Cloud Networking: Connectivity, Segmentation, and Hybrid Design
Core concepts
Cloud networking replaces static VLAN-and-trunk thinking with declarative constructs: virtual networks (VPCs/VNets), subnets, route tables, security groups, network ACLs, and gateways. A candidate must be fluent in the difference between stateful security groups (connection-tracked, allow-only) and stateless ACLs (evaluated per packet, need both directions). Understand peering versus transit: peering is non-transitive, so a hub-and-spoke or transit-gateway design is required for many-to-many reachability. Know the hybrid options - site-to-site VPN over the internet versus dedicated private circuits - and their trade-offs in latency, SLA, and encryption. DNS design (private zones, split-horizon resolution, forwarding rules) is frequently tested because name resolution often breaks before routing does. Egress design matters too: NAT gateways, centralized inspection, and avoiding asymmetric return paths.
Traps
Questions love non-transitive peering ("spoke A to spoke B through the hub?") and overlapping CIDR ranges that block peering entirely. Another classic: assuming a route table entry alone permits traffic - security policy must also allow it. Watch for asymmetric routing when one path is inspected and the return path is direct. Also distinguish reachability from resolution: a workload can route fine yet fail on DNS.
Worked example
Two VPCs both use 10.0.0.0/16. Peering is rejected because ranges overlap. Rule of thumb: plan address space before you plan topology - allocate non-overlapping /16s per environment and summarize at the transit layer. If overlap is unavoidable, front the legacy network with a NAT/private-link style indirection rather than peering.
Rule of thumb
Draw the packet path in both directions; if the two paths differ in inspection or NAT, you have found the bug.