A company needs reliable connectivity between its data center and the cloud. Compare site-to-site VPN and a dedicated connection like AWS Direct Connect, and describe a resilient design.
What the interviewer wants to hear
- VPN runs encrypted over the internet, quick and cheap but variable latency and limited throughput
- Direct Connect is a private dedicated link with consistent latency and higher bandwidth, but takes longer to set up
- Direct Connect is not encrypted by default; use MACsec or VPN over it if needed
- Resilience with redundant connections at different locations, or VPN as backup
- BGP routing and transit gateway integration, avoid overlapping CIDRs
Model answer
A site-to-site VPN creates IPsec tunnels over the public internet. It can be set up in hours and is cheap, but latency and throughput vary, and each tunnel has bandwidth limits, around 1.25 Gbps on AWS. Direct Connect, ExpressRoute on Azure or Cloud Interconnect on GCP, is a private dedicated link through a colocation partner. It gives stable latency, high bandwidth and lower data transfer prices, but takes weeks to provision and is not encrypted by default, so I would add MACsec or run a VPN over it for sensitive traffic. For resilience I would use two Direct Connect connections at two different locations, landing on a Direct Connect gateway attached to a transit gateway, with BGP handling failover. A cheaper option is one Direct Connect plus a VPN backup. I also plan non-overlapping IP ranges and monitor BGP sessions and link health.
Can you answer it under time pressure?
Take a timed hard round and get scored on every answer.
More hard Cloud Engineer questions
- Design a multi-region disaster recovery setup for a payments API with an RPO of under 1 minute and an RTO of 15 minutes. What trade-offs do you consider?
- How would you design a multi-account cloud landing zone for a company with 20 product teams?
- Leadership asks you to reduce the cloud bill by 30 percent without hurting reliability. How do you approach it?
- How would you migrate a large production database to a managed cloud database with near-zero downtime?
- Design a shared Kubernetes platform used by 30 product teams. How do you handle isolation, security, cost and upgrades?
- You find out that long-lived AWS access keys were pushed to a public GitHub repository an hour ago. How do you respond?
- Design observability and alerting for a customer-facing API so on-call gets paged for real problems but not for noise.
- Design an event-driven order processing system on a public cloud that must handle traffic spikes and never lose or double-charge an order.
- Your company has hundreds of Terraform configurations owned by many teams. How do you structure modules, state and governance so it scales safely?