Home › Interview questions › Technology & IT › Cloud EngineerCLOUD ENGINEER INTERVIEW PREP
Cloud Engineer Interview Questions (AWS, Azure) and Answer Tips
Cloud interviews test architecture judgment: availability, security, cost and automation. Name the services you have actually used and explain the trade-offs.
Design a highly available web application in AWS. Explain VPC design: public vs private subnets, NAT and security groups. How do you manage IAM and least privilege? What is infrastructure as code and which tools have you used? How would you reduce a cloud bill that grew 40% last quarter? Containers vs serverless — when would you choose each? How do you handle secrets in the cloud? Tell me about a production issue you debugged in the cloud.
1. Design a highly available web application in AWS.
Why they ask: The classic architecture question — it shows breadth and trade-off thinking.
How to answer:
Multi-AZ: load balancer, auto-scaling group or containers across at least two AZs. Data tier: managed database with Multi-AZ, read replicas, backups. Edge: CloudFront/CDN, WAF, Route 53 health checks. Cover observability, IaC and cost, and say what you would add for multi-region.
2. Explain VPC design: public vs private subnets, NAT and security groups.
Why they ask: Cloud networking is where many engineers are weakest.
How to answer:
Public subnets route to an internet gateway; private subnets reach out through NAT. Security groups are stateful and attached to resources; NACLs are stateless at the subnet level. Mention VPC peering vs Transit Gateway for multi-VPC connectivity.
3. How do you manage IAM and least privilege?
Why they ask: Security is a top cloud concern.
How to answer:
Roles over long-lived keys; no root account usage. Least-privilege policies, permission boundaries, SCPs at the organisation level. Regular access reviews; tools like IAM Access Analyzer.
4. What is infrastructure as code and which tools have you used?
Why they ask: Automation maturity.
How to answer:
Define infra declaratively, version it, review it, apply it repeatably. Terraform vs CloudFormation/Bicep; state management and remote backends. Example: a module you wrote and how you tested or promoted it across environments.
5. How would you reduce a cloud bill that grew 40% last quarter?
Why they ask: Cost awareness is increasingly expected.
How to answer:
Find the drivers first: cost explorer by service, tags, account. Quick wins: rightsizing, idle resources, storage tiers, egress. Commitments: Savings Plans / reserved instances for steady load. Prevent recurrence: budgets, alerts, tagging policy.
6. Containers vs serverless — when would you choose each?
Why they ask: Tests architecture judgment rather than hype.
How to answer:
Serverless: event-driven, spiky load, minimal ops; watch cold starts and limits. Containers: long-running services, more control, portability. Give a real example of choosing one and why.
7. How do you handle secrets in the cloud?
Why they ask: Common security failure point.
How to answer:
Use a secrets manager or key vault, never code or plain environment files in repos. Rotation, access via IAM roles, audit logging. Mention scanning repos for leaked secrets.
8. Tell me about a production issue you debugged in the cloud.
Why they ask: Real-world troubleshooting and ownership.
How to answer:
Symptom and impact. How you used logs, metrics and traces to isolate it. Fix and follow-up (alarms, runbooks, design change).
More interview guides Any job title works in CareerCue — these are just a starting point. See all fields →
Mind going blank in the real interview? CareerCue works for any job in any field. It listens to the question and shows a short cue based on your resume and the role, so you can answer in your own words. Free to try, no credit card.
Try CareerCue free →
CareerCue