Cloud Engineer Interview Questions

Typical Cloud Engineer Interview Process

Networking, Compute & Storage

Core competencies for Cloud Engineers: designing virtual networks, configuring compute instances, managing storage solutions and ensuring connectivity.

• How would you design a VPC (or Virtual Network on Azure) for a multi-tier application with public and private subnets?

  Sample Answer Guidance: I'd create a VPC with two availability zones, each containing public subnets (with NAT gateways) for the load balancer tier and private subnets for application and database tiers. Public subnets use internet gateways with 0.0.0.0/0 routes, whilst private subnets route outbound traffic through NAT gateways for security patching. This pattern isolates databases from internet exposure whilst allowing secure outbound connections.
• What's the difference between security groups and network ACLs in AWS? When would you use each?
• Explain the purpose of NAT gateways and bastion hosts. When would you deploy each and why?

  Sample Answer Guidance: NAT gateways enable private instances to initiate outbound connections (for updates, API calls) while blocking inbound access—deployed in public subnets and used in production. Bastion hosts are hardened EC2 instances in public subnets that serve as secure jump hosts for administrative access to private instances, with strict security groups restricting SSH. Use NAT for scale, bastion for auditable admin access.
• How do you choose between EC2 instance types for different workloads? What factors influence your decision?
• Describe how you would configure an Application Load Balancer (ALB) or Azure Load Balancer for high availability across multiple availability zones.

  Sample Answer Guidance: I'd deploy an ALB with target groups across two+ AZs, enabling cross-zone load balancing in the target group settings. Configure health checks (HTTP 200 on /health with 30s intervals) to automatically deregister unhealthy instances. Use path-based routing rules to direct traffic to different services. Enable stickiness only if required, and use HTTPS listeners with ACM certificates to encrypt traffic.
• What's your approach to choosing between S3 (or Azure Blob Storage) storage classes? How do you optimise for cost while maintaining performance?
• How would you implement DNS failover and routing in AWS Route 53 (or Azure Traffic Manager) for disaster recovery?

  Sample Answer Guidance: I'd configure Route 53 failover routing with primary and secondary regions, each with health checks pointing to ALBs. Primary endpoints use failover policy to route to secondary only if health checks fail. Implement CloudWatch alarms to monitor endpoint health, and set low TTL values (30-60s) to enable rapid DNS propagation during failover. Test failover regularly using chaos engineering.
• Explain the role of CloudFront (or Azure CDN) in your architecture. When would you implement a CDN and what performance benefits does it provide?

Infrastructure as Code, Automation & Cost Management

Modern cloud operations rely on Infrastructure as Code (IaC) to provision infrastructure consistently and manage costs effectively at scale.

• Compare Terraform, AWS CloudFormation and Azure Bicep. What are the advantages of each and how do you choose between them?

  Sample Answer Guidance: Terraform is platform-agnostic with cleaner HCL syntax and reusable modules—ideal for multi-cloud deployments. CloudFormation is AWS-native, tightly integrated with AWS services and IAM policies, but less portable. Bicep is Azure's simplified IaC language replacing ARM templates. I'd choose Terraform for multi-cloud flexibility and team familiarity, CloudFormation if locked into AWS ecosystem and native service support is critical.
• How do you manage Terraform state files? Discuss remote state, state locking and security considerations.

  Sample Answer Guidance: I'd store remote state in S3 with DynamoDB for state locking (prevents concurrent apply conflicts), enabling versioning and server-side encryption with KMS. IAM policies restrict state file access—only CI/CD and authorised engineers. I'd avoid committing state to Git. For migrations, I'd use terraform import or backends to handle state transitions safely. Use terraform state show to audit sensitive values before sharing.
• Write a Terraform module for provisioning an EC2 instance with security group and monitoring enabled. What best practices would you follow?

  Sample Answer Guidance: I'd structure a module with variables (instance_type, subnet_id, tags), outputs (instance_id, private_ip), and resources for security groups with ingress rules. Enable detailed CloudWatch monitoring (aws_cloudwatch_log_group), attach an IAM role for Systems Manager access, and pass user_data for agent installation. Use locals for standardised tags and avoid hardcoded values. The module should be reusable across environments with minimal variable changes.
• Explain your approach to tagging strategy in cloud infrastructure. Why is tagging important for cost management and governance?
• How do you implement auto-scaling policies in AWS (EC2 Auto Scaling Groups) or Azure (Virtual Machine Scale Sets)?
• Describe your experience with monitoring and alerting. How do you use CloudWatch metrics and dashboards (or Azure Monitor) to detect issues?
• What strategies do you use to optimise cloud costs? Discuss reserved instances, spot instances, compute scheduling and resource right-sizing.

  Sample Answer Guidance: I'd analyse AWS Cost Explorer to identify over-provisioned instances, then right-size compute using CloudWatch memory metrics. Mix reserved instances (3-year for stable workloads, 1-year for flexible) with spot instances for batch jobs and auto-scaling, saving 70-90% on compute. Implement scheduled shutdown for dev/test environments, use S3 Intelligent-Tiering for variable storage access, and enable EBS volume cleanup. Tag all resources for cost allocation and monthly cost reports.

What Interviewers Are Assessing