Network Design
Core concepts
Design questions test whether you can translate requirements (latency, throughput, isolation, cost, hybrid connectivity) into an AWS topology. Know the building blocks: VPC CIDR planning with non-overlapping ranges, subnet tiers (public, private, isolated), route tables and their association rules, NAT Gateway vs NAT instance, VPC peering (non-transitive), AWS Transit Gateway with route-table segmentation, Site-to-Site VPN and AWS Direct Connect (dedicated vs hosted), and PrivateLink/endpoint services for one-way service exposure. Understand IP address conservation: /16 VPCs with /24 subnets, reserved five addresses per subnet, and how many IPs a load balancer or EKS pod consumes.
Traps
Questions often hide a peering transitivity assumption (spoke-to-spoke traffic needs Transit Gateway or a shared VPC), or a CIDR overlap that makes peering or VPN fail. Watch for "most cost-effective" phrasing: a single NAT Gateway per AZ costs more but survives AZ failure, while one shared NAT Gateway is cheaper and a single point of failure. Overlapping RFC1918 ranges with on-premises are a classic blocker; the fix is re-IP, or NAT/PrivateLink.
Rule of thumb
Design for failure domains first: one subnet per AZ per tier, and a stateful egress path (NAT Gateway) per AZ. If two VPCs must talk many-to-many, choose Transit Gateway over a mesh of peerings, because peering connections do not scale linearly in cost or operations.
Worked example
A company has 40 VPCs that must reach a shared services VPC and on-premises. A full peering mesh needs 780 connections; a Transit Gateway with one attachment per VPC and a VPN or Direct Connect attachment to on-premises is far simpler. Segment route tables so prod cannot route to dev.