All jobs / Solutions / cloud architect
Cloud Architecture interview questions
Cloud Architecture questions a Solutions / cloud architect can be asked, from first job to senior. Open one to see the strongest answer and why it works.
What is the difference between a region and an availability zone?
The strongest answer: A region is a geographic area with several availability zones; each zone is one or more separate data centres with its own power and network, so spreading across zones survives a data-centre failure
Why it works: Right. The zone is the fault boundary you design around; the region is where your data lives.
- Region: a geography with multiple zones.
- Zone: isolated power, cooling and network.
- Spread across zones for availability.
- Spread across regions for disaster recovery.
IaaS, PaaS, SaaS — what does each one leave to you?
The strongest answer: IaaS gives you machines and networks and you run everything on them; PaaS runs the platform and you bring code and data; SaaS is a finished application you configure
Why it works: Exactly. The line that moves is who patches, scales and operates the layer underneath.
- IaaS: VMs, disks, networks — you run the rest.
- PaaS: bring code and data, the platform runs it.
- SaaS: a finished product you configure.
- The difference is who operates each layer.
When would you use object storage rather than a block volume?
The strongest answer: For files you read and write whole over HTTP — uploads, backups, static assets, data-lake files — because object storage is durable, cheap and shared, while a block volume is a disk attached to one machine
Why it works: Right. Whole-object access, shared, durable and cheap; a disk is for a filesystem or a database.
- Object: whole files over HTTP, shared, cheap, durable.
- Block: a disk for one machine's filesystem or database.
- Pick by access pattern, not by speed.
- Static assets and backups belong in object storage.
You create a new storage bucket for user uploads. Who can read it by default, and what should you check?
The strongest answer: Nobody outside your account — buckets are private by default; check that public access stays blocked and grant access through the application's role or signed URLs, never by making the bucket public
Why it works: Right. Private by default, and keep it that way; a signed URL is how a user gets one file.
- Buckets are private by default.
- Keep public access blocked at the account level.
- Serve user files by signed URL or through a role.
- A public bucket of uploads is a data breach waiting.
What is the difference between an IAM user and an IAM role?
The strongest answer: A user is a permanent identity with long-lived credentials for a person; a role is a set of permissions any trusted identity — a service, a machine, a person — assumes temporarily, and workloads should use roles rather than keys
Why it works: Exactly. Temporary credentials via roles are why you never bake access keys into a server.
- User: long-lived identity, for a person.
- Role: assumed temporarily by a trusted principal.
- Workloads get roles, never stored keys.
- Temporary credentials limit the blast of a leak.
Managed database service or run the database yourself on VMs?
The strongest answer: Managed by default: backups, patching and failover become someone else’s job; self-host only for a named need the managed service cannot meet
Why it works: Exactly. Default to managed, deviate for a named reason. Operations time is the hidden cost.
- Managed by default.
- Self-host for a named, unmet need.
- Count operations time as cost.
- Lock-in is a separate decision.
Name the three basic building blocks every cloud offers and what each one is for.
The strongest answer: Compute to run code, storage to keep data, and networking to connect and isolate them — every managed service is a packaging of those three
Why it works: Exactly. Compute, storage, network. Learn to see the managed services as combinations of them.
- Compute runs code.
- Storage keeps data.
- Network connects and isolates.
- Managed services are these three, packaged.
A security group allows inbound port 443. Do you also need an outbound rule for the responses?
The strongest answer: No — security groups are stateful, so return traffic for an allowed connection is permitted automatically; a network ACL, by contrast, is stateless and would need both directions
Why it works: Right. Stateful means the response follows the request; NACLs are where both directions are written.
- Security groups are stateful.
- Network ACLs are stateless.
- Return traffic for allowed connections is automatic.
- Write both directions only in a NACL.
What is a VPC, in one sentence?
The strongest answer: A private, isolated network you define inside the cloud — your own address range, subnets, route tables and gateways — where your resources live and which decides what can talk to what
Why it works: Exactly. It is the network boundary everything else sits inside.
- Your own isolated network in the cloud.
- Subnets, route tables, gateways.
- Decides what can reach what.
- Everything else is placed inside it.
Why put a load balancer in front of two web servers instead of pointing DNS at one?
The strongest answer: It spreads traffic across healthy servers, drops a server that fails its health check, ends TLS in one place and lets you add or replace servers without touching DNS
Why it works: Right. Availability, health checking and a stable front door are the reasons.
- Distributes across healthy servers.
- Removes a failing server via health checks.
- One place to terminate TLS.
- Add and replace servers behind a stable address.
What does autoscaling actually do, and what does it not do?
The strongest answer: It adds or removes identical instances according to a metric or schedule so capacity follows demand; it does not make a single slow request faster or fix an application that cannot run as more than one copy
Why it works: Exactly. Horizontal, metric-driven, and it assumes the app is stateless enough to copy.
- Adds and removes copies on a metric.
- Assumes the app runs as many identical copies.
- Throughput, not per-request speed.
- Not a fix for leaks or single-copy apps.
Why choose a managed database service over running the database yourself on a VM?
The strongest answer: Backups, patching, failover and monitoring come with it, so a small team gets reliability it would struggle to build; you pay more per hour and give up some low-level control
Why it works: Right. You are buying operations you would otherwise have to staff.
- Managed: backups, patching, failover included.
- You pay for operations you do not have to staff.
- Less low-level control.
- Self-hosted only when you need what managed cannot do.
What is a cold start in a serverless function?
The strongest answer: The delay when a function runs on an instance that has to be created first — code loaded, runtime started — so the first request after idle is slower than the ones that follow
Why it works: Right. It is why latency-sensitive paths keep instances warm or use provisioned concurrency.
- A fresh instance must start before it can serve.
- First request after idle pays the cost.
- Smaller packages and warm instances reduce it.
- Matters most on user-facing paths.
Cloud is pay for what you use. What is the cost people forget most often?
The strongest answer: Data transfer out — egress to the internet or between regions is billed per gigabyte, so a chatty design or a big download feature can cost more than the compute behind it
Why it works: Right. Egress is the line that surprises new teams; keep data near its consumers and cache at the edge.
- Egress is billed per gigabyte.
- Cross-region traffic counts too.
- Idle resources bill while they exist.
- Design to keep data near where it is read.
A stakeholder asks whether the new service “runs in two data centres”.
What is the difference between a region and an availability zone, and which do you design for first?
The strongest answer: A region is a geographic area; zones are separate facilities inside it; design for zone failure first — it is the common case and cheap to survive — and treat region failure as a separate, costed decision
Why it works: Exactly. Multi-zone is the default; multi-region is a business decision with a real bill.
- Region: geography. Zone: facility.
- Multi-zone by default.
- Multi-region is a costed decision.
- You place compute; it is not automatic.
Why insist that infrastructure be defined as code rather than built in the console?
The strongest answer: Environments become reproducible, reviewable and diffable; you can rebuild after a disaster and see who changed what — the console leaves no trail you can replay
Why it works: Exactly. Reproducibility, review and recovery. Console-built environments are unrepeatable.
- Reproducible environments.
- Reviewable and diffable changes.
- Rebuild after disaster.
- The console leaves no replayable trail.
You are asked to move a portfolio of two hundred applications to the cloud. How do you approach it?
The strongest answer: Inventory and classify by business value, risk and technical shape, assign each a path — retire, rehost, replatform, refactor, replace — sequence by dependencies and quick wins, and build a landing zone and a repeatable pipeline before the first wave
Why it works: Exactly. Classify, choose a path per application, sequence, and industrialise the mechanics first.
- Inventory and classify first.
- A path per application.
- Landing zone and pipeline before wave one.
- Learn on low-risk systems.
How much should an organisation worry about cloud vendor lock-in?
The strongest answer: Decide deliberately per layer: accept lock-in where the managed service is a real advantage, keep data and interfaces portable, and know the exit cost of each big dependency — total avoidance costs more than most lock-in
Why it works: Exactly. Lock-in is a price you pay knowingly, per layer, with data portability as the line you hold.
- Decide per layer, deliberately.
- Keep data and interfaces portable.
- Know the exit cost.
- Total avoidance is its own cost.