Cloud engineer interview questions

As asked

Your company has 80 engineering teams and every team deploys services differently. How would you design a self-service platform that standardises the paved road?

Sample answer outline

Start with the most common service path: repository template, CI pipeline, container build, deployment, secrets, observability, and rollback. The platform should expose simple self-service APIs or portals while hiding Kubernetes, cloud IAM, and network details where possible. Strong answers balance golden paths with escape hatches, because forcing every workload into one shape creates shadow platforms. Adoption depends on migration support, clear docs, sensible defaults, and measuring developer lead time, failure rate, and support burden. The common mistake is building a portal before standardising the underlying runtime contracts.

Expect these follow-ups

• What should be configurable and what should be fixed?
• How do you migrate the first 20 teams?
• What metric proves the platform is helping rather than adding process?

As asked

You inherit a cloud estate where every team uses admin-like roles in a shared account. How would you redesign access without blocking delivery?

Sample answer outline

Start by separating environments and blast radii: production from non-production, shared platform from application accounts, and human access from workload identity. Define roles around actions people actually need, then enforce least privilege with permission boundaries, short-lived credentials, and break-glass access that is audited. Use infrastructure-as-code and policy-as-code so access changes are reviewed, repeatable, and testable. Strong answers mention migration sequencing because cutting everyone over in one move usually breaks deployments. Candidates often trip up by describing perfect IAM theory without a path from the current unsafe state.

Expect these follow-ups

• How do you handle a senior engineer who insists they need admin for debugging?
• Where would you use service control policies or organisation policies?
• What audit signals tell you the new model is working?

As asked

Traffic to your public service suddenly starts routing through an unexpected provider and latency triples. How would you investigate and respond to a possible BGP route leak?

Sample answer outline

Start with external visibility: route collectors, looking glasses, RPKI status, traceroutes from multiple regions, and provider status channels. Confirm whether your prefixes are being originated or propagated incorrectly, then work with upstream providers to filter or withdraw bad routes. Ensure your own route objects, ROAs, prefix filters, and max-prefix limits are correct before blaming the internet. Mitigate user impact with traffic engineering, alternate providers, or CDN routing where available. Candidates should understand that BGP convergence and provider coordination are operational realities, not instant local fixes.

Expect these follow-ups

• How does RPKI help, and what does it not prevent?
• What prefix filtering would you expect from a responsible upstream?
• How would you communicate customer impact during a routing incident?

As asked

Two engineers run terraform apply at the same time against the same workspace. Walk me through exactly what happens, what breaks, and how you prevent this in a team setup.

Sample answer outline

Candidate should describe the state lock mechanism (DynamoDB for S3 backends), the .terraform.lock.hcl file versus the state lock, what happens on a crash (stale lock ID in DynamoDB), and the terraform force-unlock command. Team-level prevention involves remote backends with locking, CI/CD pipeline serialisation, and per-environment workspaces or directories.

Expect these follow-ups

• How do you handle state drift when someone makes a manual change in the console?
• What does terraform refresh actually do and when is it dangerous?

As asked

A Node.js Lambda function behind an API Gateway is timing out intermittently, always on the first call after a quiet period. How do you diagnose and reduce cold start latency?

Sample answer outline

Good answers distinguish init duration in X-Ray traces from actual handler duration. A common misconception is that VPC-attached Lambda cold starts are significantly slower due to ENI creation; AWS fixed this in 2019 with Hyperplane ENIs, so VPC attachment no longer adds seconds to cold starts. The real cold start drivers are: package size (larger deployment zip means longer download and initialisation), heavy SDK initialisation inside the handler, and the Lambda runtime itself. Provisioned concurrency is the definitive fix for latency-sensitive paths. Candidate should also mention moving SDK clients and DB connections outside the handler so they are reused across warm invocations, and the cost tradeoff of provisioned concurrency versus the response time SLA.

Expect these follow-ups

• How does Lambda SnapStart for Java change this equation?
• What happens to provisioned concurrency during a deployment?

As asked

Explain the difference between a security group and a network ACL in AWS. Give me a concrete scenario where you would reach for a NACL that a security group cannot solve.

Sample answer outline

Candidate must distinguish stateful (security group) versus stateless (NACL) evaluation, subnet-level versus ENI-level attachment, and that NACLs support explicit deny rules. The concrete scenario should be something like blocking a specific IP range at the subnet boundary as an emergency response, since security groups cannot explicitly deny and apply only to attached resources, not the whole subnet.

Expect these follow-ups

• What happens to an established TCP connection when you add a deny rule to a NACL?
• Can you apply a security group to an entire subnet?