25 Cloud Engineer Interview Questions (AWS, Azure, GCP)

Cloud engineer interviews boil down to a deceptively simple question: do you understand what you're actually renting? The console makes everything look like magic, and interviewers delight in puncturing that — asking what happens to your data when an instance stops, why your security group change didn't work, or how two services find each other. Conceptual clarity beats memorised service names every time.

The core idea: The cloud is someone else's computers with an API on top — plus a shared responsibility model. Knowing where the provider's job ends and yours begins (patching, IAM, encryption, configuration) is the thread running through every question.

The question taxonomy

• Compute. VMs vs containers vs serverless — and the honest trade-offs between them.
• Storage. Object vs block vs file storage; durability vs availability; lifecycle policies.
• Networking. VPCs, subnets, route tables, security groups vs NACLs, load balancers (L4 vs L7).
• Identity and security. IAM policies, roles vs users, least privilege, encryption at rest and in transit.
• Reliability and cost. Multi-AZ design, autoscaling, and the classic "my bill exploded — why?"

Worked example: design a highly available web app

"Design a web application that survives a data centre failure." Structure beats service-name bingo:

1. Stateless application tier behind a load balancer, spread across at least two availability zones. Stateless means any instance can die without losing user sessions — push state to a shared store.
2. Managed database with synchronous replication to a standby in another AZ, with automatic failover. Know the difference between a read replica (scaling) and a standby (availability).
3. Static assets in object storage behind a CDN, so your app servers never serve files.
4. Health checks and autoscaling so unhealthy instances are replaced, not just tolerated.

The follow-ups define your score: What about regional failure (backups and a DR plan)? Where does session state live (external cache or signed tokens)? What's the blast radius of a bad deploy? Reason out loud through each.

How answers get scored

Rubrics reward trade-off articulation ("serverless is simpler but cold starts and vendor coupling are real costs") and security reflexes — mentioning least-privilege IAM and encryption unprompted. Cost awareness is a quiet differentiator: knowing that egress, NAT gateways, and idle resources dominate surprise bills marks you as someone who's operated real infrastructure.

Common mistakes

• Designing everything around a single availability zone and calling it "highly available."
• Opening 0.0.0.0/0 on a security group "temporarily" and leaving it.
• Assuming instance storage persists — it usually doesn't; that's what object and block storage are for.
• Ignoring cost entirely. "I'd just use the biggest instance" ends interviews faster than wrong answers do.

The networking questions that catch people out

Networking is where theoretical prep meets reality, and interviewers know it. Be ready for: "an instance in a private subnet needs package updates — how?" (a NAT gateway or instance, and know it's a common surprise cost), "your security group allows the port but traffic still fails — what else?" (NACLs, route tables, the application itself not listening), and "how do two services in different VPCs talk?" (peering or a private link, versus routing over the public internet). The meta-skill being graded is layered reasoning: cloud networking fails at exactly one layer at a time, and strong candidates check them in order rather than flailing. If you've never built this, build it once — one VPC, public and private subnets, an instance in each, and make them talk. One evening of doing beats a week of reading, and the interview stories write themselves.

FAQ

Which provider should I learn? One, deeply — the concepts (VPC, IAM, object storage, managed databases) map almost one-to-one across AWS, Azure, and GCP. Say which you know and translate when asked.

How much infrastructure-as-code comes up? Increasingly, a lot. Being able to talk about Terraform-style declarative infrastructure is a strong plus — the DevOps guide covers that workflow.

Round out the operations side with the Kubernetes guide, and rehearse architecture answers with Aissence practice.