Cloud engineer role-specific interview questions

As asked

You inherit a cloud estate where every team uses admin-like roles in a shared account. How would you redesign access without blocking delivery?

Sample answer outline

Start by separating environments and blast radii: production from non-production, shared platform from application accounts, and human access from workload identity. Define roles around actions people actually need, then enforce least privilege with permission boundaries, short-lived credentials, and break-glass access that is audited. Use infrastructure-as-code and policy-as-code so access changes are reviewed, repeatable, and testable. Strong answers mention migration sequencing because cutting everyone over in one move usually breaks deployments. Candidates often trip up by describing perfect IAM theory without a path from the current unsafe state.

Expect these follow-ups

• How do you handle a senior engineer who insists they need admin for debugging?
• Where would you use service control policies or organisation policies?
• What audit signals tell you the new model is working?

As asked

Traffic to your public service suddenly starts routing through an unexpected provider and latency triples. How would you investigate and respond to a possible BGP route leak?

Sample answer outline

Start with external visibility: route collectors, looking glasses, RPKI status, traceroutes from multiple regions, and provider status channels. Confirm whether your prefixes are being originated or propagated incorrectly, then work with upstream providers to filter or withdraw bad routes. Ensure your own route objects, ROAs, prefix filters, and max-prefix limits are correct before blaming the internet. Mitigate user impact with traffic engineering, alternate providers, or CDN routing where available. Candidates should understand that BGP convergence and provider coordination are operational realities, not instant local fixes.

Expect these follow-ups

• How does RPKI help, and what does it not prevent?
• What prefix filtering would you expect from a responsible upstream?
• How would you communicate customer impact during a routing incident?

As asked

Two engineers run terraform apply at the same time against the same workspace. Walk me through exactly what happens, what breaks, and how you prevent this in a team setup.

Sample answer outline

Candidate should describe the state lock mechanism (DynamoDB for S3 backends), the .terraform.lock.hcl file versus the state lock, what happens on a crash (stale lock ID in DynamoDB), and the terraform force-unlock command. Team-level prevention involves remote backends with locking, CI/CD pipeline serialisation, and per-environment workspaces or directories.

Expect these follow-ups

• How do you handle state drift when someone makes a manual change in the console?
• What does terraform refresh actually do and when is it dangerous?

As asked

A Node.js Lambda function behind an API Gateway is timing out intermittently, always on the first call after a quiet period. How do you diagnose and reduce cold start latency?

Sample answer outline

Good answers distinguish init duration in X-Ray traces from actual handler duration. A common misconception is that VPC-attached Lambda cold starts are significantly slower due to ENI creation; AWS fixed this in 2019 with Hyperplane ENIs, so VPC attachment no longer adds seconds to cold starts. The real cold start drivers are: package size (larger deployment zip means longer download and initialisation), heavy SDK initialisation inside the handler, and the Lambda runtime itself. Provisioned concurrency is the definitive fix for latency-sensitive paths. Candidate should also mention moving SDK clients and DB connections outside the handler so they are reused across warm invocations, and the cost tradeoff of provisioned concurrency versus the response time SLA.

Expect these follow-ups

• How does Lambda SnapStart for Java change this equation?
• What happens to provisioned concurrency during a deployment?

As asked

Explain the difference between a security group and a network ACL in AWS. Give me a concrete scenario where you would reach for a NACL that a security group cannot solve.

Sample answer outline

Candidate must distinguish stateful (security group) versus stateless (NACL) evaluation, subnet-level versus ENI-level attachment, and that NACLs support explicit deny rules. The concrete scenario should be something like blocking a specific IP range at the subnet boundary as an emergency response, since security groups cannot explicitly deny and apply only to attached resources, not the whole subnet.

Expect these follow-ups

• What happens to an established TCP connection when you add a deny rule to a NACL?
• Can you apply a security group to an entire subnet?

As asked

A Lambda in account A needs to read from an S3 bucket in account B. Walk me through the exact IAM configuration needed in both accounts.

Sample answer outline

Candidate should describe creating a role in account B with a trust policy allowing account A's Lambda execution role to assume it, attaching an S3 read policy to the role in B, and in the Lambda code using sts:AssumeRole to get temporary credentials before calling S3. Also mention the bucket policy in account B may need to allow the assumed role if the bucket is not owned by B's account, and session tags for auditing.

Expect these follow-ups

• What is the maximum duration for an assumed role session?
• How does sts:AssumeRoleWithWebIdentity differ from sts:AssumeRole?

As asked

Your monthly cloud forecast jumps by 45 percent over a weekend. What do you check first, and how do you stop it happening again?

Sample answer outline

Break the bill down by service, region, account, tag, and usage type before guessing. Common causes are runaway data transfer, NAT gateway traffic, oversized compute, forgotten test clusters, log ingestion, or a warehouse job scanning far more data than expected. Stop the bleeding with quotas, budgets, anomaly alerts, and temporary scaling caps where they are safe. Then fix ownership: mandatory tags, showback or chargeback, and pull-request visibility for expensive infrastructure changes. The interviewer wants pragmatism, not just 'buy savings plans', because commitments can lock in waste.

Expect these follow-ups

• Which cost category is hardest to allocate back to a team?
• When do savings plans make the problem worse?
• How would you explain this incident to finance without hiding the engineering details?

As asked

Two VPCs you need to peer have overlapping CIDR ranges. What options do you have, and what are the tradeoffs of each?

Sample answer outline

Strong answers cover VPC re-addressing (destructive, requires recreating resources), using a transit VPC or AWS Transit Gateway with NAT in the middle, or rewriting traffic via a proxy layer. Candidate should explain why VPC peering itself has no built-in NAT and what the packet routing implications are at each hop.

Expect these follow-ups

• How does Transit Gateway handle route tables differently from VPC peering?
• Would PrivateLink solve this and when would you choose it instead?

As asked

You inherit an AWS account where most IAM roles were given broad permissions years ago. How do you systematically move to least privilege without breaking production?

Sample answer outline

Candidate should mention AWS IAM Access Analyzer to identify unused permissions, using CloudTrail + Athena to query actual API call history, generating least-privilege policies with IAM policy generation, and a phased rollout using permissions boundaries. A good answer also covers using SCPs in AWS Organizations as guardrails before touching individual role policies.

Expect these follow-ups

• What is the difference between a permission boundary and an SCP?
• How would you handle service-linked roles in this audit?

As asked

An S3 bucket holds 200 TB of mixed objects: logs older than 90 days, versioned assets, and rarely accessed analytics outputs. How do you design lifecycle policies to meaningfully reduce cost without data loss?

Sample answer outline

Candidate should map object age and access patterns to storage classes (Standard, Intelligent-Tiering, Standard-IA, Glacier Instant Retrieval, Glacier Deep Archive), explain that Glacier transitions have minimum storage duration charges, and address versioning separately (expiring noncurrent versions). A strong answer also covers S3 Storage Lens to understand access patterns before committing to a policy.

Expect these follow-ups

• What is the minimum object size that benefits from Standard-IA?
• How do you handle multipart upload cleanup in lifecycle?

As asked

You need to upgrade an EKS managed node group from Kubernetes 1.28 to 1.29 during business hours. How do you do it with zero downtime for running workloads?

Sample answer outline

Strong answer covers the upgrade order (control plane first, then node groups), using managed node group rolling updates with maxUnavailable, checking PodDisruptionBudgets are in place on all critical deployments, and confirming the add-ons (CoreDNS, kube-proxy, VPC CNI) are compatible with the target version before starting. Mention surge upgrades if PDPs are too restrictive.

Expect these follow-ups

• How do you verify that the VPC CNI is compatible before upgrading?
• What is the difference between a managed node group update and a self-managed one?

As asked

Your team runs 20 deploys a day and does a full wildcard cache invalidation after each one. Finance just flagged the CloudFront bill. What do you change and why?

Sample answer outline

Candidate should quantify the issue: AWS charges for invalidations beyond 1000 paths per month, so wildcard /* counts as one path but repeated invocations add up. The fix is cache busting via versioned asset filenames so invalidations are never needed for static assets. For HTML, targeted path invalidations rather than wildcard are cheaper, and origin shield reduces the blast radius of cache misses.

Expect these follow-ups

• How does Cache-Control max-age interact with CloudFront TTL settings?
• When would you use a Lambda@Edge function to handle versioning instead?

As asked

A team reports that their RDS Postgres read replica is consistently 30 to 60 seconds behind the primary during business hours. How do you investigate and what are the likely fixes?

Sample answer outline

Good answers check ReplicaLag in CloudWatch, look at the primary's write IOPS versus the replica's IOPS throughput, and understand that RDS read replicas always use physical streaming replication, not logical replication. High write volume on the primary can saturate the replica's single-threaded WAL apply process. Solutions include right-sizing the replica instance to match the primary's IOPS capacity, upgrading to Postgres 16 which introduced parallel WAL apply for physical replicas, or moving to Aurora Postgres which uses shared distributed storage and has no replication lag between writer and readers. Application-side mitigation is routing only truly read-only queries to the replica and accepting stale reads where the business permits.

Expect these follow-ups

• How does Aurora Postgres handle replica lag differently from RDS Postgres?
• What application-side change would help if you cannot fix lag quickly?

As asked

Your team maintains a shared VPC Terraform module used by 15 other teams. You need to make a breaking change to the module's interface. How do you handle this across a large org?

Sample answer outline

Candidate should describe semantic versioning in module source references (Git tags), publishing v2.0.0 alongside v1.x without removing the old tag, writing a migration guide, and using a mono-repo module registry or Terraform Cloud private module registry. A strong answer also mentions using variable defaults to make the new interface backward compatible where possible, and running terraform plan in each consumer's CI before deprecating v1.

Expect these follow-ups

• How does Terraform Cloud's private module registry differ from a public one?
• How would you automate discovery of which teams are pinned to the old version?

As asked

Finance wants per-team AWS cost breakdowns. You have 50 teams, 6 accounts, and very inconsistent tagging. How do you fix this and what do you put in place to prevent drift?

Sample answer outline

Candidate should define a mandatory tag taxonomy (team, environment, service, cost-centre), use AWS Config rules or tag policies in AWS Organizations to enforce tags on resource creation, activate cost allocation tags in Billing, and use Cost Explorer or a third-party tool like Cloudability for reporting. Prevention involves SCP denying resource creation without required tags and CI/CD pipeline tag validation in Terraform plans.

Expect these follow-ups

• Can an SCP enforce tagging on all resource types?
• How do you retroactively tag untagged resources without causing downtime?

As asked

A CloudWatch alarm on Lambda error rate is triggering and resolving every few minutes, generating alert fatigue. What causes this and how do you fix it?

Sample answer outline

Candidate should explain evaluation periods and datapoints-to-alarm versus datapoints-to-resolve asymmetry (e.g., require 3-of-3 periods to alarm but only 1-of-3 to resolve), the missing data treatment option, and composite alarms to suppress noise. Also worth mentioning anomaly detection bands as an alternative to static thresholds for bursty Lambda workloads.

Expect these follow-ups

• What does 'treat missing data as not breaching' do to your alarm during a Lambda outage?
• How would you use a composite alarm to combine multiple Lambda signals?

As asked

Explain how GCP Shared VPC works, who controls what, and what problems it solves that project-level VPCs do not.

Sample answer outline

Candidate should explain the host project owning the VPC and subnets, service projects attaching to subnets and deploying VMs/GKE into them, and that IAM on the host project controls network admin. This solves the problem of network sprawl when each project has its own VPC and needs peering meshes. Strong answers also note the limitation that Shared VPC does not extend across organisations.

Expect these follow-ups

• How do firewall rules work in a Shared VPC context?
• What is the difference between Shared VPC and VPC Peering in GCP?

As asked

Your security team wants to guarantee that no Azure Storage Account in any subscription has a public endpoint. How do you enforce and audit this using Azure native tooling?

Sample answer outline

Candidate should describe creating an Azure Policy definition with effect 'Deny' on Microsoft.Storage/storageAccounts where allowBlobPublicAccess is true, assigning it at the Management Group scope, and using Compliance view to audit existing non-compliant resources. A strong answer also mentions remediation tasks for existing resources and the difference between Deny and DeployIfNotExists effects.

Expect these follow-ups

• What is the difference between the Audit and Deny effects in Azure Policy?
• How does a remediation task differ from a DeployIfNotExists policy?

As asked

You need to bring a manually created VPC and 12 subnets under Terraform management without destroying and recreating them. How do you do this safely?

Sample answer outline

Candidate should walk through writing resource blocks matching the existing configuration, running terraform import for each resource ID, then running terraform plan to check for drift and fixing differences before ever running apply. A strong answer mentions the terraform import block in Terraform 1.5+ as a cleaner alternative and the risk of terraform plan showing unwanted changes due to computed fields.

Expect these follow-ups

• What does terraform plan show immediately after an import if your config is slightly wrong?
• How does the new 'import' block in Terraform 1.5 improve on the old CLI import command?

As asked

You are asked to run a Well-Architected review for the Cost Optimisation pillar on a production workload. Walk me through the process and the top three things you look for first.

Sample answer outline

Candidate should mention the AWS Well-Architected Tool in the console, the structured questionnaire approach, and describe the five cost pillar areas: practice cloud financial management, expenditure awareness, cost-effective resources, managing demand and supply, and optimising over time. Top three to look for first: right-sizing (Compute Optimizer recommendations), purchasing model (on-demand vs Reserved vs Savings Plans), and idle/unattached resources (unattached EBS volumes, idle load balancers).

Expect these follow-ups

• What is the difference between an EC2 Instance Savings Plan and a Compute Savings Plan?
• How do you present a Well-Architected review report to non-technical stakeholders?

As asked

You need to process an event by dispatching it to 10 different downstream consumers, each with independent retry logic and dead-letter handling. How do you design this on AWS?

Sample answer outline

Candidate should describe the SNS-to-SQS fan-out pattern: one SNS topic, 10 SQS subscriptions, each queue backed by its own Lambda with a DLQ. Key points: individual consumer failures do not affect others, SQS visibility timeout must exceed Lambda max duration, and DLQs need alerting. A strong answer also mentions filter policies on SNS subscriptions to avoid delivering irrelevant events.

Expect these follow-ups

• What happens to a message that exceeds the SQS maxReceiveCount?
• When would you use EventBridge instead of SNS for this pattern?

As asked

Your ML training job runs on Spot instances and occasionally gets interrupted mid-run. How do you architect the job to handle interruptions gracefully and resume efficiently?

Sample answer outline

Candidate should describe polling the instance metadata service for the 2-minute interruption notice, checkpointing model state to S3 or EFS at regular intervals, using an SQS queue for work items so the interrupted item re-enters the queue after visibility timeout, and using Spot Fleet or Auto Scaling with capacity rebalancing. A strong answer also mentions Spot placement diversity across instance families to reduce correlated interruptions.

Expect these follow-ups

• What is the difference between Spot Fleet and EC2 Fleet?
• How does capacity rebalancing differ from the 2-minute interruption notice?

As asked

Security alerts you that an EC2 instance is sending unusual outbound traffic. You have VPC Flow Logs enabled. How do you investigate and what do you look for?

Sample answer outline

Candidate should describe querying VPC Flow Logs in CloudWatch Insights or Athena, filtering by source ENI and action ACCEPT, looking at destination IPs and ports for anomalies, correlating with GuardDuty findings, and checking for large byte counts to non-standard destinations. Strong answers also mention isolating the instance by modifying its security group to block all outbound while the investigation runs.

Expect these follow-ups

• VPC Flow Logs do not capture packet payloads. What tool would you layer on top if you needed payload inspection?
• How long does it take for VPC Flow Logs to appear in CloudWatch after a connection?

As asked

A project has been using local state for 6 months and has 80+ resources. How do you migrate to a remote S3 backend with DynamoDB locking without losing state or causing drift?

Sample answer outline

Candidate should walk through adding the backend block to main.tf, running terraform init which detects the backend change and prompts to migrate state, confirming the migration, and verifying the remote state file appears in S3. They should stress taking a manual backup of terraform.tfstate before starting and running terraform plan immediately after to confirm zero changes. Mention that team members must re-run init to pull from the new backend.

Expect these follow-ups

• What happens if you run terraform plan before other team members have re-initialised after the backend change?
• How do you encrypt state at rest in S3?

As asked

When would you terminate TLS at the ALB versus configure end-to-end TLS all the way to your EC2 instances? What are the operational costs of each approach?

Sample answer outline

Candidate should explain that ALB termination simplifies certificate management (ACM does rotation) and reduces CPU on instances but means traffic is plaintext inside the VPC. End-to-end TLS is required for compliance regimes (PCI-DSS, HIPAA) where plaintext inside the VPC is not acceptable. Operational cost of end-to-end includes managing certs on every instance, handling rotation, and the CPU overhead of TLS on the backend.

Expect these follow-ups

• Can you use ACM certificates on EC2 instances directly?
• What is the purpose of the ALB ALPN policy when doing end-to-end TLS?