Public and private subnet VPC design

WHAT THIS TESTS This checks foundational VPC design: the ability to isolate tiers using subnets, route tables, and gateways rather than relying on a single control.

A GOOD ANSWER COVERS Define a VPC with a CIDR block, then carve at least two subnets. The public subnet has a route table with a default route, 0.0.0.0/0, pointing to an internet gateway; the web server lives here with a public or elastic IP, so it can receive inbound traffic from the internet. The private subnet has a route table with no route to the internet gateway, so nothing on the internet can reach it directly; the database lives here. Restrict the database's security group to allow inbound only on the database port and only from the web server's security group, layering identity-based control on top of network isolation. Because the database still needs outbound access for patches or to reach other services, route its outbound default through a NAT gateway placed in the public subnet, which permits outbound connections while blocking unsolicited inbound. For defense in depth, add network ACLs at the subnet boundary.

COMMON WRONG ANSWERS Placing the database in a public subnet and trying to lock it down with security groups alone, which leaves it one misconfiguration away from exposure. Forgetting the NAT gateway, so the private database cannot fetch updates. Giving the database a public IP. Confusing the internet gateway, for inbound and outbound public traffic, with the NAT gateway, for outbound only.

LIKELY FOLLOW-UPS What distinguishes a public from a private subnet, concretely. Why use a NAT gateway and where does it sit. Security groups versus network ACLs. How would you add a bastion or use SSM to administer the private database.

ONE CONCRETE EXAMPLE A team builds a VPC with a public subnet routed to an internet gateway hosting the web server, and a private subnet with no internet route hosting the database. The database security group accepts traffic only from the web server's security group on the database port. A NAT gateway in the public subnet lets the database download security patches outbound, while no path exists for the internet to initiate a connection to it, cleanly satisfying the requirement.