Backend interview prep

Start

Subnets Interview Questions (Top 15 Questions with Answers)

Master Subnets Interview Questions with production-ready explanations covering public and private subnets, CIDR planning, subnet sizing, availability zones, route-table association, Kubernetes networking, subnet security, troubleshooting, and enterprise cloud network design.

Module Navigation

Previous: VPC vs VNet QA | Parent: Networking Learning Path | Next: Route Tables QA

Introduction

A subnet is a smaller logical network created inside a larger cloud virtual network.

Cloud platforms use subnets to organize, isolate, secure, and route workloads such as:

  • Virtual machines
  • Kubernetes nodes
  • Load balancers
  • Application servers
  • Databases
  • NAT gateways
  • Private endpoints
  • Managed cloud services

A well-designed subnet architecture separates workloads based on:

  • Security level
  • Application tier
  • Environment
  • Availability zone
  • Routing requirements
  • Internet access
  • Compliance requirements
Virtual Network
      │
 ┌────┼───────────────┐
 ▼    ▼               ▼
Public Subnet   Private App Subnet
                         │
                         ▼
                 Private DB Subnet

Subnets exist across major cloud platforms:

  • AWS VPC subnets
  • Azure VNet subnets
  • Google Cloud VPC subnets

Although implementation details differ, the core concepts remain similar.

This guide contains 15 production-focused subnet interview questions covering CIDR allocation, public and private subnets, availability zones, routing, Kubernetes networking, security, troubleshooting, and enterprise design.

Learning Roadmap

Subnet Fundamentals
        │
        ▼
CIDR and Sizing
        │
        ▼
Public and Private Subnets
        │
        ▼
Availability Zones
        │
        ▼
Routing
        │
        ▼
Security
        │
        ▼
Kubernetes Networking
        │
        ▼
Enterprise Architecture

Subnet Fundamentals

1. What is a subnet?

A subnet is a smaller IP address range created inside a larger virtual network.

Example:

VPC CIDR

10.0.0.0/16

Possible subnets:

10.0.1.0/24

10.0.2.0/24

10.0.3.0/24

Each subnet can contain resources such as:

  • Virtual machines
  • Containers
  • Databases
  • Load balancers
  • Gateways
  • Private endpoints

Benefits:

  • Network segmentation
  • Better security
  • Controlled routing
  • Easier management
  • High availability
  • Environment isolation

2. Why are subnets important in cloud networking?

Subnets allow organizations to divide one large network into smaller security and routing boundaries.

Without subnet separation:

Applications
Databases
Load Balancers
Admin Systems

↓

One Flat Network

With subnet separation:

Public Subnet

↓

Application Subnet

↓

Database Subnet

↓

Management Subnet

Benefits include:

  • Reduced attack surface
  • Better traffic control
  • Easier troubleshooting
  • Workload isolation
  • Compliance support
  • High-availability design

A flat network is easier to create initially but harder to secure and scale.

CIDR and Address Planning

3. How is a subnet CIDR calculated?

A subnet CIDR defines the subnet's IP range and size.

Example:

10.0.1.0/24

The /24 means that 24 bits identify the network portion.

Number of total IPv4 addresses:

2^(32 - 24)

=

256

Common subnet sizes:

CIDR Total IPv4 Addresses
/20 4,096
/22 1,024
/24 256
/26 64
/27 32
/28 16

Cloud providers reserve some addresses, so usable addresses may be fewer than the total count.

4. How do you choose the correct subnet size?

Subnet sizing depends on:

  • Number of workloads
  • Growth expectations
  • Auto Scaling
  • Kubernetes Pods
  • Load balancers
  • Private endpoints
  • Managed services
  • High availability
  • IP addresses reserved by the cloud provider

Example:

Current Application Servers = 40

Expected Growth = 100

Load Balancers and Endpoints = 20

Safety Buffer = 50

A /24 may provide enough capacity for this workload.

Bad design:

Production Application Subnet

10.0.1.0/28

A /28 may be too small for scaling.

Better design:

Production Application Subnet

10.0.1.0/24

Recommended principles:

  • Plan for future growth
  • Avoid extremely small subnets
  • Reserve additional ranges
  • Consider Kubernetes IP consumption
  • Document all allocations
  • Avoid overlapping ranges

5. What is subnetting?

Subnetting is the process of dividing a larger network into smaller networks.

Example:

Original Network

10.0.0.0/16

Divide into /24 subnets:

10.0.0.0/24

10.0.1.0/24

10.0.2.0/24

10.0.3.0/24

Benefits:

  • Smaller broadcast or routing domains
  • Better isolation
  • Easier security control
  • More efficient IP management
  • Environment separation

In cloud platforms, subnetting is primarily used for address allocation, routing, workload placement, and policy enforcement.

Public and Private Subnets

6. What is a public subnet?

A public subnet is a subnet whose route table provides a path to the internet.

In AWS, a typical public subnet has:

0.0.0.0/0

↓

Internet Gateway

Resources also require:

  • A public IP or equivalent public frontend
  • Appropriate firewall rules
  • Correct routing

Architecture:

Internet
   │
   ▼
Internet Gateway
   │
   ▼
Public Subnet
   │
   ▼
Load Balancer

Common public-subnet resources:

  • Internet-facing load balancers
  • NAT gateways
  • Bastion hosts
  • Public web servers

A subnet is not public only because its name contains the word public; its routing configuration determines its behavior.

7. What is a private subnet?

A private subnet does not provide direct inbound connectivity from the internet.

Resources usually use private IP addresses.

Architecture:

Internet
   │
   ▼
Public Load Balancer
   │
   ▼
Private Application Subnet
   │
   ▼
Private Database Subnet

Private resources may still initiate outbound internet access through:

Private Subnet

↓

NAT Gateway

↓

Internet

Common private-subnet resources:

  • Application servers
  • Kubernetes worker nodes
  • Databases
  • Caches
  • Message brokers
  • Internal APIs

Private subnets reduce direct internet exposure.

8. What is an isolated subnet?

An isolated subnet has no direct route to the internet and often no route through a NAT gateway.

Architecture:

Application Subnet
        │
        ▼
Isolated Database Subnet

Typical isolated-subnet resources:

  • Databases
  • Encryption systems
  • Internal directory services
  • Sensitive workloads
  • Regulated systems

Connectivity may be limited to:

  • Internal application subnets
  • Private endpoints
  • On-premises networks
  • Approved management networks

Comparison:

Subnet Type Inbound Internet Outbound Internet
Public Possible Possible
Private No direct inbound Through NAT
Isolated No Usually no

Availability and Placement

In AWS, a subnet belongs to one Availability Zone.

Example:

VPC
 │
 ├── Public Subnet AZ-A
 ├── Private App Subnet AZ-A
 ├── Private DB Subnet AZ-A
 │
 ├── Public Subnet AZ-B
 ├── Private App Subnet AZ-B
 └── Private DB Subnet AZ-B

This supports high availability.

If one Availability Zone fails:

AZ-A Unavailable

↓

Traffic Continues Through AZ-B

Azure subnets are regional rather than tied to a single Availability Zone.

Google Cloud subnets are regional, and workloads inside them may use multiple zones within the region.

Cloud-specific subnet scope must be understood when designing high availability.

10. Why should production workloads use multiple subnets?

Multiple subnets improve:

  • High availability
  • Fault isolation
  • Security segmentation
  • Routing control
  • Capacity
  • Disaster recovery

Bad design:

All Application Servers

↓

One Subnet

↓

One Availability Zone

Better design:

Load Balancer
     │
 ┌───┴───────┐
 ▼           ▼
App Subnet  App Subnet
AZ-A        AZ-B

Production applications should normally distribute workloads across multiple zones or equivalent fault domains.

Routing and Security

11. How do route tables work with subnets?

A route table determines where traffic from a subnet is sent.

Example public route table:

Destination Target
10.0.0.0/16 Local
0.0.0.0/0 Internet Gateway

Example private route table:

Destination Target
10.0.0.0/16 Local
0.0.0.0/0 NAT Gateway

Architecture:

Private Application
       │
       ▼
Subnet Route Table
       │
       ▼
NAT Gateway
       │
       ▼
Internet

A routing error can make a correctly configured resource unreachable.

12. How is subnet security implemented?

Subnet security may involve:

  • Route tables
  • Network ACLs
  • Network Security Groups
  • Firewall policies
  • Security groups
  • Private endpoints
  • Service endpoints
  • Network policies

Security layers:

Internet
   │
   ▼
Firewall
   │
   ▼
Subnet-Level Controls
   │
   ▼
Workload-Level Controls
   │
   ▼
Application

Recommended approach:

  • Deny unnecessary access
  • Allow only required ports
  • Restrict source CIDRs
  • Keep databases private
  • Use private service connectivity
  • Enable flow logs
  • Separate management traffic
  • Review rules regularly

Subnet isolation alone does not replace workload-level security.

Kubernetes and Cloud-Native Networking

13. How do subnets affect Kubernetes deployments?

Kubernetes clusters consume significant IP address capacity.

IP addresses may be assigned to:

  • Worker nodes
  • Pods
  • Services
  • Load balancers
  • Ingress controllers
  • Private endpoints
  • Control-plane interfaces

Example:

Kubernetes Node Subnet

10.20.0.0/20

If each Pod receives an IP from the subnet, IP exhaustion may occur quickly.

Architecture:

Kubernetes Cluster
        │
        ▼
Node Subnet
        │
 ┌──────┼───────────┐
 ▼      ▼           ▼
Node A  Node B     Node C
 │       │           │
 ▼       ▼           ▼
Pods    Pods        Pods

Important considerations:

  • Pod CIDR sizing
  • Node scaling
  • Multiple availability zones
  • Load balancer IP usage
  • Service CIDRs
  • CNI implementation
  • Private control-plane access

Kubernetes subnet planning should include both current and future Pod capacity.

Troubleshooting

14. How do you troubleshoot subnet connectivity issues?

Use a systematic approach.

Connection Failure
       │
       ▼
Verify Source IP
       │
       ▼
Verify Destination IP
       │
       ▼
Check Subnet CIDR
       │
       ▼
Check Route Table
       │
       ▼
Check Security Rules
       │
       ▼
Check Gateway or NAT
       │
       ▼
Review Flow Logs
       │
       ▼
Test Port and Protocol

Common causes:

  • Incorrect route-table association
  • Missing route
  • Overlapping CIDR blocks
  • Firewall rule blocking traffic
  • Network ACL blocking return traffic
  • NAT gateway failure
  • IP exhaustion
  • DNS resolution failure
  • Missing private endpoint
  • Wrong subnet placement

Useful checks:

Can the source resolve the hostname?

Can it reach the destination IP?

Is the required port open?

Is return traffic allowed?

Does the subnet have available IP addresses?

Enterprise Architecture

15. How would you design subnets for an enterprise application?

A production subnet design should separate internet-facing, application, database, management, and integration workloads.

Example:

Cloud Virtual Network
          │
 ┌────────┼──────────────────────┐
 ▼        ▼                      ▼
Public    Private App         Management
Subnets   Subnets             Subnets
          │
          ▼
      Database Subnets
          │
          ▼
      Isolated Services

Multi-zone design:

Availability Zone A
 ├── Public Subnet
 ├── Application Subnet
 └── Database Subnet

Availability Zone B
 ├── Public Subnet
 ├── Application Subnet
 └── Database Subnet

Example CIDR allocation:

Purpose CIDR
VPC 10.10.0.0/16
Public AZ-A 10.10.1.0/24
Public AZ-B 10.10.2.0/24
Application AZ-A 10.10.10.0/23
Application AZ-B 10.10.12.0/23
Database AZ-A 10.10.20.0/24
Database AZ-B 10.10.21.0/24
Management 10.10.30.0/24
Kubernetes 10.10.40.0/20

Recommended controls:

  • Non-overlapping CIDRs
  • Multi-zone subnet design
  • Private application workloads
  • Isolated databases
  • Separate Kubernetes ranges
  • Controlled outbound access
  • Private endpoints
  • Centralized routing
  • Flow logs
  • Capacity monitoring
  • Reserved space for future growth

Production Scenario

Enterprise Banking Platform

Requirements:

  • Internet-facing APIs
  • Private Spring Boot services
  • Kubernetes
  • Oracle Database
  • Kafka
  • Multi-zone deployment
  • Hybrid connectivity
  • Strong network isolation

Architecture:

Internet Users
      │
      ▼
Public Load Balancer
      │
 ┌────┴─────────┐
 ▼              ▼
Public Subnet   Public Subnet
AZ-A            AZ-B
      │
      ▼
Private Kubernetes Subnets
      │
 ┌────┴────────────┐
 ▼                 ▼
App Subnet AZ-A   App Subnet AZ-B
      │
      ▼
Private Database Subnets
      │
 ┌────┴────────────┐
 ▼                 ▼
DB Subnet AZ-A    DB Subnet AZ-B

Outbound access:

Private Application Subnet
          │
          ▼
NAT Gateway in Same Zone
          │
          ▼
Internet

Hybrid access:

Cloud Subnets
      │
      ▼
Transit Hub
      │
      ▼
VPN / Dedicated Connection
      │
      ▼
On-Premises

Benefits:

  • High availability
  • Strong segmentation
  • Controlled internet exposure
  • Private database access
  • Easier compliance
  • Better fault isolation

Subnet Architecture

Virtual Network
      │
 ┌────┼──────────────┐
 ▼    ▼              ▼
Public Private App Private DB
Subnet   Subnet      Subnet

Public Subnet Flow

Internet
   │
   ▼
Internet Gateway
   │
   ▼
Public Route Table
   │
   ▼
Public Subnet

Private Subnet Flow

Private Application
        │
        ▼
Private Route Table
        │
        ▼
NAT Gateway
        │
        ▼
Internet

Isolated Subnet Flow

Application Subnet
        │
        ▼
Internal Route
        │
        ▼
Isolated Database Subnet

Subnet Design Flow

Identify Workloads
       │
       ▼
Estimate IP Demand
       │
       ▼
Choose CIDR Sizes
       │
       ▼
Separate Security Tiers
       │
       ▼
Distribute Across Zones
       │
       ▼
Associate Route Tables
       │
       ▼
Apply Security Controls
       │
       ▼
Monitor IP Utilization

Common Subnet Mistakes

✗ Using overlapping CIDR ranges
✗ Creating subnets that are too small
✗ Placing databases in public subnets
✗ Deploying production workloads in one zone
✗ Using one route table for every subnet
✗ Ignoring Kubernetes IP consumption
✗ Not reserving space for growth
✗ Allowing unrestricted outbound traffic
✗ Forgetting subnet-specific security rules
✗ Running NAT gateways in only one zone
✗ Hardcoding IP addresses
✗ Not enabling flow logs
✗ Mixing production and development workloads
✗ Using public IPs unnecessarily
✗ Not monitoring available IP addresses

Best Practices Checklist

✓ Plan CIDR Ranges Centrally
✓ Avoid Overlapping Address Space
✓ Separate Public and Private Workloads
✓ Keep Databases in Isolated Subnets
✓ Use Multiple Availability Zones
✓ Size Subnets for Future Growth
✓ Reserve Capacity for Kubernetes
✓ Use Separate Route Tables Where Required
✓ Control Outbound Internet Access
✓ Use Private Endpoints
✓ Apply Least-Privilege Security Rules
✓ Enable Network Flow Logs
✓ Monitor IP Address Utilization
✓ Document Subnet Ownership
✓ Review Subnet Capacity Regularly
✓ Use Infrastructure as Code
✓ Validate Routes Automatically
✓ Test Zone Failover
✓ Separate Environments
✓ Maintain an IP Address Management Plan

Quick Revision

Topic Key Point
Subnet Smaller network inside a virtual network
CIDR Defines subnet address range
Public Subnet Has an internet route
Private Subnet No direct inbound internet access
Isolated Subnet No direct internet route
Route Table Controls subnet traffic paths
Availability Zone Fault-isolation boundary
Multi-Zone Design Improves availability
NAT Gateway Outbound internet for private subnets
Internet Gateway Internet connectivity
Network ACL Subnet-level packet filtering
Security Group Workload-level stateful filtering
Kubernetes Subnet Provides IP capacity for nodes and Pods
IP Exhaustion No addresses available for new resources
Best Practice Segmented, non-overlapping, scalable subnet design

Interview Follow-Up Questions

Interviewers may ask:

  1. What makes a subnet public?
  2. Can a resource in a public subnet remain private?
  3. What is the difference between private and isolated subnets?
  4. How do you calculate subnet capacity?
  5. Why do cloud providers reserve subnet IP addresses?
  6. How do route tables determine subnet behavior?
  7. Why should production subnets span multiple zones?
  8. What causes IP exhaustion?
  9. How does Kubernetes consume subnet IP addresses?
  10. Why should databases use isolated subnets?
  11. Can two subnets overlap within the same virtual network?
  12. How does a private subnet access the internet?
  13. Why might each Availability Zone require its own NAT gateway?
  14. How do you troubleshoot an unreachable private server?
  15. How would you redesign a flat cloud network?

Interview Tips

During Subnet interviews:

  • Define a subnet as a smaller CIDR range inside a virtual network.
  • Explain that routing—not the subnet name—determines whether a subnet is public or private.
  • Clearly differentiate public, private, and isolated subnets.
  • Be ready to calculate IPv4 address counts from CIDR notation.
  • Discuss cloud-provider-reserved addresses and usable capacity.
  • Explain why production workloads should span multiple zones.
  • Describe route-table association and longest-prefix matching.
  • Mention Kubernetes Pod IP consumption and subnet exhaustion.
  • Include security controls such as network ACLs, security groups, flow logs, and private endpoints.
  • Recommend non-overlapping CIDRs, capacity planning, environment separation, and multi-zone design.

Summary

Subnets divide cloud virtual networks into smaller address ranges that support workload isolation, routing, security, availability, and scalability.

Key concepts include:

  • Subnet Fundamentals
  • CIDR Planning
  • Subnet Sizing
  • Public Subnets
  • Private Subnets
  • Isolated Subnets
  • Route Tables
  • Availability Zones
  • Multi-Zone Design
  • NAT Gateways
  • Internet Gateways
  • Subnet Security
  • Kubernetes Networking
  • IP Exhaustion
  • Enterprise Subnet Architecture

Mastering these 15 Subnet interview questions prepares you for Cloud Engineer, Network Engineer, DevOps Engineer, Site Reliability Engineer, Platform Engineer, Kubernetes Engineer, Cloud Security Engineer, Technical Lead, Solution Architect, and Enterprise Architect interviews.