Networking
What to know
Cover the OSI-relevant layers as they appear in cloud design: IP addressing and CIDR, subnets (public vs private), routing tables, and gateways. Understand security groups (stateful, instance-level allow rules) versus network ACLs (stateless, subnet-level allow/deny). Know VPC/VNet peering, transit gateways, VPN vs dedicated interconnect, and when each is appropriate. DNS fundamentals - record types, TTL, and private vs public zones - appear frequently. Load balancers (Layer 4 vs Layer 7), NAT for outbound-only access, and the concept of egress vs ingress costs round out the domain. Private connectivity to services (private endpoints) is increasingly tested.
Traps
Security groups are stateful and default-deny; NACLs are stateless and require both inbound and outbound rules - questions exploit this. A common trap is opening a database to the internet when a private subnet plus bastion or private endpoint is correct. Another is confusing peering (non-transitive) with a transit gateway (hub-and-spoke, transitive). Watch for CIDR overlap errors: overlapping ranges break peering. Also distinguish inbound rules from outbound rules when troubleshooting "why can't the instance reach the internet" - the answer is often a missing route to a NAT gateway, not a security group.
Worked example
An app in a private subnet cannot download updates. Check order: route table has a path to NAT, NAT sits in a public subnet, security group allows outbound, NACL allows both directions. Rule of thumb: troubleshoot networking inside-out - route, then gateway, then stateful rule, then stateless rule.