Cloud Infrastructure and Networking
Cloud Infrastructure and Networking
This domain covers VPC topology, IP planning, routing, hybrid connectivity, and how traffic actually leaves your environment. Questions typically present a topology that works at small scale and ask what breaks at ten times the size, or hand you a host count and check whether you can size subnets correctly.
Plan addresses before anything else
- Reserve one private supernet for the whole estate that cannot collide with on-premises ranges, and record it centrally as the source of truth.
- Subnets are zonal. Span at least three zones per region for any tiered workload so a single zone failure does not halve capacity.
- Cloud subnets reserve addresses: AWS reserves five per subnet, GCP reserves four. Never size a subnet to exactly the host count.
- Leave deliberate gaps (contiguous /20 blocks) so a future region, acquisition, or merger can be attached without renumbering.
Topology and hybrid connectivity
- Hub-and-spoke with a central transit layer beats full mesh: VPC peering is non-transitive, so N spokes need N attachments and disciplined route tables.
- Dedicated interconnect for predictable latency and bandwidth; site-to-site VPN for backup paths, small sites, or fast setup. Encrypt everything over the public internet.
- Keep data-plane traffic private: private endpoints, PrivateLink/Private Service Connect, or private Google access, so backend calls never traverse the internet.
- DNS is part of the network design: private zones, split-horizon resolution, and forwarding rules must exist before the first migration, not after.
Worked example
You need 1,200 container hosts now with 2x growth in two years across three zones. A /24 gives 256 addresses; subtract five reserved and 251 usable - far too small. A /23 gives 507 usable; still short of 1,200. A /22 gives 1,019 usable - also short. A /21 gives 2,043 usable, which covers current demand with headroom. Three zonal subnets of /21 each consume 6,144 addresses, so the VPC block should be at least a /19 to leave room for a separate data tier. Before requesting it, verify the block does not overlap the existing on-premises /16.
Traps that cost marks
- Assuming peering or VPC connections are transitive.
- Sizing subnets without subtracting cloud-reserved addresses.
- Discovering overlapping CIDRs during a merger; renumbering is a project, not a change ticket.
- Forgetting egress: NAT gateways, firewall rules, and per-GB outbound charges for internet-bound traffic.