An internet gateway gives a subnet two way internet reachability, so resources with public addresses can be reached from outside. A NAT gateway gives private subnets outbound only internet access, and charges per gigabyte processed. A VPC endpoint keeps traffic to cloud services on the provider network entirely, so it never touches the internet or NAT; gateway endpoints for object and key value storage are free, interface endpoints bill hourly plus data.
Why interviewers ask this
This separates people who have built networks from people who have only consumed them. The interviewer is checking that you understand the direction of connectivity and the cost model, since NAT data processing charges are one of the biggest surprise line items on a cloud bill. Knowing that endpoints both save money and remove an internet path is the answer they want.
How to structure your answer
- Define each one by the direction of traffic it enables.
- Attach the cost model to each, especially NAT per gigabyte.
- Explain what endpoints buy beyond cost, namely no internet path.
- Give an example of when you would use each.
Example answer
An internet gateway is the door in both directions: attach it, give a subnet a route, and resources with public addresses can be reached from the internet and reach out. That is where a public load balancer lives. A NAT gateway is outbound only, so instances in private subnets can pull packages or call an external API but nothing can initiate a connection to them. It is managed and highly available, but you pay both an hourly rate and a per gigabyte processing charge, and that processing charge is a classic bill surprise once a service starts moving real volume. A VPC endpoint is different in kind: instead of going out to the internet to reach a cloud service, traffic stays on the provider's network. Gateway endpoints for object storage and the key value store cost nothing and immediately remove that traffic from your NAT bill, so I add them by default. Interface endpoints cost per hour per zone, so I add those selectively where the data volume or the compliance requirement justifies it.
Walking into this interview soon? GhostPilot listens to your live call, spots the question the moment it is asked, and puts a structured answer on your screen in real time. Try it on your next mock, or grab a $29 Session Pass, no subscription, for the real thing.
See how it worksFollow-up questions to expect
- How would you cut NAT gateway costs for a data heavy workload?
- How do you restrict an endpoint so only your VPC can use a given bucket?
- What breaks if you attach an internet gateway but keep private addressing?
Related cloud engineer questions
Your interviewer will ask their own version of this. Paste your actual job description into the free Question Predictor and get the 20 questions that role is most likely to ask, with what each one is really probing.
Predict my questions