Why Is the Database in a Private Subnet?
Your database sits in a private subnet with no route to the internet. What does that actually buy you — and what does it not?
Practical scenario
A review asks why the production database is in a private subnet when it already requires a password. The team has also just added a nightly job on the database host that needs to reach a third-party API.
What it tests
Answer it out loud first. The guide below stays closed until you ask for it, on purpose.
- Whether network boundaries are understood as a mechanism, not a slogan
- Whether the candidate knows what a private subnet does and does not prevent
- Whether defence in depth is separated from a single control
Reading a strong answer is not the same as producing one. Commit to what you would say, then compare.