How would you connect a cloud network to an on-prem datacenter, and what are the trade-offs between the options?
What they are really testing: Senior signal: do you reason about cost, latency, bandwidth, and security as a deliberate trade-off, and start from requirements rather than naming one product.
A real interview question
How would you connect a cloud network to an on-prem datacenter, and what are the trade-offs between the options?
What most people say
drag me
“I would set up a VPN between the cloud and the datacenter.”
It picks a product without asking the requirements. A VPN may be right, but a senior answer weighs bandwidth, latency consistency, cost, and time-to-provision, and knows when a dedicated circuit or a hub topology is the better call.
The follow-ups they ask next
When is the cost and weeks-long setup of Direct Connect actually justified over a VPN?
Sustained high bandwidth, latency-sensitive or jitter-sensitive workloads, large egress volumes (cheaper per GB), or compliance needing a private path. For low/bursty traffic a VPN is usually enough.
Why can a mesh of VPC peerings become unmanageable, and what fixes it?
Peering is non-transitive and grows O(n^2) with routes/rules to maintain. A Transit Gateway / hub-and-spoke centralizes routing so each VPC attaches once.
What the interviewer is listening for
- Starts from requirements not a product
- Weighs cost/latency/bandwidth/provisioning
- Knows peering is non-transitive / hub at scale
- Mentions VPN-as-backup-to-DX
What sinks the answer
- Names one product immediately
- No cost or latency trade-off
- Unaware of transitive routing limits or overlapping CIDRs
If you genuinely do not know
Say this instead of freezing. Reasoning out loud from what you do know beats silence every single time, and a good interviewer is listening for exactly that.
“I start from [requirements: bandwidth, latency, consistency, security, time-to-live]. A [VPN is encrypted, cheap, live in hours, but variable over the internet]; a [dedicated circuit like Direct Connect/ExpressRoute is consistent and high-bandwidth but costly and slow to provision]. At scale I use [a hub like Transit Gateway since peering is non-transitive] and ensure [non-overlapping CIDRs and encryption where compliance needs it].”
Keep going with networking
Foundation
What is a VPC, and what is a subnet within it? Why split a network into subnets at all?
Foundation
What is the difference between TCP and UDP, and when would you choose each?
Foundation
What happens, step by step, when you type a URL into a browser and press enter?
Foundation
How does DNS resolution actually work, and what is the difference between an A record and a CNAME?
Foundation
What is the difference between IPv4 and IPv6, and why does IPv6 exist?
Junior
An EC2 instance in a private subnet needs to download OS updates from the internet. Walk me through how you make that work, and why.
Knowing the answer is not the same as recalling it under pressure
Sign in to send the questions you fumble to spaced recall, so they come back right before you would forget them, and learn the concepts behind them with hands-on labs.
Start free