Technical interview guide

Cloud-Native Network Security

Security groups, network ACLs, and private networking that control traffic flow within a cloud environment.

Read: 45 min
Practice MCQs: 25
Interview QA: 25
Edition: v4
Editorial status: Reviewed
Relevant for: Cloud Security Engineer

Scope: AWS VPC, Azure networking/Private Link, Google Cloud NGFW, and NIST SP 800-207 guidance current 2026-08-31.

Interview QA

Treat each question like a live interview question: answer out loud first (structure, assumptions, tradeoffs), then open the model answer to spot gaps and rehearse a tighter follow-up.

Curated: 2026-10-05 · Written: 2026-10-05 · Reviewed: 2026-10-03

QA-1

Design network security for a three-tier cloud application.

QA-2

Explain and combine AWS security groups and network ACLs.

QA-3

Move a managed database from public access to a private endpoint.

QA-4

Secure an internet-facing application load balancer and its backends.

QA-5

Introduce default-deny egress for cloud workloads.

QA-6

Design secure hybrid connectivity from on-premises to cloud.

QA-7

Design a multi-account hub-and-spoke network securely.

QA-8

Roll out an organization-level firewall guardrail.

QA-9

Respond to an accidentally public database firewall rule.

QA-10

Test cloud firewall rules before production.

QA-11

Build useful flow-log observability.

QA-12

Secure DNS across private cloud networks.

QA-13

Protect workloads from cloud metadata credential theft.

QA-14

Explain why private networking is not zero trust.

QA-15

Secure a managed database network boundary.

QA-16

Design secure administrator access to private cloud resources.

QA-17

Secure network access for a serverless function calling private services.

QA-18

Maintain equivalent IPv4 and IPv6 exposure controls.

QA-19

Prevent data exfiltration through cloud network paths.

QA-20

How do you enforce pod-to-pod network segmentation and runtime egress policies using Kubernetes NetworkPolicies or CNI plugins?

QA-21

Manage an exception for broad network access.

QA-22

Diagnose an intermittent private-endpoint connectivity failure.

QA-23

Detect and remediate cloud network-policy drift.

QA-24

Define observability and metrics for cloud network security.

QA-25