Networking: VPC, SLB, DNS, Connectivity
VPC is the foundation: a private network with a CIDR block, divided into vSwitches (subnets) bound to a zone. A candidate must understand that a vSwitch is zone-specific, so multi-AZ design means multiple vSwitches. Route tables control traffic toward the internet gateway, NAT gateway, VPN gateway, or peering. Security groups are stateful virtual firewalls at the instance NIC level; network ACLs are stateless at the vSwitch level - questions test this distinction.
SLB (Server Load Balancer) distributes traffic across backend servers with health checks. Know the difference between the public and private SLB, layer-4 (TCP/UDP) vs layer-7 (HTTP/HTTPS) listeners, and that backends must be in the same region and have the SLB health-check port open in their security group. DNS (Alibaba Cloud DNS) resolves domains; private zone DNS resolves inside a VPC.
Traps: forgetting that a NAT gateway needs a SNAT rule and an EIP; assuming SLB health checks pass when the security group blocks the probe; confusing VPC peering (non-transitive) with a transit/Cloud Enterprise Network setup; assuming cross-region connectivity works without CEN or peering.
Rule of thumb: for "instance cannot reach the internet," check in order: route table → NAT gateway + SNAT → EIP binding → security group egress.
Worked example: Backend healthy but SLB marks it unhealthy - the security group lacks an inbound rule for the health-check port from the SLB address pool.