An EC2 instance in a private subnet needs to download OS updates from the internet. Walk me through how you make that work, and why.
What they are really testing: Whether you understand subnet routing and the difference between inbound and outbound reachability, the single most common cloud-networking confusion. They want the NAT gateway reasoning, not just the term.
A real interview question
An EC2 instance in a private subnet needs to download OS updates from the internet. Walk me through how you make that work, and why.
What most people say
drag me
“I would give it a public IP / put it in a public subnet so it can reach the internet.”
That defeats the purpose, it makes the instance internet-reachable, the opposite of "private". It shows the candidate conflates outbound access with inbound exposure, the exact thing the question tests.
The follow-ups they ask next
The instance still cannot reach the internet after you add the NAT. Where do you look?
Check the private subnet’s route table actually points 0.0.0.0/0 at the NAT; the NAT is in a public subnet with an IGW route; security groups/NACLs allow the outbound + return traffic; and the NAT has an Elastic IP.
How is a NAT gateway different from an Internet Gateway?
An IGW allows bidirectional internet traffic (needed for public-facing resources with public IPs). A NAT allows only outbound-initiated traffic from private resources, no unsolicited inbound.
What the interviewer is listening for
- Defines private subnet by its route table
- Separates inbound vs outbound reachability
- Reaches for a VPC endpoint for AWS-service traffic
What sinks the answer
- Suggests a public IP / public subnet
- Confuses NAT and Internet Gateway
- Can't trace the packet path
If you genuinely do not know
Say this instead of freezing. Reasoning out loud from what you do know beats silence every single time, and a good interviewer is listening for exactly that.
“The subnet is private because [its route table has no Internet Gateway route]. The instance only needs [outbound, not inbound], so I add a [NAT gateway in a public subnet] and route the private subnet’s 0.0.0.0/0 at it. Traffic goes [instance -> NAT -> IGW out], and it stays unreachable inbound. For S3/ECR I’d use [a VPC endpoint] instead.”
Keep going with networking
Foundation
What is a VPC, and what is a subnet within it? Why split a network into subnets at all?
Foundation
What is the difference between TCP and UDP, and when would you choose each?
Foundation
What happens, step by step, when you type a URL into a browser and press enter?
Foundation
How does DNS resolution actually work, and what is the difference between an A record and a CNAME?
Foundation
What is the difference between IPv4 and IPv6, and why does IPv6 exist?
Junior
In AWS, what is the difference between a security group and a network ACL, and when would you reach for each?
Knowing the answer is not the same as recalling it under pressure
Sign in to send the questions you fumble to spaced recall, so they come back right before you would forget them, and learn the concepts behind them with hands-on labs.
Start free