Cloud engineer system design interview questions

As asked

Your company has 80 engineering teams and every team deploys services differently. How would you design a self-service platform that standardises the paved road?

Sample answer outline

Start with the most common service path: repository template, CI pipeline, container build, deployment, secrets, observability, and rollback. The platform should expose simple self-service APIs or portals while hiding Kubernetes, cloud IAM, and network details where possible. Strong answers balance golden paths with escape hatches, because forcing every workload into one shape creates shadow platforms. Adoption depends on migration support, clear docs, sensible defaults, and measuring developer lead time, failure rate, and support burden. The common mistake is building a portal before standardising the underlying runtime contracts.

Expect these follow-ups

• What should be configurable and what should be fixed?
• How do you migrate the first 20 teams?
• What metric proves the platform is helping rather than adding process?

As asked

Design isolation for an internal developer platform where hundreds of services share Kubernetes clusters and cloud accounts.

Sample answer outline

Use multiple layers of isolation: namespaces, RBAC, network policies, resource quotas, admission controls, workload identity, and separate accounts or clusters for higher-risk environments. A strong answer explains the difference between soft tenancy for ordinary services and hard isolation for regulated, privileged, or noisy workloads. They should discuss blast radius, auditability, cost allocation, and how platform defaults are enforced through policy-as-code. The design should include safe escape hatches because some workloads will not fit the default. A common miss is relying only on Kubernetes namespaces and ignoring cloud IAM or network egress.

Expect these follow-ups

• Which workloads deserve their own cluster?
• How do you prevent one team from exhausting shared cluster capacity?
• What policy would you enforce at admission time?

As asked

A company wants all application traffic to managed databases and internal APIs to stay off the public internet. Walk me through the cloud networking design.

Sample answer outline

Use private subnets for workloads and private endpoints or PrivateLink-style services for managed databases and vendor APIs that support it. Route outbound internet access through controlled egress points, not from every workload subnet, and restrict security groups or firewall rules by service identity and port. DNS matters: the application should resolve the same service name to a private address inside the VPC or VNet. Discuss overlapping CIDRs, peering limits, transit gateways, and how this changes across AWS, Azure, and GCP. Weak answers often say 'use a VPN' without addressing name resolution, routing tables, or operational debugging.

Expect these follow-ups

• How would you debug an intermittent connection timeout to a private endpoint?
• When is VPC peering the wrong answer?
• How do you prevent all traffic from hairpinning through one expensive NAT path?

As asked

Design an OTA firmware update system for a device deployed in homes where physical recovery is expensive.

Sample answer outline

Use A/B firmware slots or a golden fallback image so a bad update does not brick the device. Download and verify the image with signatures and checksums before marking it bootable, then use a bootloader that only commits the new slot after the application reports healthy startup. Roll out gradually by device cohort, model, region, and power or network conditions, with telemetry on download failures, boot loops, and rollback rates. Include version anti-rollback if security requires it, but design a support path for emergency downgrade. Strong candidates discuss power loss during update and how the bootloader state machine handles it.

Expect these follow-ups

• How do you test the bootloader update path itself?
• What telemetry do you need before expanding rollout from 1 percent to 50 percent?
• How do you handle a device that loses power halfway through flashing?

As asked

Design a system to serve static and dynamic content to 50 million users across 5 continents with sub-100ms p95 latency. Walk me through your architecture decisions.

Sample answer outline

Candidate should propose CloudFront or a multi-CDN strategy for static content, edge compute (Lambda@Edge or CloudFront Functions) for lightweight dynamic personalisation, origin shield to reduce origin load, and multi-region origins with Route 53 latency routing. They should address cache invalidation strategy, TLS certificate management at edge, and how to measure p95 latency per region using CloudWatch and synthetic canaries.

Expect these follow-ups

• How would you handle a sudden 10x traffic spike to a single region?
• What is the difference between Lambda@Edge and CloudFront Functions and when do you pick each?

As asked

A partner sends 500 JSON events per second via HTTP. You need to ingest, validate, transform, and store them in a data lake and a real-time dashboard. Design this without managing any servers.

Sample answer outline

Strong answer: API Gateway or Kinesis Data Streams as ingestion point, Lambda for validation and enrichment, Firehose for buffered delivery to S3 (data lake) with Parquet conversion via a Glue schema, and DynamoDB or OpenSearch for real-time dashboard queries. Candidate should address backpressure (Kinesis shard limits), DLQ for failed events, schema registry for evolution, and partition strategy in S3 for Athena performance.

Expect these follow-ups

• Why would you choose Kinesis Data Streams over Firehose at the ingestion layer?
• How do you handle a validation failure without losing the event?

As asked

A company with 30 development teams is moving to AWS from on-prem. Design the account structure, networking, and governance foundation they will build on.

Sample answer outline

Candidate should describe an AWS Organizations hierarchy with OUs per business unit or environment, a management account with SCPs only, a centralised security account (GuardDuty aggregator, Security Hub, CloudTrail org trail), a shared services account for DNS and artifact registries, and a networking account with Transit Gateway for inter-VPC routing. Automated vending via AWS Control Tower or a custom account factory using Service Catalog.

Expect these follow-ups

• Why should the management account itself not run workloads?
• How does AWS Control Tower differ from building your own landing zone with Organizations + CloudFormation StackSets?

As asked

A 10-year-old Java monolith runs on bare-metal servers with a 2 TB Oracle database. Your task is to migrate it to AWS with minimal downtime. Design the strategy and sequence.

Sample answer outline

Candidate should propose a phased approach: assess with Migration Hub, use AWS DMS for schema conversion and data replication (SCT for Oracle to Aurora Postgres), set up Direct Connect for the migration window, lift-and-shift the app tier to EC2 first, then optionally re-platform to containers. Key: run DMS CDC to keep Oracle and Aurora in sync until cutover, test the app against Aurora before cutting DNS, and plan rollback to on-prem if Aurora fails validation.

Expect these follow-ups

• What is the role of AWS Application Migration Service versus a manual lift-and-shift?
• How do you handle Oracle-specific SQL that does not translate to Postgres?

As asked

A SaaS product has a 4-hour RTO and 1-hour RPO requirement. Design a disaster recovery architecture across two AWS regions to meet those targets.

Sample answer outline

A 4-hour RTO and 1-hour RPO points to a warm standby pattern rather than cold standby or active-active. Candidate should describe Aurora Global Database with replication lag typically under 1 second, scaled-down but running EC2 or ECS in the secondary region, Route 53 health checks triggering DNS failover within minutes, and regular DR drill automation. They should explicitly map each DR pattern (backup/restore, cold standby, warm standby, active-active) to RTO/RPO ranges.

Expect these follow-ups

• How do you automate a DR failover drill to verify your RTO without impacting production?
• What changes in the warm standby architecture if the RPO drops to 5 minutes?

As asked

Your team manages 15 Terraform root modules across 5 AWS accounts. Design a CI/CD pipeline that plans, validates, and safely applies changes with appropriate guardrails.

Sample answer outline

Candidate should describe a pipeline that runs terraform fmt -check and tflint on every PR, generates and posts a speculative plan as a PR comment, requires human approval before apply, uses OpenID Connect (OIDC) to authenticate to AWS without stored credentials, and isolates each root module run to prevent cross-account blast radius. Mention Atlantis or Terraform Cloud as managed alternatives and state per-account backend isolation.

Expect these follow-ups

• How does OIDC for GitHub Actions to AWS work at the credential level?
• How do you handle a failed apply that left infrastructure in a partially created state?

As asked

You have 200 microservices across ECS, EKS, and Lambda that all need database passwords, API keys, and TLS certs. Design the secrets management architecture.

Sample answer outline

Candidate should describe AWS Secrets Manager for credentials (with automatic rotation for RDS), ACM Private CA for TLS certs, and KMS for envelope encryption. Services retrieve secrets at startup or via IAM-authenticated API calls rather than baking into images. For EKS, the Secrets Store CSI driver or External Secrets Operator syncs to Kubernetes secrets. Audit access via CloudTrail. Avoid environment variable injection at launch time for long-lived containers.

Expect these follow-ups

• What is the difference between Secrets Manager and SSM Parameter Store and when do you pick each?
• How does Secrets Manager automatic rotation work for RDS without downtime?

As asked

You are moving a legacy application from self-managed VMs to the cloud. Which parts do you move to managed services, and which do you keep under your own control?

Sample answer outline

Classify components by operational burden, customisation needs, compliance constraints, and migration risk. Databases, queues, object storage, secrets, and load balancing often benefit from managed services because reliability work shifts to the provider. Keep control where latency, custom extensions, specialised networking, or vendor lock-in risk outweighs the operational win. A mature answer includes an incremental migration plan with strangler patterns, dual-write risk, rollback paths, and observability before cutover. Candidates trip up when they treat managed services as automatically cheaper or automatically more reliable.

Expect these follow-ups

• How do you compare managed Postgres with self-hosted Postgres for a regulated workload?
• What does rollback look like after moving state to a managed service?
• How do you measure whether the migration actually improved reliability?

As asked

Your security team wants to move away from VPN-based perimeter security. Design a zero-trust architecture for 500 internal services communicating over AWS.

Sample answer outline

Candidate should describe identity-based access using IAM and service mesh (App Mesh or Istio on EKS) with mTLS between services, AWS Verified Access for user-to-application access replacing VPN, removing broad security group rules in favour of per-service rules, and using PrivateLink for third-party services. Mention that zero trust requires strong identity, device posture checks, and continuous authorisation per request rather than session-level trust.

Expect these follow-ups

• How does AWS Verified Access integrate with your identity provider?
• What is the difference between mTLS in a service mesh and IAM-based authorization?

As asked

Engineering leadership wants every team to see their daily AWS spend within 24 hours, get alerted on anomalies, and have per-service cost breakdowns. Design the platform.

Sample answer outline

Candidate should describe enabling Cost and Usage Report (CUR) delivered to S3, crawling with Glue and querying with Athena, tag-based cost allocation per team, Cost Anomaly Detection for alerting, and a Grafana or QuickSight dashboard consuming Athena. They should address the 24-hour CUR delay and how to supplement with real-time tag-based Budget alerts for immediate overspend signals.

Expect these follow-ups

• How would you handle teams that do not have consistent tagging?
• What is the difference between a Cost Budget and a Cost Anomaly Detector?