Interview prep · ☁️ Cloud Engineer (AWS / Azure / GCP / OCI)
Cloud Engineer interview questionsand answers (30, by level).
The questions Indian employers actually ask for this role — fresher, mid-level and senior — with model answers written by engineers who sit on the other side of the table. Use with the role path and the 30-day lab plan.
Fresher / L1
Fundamentals they test on day one
1IaaS vs PaaS vs SaaS?
IaaS: VMs/network/storage (EC2); PaaS: managed runtime/database (RDS, App Service); SaaS: finished apps (M365).
2What is a region and an availability zone?
Region: geographic area (Mumbai); AZ: isolated data centers within it for HA.
3Explain a VPC/VNet with public and private subnets.
Private network in the cloud; public subnets route to an internet gateway, private ones use NAT for outbound only.
4What is IAM and least privilege?
Identity and access management: users/roles/policies; grant only what a task needs, prefer roles over keys.
5Object storage vs block storage?
Object (S3/Blob): HTTP, unlimited, for files/backups; block (EBS/Disk): attached to VMs for OS/databases.
6What is auto-scaling?
Adding/removing instances based on metrics or schedules; needs stateless apps and health checks.
7Security group vs NACL?
SG: stateful, instance-level allow rules; NACL: stateless subnet-level allow/deny.
8What is a load balancer and L4 vs L7?
Distributes traffic; L4 by IP/port (NLB), L7 by HTTP (ALB: paths, hosts, TLS termination).
9How is cloud billed and what surprises people?
Pay-as-you-go; surprises: data egress, idle resources, NAT gateway hours, snapshots, cross-AZ traffic.
10What is a managed Kubernetes service?
EKS/AKS/GKE run the control plane; you manage node pools and workloads.
2–5 years / L2
What a working engineer must know
1Design a 3-tier web app on AWS with HA.
Route 53 → ALB in 2 AZs → ASG of app instances (or ECS/EKS) → RDS Multi-AZ; S3 + CloudFront for static; secrets in Secrets Manager; CloudWatch alarms; IaC with Terraform.
2Terraform state — how do you manage it in a team?
Remote backend (S3 + DynamoDB lock / Azure Storage), workspaces or directories per env, plan in CI, no manual changes.
3Cut a cloud bill by 30% — where do you look?
Idle/oversized instances, reserved/savings plans, storage tiers, snapshots, egress, logs retention, right-size databases, scheduled off-hours for non-prod.
4Explain landing zones.
Multi-account/subscription structure with guardrails (SCPs/policies), central logging, networking hub, identity federation — the foundation before workloads.
5Hybrid connectivity options to India data centers?
Site-to-site VPN (quick), Direct Connect/ExpressRoute via partners (Sify, Tata, Airtel), SD-WAN; consider latency to Mumbai/Hyderabad regions.
6How do you secure S3/Blob buckets?
Block public access, bucket policies, encryption (SSE-KMS), versioning, access logging, lifecycle rules; scan with config rules.
7Blue/green vs canary deployments?
Blue/green switches all traffic between two environments; canary shifts a small percentage first with metrics-based promotion.
8What is serverless good and bad for?
Good: event-driven, spiky, low-ops; bad: long-running, latency-sensitive cold starts, heavy steady loads (cost).
9Observability in cloud: what do you set up day one?
Centralised logs, metrics, traces (OpenTelemetry), dashboards, alerts on SLOs, budget alerts, audit trail (CloudTrail/Activity Log).
10Explain IAM roles for workloads instead of keys.
Instance profiles/managed identities/OIDC federation issue short-lived credentials; no static keys in code or CI.
Senior / L3
Design, judgement and leadership
1Cloud vs private cloud decision framework for an Indian enterprise?
Workload profile (steady vs bursty), data residency, team skills, 3-year TCO, exit cost, latency; hybrid with private cloud for steady workloads is often cheapest — see our guide.
2Multi-region active-active — what breaks first?
Data consistency; design with global databases or partitioned writes, DNS/global LB, idempotent services, chaos tests.
3FinOps programme — how do you run it?
Tagging standards, showback dashboards, anomaly alerts, monthly reviews with owners, commitments strategy, unit economics (cost per transaction).
4Design a migration of 150 VMs to cloud (or back).
Discovery (dependencies), 6R classification, pilot, network/identity first, migration waves with tools (MGN/Azure Migrate or V2V to Proxmox), cutover plan, decommission.
5Compliance (RBI/SEBI/DPDP) on cloud — key controls?
Data residency in Indian regions, encryption with customer-managed keys, logging/retention, access reviews, vendor assessments, DR drills, breach process.
6Kubernetes platform on cloud for 20 teams?
Cluster per environment, namespaces + RBAC + quotas, ingress and cert automation, GitOps (Argo CD), policy (Kyverno/OPA), observability stack, cost allocation.
7How do you handle a cloud provider outage affecting production?
Pre-built runbooks, multi-AZ/region plans per tier, communication, failover decision criteria, post-incident review on dependencies.
8Network design for a hub-and-spoke across 30 accounts?
Transit Gateway/vWAN hub, shared services VPC, centralised egress and inspection, IPAM to avoid overlaps, private endpoints.
9Cloud security posture: top 5 controls with best ROI?
MFA everywhere, no public storage, least-privilege IAM with reviews, logging + alerting, patching/golden images.
10Describe a time you reduced cloud spend dramatically.
Numbers matter: what you found, what you changed, savings, and the governance that kept it from creeping back.
How to answer
Four habits that pass interviews
- Say the structure first“I’d check three things: …” — interviewers reward a method more than a lucky answer.
- Numbers and namesMention real tools, versions and figures from your lab; vague answers lose.
- Admit gaps cleanly“I haven’t run X in production; here is how I’d approach it” beats bluffing.
- Ask about the environmentScale, on-call, tooling — it shows you think like an operator.
Ready to be hired, or ready to hire?
Engineers: join our vetted network for projects and placements. Companies: we shortlist cloud engineers within 48 hours.