Guides

AWS VPC Interview Questions and Answers: 30 Questions With Scenarios

By Ravindra Bagale, AWS & DevOps trainer · LinkedIn · Published: 16 October 2026 · Last updated: 17 October 2026

Here are 30 AWS VPC interview questions with short, clear answers, grouped from basics to real troubleshooting scenarios. If you remember one thing, remember the request path: Internet → Internet Gateway (or NAT for outbound) → route table → network ACL → security group → instance. Almost every scenario question is answered by walking that path in order.

A live example first

The most common scenario: "A private EC2 instance cannot download updates." Here is the answer as a checklist, using a real VPC 10.0.0.0/16:

Private subnet 10.0.11.0/24 (ap-south-1a) route table:
  10.0.0.0/16   local
  0.0.0.0/0     nat-0abc...        <- must exist
NAT gateway nat-0abc... in public subnet 10.0.1.0/24
Public subnet route table:
  0.0.0.0/0     igw-0def...        <- NAT needs this

1. Private route table sends 0.0.0.0/0 to a NAT gateway.
2. The NAT gateway is in a public subnet that routes to the IGW.
3. The security group allows outbound HTTPS (default allows all outbound).
4. The NACL allows outbound 443 and inbound ephemeral ports 1024–65535.

Friends, interviewers love this answer because it shows you think in order.

The request path

Basics

Q1. What is a VPC?

A Virtual Private Cloud is your own private network inside an AWS Region. You choose its IP range (CIDR), split it into subnets, and control routing and firewalls.

Q2. What CIDR sizes can a VPC have?

From /16 (65,536 addresses) to /28 (16 addresses) for IPv4. You can add secondary CIDR blocks later.

Q3. How many IPs does AWS reserve in each subnet?

Five: the network address, the VPC router (.1), DNS (.2), one reserved for future use (.3), and the last (broadcast) address. A /24 gives 251 usable IPs.

Q4. What makes a subnet public?

Its route table has a route 0.0.0.0/0 to an Internet Gateway. Instances also need a public IP to be reachable.

Q5. Is a subnet tied to an Availability Zone?

Yes. A subnet lives in exactly one AZ. For high availability, create subnets in at least two AZs.

Q6. What is the default VPC?

A ready-made VPC in each Region with public subnets in every AZ and an Internet Gateway. Fine for learning; production usually uses a custom VPC.

Routing and internet access

Q7. What does an Internet Gateway do?

It lets resources with public IPs talk to the internet and lets the internet reach them (if security rules allow). One per VPC, highly available.

Q8. What is a NAT gateway?

It lets instances in private subnets start outbound connections (for updates, APIs) without being reachable from the internet. It sits in a public subnet and costs per hour and per GB.

Q9. NAT gateway vs NAT instance?

A NAT gateway is managed, scales and is highly available within its AZ. A NAT instance is an EC2 you manage yourself; cheaper but more work and a single point of failure.

Q10. Why put one NAT gateway per AZ?

If the only NAT gateway's AZ fails, private subnets in other AZs lose internet access. One per AZ also avoids cross-AZ data charges.

Q11. What is an Egress-only Internet Gateway?

The IPv6 version of NAT: lets IPv6 instances go out but blocks inbound connections started from the internet.

Q12. How do route tables pick a route?

Longest prefix match: the most specific route wins. The local route for the VPC CIDR always exists and cannot be removed.

Security

Q13. Security group vs network ACL?

Security groups are stateful, attached to network interfaces, and have allow rules only. NACLs are stateless, attached to subnets, have allow and deny rules, and are evaluated by rule number.

Q14. What does stateful mean?

Return traffic is allowed automatically. With a stateless NACL you must also allow the return traffic, usually ephemeral ports 1024–65535.

Q15. How would you block one bad IP address?

Add a deny rule in the subnet's NACL (security groups cannot deny), or use AWS WAF in front of a load balancer or CloudFront.

Q16. Can a security group reference another security group?

Yes. For example, allow port 3306 on the database group only from the app server's security group. This is better than using IP ranges.

Q17. What are VPC Flow Logs?

Records of accepted and rejected IP traffic for a VPC, subnet or network interface, sent to CloudWatch Logs or S3. Used for troubleshooting and security investigations.

Q18. How do you keep a database private?

Put it in private subnets with no internet route, allow access only from the app security group, and turn off public accessibility.

Connectivity

Q19. What is VPC peering?

A private connection between two VPCs (same or different account or Region). It is not transitive: if A peers with B and B with C, A cannot reach C through B.

Q20. When use Transit Gateway instead of peering?

When you have many VPCs and on-premises networks. Transit Gateway is a hub that connects them all, instead of a mesh of many peering links.

Q21. Can peered VPCs have overlapping CIDRs?

No. Plan non-overlapping ranges across all accounts from the start.

Q22. What are VPC endpoints?

Private connections from your VPC to AWS services without going through the internet or NAT. Gateway endpoints (S3, DynamoDB) are free; interface endpoints (PrivateLink) cost per hour and per GB.

Q23. Site-to-Site VPN vs Direct Connect?

VPN is encrypted over the internet, quick to set up, and cheaper. Direct Connect is a dedicated private line with steadier performance, but takes longer to set up.

Q24. What is AWS PrivateLink?

A way to expose a service from one VPC to others (or to customers) privately through interface endpoints, without peering or opening the whole network.

Scenarios

Q25. A private EC2 cannot run dnf update. What do you check?

1. The subnet's route table has 0.0.0.0/0 to a NAT gateway. 2. The NAT gateway is in a public subnet with an IGW route. 3. The security group allows outbound. 4. The NACL allows outbound and return ephemeral ports.

Q26. An EC2 has a public IP but you cannot SSH. Steps?

1. Route table has 0.0.0.0/0 to the IGW. 2. Security group allows port 22 from your IP. 3. NACL allows 22 in and ephemeral ports out. 4. The instance is running and sshd is up. Better still, use Session Manager.

Q27. Your NAT gateway bill is high. How do you reduce it?

Add free S3 and DynamoDB gateway endpoints, use interface endpoints for heavy services like ECR, keep traffic in the same AZ, and check Flow Logs for large unexpected downloads.

Q28. Design a VPC for a three-tier web app.

Two or three AZs. Public subnets for the load balancer and NAT gateways, private app subnets for EC2/containers, private data subnets for RDS. Security groups chain ALB → app → DB.

Q29. You ran out of IPs in a subnet. What can you do?

Create new subnets from free VPC space, or add a secondary CIDR to the VPC. Subnets cannot be resized after creation. For EKS, consider prefix delegation or larger subnets.

Q30. Two companies merge and their VPCs both use 10.0.0.0/16. How do you connect them?

Peering will not work with overlap. Use PrivateLink to expose specific services, or NAT-based solutions, and plan to re-address one network over time.

Summary table

Real example

During the large AWS us-east-1 outage of December 2021, AWS reported that problems in its internal network affected many services, and customers who had designed for only one AZ or Region saw more impact. Interviewers often ask how to design a VPC for availability: subnets in multiple AZs, a NAT gateway per AZ, and load balancers spread across zones are the basic answers.