Cloud Data Platforms interview questions
Cloud Data Platforms questions a Data engineer can be asked, from first job to senior. Open one to see the strongest answer and why it works.
What is the difference between a region and an availability zone?
The strongest answer: A region is a geographic area with several availability zones; each zone is one or more separate data centres with its own power and network, so spreading across zones survives a data-centre failure
Why it works: Right. The zone is the fault boundary you design around; the region is where your data lives.
- Region: a geography with multiple zones.
- Zone: isolated power, cooling and network.
- Spread across zones for availability.
- Spread across regions for disaster recovery.
IaaS, PaaS, SaaS — what does each one leave to you?
The strongest answer: IaaS gives you machines and networks and you run everything on them; PaaS runs the platform and you bring code and data; SaaS is a finished application you configure
Why it works: Exactly. The line that moves is who patches, scales and operates the layer underneath.
- IaaS: VMs, disks, networks — you run the rest.
- PaaS: bring code and data, the platform runs it.
- SaaS: a finished product you configure.
- The difference is who operates each layer.
When would you use object storage rather than a block volume?
The strongest answer: For files you read and write whole over HTTP — uploads, backups, static assets, data-lake files — because object storage is durable, cheap and shared, while a block volume is a disk attached to one machine
Why it works: Right. Whole-object access, shared, durable and cheap; a disk is for a filesystem or a database.
- Object: whole files over HTTP, shared, cheap, durable.
- Block: a disk for one machine's filesystem or database.
- Pick by access pattern, not by speed.
- Static assets and backups belong in object storage.
You create a new storage bucket for user uploads. Who can read it by default, and what should you check?
The strongest answer: Nobody outside your account — buckets are private by default; check that public access stays blocked and grant access through the application's role or signed URLs, never by making the bucket public
Why it works: Right. Private by default, and keep it that way; a signed URL is how a user gets one file.
- Buckets are private by default.
- Keep public access blocked at the account level.
- Serve user files by signed URL or through a role.
- A public bucket of uploads is a data breach waiting.
What is the difference between an IAM user and an IAM role?
The strongest answer: A user is a permanent identity with long-lived credentials for a person; a role is a set of permissions any trusted identity — a service, a machine, a person — assumes temporarily, and workloads should use roles rather than keys
Why it works: Exactly. Temporary credentials via roles are why you never bake access keys into a server.
- User: long-lived identity, for a person.
- Role: assumed temporarily by a trusted principal.
- Workloads get roles, never stored keys.
- Temporary credentials limit the blast of a leak.
A security group allows inbound port 443. Do you also need an outbound rule for the responses?
The strongest answer: No — security groups are stateful, so return traffic for an allowed connection is permitted automatically; a network ACL, by contrast, is stateless and would need both directions
Why it works: Right. Stateful means the response follows the request; NACLs are where both directions are written.
- Security groups are stateful.
- Network ACLs are stateless.
- Return traffic for allowed connections is automatic.
- Write both directions only in a NACL.
What is a VPC, in one sentence?
The strongest answer: A private, isolated network you define inside the cloud — your own address range, subnets, route tables and gateways — where your resources live and which decides what can talk to what
Why it works: Exactly. It is the network boundary everything else sits inside.
- Your own isolated network in the cloud.
- Subnets, route tables, gateways.
- Decides what can reach what.
- Everything else is placed inside it.
Why put a load balancer in front of two web servers instead of pointing DNS at one?
The strongest answer: It spreads traffic across healthy servers, drops a server that fails its health check, ends TLS in one place and lets you add or replace servers without touching DNS
Why it works: Right. Availability, health checking and a stable front door are the reasons.
- Distributes across healthy servers.
- Removes a failing server via health checks.
- One place to terminate TLS.
- Add and replace servers behind a stable address.
What does autoscaling actually do, and what does it not do?
The strongest answer: It adds or removes identical instances according to a metric or schedule so capacity follows demand; it does not make a single slow request faster or fix an application that cannot run as more than one copy
Why it works: Exactly. Horizontal, metric-driven, and it assumes the app is stateless enough to copy.
- Adds and removes copies on a metric.
- Assumes the app runs as many identical copies.
- Throughput, not per-request speed.
- Not a fix for leaks or single-copy apps.
Why choose a managed database service over running the database yourself on a VM?
The strongest answer: Backups, patching, failover and monitoring come with it, so a small team gets reliability it would struggle to build; you pay more per hour and give up some low-level control
Why it works: Right. You are buying operations you would otherwise have to staff.
- Managed: backups, patching, failover included.
- You pay for operations you do not have to staff.
- Less low-level control.
- Self-hosted only when you need what managed cannot do.
What is a cold start in a serverless function?
The strongest answer: The delay when a function runs on an instance that has to be created first — code loaded, runtime started — so the first request after idle is slower than the ones that follow
Why it works: Right. It is why latency-sensitive paths keep instances warm or use provisioned concurrency.
- A fresh instance must start before it can serve.
- First request after idle pays the cost.
- Smaller packages and warm instances reduce it.
- Matters most on user-facing paths.
Cloud is pay for what you use. What is the cost people forget most often?
The strongest answer: Data transfer out — egress to the internet or between regions is billed per gigabyte, so a chatty design or a big download feature can cost more than the compute behind it
Why it works: Right. Egress is the line that surprises new teams; keep data near its consumers and cache at the edge.
- Egress is billed per gigabyte.
- Cross-region traffic counts too.
- Idle resources bill while they exist.
- Design to keep data near where it is read.
You copy a lake across clouds nightly. What do you fear besides the bill?
The strongest answer: A second, drifted copy of PII and a split brain on “which is gold” — I name a primary and a purpose
Why it works: Exactly. Copies are products with class and a primary. Luck copies are incidents.
- Name the primary.
- Name the purpose of the copy.
- Count PII copies.
- No luck replicas.
You are asked for a two-year data-platform strategy. What are the first three pages?
The strongest answer: The products you owe (certified tables, SLOs, contracts), the paved road (ingest, orchestrate, quality), and the cost model — not a tool catalogue
Why it works: Exactly. Products, road, cost. Tools and empire are appendices.
- Name the data products.
- Describe the paved road.
- Show how you will pay for scans.
- Put tools in the back.
When is cost a first-class SLO, not a quarterly surprise?
The strongest answer: When a job has users and a habit of scanning — budget per product, pages on burn, the same seriousness as freshness
Why it works: Exactly. Burn is operable. Q4 yells and magic opex are how you get a freeze.
- Budget per data product.
- Page on burn.
- Same seriousness as freshness.
- Do not wait for Q4.
Give the one sentence you want every squad to say about data platform.
The strongest answer: “I can land, test, and publish a certified table before lunch” — if they cannot, you built a ticket queue, not a road
Why it works: Exactly. Self-serve before lunch. Tickets, hope, and sheets are the failed platform.
- Land, test, publish — before lunch.
- Not a ticket.
- Not copy-and-hope.
- Not a shadow sheet.
What must a disaster drill prove besides “we have snapshots”?
The strongest answer: That you can rebuild certified gold, restore identity to the jobs, and know who speaks — snapshots you have never applied are a rumour
Why it works: Exactly. Rebuild, identity, voice. Brochures and slide-regions are not drills.
- Prove a gold rebuild.
- Prove job identity.
- Name the spokesperson.
- Snapshots without apply are rumours.