Public and private subnet VPC design
core VPC networking.
web server in a public subnet routed to an internet gateway, database in a private subnet with no inbound from the internet, NAT for outbound.
placing the database in a public subnet or relying only on.
What's really being asked
This checks foundational VPC design: the ability to isolate tiers using subnets, route tables, and gateways rather than relying on a single control.
The full answer
Define a VPC with a CIDR block, then carve at least two subnets. The public subnet has a route table with a default route, 0.0.0.0/0, pointing to an internet gateway; the web server lives here with a public or elastic IP, so it can receive inbound traffic from the internet. The private subnet has a route table with no route to the internet gateway, so nothing on the internet can reach it directly; the database lives here. Restrict the database's security group to allow inbound only on the database port and only from the web server's security group, layering identity-based control on top of network isolation. Because the database still needs outbound access for patches or to reach other services, route its outbound default through a NAT gateway placed in the public subnet, which permits outbound connections while blocking unsolicited inbound. For defense in depth, add network ACLs at the subnet boundary.
The mistakes people make
Placing the database in a public subnet and trying to lock it down with security groups alone, which leaves it one misconfiguration away from exposure. Forgetting the NAT gateway, so the private database cannot fetch updates. Giving the database a public IP. Confusing the internet gateway, for inbound and outbound public traffic, with the NAT gateway, for outbound only.
What usually comes next
What distinguishes a public from a private subnet, concretely. Why use a NAT gateway and where does it sit. Security groups versus network ACLs. How would you add a bastion or use SSM to administer the private database.
A concrete example
A team builds a VPC with a public subnet routed to an internet gateway hosting the web server, and a private subnet with no internet route hosting the database. The database security group accepts traffic only from the web server's security group on the database port. A NAT gateway in the public subnet lets the database download security patches outbound, while no path exists for the internet to initiate a connection to it, cleanly satisfying the requirement.
Interview question
What most fundamentally keeps a database in a private subnet unreachable from the internet?
- a.A NAT gateway encrypts all inbound database connections
- b.The database's security group denies all traffic by default
- c.The private subnet's route table has no route to an internet gatewayCorrect
- d.The database is assigned a smaller instance type
Why? this is the answer
Without an internet-gateway route, no inbound internet path exists to the subnet, providing network-level isolation. Security groups add a layer but routing is the structural control, and NAT only enables outbound, not encryption.
Just read this? Test yourself on what you have been reading.
Read the original → docs.aws.amazon.com
- #vpc
- #networking
- #subnets
- #nat-gateway
- #security
You just looked this up. Could you explain it out loud?
That is the part interviews actually test. Tezvyn takes questions like this one and gives you what the interviewer is really checking, the answer that lands, and the mistake that ends the conversation, in the four minutes before your next meeting.
The iPhone app is on the way
We are building it. Until it lands, nothing here is held back from you: every interview card, your saved cards, streaks and the job board all work in Safari, plus hundreds of free practice quizzes of thirty questions each. Sign in and it all carries over to the app the day it arrives.
Want it as an icon? Tap Share at the bottom of Safari, then Add to Home Screen. It opens full screen and the cards you have read stay available offline.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles