# Design a virtual private cloud service: system design interview question

> A cloud network service with overlapping addresses, tenant isolation, and safe route and security changes across many hosts.

Source: https://sysround.com/questions/design-virtual-private-cloud-service
Updated: 2026-11-05


Difficulty: hard. Levels: Senior, Staff+.

## How the interviewer opens it

"Design a cloud service that gives customers isolated virtual networks, subnets, routes, and security rules. Explain how the service handles configuration changes and failures."

## What to clarify first

- Service boundary
- Scale
- API traffic
- Change distribution
- Latency and packet rate
- Addresses and routes
- Security rules
- Consistency and availability
- Durability and failures
- Excluded features

## Scope of a strong answer

Core requirements:

- Create isolated VPCs and subnets with private IPv4 addresses.
- Attach virtual machines and route packets within each VPC.
- Apply stateful security rules at virtual machine attachments.
- Distribute configuration changes without loss of tenant isolation.

Usually out of scope:

- Physical network design
- Virtual machine placement
- Internet gateways and NAT
- Connections between VPCs
- IPv6
- Compromised host software

## What interviewers probe

### Packet identity and isolation

Different tenants can use identical addresses. Every packet lookup must preserve the correct VPC identity despite hostile guest packets and stale host state.

### Rule and route changes

Hosts apply changes at different times. Old connection state can preserve access after a rule deletion, even when every host receives the new rules.

### Host and zone failures

A host without control contact can still send packets. The service must remove stale authority without treating lost contact as proof of shutdown.

### Large configuration changes

One change can affect 20,000 hosts. Repeated changes and host recovery can consume distribution capacity and delay unrelated tenants.

## Common mistakes

- The design trusts guest packet addresses as proof of tenant identity.
- The service reports a change as effective after it only commits the database row.
- The design treats an unreachable host as unable to send packets.
- The packet path queries a central database for every packet.
- The service keeps old connection permissions after a rule deletion becomes effective.
- The service reuses an address before the former owner loses authority.

## The bar by level

- **Senior:** Separates acceptance from enforcement. Defines acknowledgments, local atomic changes, connection revocation, and a safe recovery path. Calculates distribution load and prevents stale hosts from regaining authority.
- **Staff+:** States isolation invariants across packet, configuration, and attachment lifecycles. Proves bounded revocation under partitions and agent failure. Defines clock assumptions, reuse fences, tenant load limits, and zone recovery behavior.

Practice this question with an AI interviewer: https://sysround.com/practice/new?problem=virtual-private-cloud


---
SysRound (https://sysround.com) is an AI practice tool for system design interviews. It has a voice or typed AI interviewer and a shared whiteboard. At the end, you get feedback on each skill and a model answer. The AI feedback can be wrong.