An instance in a private subnet cannot reach the internet to install packages. How do you troubleshoot it?
What the interviewer wants to hear
- Check the private subnet route table has 0.0.0.0/0 to a NAT gateway
- Check the NAT gateway is in a public subnet with a route to an internet gateway and is available
- Check security group outbound rules and NACL rules including ephemeral ports
- Check DNS resolution settings in the VPC
- Use tools like Reachability Analyzer and VPC Flow Logs
Model answer
I would follow the packet path step by step. First, the private subnet route table must send 0.0.0.0/0 to a NAT gateway. Second, that NAT gateway must sit in a public subnet whose route table points 0.0.0.0/0 to an internet gateway attached to the VPC, and the NAT must be in the available state with an Elastic IP. Third, I check the instance security group allows outbound traffic on 80 and 443, and that the network ACLs on both subnets allow outbound traffic and the inbound return traffic on ephemeral ports 1024 to 65535, since NACLs are stateless. Fourth, I check DNS: the VPC needs DNS resolution enabled, and I test with nslookup or curl to an IP. Finally, VPC Reachability Analyzer and Flow Logs quickly show where traffic is rejected. If the instance only needs AWS services, VPC endpoints may be a better answer.
Can you answer it under time pressure?
Take a timed medium round and get scored on every answer.
More medium Cloud Engineer questions
- Design a secure three-tier web application on AWS (or your preferred cloud). Walk through the network and services.
- How do you manage Terraform state and multiple environments (dev, staging, prod) safely?
- A team stores customer documents in an S3 bucket. How would you secure it?
- How would you plan the migration of an on-premises application to the cloud?
- Describe how you would build a CI/CD pipeline for Terraform changes across dev, staging and production.
- A team wants to move a service onto your Kubernetes cluster. What do you check before calling it production ready?
- You are on call and p99 latency for a cloud API jumps from 200 ms to 3 seconds. Walk through how you investigate and handle it.
- How do you manage application secrets such as database passwords and API keys in a cloud environment?
- Design a tagging and cost allocation strategy for a company running many teams on AWS.