Design the network layout for a three-tier application in one cloud region. What are the decisions you cannot easily change later?
Show the full answer Hide the answer
What the interviewer is testing
Whether you know which network decisions are cheap and which are effectively permanent. This is a knowledge question with a clear right answer, and it separates people who have built a landing zone from people who have consumed one.
The layout
Three tiers × three availability zones, because a subnet lives in exactly one zone:
| Tier | Reachability | Contains |
|---|---|---|
| Public (3 subnets) | Route to internet gateway | Load balancers and NAT gateways only |
| Private app (3 subnets) | No inbound from internet | Application instances, containers |
| Private data (3 subnets) | No internet route at all | Databases, caches, queues |
Traffic path: internet → load balancer in a public subnet → application in a private subnet → database in a data subnet. Outbound from private tiers goes through a NAT gateway per zone, not one shared, because a shared one is both a single point of failure and a generator of cross-zone transfer charges.
Security groups reference each other, not CIDR blocks: the database group allows 5432 from the application group. This keeps working through autoscaling and expresses the intended architecture directly, whereas CIDR rules describe a topology that drifts.
The decisions you cannot easily change
1. The VPC CIDR range. This is the big one. It cannot be meaningfully resized, and it must not overlap with anything you may ever peer with — the corporate network, another cloud account, a partner, or a company you acquire. Overlapping ranges are the single most common cause of painful cloud networking work, and the remedy is usually NAT gymnastics or a migration. Take a range from central IP address management; do not invent one.
2. Subnet sizing. Subnets cannot be resized either. A /28 that looked generous runs out the
first time a Kubernetes CNI assigns an address per pod, or an autoscaler doubles. Size for the
five-year case; addresses inside a private range are free.
3. Zone spread. Retrofitting a third zone onto a two-zone design means new subnets, new route tables, and often a database re-deployment.
What is cheap to change
Security group rules, route table entries, adding subnets from spare range, load balancer configuration, adding private endpoints. If a decision is in this list, do not spend a week on it.
What a strong answer adds
- Private endpoints for managed services. Traffic from a private subnet to object storage or a managed database should not traverse NAT — it is slower, less private, and NAT charges per GB. This is a common and material cost surprise.
- Egress control. Restricting outbound traffic is the step most teams skip, and it is what limits data exfiltration and SSRF impact.
- Flow logs on, from the start. They are the only forensic record of what talked to what.