What is a VPC (Virtual Private Cloud)?
Learn what a VPC is, how subnets, route tables, and internet/NAT gateways work, and how to explain AWS network isolation clearly in a cloud interview.
Expected Interview Answer
A VPC (Virtual Private Cloud) is a logically isolated virtual network within AWS where you control the IP address range, subnets, routing, and gateways, letting you run resources in a private network you design yourself.
You define a CIDR block for the VPC, then carve it into subnets across Availability Zones, marking some as public (routed to an internet gateway) and others as private (with no direct internet route, often reaching the internet via a NAT gateway). Route tables control traffic flow between subnets and gateways, while security groups and network ACLs enforce access rules at the instance and subnet level respectively. VPCs can be connected to on-premises networks via VPN or Direct Connect, or peered with other VPCs, giving you the same network isolation and control you would have in a traditional data center, but defined entirely in software.
- Full control over IP addressing and network topology
- Isolation between public-facing and private backend resources
- Fine-grained traffic control via route tables, security groups, and NACLs
- Secure connectivity options to on-premises networks or other VPCs
- Foundation for defense-in-depth network security in AWS
AI Mentor Explanation
A VPC is like a private stadium complex you design yourself, with separate zones for the public gate entrance and the restricted players-only area. You control which gates connect to the public street and which corridors stay internal, just as route tables decide which subnets reach the internet and which stay isolated inside the complex.
Step-by-Step Explanation
Step 1
Define a CIDR block
The VPC is assigned an IP address range that all its subnets are carved out of.
Step 2
Create subnets across AZs
Split the CIDR block into subnets, each tied to a single Availability Zone.
Step 3
Attach gateways
An internet gateway enables public subnet internet access; a NAT gateway lets private subnets reach out without being reachable in.
Step 4
Configure route tables
Route tables per subnet decide whether traffic goes to the internet gateway, NAT gateway, peering connection, or stays local.
Step 5
Layer security controls
Security groups (stateful, instance-level) and NACLs (stateless, subnet-level) enforce allowed traffic.
What Interviewer Expects
- Defines a VPC as an isolated, software-defined network within AWS
- Explains the role of CIDR blocks, subnets, and Availability Zones
- Distinguishes public subnets (internet gateway) from private subnets (NAT gateway)
- Knows the difference between security groups and network ACLs
- Mentions connectivity options like VPC peering, VPN, or Direct Connect
Common Mistakes
- Confusing security groups (stateful) with NACLs (stateless)
- Assuming a private subnet has no internet access at all rather than outbound-only via NAT
- Forgetting that subnets are tied to a single Availability Zone
- Thinking a VPC is a physical network rather than a logical, software-defined one
Best Answer (HR Friendly)
“A VPC is a private, isolated section of AWS's cloud network that a company controls completely, similar to having your own secure network inside a larger building. It lets teams decide exactly which parts of their systems are exposed to the internet and which stay hidden and protected.”
Code Example
aws ec2 create-vpc --cidr-block 10.0.0.0/16
# VpcId: vpc-0123456789abcdef0
aws ec2 create-subnet --vpc-id vpc-0123456789abcdef0 \
--cidr-block 10.0.1.0/24 --availability-zone us-east-1a # public
aws ec2 create-subnet --vpc-id vpc-0123456789abcdef0 \
--cidr-block 10.0.2.0/24 --availability-zone us-east-1b # private
aws ec2 create-internet-gateway
aws ec2 attach-internet-gateway --vpc-id vpc-0123456789abcdef0 \
--internet-gateway-id igw-0123456789abcdef0Follow-up Questions
- What is the difference between a public subnet and a private subnet?
- How do security groups differ from network ACLs?
- What is a NAT gateway and why is it needed?
- How does VPC peering differ from a Transit Gateway?
- How would you design a multi-tier VPC for a production application?
MCQ Practice
1. What determines whether a subnet is considered public in a VPC?
A subnet is public when its route table routes internet-bound traffic to an attached internet gateway.
2. What is the key difference between security groups and network ACLs?
Security groups are stateful firewalls at the instance/ENI level; NACLs are stateless rules applied at the subnet boundary.
3. What does a NAT gateway allow for a private subnet?
A NAT gateway lets instances in a private subnet initiate outbound traffic to the internet while remaining unreachable from it directly.
Flash Cards
What is a VPC? — A logically isolated, software-defined virtual network within AWS where you control IP ranges, subnets, and routing.
What makes a subnet 'public'? — Its route table sends internet-bound traffic to an attached internet gateway.
What is a NAT gateway used for? — Letting private subnet resources reach the internet outbound without accepting inbound connections.
Security groups vs NACLs? — Security groups are stateful and apply per instance; NACLs are stateless and apply per subnet.