Cloud Networking
What to know
Start with the CIDR basics: an address block, its mask, and how many hosts it holds. Know VPC/VNet constructs - subnets (public vs. private), route tables, and internet versus NAT gateways. Public subnets route to an internet gateway; private subnets reach the internet outbound via NAT without inbound exposure. Understand security groups (stateful, instance-level allow rules) versus network ACLs (stateless, subnet-level, ordered allow/deny). Load balancers distribute traffic and can terminate TLS; DNS maps names to endpoints and supports failover and weighted routing. Connectivity options include VPN (over the internet, encrypted) and dedicated private links (predictable, private).
Traps
Expect questions on overlapping CIDR ranges breaking peering or hybrid connections - plan address space up front. Remember security groups are typically allow-only and stateful (return traffic is automatic), while ACLs are stateless (you must allow both directions) and evaluated in order. Don't assume a private subnet has no internet access at all - it may have outbound-only via NAT. And a load balancer does not replace security controls.
Worked example
An app in a private subnet must download patches from the internet but must not accept inbound connections. Answer: private subnet + NAT gateway for outbound, no inbound route from the internet. Rule of thumb: draw the path - source, route table, gateway, destination - before choosing any control.
Rule of thumb
Address space is the hardest thing to change later; design non-overlapping CIDRs first.