Cloud Networking Questions and Answers

Answer: A

Correct answer: an isolated network with a chosen range

A virtual private cloud is a logically isolated section of the provider’s network in which the tenant chooses the address range and then divides it into subnets, attaches route tables and gateways, and controls what may enter and leave. The isolation is enforced by the provider’s network fabric rather than by separate physical cabling, which is what makes it possible to create one in seconds.

Answer: B

Placing resources in subnets across zones is how a deployment survives the loss of one. A subnet spanning zones would defeat the isolation the zones provide. Each subnet lives in one zone only. Spreading across zones is deliberate.

Answer: C

Correct answer: Both A and R are true, and R is the correct explanation of A

Both are true and the reason is the constraint that forces the practice. A subnet is bound to a single availability zone, so everything in it shares that zone’s fate. Spreading subnets across two or more zones, with the load balancer and the database replica following, is what allows the deployment to survive the loss of one - and it is why zone count, not instance count, sets the resilience.

Answer: D

The distinction between the two gateways is what makes a subnet public or private. A subnet is private precisely because its route table sends traffic to the NAT rather than the internet gateway. Routes decide the character.

Answer: A

Nothing about the addresses makes a subnet public or private, only the route. A private subnet reaches the internet outbound through a NAT and cannot be reached inbound. Addresses do not decide it. The route table is what determines the character.

Answer: B

Correct answer: Both A and R are true, and R is the correct explanation of A

Both are true and the reason is the mechanism. A NAT gateway sits in a public subnet and translates outbound connections from private instances, so those instances can fetch packages and reach APIs while remaining unreachable from outside. The asymmetry is the point: connections initiated inward have no translation entry to match and are simply dropped.

Answer: C

The access control list is stateless and applies at the subnet boundary, so return traffic needs its own rule. Forgetting that is a common cause of connections that open but never reply. State is what distinguishes the two.

Answer: D

The first two are correct. The third holds only for the access control list, since a security group has allow rules and denies everything not matched. Attachment point differs as well. One sits at the instance and one at the subnet.

Answer: A

Correct answer: Both A and R are true, and R is the correct explanation of A

Both are true and the reason is the cause. A network ACL is stateless, so it evaluates each packet on its own and knows nothing of the connection it belongs to - which means the return traffic needs its own rule, typically permitting the ephemeral port range. A security group is stateful and does track the connection, so allowing the inbound request is enough for the reply to leave. Confusing the two is the most common cause of traffic being silently dropped.

Answer: B

Correct answer: each can reach the other privately

Peering establishes a private route between two VPCs so that instances address each other by their private addresses, with traffic staying on the provider’s network. Neither becomes part of the other, and their address ranges must not overlap - if they do, the routes are ambiguous and the peering cannot be created.