Cloud Engineer interview questions
The 8 questions that actually come up, each with what a strong answer covers. These are not scripts to memorise — interviewers can tell — they are the shape of the answer that gets a yes.
8 questionsCloud Engineer career guide →
Walk me through what happens when a request hits a load balancer in your VPC.
What a strong answer coversThey want the full path: DNS, LB listener, target group health, security groups vs NACLs, and where TLS terminates. Draw it if there is a whiteboard.
How would you design a multi-region active–passive setup for an API with an RDS backend?
What a strong answer coversCover data replication lag, failover DNS (health-checked records), secrets/config parity, and how you TEST the failover — untested DR is fiction.
Your AWS bill doubled this month. How do you find out why?
What a strong answer coversCost Explorer by service and tag, then usage-type drill-down; mention tagging discipline and budgets/alerts as the prevention, not just the cure.
IAM: what is the difference between a role, a policy and a permission boundary?
What a strong answer coversShow you think in least privilege. A crisp answer distinguishes identity vs resource policies and explains when a boundary saves you from yourself.
How do you keep Terraform state safe with five engineers applying changes?
What a strong answer coversRemote state with locking, plan-in-CI apply-on-merge, workspaces or state separation per environment, and drift detection.
A deployment is failing only in production. Your debugging steps?
What a strong answer coversConfig/parity diff first (env vars, secrets, IAM), then logs/traces, then a controlled canary. They are testing method, not luck.
When would you NOT use Kubernetes?
What a strong answer coversHonest cost/benefit: small teams, few services, or serverless-friendly workloads. Saying 'always Kubernetes' is a red flag they are probing for.
How do you hand a platform to application teams without becoming their ticket queue?
What a strong answer coversGolden paths: modules, templates, docs and guardrails over gatekeeping. This question separates seniors from operators.