Cloud Architect interview questions

VPC address planning assigns non-overlapping CIDR ranges with enough space for current and future subnets.

• The plan should account for availability zones, environments, workload tiers, and expected growth.
• Ranges must not overlap with networks that will connect through peering, transit routing, VPN, or private circuits.
• A documented IP allocation scheme makes route summarization, troubleshooting, and later expansion easier.

Subnets divide a VPC address range, while route tables determine where traffic from each subnet can go.

• Every subnet is associated with a route table containing a local VPC route and any additional destinations.
• A route to an internet gateway makes internet routing possible for suitably addressed resources in a public subnet.
• Private subnets usually route outbound traffic through NAT and keep databases or internal services off direct internet routes.

Security groups are stateful resource-level controls, while network ACLs are stateless subnet-level controls.

• A security group automatically allows response traffic for an allowed connection and contains allow rules.
• A network ACL evaluates separate inbound and outbound rules in number order and can explicitly allow or deny traffic.
• Security groups provide the primary workload boundary, while ACLs add coarse subnet guardrails.

VPC peering creates private IP connectivity between two VPCs through provider networking.

• Routes must be added on both sides and security controls must allow the intended traffic.
• Peering does not support overlapping CIDR ranges and does not provide transitive routing through a third VPC.
• Large peering meshes become difficult to manage because every required VPC pair needs its own relationship and routes.

AWS Transit Gateway provides a regional hub for routing among many VPCs and on-premises networks.

• VPC, VPN, and Direct Connect attachments connect to the hub instead of forming a full mesh.
• Transit Gateway route tables can segment attachments and control which networks can reach one another.
• Centralized routing reduces connection count, but address planning and propagation rules still require governance.

AWS PrivateLink exposes a service through private interface endpoints without joining the consumer and provider networks.

• The provider publishes an endpoint service, commonly behind a Network Load Balancer.
• The consumer creates interface endpoints with private IP addresses in selected subnets.
• Traffic stays on AWS networking, and overlapping VPC address ranges are possible because full bidirectional routing is not established.

An internet gateway enables direct VPC internet routing, while a NAT gateway lets private IPv4 resources initiate outbound connections through address translation.

• Public resources need a route to the internet gateway, a public address, and suitable security rules.
• Private resources send internet-bound IPv4 traffic to a NAT gateway placed in a public subnet.
• The NAT gateway does not accept unsolicited inbound connections initiated from the internet.

A site-to-site VPN encrypts traffic over the public internet, while dedicated connectivity uses a private provider circuit.

• VPN connections are faster to provision and commonly provide backup or lower-volume hybrid connectivity.
• AWS Direct Connect and Google Cloud Interconnect offer more predictable bandwidth and latency than internet paths.
• Dedicated links still need redundant circuits, routing design, and often a VPN for encryption or backup.

A private DNS zone resolves selected domain names only for associated private networks.

• It maps internal service names to private addresses or endpoints without publishing them to public DNS.
• Associations or forwarding rules extend resolution across VPCs, projects, and hybrid networks.
• Split-horizon DNS can return different records for the same name depending on whether the query is private or public.

Gateway endpoints add routes for supported AWS services, while interface endpoints create private network interfaces powered by PrivateLink.

• Gateway endpoints support Amazon S3 and DynamoDB and do not require NAT for matching traffic.
• Interface endpoints provide private IP addresses and DNS for many AWS services and customer endpoint services.
• Endpoint policies, security groups where applicable, routing, and private DNS control the reachable service operations.

Object, block, and file storage expose different data models and access interfaces.

• Object storage uses API-addressed objects and metadata, making it suitable for media, backups, logs, and data lakes.
• Block storage presents volumes to one or more supported compute instances for filesystems and databases.
• File storage provides shared hierarchical files through protocols such as NFS or SMB.

Object-storage tiers price data according to access frequency, retrieval behavior, and retention expectations.

• Frequent-access tiers have higher storage cost and immediate access, while archive tiers reduce storage cost with retrieval constraints.
• Lifecycle policies move objects between tiers or expire them according to age and metadata.
• Minimum storage duration, retrieval fees, request charges, and restore time affect the real cost of colder tiers.

Versioning preserves object revisions, while cross-region replication copies eligible objects to another regional bucket.

• Versioning helps recover from accidental overwrite or deletion but increases retained storage.
• Replication creates a separate regional copy for locality, compliance, or recovery objectives.
• Replication needs permissions, versioning, monitoring, and explicit handling of existing objects and delete behavior.

A block-storage snapshot captures a point-in-time backup of a volume into provider-managed durable storage.

• Cloud snapshots are commonly incremental, so later snapshots store changed blocks while remaining independently restorable.
• Restoring creates a new volume, and initial reads may have different performance until blocks are loaded.
• Application-consistent snapshots require filesystem or database coordination rather than relying only on a crash-consistent volume image.

Amazon CloudFront serves cacheable content through distributed edge locations in front of an origin.

• A cache key commonly includes the path and selected query strings, headers, or cookies.
• TTLs and cache-control headers determine freshness, while invalidations remove selected objects early.
• Origin Access Control can keep an S3 origin private so users retrieve content only through CloudFront.

RDS Multi-AZ improves availability, while read replicas primarily add read capacity and separate copies.

• A standard Multi-AZ deployment synchronously maintains a standby for managed failover rather than application reads.
• Read replicas receive changes asynchronously and can serve read-only queries with possible replication lag.
• Backups remain necessary because replication can copy accidental changes or corruption to another database copy.

Amazon Aurora separates database compute from a distributed storage volume replicated across availability zones.

• The storage layer maintains multiple copies across three zones and grows automatically within service limits.
• Writer and reader instances attach to the shared cluster volume rather than maintaining independent full storage copies.
• Cluster endpoints and replica endpoints route connections according to write and read roles.

DynamoDB uses the partition key to distribute items and route requests across internal partitions.

• High-cardinality keys with balanced access spread storage and throughput more evenly.
• A small set of very popular keys can create hot partitions even when total table capacity is sufficient.
• A composite primary key adds a sort key, allowing multiple ordered items under one partition-key value.

BigQuery is a managed analytical data warehouse designed for large-scale SQL queries over columnar data.

• Compute is separated from managed storage, so analytical processing can scale without database-server administration.
• Columnar storage and distributed execution suit scans, aggregations, reporting, and data analysis.
• Partitioning, clustering, and limiting scanned columns reduce query work and cost.

Automated backups and transaction logs allow a managed database to restore to a selected time within its retention window.

• Scheduled snapshots provide baseline copies, while logs capture changes between them.
• Point-in-time recovery creates a restored database rather than rewinding the running instance in place in many services.
• Retention, encryption keys, cross-region copies, and restore tests determine whether backups meet recovery requirements.