Cloud Engineer interview question
What is the difference between public and private subnets?
A public subnet routes to an internet gateway and can host resources with public addresses; a private subnet has no direct inbound internet route and usually uses NAT or private endpoints for controlled egress.
Direct answer
What a strong answer covers
How it works
The difference is entirely in the route table. A public subnet has a route for 0.0.0.0/0 to an internet gateway, so an instance with a public address can accept and initiate internet traffic. A private subnet has no such route; its instances reach the internet only through a NAT gateway for outbound-only access, or not at all, and reach cloud services through private endpoints. Load balancers and bastion hosts sit in public subnets; application servers, databases, and internal services sit in private ones, so a compromised web tier still has no direct path in from the internet to the data tier.
Example
A three-tier VPC has public subnets in each zone holding only the application load balancer and a NAT gateway, private application subnets where the API containers run with security groups allowing traffic only from the load balancer, and isolated database subnets with no NAT route at all. The API reaches S3 and Secrets Manager through VPC endpoints, so the database tier never needs internet egress.
Common mistakes
- Launching application servers in public subnets because it is easier to SSH into them.
- Giving database subnets a NAT route they never need and widening egress.
- Assuming a private subnet is secure without security groups and NACLs.
A useful answer structure
Answer from your own work.
Do not memorise a script: use only examples you can explain honestly in follow-up questions.
Open the desktop workspace and rehearse a clear answer in your own words.