For Solution Architect, Cloud Architect, DevOps Engineer, Security Engineer, Platform Engineer, AI Architect, and AWS Infrastructure roles, VPC and Private Endpoints are among the most frequently asked interview topics.
1. What is Amazon VPC?
Answer
Amazon Virtual Private Cloud (VPC) is a logically isolated virtual network within AWS where you can launch AWS resources such as EC2 instances, databases, EKS clusters, Lambda functions, and AI services.
A VPC allows you to control:
- IP address ranges
- Subnets
- Route tables
- Network gateways
- Security groups
- Network ACLs
Example
A company creates:
- VPC: 10.0.0.0/16
- Public Subnet: 10.0.1.0/24
- Private Subnet: 10.0.2.0/24
Web servers are placed in public subnets while databases are placed in private subnets.
2. What are the components of a VPC?
Answer
Major VPC components:
| Component | Purpose |
|---|---|
| CIDR Block | IP range |
| Subnet | Segment of VPC |
| Route Table | Traffic routing |
| Internet Gateway | Internet access |
| NAT Gateway | Outbound internet for private subnet |
| Security Group | Instance-level firewall |
| Network ACL | Subnet-level firewall |
| VPC Endpoint | Private AWS service access |
| Transit Gateway | Connect multiple VPCs |
| VPC Peering | Connect two VPCs |
3. What is CIDR?
Answer
CIDR (Classless Inter-Domain Routing) defines the IP range for a VPC.
Example:
- 10.0.0.0/16 = 65,536 IPs
- 10.0.0.0/24 = 256 IPs
Interview Question:
Why choose /16 instead of /24?
Because future growth requires more IPs.
4. What is a Subnet?
Answer
A subnet is a range of IP addresses within a VPC.
Types:
Public Subnet
Has route to Internet Gateway.
Used for:
- Load Balancers
- Bastion Hosts
- Public APIs
Private Subnet
No direct internet route.
Used for:
- Databases
- EKS Worker Nodes
- Internal Applications
5. Difference between Public and Private Subnet?
| Public | Private |
|---|---|
| Internet access | No direct internet |
| IGW route exists | No IGW route |
| Public IP supported | Usually no public IP |
| ALB/NLB | RDS/EKS Nodes |
6. What is an Internet Gateway?
Answer
Internet Gateway (IGW) enables communication between VPC resources and the internet.
Without IGW:
- Public subnet cannot access internet.
- Internet users cannot access instances.
7. What is NAT Gateway?
Answer
NAT Gateway enables private subnet resources to access the internet without exposing them publicly.
Example
Private EC2 needs:
- OS updates
- Package downloads
- AWS SDK downloads
Traffic flow:
Private EC2
→ NAT Gateway
→ Internet
8. Difference between NAT Gateway and Internet Gateway?
| NAT Gateway | Internet Gateway |
|---|---|
| Outbound only | Inbound + Outbound |
| Used by private subnet | Used by public subnet |
| Managed service | VPC component |
| Charged hourly | No charge |
9. What is a Route Table?
Answer
Route table determines where traffic should go.
Example:
| Destination | Target |
|---|---|
| 10.0.0.0/16 | local |
| 0.0.0.0/0 | IGW |
This means internet traffic goes through IGW.
10. What is VPC Peering?
Answer
VPC Peering connects two VPCs privately.
Example:
VPC-A (10.0.0.0/16)
communicates directly with
VPC-B (172.31.0.0/16)
without internet.
Limitation
No transitive routing.
A ↔ B and B ↔ C
does NOT mean
A ↔ C
11. What is Transit Gateway?
Answer
Transit Gateway acts as a central network hub.
Instead of:
50 VPC Peering connections
Use:
1 Transit Gateway
Benefits:
- Simplified architecture
- Central routing
- Multi-account connectivity
12. What is AWS PrivateLink?
Answer
AWS PrivateLink provides private connectivity between VPCs and AWS services without using public internet.
Traffic remains inside AWS network.
This is one of the most important interview topics.
13. What is a VPC Endpoint?
Answer
A VPC Endpoint enables private communication with AWS services without:
- Internet Gateway
- NAT Gateway
- Public IP
Traffic stays within AWS backbone.
14. Types of VPC Endpoints?
Answer
Two primary types:
Gateway Endpoint
Supports:
- Amazon S3
- DynamoDB
Interface Endpoint
Supports:
- Most AWS Services
Examples:
- Bedrock
- Secrets Manager
- SSM
- KMS
- CloudWatch
- ECR
- STS
15. Difference Between Gateway and Interface Endpoints?
| Gateway Endpoint | Interface Endpoint |
|---|---|
| S3/DynamoDB only | Most AWS services |
| Free | Charged |
| Route table entry | ENI created |
| Simpler | More flexible |
16. What is an Interface Endpoint?
Answer
Interface Endpoint creates an Elastic Network Interface (ENI) inside your subnet.
Applications connect to the private IP.
Traffic never leaves AWS network.
17. What is Gateway Endpoint?
Answer
Gateway Endpoint provides private access to:
- S3
- DynamoDB
without NAT Gateway.
Example
Private EC2
↓
S3 Gateway Endpoint
↓
Amazon S3
No internet required.
18. Why use VPC Endpoints?
Answer
Benefits:
Security
No public internet exposure.
Compliance
Supports:
- HIPAA
- PCI-DSS
- FedRAMP
Cost Savings
Reduce NAT Gateway usage.
Performance
Traffic remains on AWS backbone.
19. Explain PrivateLink Architecture.
Answer
Provider Side:
- NLB
- Endpoint Service
Consumer Side:
- Interface Endpoint
Flow:
Consumer VPC
→ Interface Endpoint
→ AWS PrivateLink
→ NLB
→ Provider Service
20. How does PrivateLink differ from VPC Peering?
| PrivateLink | Peering |
|---|---|
| Service sharing | Network sharing |
| No overlapping CIDR issue | CIDR restrictions |
| One-way access | Full access |
| More secure | Broader connectivity |
21. When would you use PrivateLink over Peering?
Answer
Use PrivateLink when:
- Exposing application as a service
- SaaS architectures
- Zero Trust networking
- Multi-account isolation
22. Can PrivateLink work across accounts?
Answer
Yes.
Common architecture:
Account A:
Provider Service
Account B:
Consumer Service
Connected via PrivateLink.
23. Can PrivateLink work across regions?
Answer
Yes, cross-region PrivateLink is supported for many services.
Useful for:
- SaaS providers
- Multi-region architectures
24. What AWS Services Commonly Use Interface Endpoints?
Examples:
- Amazon Bedrock
- AWS Secrets Manager
- AWS Systems Manager
- AWS Key Management Service
- Amazon ECR
- AWS STS
25. Why are VPC Endpoints important for EKS?
Answer
Private EKS clusters often require endpoints for:
- ECR
- S3
- STS
- CloudWatch
- Secrets Manager
Without endpoints:
Nodes require NAT Gateway.
Endpoints reduce costs and improve security.
26. Why are Private Endpoints important for Amazon Bedrock?
Answer
Enterprise AI environments often require:
- No public internet
- Secure LLM access
- Compliance controls
Private endpoints allow workloads in private subnets to access Bedrock securely.
Common interview scenario for AI Architect roles.
27. What is Endpoint Policy?
Answer
Endpoint Policy controls which AWS resources can be accessed through the endpoint.
Example:
Allow only:
- Specific S3 bucket
Block all others.
Provides an extra security layer.
28. What Security Controls Apply to Interface Endpoints?
Answer
You can apply:
- Security Groups
- IAM Policies
- Endpoint Policies
- Route Controls
Multiple layers of protection.
29. How do you troubleshoot VPC Endpoint connectivity?
Answer
Check:
Step 1
Endpoint status = Available
Step 2
DNS enabled
- Enable Private DNS
Step 3
Security Groups
Allow required ports.
Step 4
Route Tables
For gateway endpoints.
Step 5
IAM Permissions
Verify service access.
Step 6
VPC Flow Logs
Inspect traffic.
30. Explain a Real-World Interview Scenario
Question
Your company runs a private EKS cluster and wants secure access to S3, Bedrock, Secrets Manager, and ECR without internet access. How would you design it?
Answer
Architecture:
Private Subnets
↓
EKS Cluster
↓
VPC Endpoints:
- S3 Gateway Endpoint
- ECR Interface Endpoint
- STS Interface Endpoint
- Secrets Manager Interface Endpoint
- Bedrock Interface Endpoint
- CloudWatch Interface Endpoint
Benefits:
- No public IPs
- No Internet Gateway dependency
- Reduced NAT costs
- Compliance ready
- Zero-trust architecture
Top 10 Interview Questions Asked Most Frequently
- What is VPC and why is it needed?
- Difference between public and private subnet?
- Difference between NAT Gateway and Internet Gateway?
- What is VPC Endpoint?
- Difference between Interface and Gateway Endpoint?
- What is AWS PrivateLink?
- PrivateLink vs VPC Peering?
- How does Bedrock use VPC Endpoints?
- How would you secure EKS using VPC Endpoints?
- Design a fully private AWS architecture without internet access.
For AI Architect, Cloud Architect, and AWS Solution Architect interviews in 2026, mastery of VPC networking, PrivateLink, Interface Endpoints, Gateway Endpoints, Transit Gateway, EKS networking, and secure AI platform connectivity is considered essential.
