Cloud engineer behavioural interview questions

As asked

Describe a production incident where a cloud infrastructure failure caused customer impact. What was your role, what did you do, and what did you change afterward?

Sample answer outline

Strong answers follow STAR: the situation with specific blast radius (how many customers, how long), the actions taken during the incident (detection, mitigation, communication), the root cause found in the postmortem, and concrete process or architecture changes that reduced recurrence probability. Interviewers look for ownership, technical accuracy, and learning orientation rather than blame.

Expect these follow-ups

• What would you do differently if you faced the same incident today?
• How did you communicate the incident to non-technical stakeholders during the outage?

As asked

Tell me about a time you identified and drove a meaningful reduction in cloud infrastructure costs. How did you find the opportunity and what was the outcome?

Sample answer outline

Candidate should quantify the saving (percentage or dollar amount), describe the discovery method (Cost Explorer, Trusted Advisor, rightsizing analysis), explain how they got buy-in from engineering or finance, and describe what guardrails were put in place so the cost did not creep back. Interviewers look for data-driven thinking and cross-functional communication, not just technical execution.

Expect these follow-ups

• How did you validate that the cost reduction did not degrade performance or reliability?
• Did you put any process in place to catch similar waste in the future?

As asked

Tell me about a time when a security requirement threatened to delay a launch and you had to navigate the tradeoff between the two.

Sample answer outline

A strong answer shows the candidate did not simply capitulate to either pressure: they quantified the security risk (likelihood and impact), proposed a time-bounded compensating control that allowed the launch, and committed to closing the gap within a defined window. Interviewers look for risk articulation, stakeholder communication, and follow-through on the remediation.

Expect these follow-ups

• How did you track the remediation to make sure it actually happened after launch?
• How do you decide when a security risk is acceptable to ship with versus a blocker?

As asked

Describe a significant infrastructure migration you led or were a key contributor to. What was the scope, what went wrong, and how did you keep it on track?

Sample answer outline

Candidate should describe the scale (number of services, teams involved, timeline), the planning approach (phased migration, dry runs, rollback plan), what unexpected issue arose mid-migration, and how they adapted. Interviewers want evidence of project management skill alongside technical depth, and the ability to handle ambiguity without stalling.

Expect these follow-ups

• How did you communicate progress and blockers to leadership during the migration?
• What would you do differently in the planning phase next time?

As asked

Have you ever tried to introduce or enforce infrastructure-as-code standards across teams that were not your own? How did you get adoption?

Sample answer outline

Candidate should describe the specific standard (module structure, naming convention, tagging enforcement), how they built the case (showing concrete problems the standard solves), the approach to adoption (working examples, office hours, golden-path templates), and how they measured uptake. Forcing standards via governance alone without making the good path easy rarely works.

Expect these follow-ups

• What would you do if a senior engineer on another team publicly resisted the standard?
• How do you handle a team that has legitimate reasons to deviate from the standard?

As asked

Tell me about a time when you joined or were on a cloud operations on-call rotation that was overwhelmed with noisy or manual alerts. What did you change?

Sample answer outline

Candidate should identify the root cause of on-call pain (alert volume, alert quality, missing runbooks, manual remediation steps), describe specific changes made (threshold tuning, composite alarms, runbook automation with SSM, better dashboards), and show before-and-after metrics (alerts per week, MTTR). Strong answers also mention psychological safety in postmortems.

Expect these follow-ups

• How did you decide which alerts to remove versus which to fix?
• How do you prevent alert quality from degrading again after initial cleanup?

As asked

Describe a time when you believed a proposed cloud architecture had a serious flaw and you pushed back on it. How did you make your case and what was the outcome?

Sample answer outline

Candidate should describe the proposed design and the specific flaw (single point of failure, cost trap, security hole, etc.), how they gathered evidence (data, Well-Architected principles, prior incidents), and how they presented the alternative constructively rather than just criticising. The outcome may have been that they were overruled and should be able to describe how they handled that too.

Expect these follow-ups

• What do you do when you raise a concern and it is overruled by someone more senior?
• How do you distinguish a legitimate difference of opinion from an actual architectural risk?

As asked

Describe a cloud tool or internal platform you built that measurably improved other engineers' ability to provision or operate cloud infrastructure. How did you measure the impact?

Sample answer outline

Candidate should describe the pain point solved (slow manual provisioning, inconsistent environments, no self-service), the solution (Terraform module library, account vending machine, internal dev portal), and how adoption and impact were measured (time to provision, number of teams using it, DORA metrics). Strong answers treat internal tools with the same product thinking as customer-facing ones.

Expect these follow-ups

• How did you gather requirements from the engineers who would use this tool?
• What did you cut from the initial scope and why?

As asked

Tell me about a time you identified significant cloud infrastructure technical debt, such as legacy manual provisioning, unmanaged resources, or ageing AMIs, that was causing operational pain. How did you prioritise addressing it alongside feature work?

Sample answer outline

Candidate should frame the debt in business terms (cost, reliability risk, developer velocity), show how they made it visible to stakeholders (incident frequency correlation, cost to maintain), and describe the negotiation for time to address it. Good answers show incrementalism: addressing the highest-risk debt first rather than requesting a full freeze on feature work.

Expect these follow-ups

• How do you avoid a situation where technical debt is perpetually deferred?
• How did you communicate the risk of not addressing the debt without being alarmist?

As asked

Describe a time you evaluated two or more cloud services or vendors for the same use case. How did you structure the evaluation and make the final recommendation?

Sample answer outline

Candidate should describe defining evaluation criteria upfront (cost, operational complexity, lock-in, performance, team familiarity), building a proof of concept for each option, involving the relevant stakeholders in the review, and writing a clear recommendation with the tradeoffs documented. Strong answers mention what they would revisit if the initial choice proves wrong.

Expect these follow-ups

• How do you handle a situation where the cheapest option is not the right choice?
• How do you account for vendor lock-in risk in your evaluation?

As asked

Describe a time you had to prepare AWS or cloud infrastructure for an external compliance audit (SOC 2, ISO 27001, PCI-DSS, or similar). What did you do and what surprised you?

Sample answer outline

Candidate should describe the compliance framework, the evidence collection process (CloudTrail logs, Config compliance reports, IAM access reviews), how they worked with security and legal, and what gaps they found and closed. A strong answer mentions the operationalisation after the audit to keep evidence collection continuous rather than point-in-time.

Expect these follow-ups

• How do you make compliance a continuous process rather than a fire drill before each audit?
• What is the most common finding you see in AWS environments during SOC 2 audits?

As asked

You arrive Monday morning to an alert that your AWS bill for Sunday was double the typical daily spend. You have no immediate idea what caused it. Walk me through your first 30 minutes.

Sample answer outline

Candidate should describe checking Cost Explorer by service, then by linked account and region to isolate the spike, then drilling into CloudTrail for CreateResource events in that time window. Common culprits: runaway EC2 Spot Fleet, data transfer spike, new NAT Gateway traffic, or a DDoS generating LB requests. Good answers also describe who they notify immediately and whether they set a Budget alert to catch future spikes.

Expect these follow-ups

• How would you isolate the cost to a specific team if you found it was in a shared account?
• What preventive control would you add after resolving this?

As asked

A colleague ran terraform state rm on the wrong resource and now Terraform shows a plan to create 30 resources that already exist. Production is running fine. What do you do?

Sample answer outline

Candidate should describe immediately locking the workspace to prevent further applies, restoring from the S3 bucket versioned state backup (S3 versioning is why you enable it), verifying the restored state with terraform plan to confirm 0 changes, and doing a blameless postmortem. If the backup predates other legitimate changes, they need to selectively terraform import the missing resources rather than restoring wholesale.

Expect these follow-ups

• What S3 bucket configuration ensures you always have a state backup?
• How do you prevent a terraform apply from running during this recovery period if others are working?

As asked

During a routine audit you find that a production EC2 security group has port 22 open to 0.0.0.0/0. The engineer who owns it is on holiday. What do you do?

Sample answer outline

Candidate should describe assessing the risk (how long has this been open, any sign of access in CloudTrail or VPC Flow Logs, is the instance publicly accessible), then closing the rule immediately without waiting for the owner since the risk is clear. They should notify the owner's manager and open a ticket. Strong answers mention checking whether there are other security groups with similar rules (Config rule, Security Hub control) to find the scope of the problem.

Expect these follow-ups

• What AWS-native control would have detected and alerted on this when it was created?
• How do you close the rule without risking breaking a legitimate SSH workflow?

As asked

AWS us-east-1 is experiencing a major outage affecting your primary deployment. Your CEO is asking for an ETA on recovery. What do you do in the first hour?

Sample answer outline

Candidate should distinguish between failing over to a secondary region (if DR architecture exists) versus waiting for AWS to recover. First steps: check AWS Service Health Dashboard and Status page, assess which customers are affected and communicate status honestly, evaluate whether failover to the secondary region is feasible given RTO/RPO, and what manual steps that failover requires. Strong answers note that if no DR exists, now is the wrong time to design one.

Expect these follow-ups

• How does having Route 53 health checks pre-configured change your response in the first hour?
• How do you communicate 'we don't have an ETA' to a CEO without losing their confidence?

As asked

A terraform plan on a stable production module suddenly shows 5 resource changes that no one made in code. How do you investigate and decide whether to apply?

Sample answer outline

Candidate should describe comparing the plan output against recent git commits to rule out code changes, then checking CloudTrail for manual console changes to those resources (drift), and using terraform show to compare current state with what terraform is proposing. If drift is confirmed, they should terraform import or update state to reflect reality rather than blindly applying the plan which may destroy the manual change.

Expect these follow-ups

• When would you terraform apply the drift changes versus terraform state override?
• How do you prevent manual console changes in production in the first place?

As asked

You get paged at 2 AM because Lambda invocations are timing out across multiple functions. P99 duration jumped from 200ms to 30 seconds in the last 15 minutes. What do you do?

Sample answer outline

Candidate should first check if a downstream dependency is the cause (RDS, DynamoDB, external API) by looking at X-Ray traces to find where time is spent. Also check if VPC-attached Lambdas lost connectivity (DNS resolution failure, security group change, subnet exhaustion). Immediate mitigation may be to increase Lambda timeout temporarily, but the real fix requires identifying the bottleneck. Candidate should also check if there was a recent deployment that changed the functions.

Expect these follow-ups

• How would you determine if the issue is in the Lambda itself versus a downstream service?
• What would VPC subnet exhaustion look like in Lambda metrics and how would you resolve it?

As asked

A team launched a new service last month. Their first AWS bill is 10 times the estimate they gave you. They had no budget alerts configured. How do you handle this conversation and what systemic changes do you make?

Sample answer outline

Candidate should describe getting the data first (Cost Explorer by service for that account), understanding what drove the overage (data transfer, NAT Gateway, over-provisioned instances) before the conversation, then presenting findings factually without blame. Systemic change: mandatory Budget alerts before any service goes live, FinOps tagging validation in CI/CD, and a cloud cost review at launch checklist.

Expect these follow-ups

• How do you make sure the team has the skills to estimate cloud costs before their next launch?
• What Budget alert configuration would you mandate going forward?

As asked

A CVE is published for the base AMI used by 50 production EC2 instances. The vendor has released a patched AMI. You need to roll out the patch with no more than 5 minutes of downtime per instance. Walk me through the plan.

Sample answer outline

Candidate should describe building and testing a new AMI with the patch using a golden AMI pipeline (Packer), updating the Launch Template with the new AMI version, and using an Auto Scaling Group instance refresh with a minHealthyPercentage of 80% so a small batch is replaced at a time. For instances not in an ASG, they should use SSM Run Command to apply the patch in-place where possible, or use an Instance Refresh analogue. Communication plan to stakeholders is also expected.

Expect these follow-ups

• How would you track which instances have been patched and which have not?
• How does Systems Manager Patch Manager automate this going forward?

As asked

Describe a production incident where a cloud infrastructure failure caused customer impact. What was your role, what did you do, and what did you change afterward?

Sample answer outline

Strong answers follow STAR: the situation with specific blast radius (how many customers, how long), the actions taken during the incident (detection, mitigation, communication), the root cause found in the postmortem, and concrete process or architecture changes that reduced recurrence probability. Interviewers look for ownership, technical accuracy, and learning orientation rather than blame.

Expect these follow-ups

• What would you do differently if you faced the same incident today?
• How did you communicate the incident to non-technical stakeholders during the outage?

As asked

Tell me about a time you identified and drove a meaningful reduction in cloud infrastructure costs. How did you find the opportunity and what was the outcome?

Sample answer outline

Candidate should quantify the saving (percentage or dollar amount), describe the discovery method (Cost Explorer, Trusted Advisor, rightsizing analysis), explain how they got buy-in from engineering or finance, and describe what guardrails were put in place so the cost did not creep back. Interviewers look for data-driven thinking and cross-functional communication, not just technical execution.

Expect these follow-ups

• How did you validate that the cost reduction did not degrade performance or reliability?
• Did you put any process in place to catch similar waste in the future?

As asked

Tell me about a time when a security requirement threatened to delay a launch and you had to navigate the tradeoff between the two.

Sample answer outline

A strong answer shows the candidate did not simply capitulate to either pressure: they quantified the security risk (likelihood and impact), proposed a time-bounded compensating control that allowed the launch, and committed to closing the gap within a defined window. Interviewers look for risk articulation, stakeholder communication, and follow-through on the remediation.

Expect these follow-ups

• How did you track the remediation to make sure it actually happened after launch?
• How do you decide when a security risk is acceptable to ship with versus a blocker?

As asked

Describe a significant infrastructure migration you led or were a key contributor to. What was the scope, what went wrong, and how did you keep it on track?

Sample answer outline

Candidate should describe the scale (number of services, teams involved, timeline), the planning approach (phased migration, dry runs, rollback plan), what unexpected issue arose mid-migration, and how they adapted. Interviewers want evidence of project management skill alongside technical depth, and the ability to handle ambiguity without stalling.

Expect these follow-ups

• How did you communicate progress and blockers to leadership during the migration?
• What would you do differently in the planning phase next time?

As asked

Have you ever tried to introduce or enforce infrastructure-as-code standards across teams that were not your own? How did you get adoption?

Sample answer outline

Candidate should describe the specific standard (module structure, naming convention, tagging enforcement), how they built the case (showing concrete problems the standard solves), the approach to adoption (working examples, office hours, golden-path templates), and how they measured uptake. Forcing standards via governance alone without making the good path easy rarely works.

Expect these follow-ups

• What would you do if a senior engineer on another team publicly resisted the standard?
• How do you handle a team that has legitimate reasons to deviate from the standard?

As asked

Tell me about a time when you joined or were on a cloud operations on-call rotation that was overwhelmed with noisy or manual alerts. What did you change?

Sample answer outline

Candidate should identify the root cause of on-call pain (alert volume, alert quality, missing runbooks, manual remediation steps), describe specific changes made (threshold tuning, composite alarms, runbook automation with SSM, better dashboards), and show before-and-after metrics (alerts per week, MTTR). Strong answers also mention psychological safety in postmortems.

Expect these follow-ups

• How did you decide which alerts to remove versus which to fix?
• How do you prevent alert quality from degrading again after initial cleanup?

As asked

Describe a time when you believed a proposed cloud architecture had a serious flaw and you pushed back on it. How did you make your case and what was the outcome?

Sample answer outline

Candidate should describe the proposed design and the specific flaw (single point of failure, cost trap, security hole, etc.), how they gathered evidence (data, Well-Architected principles, prior incidents), and how they presented the alternative constructively rather than just criticising. The outcome may have been that they were overruled and should be able to describe how they handled that too.

Expect these follow-ups

• What do you do when you raise a concern and it is overruled by someone more senior?
• How do you distinguish a legitimate difference of opinion from an actual architectural risk?

As asked

Describe a cloud tool or internal platform you built that measurably improved other engineers' ability to provision or operate cloud infrastructure. How did you measure the impact?

Sample answer outline

Candidate should describe the pain point solved (slow manual provisioning, inconsistent environments, no self-service), the solution (Terraform module library, account vending machine, internal dev portal), and how adoption and impact were measured (time to provision, number of teams using it, DORA metrics). Strong answers treat internal tools with the same product thinking as customer-facing ones.

Expect these follow-ups

• How did you gather requirements from the engineers who would use this tool?
• What did you cut from the initial scope and why?

As asked

Tell me about a time you identified significant cloud infrastructure technical debt, such as legacy manual provisioning, unmanaged resources, or ageing AMIs, that was causing operational pain. How did you prioritise addressing it alongside feature work?

Sample answer outline

Candidate should frame the debt in business terms (cost, reliability risk, developer velocity), show how they made it visible to stakeholders (incident frequency correlation, cost to maintain), and describe the negotiation for time to address it. Good answers show incrementalism: addressing the highest-risk debt first rather than requesting a full freeze on feature work.

Expect these follow-ups

• How do you avoid a situation where technical debt is perpetually deferred?
• How did you communicate the risk of not addressing the debt without being alarmist?

As asked

Describe a time you evaluated two or more cloud services or vendors for the same use case. How did you structure the evaluation and make the final recommendation?

Sample answer outline

Candidate should describe defining evaluation criteria upfront (cost, operational complexity, lock-in, performance, team familiarity), building a proof of concept for each option, involving the relevant stakeholders in the review, and writing a clear recommendation with the tradeoffs documented. Strong answers mention what they would revisit if the initial choice proves wrong.

Expect these follow-ups

• How do you handle a situation where the cheapest option is not the right choice?
• How do you account for vendor lock-in risk in your evaluation?

As asked

Describe a time you had to prepare AWS or cloud infrastructure for an external compliance audit (SOC 2, ISO 27001, PCI-DSS, or similar). What did you do and what surprised you?

Sample answer outline

Candidate should describe the compliance framework, the evidence collection process (CloudTrail logs, Config compliance reports, IAM access reviews), how they worked with security and legal, and what gaps they found and closed. A strong answer mentions the operationalisation after the audit to keep evidence collection continuous rather than point-in-time.

Expect these follow-ups

• How do you make compliance a continuous process rather than a fire drill before each audit?
• What is the most common finding you see in AWS environments during SOC 2 audits?

As asked

You arrive Monday morning to an alert that your AWS bill for Sunday was double the typical daily spend. You have no immediate idea what caused it. Walk me through your first 30 minutes.

Sample answer outline

Candidate should describe checking Cost Explorer by service, then by linked account and region to isolate the spike, then drilling into CloudTrail for CreateResource events in that time window. Common culprits: runaway EC2 Spot Fleet, data transfer spike, new NAT Gateway traffic, or a DDoS generating LB requests. Good answers also describe who they notify immediately and whether they set a Budget alert to catch future spikes.

Expect these follow-ups

• How would you isolate the cost to a specific team if you found it was in a shared account?
• What preventive control would you add after resolving this?

As asked

A colleague ran terraform state rm on the wrong resource and now Terraform shows a plan to create 30 resources that already exist. Production is running fine. What do you do?

Sample answer outline

Candidate should describe immediately locking the workspace to prevent further applies, restoring from the S3 bucket versioned state backup (S3 versioning is why you enable it), verifying the restored state with terraform plan to confirm 0 changes, and doing a blameless postmortem. If the backup predates other legitimate changes, they need to selectively terraform import the missing resources rather than restoring wholesale.

Expect these follow-ups

• What S3 bucket configuration ensures you always have a state backup?
• How do you prevent a terraform apply from running during this recovery period if others are working?

As asked

During a routine audit you find that a production EC2 security group has port 22 open to 0.0.0.0/0. The engineer who owns it is on holiday. What do you do?

Sample answer outline

Candidate should describe assessing the risk (how long has this been open, any sign of access in CloudTrail or VPC Flow Logs, is the instance publicly accessible), then closing the rule immediately without waiting for the owner since the risk is clear. They should notify the owner's manager and open a ticket. Strong answers mention checking whether there are other security groups with similar rules (Config rule, Security Hub control) to find the scope of the problem.

Expect these follow-ups

• What AWS-native control would have detected and alerted on this when it was created?
• How do you close the rule without risking breaking a legitimate SSH workflow?

As asked

AWS us-east-1 is experiencing a major outage affecting your primary deployment. Your CEO is asking for an ETA on recovery. What do you do in the first hour?

Sample answer outline

Candidate should distinguish between failing over to a secondary region (if DR architecture exists) versus waiting for AWS to recover. First steps: check AWS Service Health Dashboard and Status page, assess which customers are affected and communicate status honestly, evaluate whether failover to the secondary region is feasible given RTO/RPO, and what manual steps that failover requires. Strong answers note that if no DR exists, now is the wrong time to design one.

Expect these follow-ups

• How does having Route 53 health checks pre-configured change your response in the first hour?
• How do you communicate 'we don't have an ETA' to a CEO without losing their confidence?

As asked

A terraform plan on a stable production module suddenly shows 5 resource changes that no one made in code. How do you investigate and decide whether to apply?

Sample answer outline

Candidate should describe comparing the plan output against recent git commits to rule out code changes, then checking CloudTrail for manual console changes to those resources (drift), and using terraform show to compare current state with what terraform is proposing. If drift is confirmed, they should terraform import or update state to reflect reality rather than blindly applying the plan which may destroy the manual change.

Expect these follow-ups

• When would you terraform apply the drift changes versus terraform state override?
• How do you prevent manual console changes in production in the first place?

As asked

You get paged at 2 AM because Lambda invocations are timing out across multiple functions. P99 duration jumped from 200ms to 30 seconds in the last 15 minutes. What do you do?

Sample answer outline

Candidate should first check if a downstream dependency is the cause (RDS, DynamoDB, external API) by looking at X-Ray traces to find where time is spent. Also check if VPC-attached Lambdas lost connectivity (DNS resolution failure, security group change, subnet exhaustion). Immediate mitigation may be to increase Lambda timeout temporarily, but the real fix requires identifying the bottleneck. Candidate should also check if there was a recent deployment that changed the functions.

Expect these follow-ups

• How would you determine if the issue is in the Lambda itself versus a downstream service?
• What would VPC subnet exhaustion look like in Lambda metrics and how would you resolve it?

As asked

A team launched a new service last month. Their first AWS bill is 10 times the estimate they gave you. They had no budget alerts configured. How do you handle this conversation and what systemic changes do you make?

Sample answer outline

Candidate should describe getting the data first (Cost Explorer by service for that account), understanding what drove the overage (data transfer, NAT Gateway, over-provisioned instances) before the conversation, then presenting findings factually without blame. Systemic change: mandatory Budget alerts before any service goes live, FinOps tagging validation in CI/CD, and a cloud cost review at launch checklist.

Expect these follow-ups

• How do you make sure the team has the skills to estimate cloud costs before their next launch?
• What Budget alert configuration would you mandate going forward?

As asked

A CVE is published for the base AMI used by 50 production EC2 instances. The vendor has released a patched AMI. You need to roll out the patch with no more than 5 minutes of downtime per instance. Walk me through the plan.

Sample answer outline

Candidate should describe building and testing a new AMI with the patch using a golden AMI pipeline (Packer), updating the Launch Template with the new AMI version, and using an Auto Scaling Group instance refresh with a minHealthyPercentage of 80% so a small batch is replaced at a time. For instances not in an ASG, they should use SSM Run Command to apply the patch in-place where possible, or use an Instance Refresh analogue. Communication plan to stakeholders is also expected.

Expect these follow-ups

• How would you track which instances have been patched and which have not?
• How does Systems Manager Patch Manager automate this going forward?