Backend interview prep

Start

Cloud Networking Basics Interview Questions (Top 15 Questions with Answers)

Master Cloud Networking Basics Interview Questions with production-ready explanations covering IP addressing, CIDR, public and private IPs, ports, protocols, routing, gateways, stateful and stateless filtering, latency, bandwidth, security, troubleshooting, and enterprise cloud network design.

Module Navigation

Previous: Storage | Parent: Networking Learning Path | Next: VPC vs VNet QA

Introduction

Cloud networking is the foundation that allows applications, services, databases, users, and on-premises systems to communicate securely in cloud environments.

Every cloud application depends on networking components such as:

  • Virtual networks
  • IP addresses
  • Subnets
  • Route tables
  • Gateways
  • Firewalls
  • Load balancers
  • DNS
  • VPN connections
  • Private endpoints

Cloud providers use different names for virtual networks:

  • AWS uses Virtual Private Cloud (VPC)
  • Azure uses Virtual Network (VNet)
  • Google Cloud uses Virtual Private Cloud (VPC)

The fundamental networking concepts are similar across all cloud platforms.

Internet Users
      │
      ▼
      DNS
      │
      ▼
Load Balancer
      │
      ▼
Application Subnet
      │
      ▼
Database Subnet
      │
      ▼
Cloud Network

Cloud networking helps answer questions such as:

  • How does traffic reach an application?
  • How do services communicate privately?
  • How is internet access controlled?
  • How are applications protected from unauthorized access?
  • How do cloud resources connect to on-premises systems?
  • How is network traffic routed?

This guide contains 15 production-focused Cloud Networking interview questions covering networking models, IP addressing, CIDR, ports, protocols, routing, gateways, security, performance, troubleshooting, and enterprise architecture.

Learning Roadmap

Networking Fundamentals
          │
          ▼
     OSI and TCP/IP
          │
          ▼
      IP Addressing
          │
          ▼
          CIDR
          │
          ▼
    Ports and Protocols
          │
          ▼
        Routing
          │
          ▼
       Gateways
          │
          ▼
 Network Security Controls
          │
          ▼
Enterprise Cloud Design

Networking Fundamentals

1. What is cloud networking?

Cloud networking is the design and management of network resources inside a cloud environment.

It enables communication between:

  • Users and applications
  • Application services
  • Databases
  • Virtual machines
  • Containers
  • Serverless functions
  • On-premises systems
  • External APIs
  • Multiple cloud environments

Typical cloud networking components include:

Component Purpose
Virtual Network Isolated logical network
Subnet Smaller network segment
Route Table Controls traffic paths
Internet Gateway Provides internet connectivity
NAT Gateway Provides outbound internet access
Firewall Filters network traffic
Load Balancer Distributes traffic
DNS Resolves names to IP addresses
VPN Secure private connection
Private Endpoint Private access to managed services

Basic architecture:

Cloud Region
     │
     ▼
Virtual Network
     │
 ┌───┴───────────────┐
 ▼                   ▼
Public Subnet    Private Subnet
 │                   │
 ▼                   ▼
Load Balancer     Application
                     │
                     ▼
                  Database

Cloud networking provides:

  • Isolation
  • Connectivity
  • Security
  • Availability
  • Scalability
  • Traffic management

2. What is the OSI model, and why is it important?

The OSI model divides network communication into seven layers.

Layer Name Examples
7 Application HTTP, HTTPS, DNS
6 Presentation Encryption, encoding
5 Session Session management
4 Transport TCP, UDP
3 Network IP, routing
2 Data Link Ethernet, MAC
1 Physical Cable, radio, hardware

Architecture:

Application Layer
       │
       ▼
Presentation Layer
       │
       ▼
Session Layer
       │
       ▼
Transport Layer
       │
       ▼
Network Layer
       │
       ▼
Data Link Layer
       │
       ▼
Physical Layer

Cloud networking commonly focuses on:

  • Layer 3: IP addressing and routing
  • Layer 4: TCP, UDP, and ports
  • Layer 7: HTTP routing and application load balancing

Example:

Layer 7 Load Balancer
        │
        ▼
HTTP Host and Path Routing

Layer 4 Load Balancer
        │
        ▼
TCP or UDP Traffic

The OSI model helps engineers identify where a network issue occurs.

3. What is the TCP/IP model?

The TCP/IP model is the practical networking model used on the internet.

It usually contains four layers:

TCP/IP Layer Examples
Application HTTP, DNS, SSH
Transport TCP, UDP
Internet IP, ICMP
Network Access Ethernet, Wi-Fi

Flow:

Application Data
       │
       ▼
TCP or UDP Segment
       │
       ▼
IP Packet
       │
       ▼
Network Frame

Difference from OSI:

  • OSI is a seven-layer conceptual model.
  • TCP/IP is a practical protocol model used in real networks.

Cloud engineers use TCP/IP concepts for:

  • Routing
  • Firewall rules
  • Load balancing
  • Network troubleshooting
  • Service communication

IP Addressing

4. What is an IP address?

An IP address is a unique logical address assigned to a network interface.

It identifies:

  • A virtual machine
  • A container node
  • A load balancer
  • A database
  • A gateway
  • A network interface

Example IPv4 address:

10.0.1.25

An IPv4 address contains 32 bits.

10        .0         .1         .25
00001010  00000000   00000001   00011001

Two major IP versions exist:

  • IPv4
  • IPv6

IP addresses allow routers to determine where packets should be delivered.

5. What is the difference between IPv4 and IPv6?

IPv4 IPv6
32-bit address 128-bit address
Example: 10.0.1.25 Example: 2001:db8::1
Limited address space Very large address space
Commonly uses NAT Reduces the need for NAT
Decimal notation Hexadecimal notation

Example:

IPv4

192.168.1.10

IPv6

2001:db8:abcd:0012::10

IPv6 benefits include:

  • Larger address space
  • Better support for large-scale networks
  • Simplified end-to-end addressing
  • Improved support for modern cloud environments

Security controls are still required because having an IPv6 address does not automatically make a resource secure.

6. What is the difference between public and private IP addresses?

Public IP address

A public IP address is reachable through the internet, subject to routing and security rules.

Examples of resources that may use public IPs:

  • Public load balancers
  • Internet-facing applications
  • Bastion hosts
  • NAT gateways

Private IP address

A private IP address is used inside private networks.

Common IPv4 private ranges are:

10.0.0.0/8

172.16.0.0/12

192.168.0.0/16

Comparison:

Public IP Private IP
Internet-routable Used inside private networks
Globally unique Can be reused in separate networks
Used for public services Used for internal resources
Higher exposure Lower direct exposure

Recommended architecture:

Internet
   │
   ▼
Public Load Balancer
   │
   ▼
Private Application Servers
   │
   ▼
Private Database

Application and database resources should normally use private IP addresses.

CIDR and Network Planning

7. What is CIDR notation?

CIDR stands for Classless Inter-Domain Routing.

CIDR defines an IP network and its size.

Example:

10.0.0.0/24

The /24 indicates that the first 24 bits identify the network.

A /24 IPv4 network contains:

2^(32 - 24)

=

256 total addresses

Common CIDR sizes:

CIDR Total IPv4 Addresses
/16 65,536
/20 4,096
/24 256
/26 64
/28 16
/32 1

Example:

Network: 10.0.1.0/24

Range:

10.0.1.0

to

10.0.1.255

Cloud providers reserve some addresses within a subnet, so not every address may be assignable.

8. How do you plan CIDR ranges for cloud networks?

CIDR planning should happen before network deployment.

Important considerations:

  • Current workload size
  • Future growth
  • Number of environments
  • Number of regions
  • Kubernetes Pod addressing
  • On-premises network ranges
  • Multi-cloud connectivity
  • Network peering
  • Acquisitions and partner networks

Bad design:

AWS VPC

10.0.0.0/16

Azure VNet

10.0.0.0/16

These ranges overlap and make connectivity difficult.

Better design:

AWS Production

10.10.0.0/16

AWS Development

10.20.0.0/16

Azure Production

10.30.0.0/16

On-Premises

10.100.0.0/16

Recommended principles:

  • Avoid overlapping ranges
  • Reserve space for growth
  • Document allocations
  • Separate environments
  • Use an enterprise IP address management process
  • Consider Kubernetes Pod and service CIDRs
  • Plan multi-region ranges centrally

CIDR changes can be difficult after deployment.

Ports and Protocols

9. What are ports and protocols?

A protocol defines how devices communicate.

A port identifies a specific application or service on a host.

Common protocols:

  • TCP
  • UDP
  • ICMP
  • HTTP
  • HTTPS
  • SSH
  • DNS

Common ports:

Service Port Protocol
HTTP 80 TCP
HTTPS 443 TCP
SSH 22 TCP
DNS 53 TCP/UDP
PostgreSQL 5432 TCP
MySQL 3306 TCP
Oracle 1521 TCP
Kafka 9092 TCP

Example:

Client
   │
   │ TCP 443
   ▼
Web Application

A firewall rule may allow:

Source: 10.20.0.0/16

Destination: 10.30.1.25

Protocol: TCP

Port: 443

Only required ports should be opened.

10. What is the difference between TCP and UDP?

TCP UDP
Connection-oriented Connectionless
Reliable delivery Best-effort delivery
Ordered packets Packets may arrive out of order
Retransmission supported No built-in retransmission
Higher overhead Lower overhead

TCP is commonly used for:

  • HTTP
  • HTTPS
  • SSH
  • Database connections
  • Kafka

UDP is commonly used for:

  • DNS queries
  • Voice over IP
  • Video streaming
  • Online gaming
  • Some telemetry protocols

TCP connection:

Client

↓

SYN

↓

Server

↓

SYN-ACK

↓

Client

↓

ACK

This process is known as the TCP three-way handshake.

Use TCP when reliability matters.

Use UDP when low latency is more important than guaranteed delivery.

Routing and Gateways

11. What is routing?

Routing determines the path a network packet takes to reach its destination.

Routers and cloud route tables examine the destination IP address and select the best matching route.

Example route table:

Destination Target
10.0.0.0/16 Local
0.0.0.0/0 Internet Gateway
10.100.0.0/16 VPN Gateway

Flow:

Application
     │
     ▼
Route Table
     │
     ├────────► Local Network
     │
     ├────────► Internet Gateway
     │
     └────────► VPN Gateway

The most specific matching route is normally selected.

Example:

10.0.0.0/8

10.20.0.0/16

Traffic to 10.20.5.10 matches both, but /16 is more specific.

This is called longest-prefix matching.

12. What is a network gateway?

A gateway connects one network to another.

Common gateway types include:

Internet Gateway

Connects a virtual network to the internet.

VPC
 │
 ▼
Internet Gateway
 │
 ▼
Internet

NAT Gateway

Allows private resources to initiate outbound internet connections.

Private Server
      │
      ▼
NAT Gateway
      │
      ▼
Internet

VPN Gateway

Connects cloud networks with on-premises networks through encrypted tunnels.

Cloud Network
      │
      ▼
VPN Gateway
      │
      ▼
On-Premises

Transit Gateway or Network Hub

Connects multiple networks through a central routing layer.

VPC A
   │
   ▼
Transit Hub
   ▲
   │
VPC B

The gateway type depends on the required traffic path.

Network Security

13. What is the difference between stateful and stateless filtering?

Stateful filtering

A stateful firewall tracks active connections.

When outbound traffic is allowed, the corresponding return traffic is automatically permitted.

Client

↓

Outbound Request Allowed

↓

Return Traffic Automatically Allowed

Examples:

  • AWS Security Groups
  • Azure Network Security Groups are stateful
  • Many managed firewalls

Stateless filtering

A stateless filter evaluates each packet independently.

Inbound and outbound rules must both allow the traffic.

Outbound Request Rule

+

Inbound Return Rule

Example:

  • AWS Network ACLs

Comparison:

Stateful Stateless
Tracks connections Does not track connections
Return traffic automatically allowed Return traffic requires a rule
Usually attached to workloads Often applied at subnet boundaries
Easier to manage Provides explicit packet-level control

Both can be used together for defense in depth.

Performance and Reliability

14. What are latency, bandwidth, throughput, and packet loss?

Latency

The time required for data to travel from source to destination.

Measured in milliseconds.

Client Request

↓

120 ms

↓

Server Response

Bandwidth

The theoretical maximum amount of data a connection can carry.

Example:

10 Gbps network capacity

Throughput

The actual amount of data successfully transferred.

Example:

7 Gbps actual transfer

Packet loss

The percentage of packets that do not reach the destination.

Example:

1,000 Packets Sent

↓

990 Received

↓

1% Packet Loss

Common causes of poor network performance:

  • Long geographic distance
  • Network congestion
  • Insufficient bandwidth
  • Packet loss
  • Firewall inspection
  • Misconfigured routing
  • Overloaded NAT gateways
  • DNS delays
  • Cross-region communication
  • Application connection problems

Monitoring should include:

  • Latency
  • Throughput
  • Connection count
  • Retransmissions
  • Packet drops
  • DNS resolution time
  • Load balancer target health

Enterprise Design

15. How would you design a secure enterprise cloud network?

A secure enterprise design should provide isolation, high availability, controlled internet access, private service communication, and centralized governance.

Example:

Internet Users
      │
      ▼
Global DNS
      │
      ▼
CDN
      │
      ▼
Web Application Firewall
      │
      ▼
Public Load Balancer
      │
      ▼
Private Application Subnets
      │
      ▼
Private Database Subnets

Outbound access:

Private Application
        │
        ▼
NAT Gateway
        │
        ▼
Internet

Enterprise connectivity:

On-Premises
      │
      ▼
VPN / Dedicated Connection
      │
      ▼
Transit Network Hub
      │
 ┌────┼─────────────┐
 ▼    ▼             ▼
Prod  Dev      Shared Services

Recommended controls:

  • Non-overlapping CIDR ranges
  • Multi-availability-zone design
  • Public and private subnet separation
  • Private IP addressing
  • Restricted inbound access
  • Controlled outbound access
  • Web application firewall
  • Network firewall
  • Private endpoints
  • Centralized DNS
  • Transit routing
  • Encryption in transit
  • Network flow logs
  • DDoS protection
  • High-availability VPN or dedicated connections
  • Automated network-policy validation

Benefits:

  • Better isolation
  • Reduced attack surface
  • High availability
  • Easier governance
  • Secure hybrid connectivity
  • Faster troubleshooting

Production Scenario

Enterprise Banking Platform

Requirements:

  • Public access to mobile and web APIs
  • Private Spring Boot services
  • Private Oracle databases
  • Kubernetes deployment
  • Hybrid connectivity
  • Multi-zone availability
  • Secure outbound internet access
  • Centralized monitoring

Architecture:

Mobile and Web Users
          │
          ▼
         DNS
          │
          ▼
         CDN
          │
          ▼
Web Application Firewall
          │
          ▼
Public Load Balancer
          │
          ▼
Private Kubernetes Subnets
          │
          ▼
Spring Boot Services
          │
     ┌────┼───────────┐
     ▼    ▼           ▼
   Kafka Cache     Oracle DB

Outbound path:

Private Workload
       │
       ▼
NAT Gateway
       │
       ▼
External API

Hybrid path:

Cloud Network
      │
      ▼
Transit Hub
      │
      ▼
Dedicated Connection / VPN
      │
      ▼
On-Premises Data Center

Security controls:

  • TLS
  • Private IP addresses
  • Least-privilege firewall rules
  • Network segmentation
  • Flow logs
  • WAF
  • DDoS protection
  • Private database endpoints
  • Multi-factor administrative access
  • Centralized audit logging

Cloud Network Architecture

Cloud Region
      │
      ▼
Virtual Network
      │
 ┌────┼───────────────┐
 ▼    ▼               ▼
Public Private App Private DB
Subnet    Subnet      Subnet
 │          │           │
 ▼          ▼           ▼
Load     Services    Database
Balancer

Packet Flow

Source Application
        │
        ▼
DNS Resolution
        │
        ▼
Routing Decision
        │
        ▼
Firewall Evaluation
        │
        ▼
Destination Service
        │
        ▼
Response

Internet Traffic Flow

Internet User
      │
      ▼
Public IP
      │
      ▼
Internet Gateway
      │
      ▼
Load Balancer
      │
      ▼
Private Application

Private Outbound Traffic Flow

Private Application
        │
        ▼
Route Table
        │
        ▼
NAT Gateway
        │
        ▼
Internet Gateway
        │
        ▼
External Service

Troubleshooting Flow

Connection Failure
       │
       ▼
Verify DNS
       │
       ▼
Verify Source and Destination IP
       │
       ▼
Check Route Table
       │
       ▼
Check Firewall Rules
       │
       ▼
Check Gateway
       │
       ▼
Check Port and Protocol
       │
       ▼
Review Flow Logs
       │
       ▼
Test Application

Common Cloud Networking Mistakes

✗ Using overlapping CIDR ranges
✗ Placing databases in public subnets
✗ Opening ports to 0.0.0.0/0 unnecessarily
✗ Using one availability zone
✗ Missing outbound traffic controls
✗ Using public endpoints for every service
✗ Ignoring IPv6 security rules
✗ Misconfiguring route tables
✗ Forgetting return traffic rules in stateless filters
✗ Missing DNS planning
✗ Hardcoding IP addresses
✗ Not enabling network flow logs
✗ Allowing unrestricted administrative access
✗ Creating one large flat network
✗ Not reserving IP space for growth

Best Practices Checklist

✓ Plan CIDR Ranges Centrally
✓ Avoid Overlapping Networks
✓ Separate Public and Private Subnets
✓ Keep Databases Private
✓ Use Multiple Availability Zones
✓ Apply Least-Privilege Firewall Rules
✓ Restrict Administrative Ports
✓ Use Private Endpoints
✓ Control Outbound Traffic
✓ Enable Network Flow Logs
✓ Encrypt Traffic in Transit
✓ Use Centralized DNS
✓ Use High-Availability Gateways
✓ Monitor Latency and Packet Loss
✓ Protect Public Services with WAF
✓ Enable DDoS Protection
✓ Document Route Ownership
✓ Automate Network Validation
✓ Test Failover Regularly
✓ Review Network Costs

Quick Revision

Topic Key Point
Cloud Networking Connectivity between cloud resources
OSI Model Seven-layer networking model
TCP/IP Model Practical internet networking model
IP Address Identifies a network interface
IPv4 32-bit address
IPv6 128-bit address
Public IP Internet-routable address
Private IP Internal network address
CIDR Defines a network address range
Port Identifies an application endpoint
TCP Reliable connection-oriented protocol
UDP Fast connectionless protocol
Routing Selects the packet path
Gateway Connects different networks
Stateful Firewall Tracks connection state
Stateless Filter Evaluates each packet independently
Latency Time required for data transfer
Bandwidth Maximum connection capacity
Throughput Actual transferred data
Best Practice Secure, segmented, private, highly available networking

Interview Follow-Up Questions

Interviewers may ask:

  1. How do you calculate the number of addresses in a CIDR block?
  2. Why should cloud networks avoid overlapping CIDR ranges?
  3. What is the difference between a public and private subnet?
  4. How does longest-prefix route matching work?
  5. What is the difference between TCP and UDP?
  6. What happens during a TCP three-way handshake?
  7. What is the difference between a security group and a network ACL?
  8. How does a private server access the internet?
  9. Why should databases not receive public IP addresses?
  10. How do you troubleshoot a connection timeout?
  11. What is the difference between bandwidth and throughput?
  12. How does packet loss affect application performance?
  13. How do you design a multi-region cloud network?
  14. What networking challenges occur with Kubernetes?
  15. How would you connect cloud resources to an on-premises data center?

Interview Tips

During Cloud Networking interviews:

  • Start with virtual networks, IP addressing, subnets, routes, gateways, and security controls.
  • Explain the practical importance of OSI Layers 3, 4, and 7.
  • Clearly differentiate public and private IP addresses.
  • Be prepared to calculate CIDR ranges and address counts.
  • Explain longest-prefix route matching.
  • Compare TCP and UDP using real use cases.
  • Explain stateful and stateless filtering.
  • Discuss public, private, and hybrid traffic flows.
  • Include DNS, routing, firewall, and flow-log checks in troubleshooting answers.
  • Recommend non-overlapping CIDRs, private workloads, multi-zone deployment, least-privilege rules, and centralized network governance.

Summary

Cloud networking enables secure and reliable communication between users, applications, databases, cloud services, and enterprise data centers.

Key concepts include:

  • Cloud Networking
  • OSI Model
  • TCP/IP Model
  • IPv4
  • IPv6
  • Public and Private IP Addresses
  • CIDR
  • Ports and Protocols
  • TCP and UDP
  • Routing
  • Gateways
  • Stateful and Stateless Filtering
  • Latency
  • Bandwidth
  • Throughput
  • Network Security
  • Enterprise Cloud Architecture

Mastering these 15 Cloud Networking Basics interview questions prepares you for Cloud Engineer, Network Engineer, DevOps Engineer, Site Reliability Engineer, Platform Engineer, Cloud Security Engineer, Technical Lead, Solution Architect, and Enterprise Architect interviews.