Design a virtual private cloud service: system design interview question

How the interviewer opens it

“Design a cloud service that gives customers isolated virtual networks, subnets, routes, and security rules. Explain how the service handles configuration changes and failures.”

The prompt is vague on purpose. The first minutes are for you. Reduce the prompt to the core features and agree on the numbers before you draw.

What to clarify first

Service boundary
Scale
API traffic
Change distribution
Latency and packet rate
Addresses and routes
Security rules
Consistency and availability
Durability and failures
Excluded features

The interviewer has the answers. In a SysRound round, Alex gives these answers, as a real interviewer does.

Scope of a strong answer

Core requirements

Create isolated VPCs and subnets with private IPv4 addresses.
Attach virtual machines and route packets within each VPC.
Apply stateful security rules at virtual machine attachments.
Distribute configuration changes without loss of tenant isolation.

Usually out of scope

Physical network design
Virtual machine placement
Internet gateways and NAT
Connections between VPCs
IPv6
Compromised host software

What interviewers ask about

Packet identity and isolation: Different tenants can use identical addresses. Every packet lookup must preserve the correct VPC identity despite hostile guest packets and stale host state.
Rule and route changes: Hosts apply changes at different times. Old connection state can preserve access after a rule deletion, even when every host receives the new rules.
Host and zone failures: A host without control contact can still send packets. The service must remove stale authority without treating lost contact as proof of shutdown.
Large configuration changes: One change can affect 20,000 hosts. Repeated changes and host recovery can consume distribution capacity and delay unrelated tenants.

Common mistakes

The design trusts guest packet addresses as proof of tenant identity.
The service reports a change as effective after it only commits the database row.
The design treats an unreachable host as unable to send packets.
The packet path queries a central database for every packet.
The service keeps old connection permissions after a rule deletion becomes effective.
The service reuses an address before the former owner loses authority.

The bar by level

Senior (L5/E5): Separates acceptance from enforcement. Defines acknowledgments, local atomic changes, connection revocation, and a safe recovery path. Calculates distribution load and prevents stale hosts from regaining authority.
Staff (L6+/E6+): States isolation invariants across packet, configuration, and attachment lifecycles. Proves bounded revocation under partitions and agent failure. Defines clock assumptions, reuse fences, tenant load limits, and zone recovery behavior.

Sources · 1 reference

These records explain where the question appears. A company tag or candidate report does not guarantee a future interview question.

SysRound · 1 record

No company association
Design a virtual private cloud service
Reported date not specified
Source snapshot: Nov 12, 2026
View source

How the interviewer opens it

“Design a cloud service that gives customers isolated virtual networks, subnets, routes, and security rules. Explain how the service handles configuration changes and failures.”

The prompt is vague on purpose. The first minutes are for you. Reduce the prompt to the core features and agree on the numbers before you draw.

Scope of a strong answer

Core requirements

Create isolated VPCs and subnets with private IPv4 addresses.
Attach virtual machines and route packets within each VPC.
Apply stateful security rules at virtual machine attachments.
Distribute configuration changes without loss of tenant isolation.

Usually out of scope

Physical network design
Virtual machine placement
Internet gateways and NAT
Connections between VPCs
IPv6
Compromised host software

What interviewers ask about

Packet identity and isolation

Different tenants can use identical addresses. Every packet lookup must preserve the correct VPC identity despite hostile guest packets and stale host state.

Rule and route changes

Hosts apply changes at different times. Old connection state can preserve access after a rule deletion, even when every host receives the new rules.

Host and zone failures

A host without control contact can still send packets. The service must remove stale authority without treating lost contact as proof of shutdown.

Large configuration changes

One change can affect 20,000 hosts. Repeated changes and host recovery can consume distribution capacity and delay unrelated tenants.

Common mistakes

The design trusts guest packet addresses as proof of tenant identity.

The service reports a change as effective after it only commits the database row.

The design treats an unreachable host as unable to send packets.

The packet path queries a central database for every packet.

The service keeps old connection permissions after a rule deletion becomes effective.

The service reuses an address before the former owner loses authority.

The bar by level

Senior (L5/E5)

Separates acceptance from enforcement. Defines acknowledgments, local atomic changes, connection revocation, and a safe recovery path. Calculates distribution load and prevents stale hosts from regaining authority.

Staff (L6+/E6+)

States isolation invariants across packet, configuration, and attachment lifecycles. Proves bounded revocation under partitions and agent failure. Defines clock assumptions, reuse fences, tenant load limits, and zone recovery behavior.