Crisp answer: The core networking stack is VPC, subnets, route tables, and security groups for isolation. Load balancers for traffic distribution. Route 53 for DNS. CloudFront for CDN. Direct Connect or Site-to-Site VPN for hybrid connectivity.
Load Balancers:
ALB (Application Load Balancer):
- Layer 7 (HTTP/HTTPS)
- Host and path-based routing
- Native support for EKS Ingress via AWS Load Balancer Controller
- WebSocket support, HTTP/2, gRPC
- Use for: web apps, microservices, APIs
NLB (Network Load Balancer):
- Layer 4 (TCP/UDP/TLS)
- Extremely low latency, millions of requests/sec
- Static IPs (important for whitelisting)
- Preserves client source IP
- Use for: non-HTTP protocols, gaming, IoT, when static IP needed
CLB (Classic Load Balancer):
- Legacy, do not use for new workloads
Route 53:
- AWS's DNS service
- Record types: A, AAAA, CNAME, MX, TXT, NS, SOA, Alias
- Alias records: point to AWS resources (ALB, CloudFront, S3 website)
without the TTL limitation of CNAME
- Routing policies:
Simple: one record, multiple values returned randomly
Weighted: send X% to one endpoint, Y% to another (A/B testing)
Latency: route to the region with lowest latency for the user
Failover: primary/secondary with health checks
Geolocation: route based on user's country/continent
Geoproximity: route based on location with bias
Multi-value: return up to 8 healthy records (basic load balancing)
CloudFront:
- CDN: caches content at 400+ edge locations globally
- Reduces latency for static content by serving from the nearest edge
- Can accelerate dynamic content by optimising TCP connections to origin
- Integrates with S3, ALB, API Gateway, Lambda@Edge
- AWS Shield Standard included (DDoS protection)
- Use for: websites, APIs needing global low latency, large file distribution
VPC Connectivity:
VPC Peering: Direct private connection between two VPCs
Non-transitive: A-B-C does not mean A can reach C
Works across accounts and regions
Transit Gateway: Hub-and-spoke: many VPCs and on-prem connect to one TGW
Transitive routing: all attached networks can talk to each other
Replaces complex peering meshes
Site-to-Site VPN: IPSec tunnel between your on-prem network and a VPC
Encrypted over the internet
Redundant tunnels: two tunnels per VPN connection
Direct Connect: Dedicated physical connection to AWS
Not over the internet: lower latency, consistent bandwidth
1Gbps or 10Gbps
Use for: high-bandwidth, latency-sensitive, or compliance workloads
What to say in the interview:
"For load balancing I default to ALB for HTTP workloads because of the routing capabilities and EKS Ingress integration, and NLB when I need Layer 4 or static IPs. Route 53 with Alias records to point to AWS resources — Alias is better than CNAME because it works at the zone apex and has no extra DNS lookup cost. For hybrid connectivity, Site-to-Site VPN is quick to set up and good enough for moderate bandwidth. Direct Connect for anything where you need guaranteed bandwidth or low latency to on-prem. For multiple VPCs I reach for Transit Gateway rather than building a peering mesh, because peering is non-transitive and gets unmanageable at scale."