Networking

Design the subnets and routing for a standard three-tier web application: a public web layer, a private application layer, and a private database layer.

Three tiers, three subnet groups, each with a route table that only grants the access that tier actually needs. The database subnet shouldn't be able to reach the internet at all, the app subnet gets outbound-only through NAT, and only the web subnet has a real route to the internet gateway. Everything else follows from that one rule.

A subnet holds your most sensitive data. Design the Network ACL rules around it as a second layer of defense behind Security Groups.

A NACL earns its place by doing the one thing a Security Group can't: an explicit, subnet-wide deny that survives a misconfigured Security Group rule. The design is a default-deny rule set with narrow, numbered exceptions, remembering that NACLs are stateless, so return traffic on ephemeral ports needs its own explicit allow.

Two EC2 instances in the same VPC can't reach each other over a port that should be open. Walk through how you'd find out why.

Work outward from the instance rather than guessing at the network: confirm the app is actually listening, then check Security Groups, then NACLs, then the route table, then Flow Logs to see what AWS's own network actually did with the packet. Each layer either clears itself or points straight at the next thing to check.

Design layered protection for a public-facing web application against DDoS attacks and common web exploits.

No single AWS service handles both problems, since a volumetric DDoS attack and a targeted web exploit look nothing alike at the network layer. CloudFront and Shield absorb and dilute volume before it reaches your origin, and WAF inspects individual requests for exploit patterns. Both sit in front of the origin, stacked, not swapped for each other.

Amazon EC2 instances in a private subnet upload large volumes of processed data to an Amazon S3 bucket in the same AWS Region. The traffic currently routes through a NAT gateway. A solutions architect must keep the traffic off the public internet and reduce data transfer charges. What should the architect do?

S3 and DynamoDB are the two services with gateway VPC endpoints, and gateway endpoints cost nothing. Adding one gives private subnets a route to S3 that skips the NAT gateway entirely, which removes both the internet path and the per-GB NAT processing charge.

A public web application runs on Amazon EC2 instances behind an Application Load Balancer and is fronted by Amazon CloudFront. The application has been targeted by SQL injection attempts and by volumetric network floods. A solutions architect must reduce exposure to both. Which TWO actions should the architect take?

These are two different attacks and they need two different controls. AWS WAF inspects HTTP requests and stops injection attempts, while AWS Shield Advanced adds managed protection and cost protection against large network floods. Security groups and network ACLs operate below the layer where SQL injection is visible.

A company must copy 40 TB of files from an on-premises NFS server into Amazon S3, and then keep the S3 copy synchronised with nightly changes. The company has a 1 Gbps AWS Direct Connect connection with spare capacity overnight. Which solution requires the LEAST ongoing operational effort?

There is enough bandwidth to transfer online, and the requirement continues after the initial copy. AWS DataSync handles both halves: it moves the bulk data quickly over the existing link and then runs on a schedule to keep the destination in sync.

A StatefulSet's Pods must each be addressable individually so peers can form a cluster. Which Service configuration provides that, and what does DNS return?

A headless Service, clusterIP: None, allocates no virtual IP. DNS returns the Pod IPs directly, and each StatefulSet Pod also gets its own name under the Service.

Requests to a ClusterIP Service time out. kubectl get endpointslices shows no endpoints for it, though the Pods are Running. What are the TWO most likely causes?

A Service with no endpoints means nothing matched or nothing is ready. Check that the selector matches the Pod labels, and that the Pods pass their readiness probes.

An Ingress rule is written with path /api and no pathType field. The manifest is rejected. What does pathType control, and which value matches /api and /api/v1 alike?

pathType is required on every path. Prefix matches element by element, so /api also matches /api/v1. Exact matches the whole path only, and ImplementationSpecific leaves it to the controller.

After applying a default-deny egress NetworkPolicy, Pods in the namespace cannot reach anything by name, though they can still reach IP addresses you allowed. Why?

A default-deny egress policy also blocks the UDP and TCP port 53 traffic that Pods send to CoreDNS, so every name lookup fails. DNS has to be allowed back explicitly.

A Service must send cluster traffic to a database running on a VM outside the cluster, at a fixed IP. Which approach keeps the in-cluster name and works with a raw IP address?

A Service with no selector gets no endpoints automatically, so you create an EndpointSlice yourself pointing at the external address. ExternalName cannot be used with a bare IP.

You apply a NetworkPolicy that should block all ingress to a namespace, but every Pod stays reachable. kubectl get networkpolicy shows the object exists. What is the most likely explanation?

NetworkPolicies are enforced by the network plugin. If the cluster's CNI plugin does not implement them, the objects are accepted by the API server and have no effect.

Write the smallest NetworkPolicy that denies all ingress traffic to every Pod in a namespace. Which spec achieves it?

An empty podSelector selects every Pod in the namespace, and policyTypes: Ingress with no ingress rules allows nothing. That combination is the documented default-deny policy.

A platform team owns the cluster's shared entry point and application teams own their own routes. Which Gateway API objects match that split?

GatewayClass describes an implementation, a Gateway is the entry point the platform team runs, and HTTPRoute is the routing an application team attaches to it. The kinds are modelled on those roles.

During a rolling update, some requests fail with connection errors even though every Pod eventually becomes healthy. Which mechanism prevents this, and how?

A readiness probe keeps a Pod out of a Service's endpoints until it can serve. Without one, a Pod receives traffic as soon as its container starts.

A Pod cannot resolve any Service name. Other Pods in the cluster resolve names normally. Which check comes first?

With other Pods resolving fine, CoreDNS is healthy, so look at this Pod. Its /etc/resolv.conf and its dnsPolicy decide which resolver it uses at all.