Network Operations, Monitoring, and Performance
This domain covers how you know the network is healthy, how you prove it with data, and how you keep latency, throughput and cost inside their targets. Questions present an SLO miss, a cost spike or a quota warning and ask which telemetry you would use and what you would change.
Telemetry layers
Metrics are cheap, aggregated and time-series: interface throughput, tunnel status, packet drops. Logs are high-cardinality and often sampled: flow logs, firewall logs, DNS query logs. Traces show per-hop latency across services. Synthetic probes measure the path from outside in. Use all four together - a metric tells you something changed, a flow log tells you who, a trace tells you where.
Performance engineering
Latency is distance plus queueing plus processing; throughput is capped by the bandwidth-delay product, so a long path needs a larger TCP window to fill it. Watch for hairpinning, where traffic leaves and re-enters the same region or appliance, cross-zone and inter-region transfer costs, and MTU/MSS mismatches on tunnels where encapsulation removes 60-80 bytes of payload.
Operating against a baseline
Record steady-state baselines per path before you need them. Alert on p95 and p99 rather than averages, and tie alerts to error budgets so they mean something. Track quotas - route table entries, peering limits, NAT port allocation, public IPs - because quota exhaustion presents as an outage, not as a capacity warning. Treat data transfer cost as an operational metric with its own trend.
Worked example
After a regional failover, p95 latency for cross-region calls rises by 40 ms with no increase in errors. Metrics show stable throughput, so bandwidth is not the constraint. Flow logs show source and destination unchanged, but the path now traverses an inspection VPC in the former primary region, adding a hairpin. The fix is to attach an inspection VPC in the active region and re-point the transit gateway association. Reasoning: quantify the change, localize it with flow data, then remove the extra hop instead of tuning the application.
Traps
Reporting averages that hide a bad tail; treating sampled flow logs as complete records; forgetting DNS TTLs delaying failover; blaming the network when application retries mask an internal timeout; ignoring that tunnel encapsulation reduces effective MTU.