How cloud engineer interviews work
Cloud engineer interviews test infrastructure design, cloud platform knowledge, networking, security, automation, and behavioral competencies. Most loops include a system design or architecture round, a technical depth round on the specific cloud platform, a scripting or automation round (Terraform, Python, or Bash), and behavioral interviews. The specific platform emphasis (AWS, Azure, GCP) depends on the company's stack.
Cloud roles span a spectrum from infrastructure-focused (building and operating cloud environments) to platform engineering (building internal developer platforms) to cloud architecture (advising on design decisions). The interview depth on specific technologies versus design thinking varies accordingly. Know which type of role you are interviewing for.
Cloud architecture questions
"Design a highly available, fault-tolerant web application on AWS." Cover: multi-AZ deployment, auto-scaling groups, load balancers, managed database services with read replicas, CDN for static assets, and a caching layer. Discuss how each component contributes to availability and how the design handles failures gracefully. Define your availability target (99.9% versus 99.99%) and explain how the architecture achieves it.
"How would you migrate a monolithic on-premises application to the cloud with minimal downtime?" A common architecture question that tests migration strategy knowledge. Discuss the strangler fig pattern for incremental migration, lift-and-shift as a first step versus rearchitecting, how you would handle the database migration, and what traffic routing approach you would use to cut over safely.
Networking and security questions
"Explain VPCs, subnets, and security groups. How do they work together to control network access?" A VPC is a logically isolated network within a cloud provider. Subnets divide the VPC into smaller segments and can be public (with internet access) or private. Security groups are stateful firewalls applied at the instance level. NACLs are stateless firewalls applied at the subnet level. Together they create a defence-in-depth network architecture.
"A service in your environment is making unexpected outbound connections. How do you investigate?" Cover: VPC flow logs to identify the traffic, CloudTrail for API calls, checking IAM roles and permissions for the service, reviewing security group egress rules, and using a WAF or network inspection tool. Show systematic thinking from observation to diagnosis to remediation.
Infrastructure as code and automation
"What is Terraform and how does state management work?" Terraform is an infrastructure-as-code tool that lets you define cloud resources declaratively. State management is a critical concern: the state file tracks what Terraform knows about your infrastructure. Remote state (in S3 with DynamoDB locking, for example) allows teams to collaborate safely. Discuss the risks of state file corruption and how to handle state drift when resources are changed outside of Terraform.
"How would you implement a CI/CD pipeline for infrastructure changes?" Describe a pipeline that: runs Terraform plan on a pull request and posts the output as a comment, requires approval before apply, runs automated policy checks (using Sentinel or OPA), applies to a staging environment first, and gates production deployment on staging validation. Show that you treat infrastructure code with the same discipline as application code.
Cost optimisation and monitoring
"How would you reduce cloud costs for a company spending $500k per month on AWS?" Start by understanding what the spend is on. Common levers: right-sizing over-provisioned instances, switching to Reserved Instances or Savings Plans for predictable workloads, using Spot Instances for fault-tolerant batch workloads, identifying and deleting idle resources, optimising S3 storage tiers, and reviewing data transfer costs. The right answer requires a diagnostic approach before jumping to specific actions.
Monitoring and alerting on cost is as important as optimising it. Discuss tagging strategies for cost allocation, budget alerts, and anomaly detection. Show that you think about cost as an ongoing operational concern rather than a one-time exercise.
Behavioral questions
"Tell me about a production incident you were involved in and how you handled it." Cloud engineers deal with infrastructure outages. Show that you have clear incident management instincts: triage quickly, communicate status proactively, fix forward rather than spending time assigning blame, write a postmortem that identifies root causes (not just symptoms), and implement systemic fixes. Stories that end with blameless postmortems and improved monitoring score well.
"How do you keep up with changes in cloud services?" Cloud providers release hundreds of new features and services every year. Discuss concrete habits: following the AWS/GCP/Azure blogs, attending re:Invent or equivalent, maintaining certifications, and participating in internal knowledge-sharing. Show that continuous learning is a built-in part of how you work, not something you do periodically.