How do I approach System Design interview questions?

System Design questions require understanding of core concepts and practice. PracHub provides solutions with explanations to help you master system design interviews.

What difficulty level is this interview question?

This is a hard difficulty System Design question, commonly asked during Technical Screen rounds at Amazon.

What role is this question designed for?

This question is commonly asked for Software Engineer candidates at Amazon during technical interviews.

Design secure multi-tier cloud infrastructure

Quick Overview

This question evaluates cloud systems design competencies including multi-tier network architecture, IP addressing and capacity planning, security controls, centralized server management, shared storage trade-offs, and identity and access integration within a production-scale virtual private cloud.

System Design: Multi-tier VPC Architecture for a Large-Scale Application

You are designing and deploying a production-ready, multi-tier network on AWS for an internet-facing application with thousands of servers. Assume three or more Availability Zones (AZs) in one Region and typical tiers: web, application, and database.

Address the following:

Network Segmentation and Access
- Design multi-layer segmentation (web/app/db) across multiple AZs using subnets and route tables.
- Show how public vs. private subnets, NAT gateways, and optional bastion hosts are used.
- Explain how you would use Security Groups vs. Network ACLs and why.
IP Address Planning (≥ 2,000 servers)
- Choose a VPC CIDR and per-subnet CIDRs.
- Account for per-subnet reserved IPs, plan headroom for growth, and distribute across at least three AZs.
- Show calculations and present one concrete, feasible plan with explicit CIDR blocks.
Centralized Server Management (Linux and Windows)
- Compare approaches for patching, configuration management, inventory, and remote sessions: AWS Systems Manager, Active Directory/Group Policy, and tools like Ansible/Salt.
- Recommend a combined approach and justify it.
Shared Storage for Concurrent Access
- Compare NFS on EC2, Amazon EFS, SMB/FSx options, and object storage gateways.
- Discuss consistency/locking semantics, throughput/IOPS scaling, latency, and cost trade-offs.
- Recommend options for Linux and Windows workloads.
Single Sign-On for Administrators
- Design "log in once" for server and console access using SSO (SAML/OIDC), MFA, short-lived credentials (e.g., SSM Session Manager/Kerberos), RBAC, auditing, and break-glass procedures.
- Provide concrete services and controls to implement this.

Quick Overview

System Design: Multi-tier VPC Architecture for a Large-Scale Application

Address the following:

Network Segmentation and Access

Design multi-layer segmentation (web/app/db) across multiple AZs using subnets and route tables.
Show how public vs. private subnets, NAT gateways, and optional bastion hosts are used.
Explain how you would use Security Groups vs. Network ACLs and why.

IP Address Planning (≥ 2,000 servers)

Choose a VPC CIDR and per-subnet CIDRs.
Account for per-subnet reserved IPs, plan headroom for growth, and distribute across at least three AZs.
Show calculations and present one concrete, feasible plan with explicit CIDR blocks.

Centralized Server Management (Linux and Windows)

Compare approaches for patching, configuration management, inventory, and remote sessions: AWS Systems Manager, Active Directory/Group Policy, and tools like Ansible/Salt.
Recommend a combined approach and justify it.

Shared Storage for Concurrent Access

Compare NFS on EC2, Amazon EFS, SMB/FSx options, and object storage gateways.
Discuss consistency/locking semantics, throughput/IOPS scaling, latency, and cost trade-offs.
Recommend options for Linux and Windows workloads.

Single Sign-On for Administrators

Design "log in once" for server and console access using SSO (SAML/OIDC), MFA, short-lived credentials (e.g., SSM Session Manager/Kerberos), RBAC, auditing, and break-glass procedures.
Provide concrete services and controls to implement this.

Design secure multi-tier cloud infrastructure

Quick Overview

System Design: Multi-tier VPC Architecture for a Large-Scale Application

Solution

Submit Your Answer to Earn 20XP

Design secure multi-tier cloud infrastructure

Quick Overview

System Design: Multi-tier VPC Architecture for a Large-Scale Application

Solution

Submit Your Answer to Earn 20XP