All jobs / DevOps / SRE / cloud
Cloud interview questions
Cloud questions a DevOps / SRE / cloud can be asked, from first job to senior. Open one to see the strongest answer and why it works.
A founder says “we are in the cloud, so we are highly available.” What do you reply?
The strongest answer: A region and an AZ are not a design — HA is multi-instance, multi-AZ, and a tested failover, not a billing account
Why it works: Exactly. The cloud sells building blocks. HA is how you place them.
- Name instances and AZs.
- Test failover.
- Do not equate a bill with HA.
- Snapshots ≠ high availability.
What is the difference between a region and an availability zone?
The strongest answer: A region is a geographic area with several availability zones; each zone is one or more separate data centres with its own power and network, so spreading across zones survives a data-centre failure
Why it works: Right. The zone is the fault boundary you design around; the region is where your data lives.
- Region: a geography with multiple zones.
- Zone: isolated power, cooling and network.
- Spread across zones for availability.
- Spread across regions for disaster recovery.
IaaS, PaaS, SaaS — what does each one leave to you?
The strongest answer: IaaS gives you machines and networks and you run everything on them; PaaS runs the platform and you bring code and data; SaaS is a finished application you configure
Why it works: Exactly. The line that moves is who patches, scales and operates the layer underneath.
- IaaS: VMs, disks, networks — you run the rest.
- PaaS: bring code and data, the platform runs it.
- SaaS: a finished product you configure.
- The difference is who operates each layer.
When would you use object storage rather than a block volume?
The strongest answer: For files you read and write whole over HTTP — uploads, backups, static assets, data-lake files — because object storage is durable, cheap and shared, while a block volume is a disk attached to one machine
Why it works: Right. Whole-object access, shared, durable and cheap; a disk is for a filesystem or a database.
- Object: whole files over HTTP, shared, cheap, durable.
- Block: a disk for one machine's filesystem or database.
- Pick by access pattern, not by speed.
- Static assets and backups belong in object storage.
You create a new storage bucket for user uploads. Who can read it by default, and what should you check?
The strongest answer: Nobody outside your account — buckets are private by default; check that public access stays blocked and grant access through the application's role or signed URLs, never by making the bucket public
Why it works: Right. Private by default, and keep it that way; a signed URL is how a user gets one file.
- Buckets are private by default.
- Keep public access blocked at the account level.
- Serve user files by signed URL or through a role.
- A public bucket of uploads is a data breach waiting.
What is the difference between an IAM user and an IAM role?
The strongest answer: A user is a permanent identity with long-lived credentials for a person; a role is a set of permissions any trusted identity — a service, a machine, a person — assumes temporarily, and workloads should use roles rather than keys
Why it works: Exactly. Temporary credentials via roles are why you never bake access keys into a server.
- User: long-lived identity, for a person.
- Role: assumed temporarily by a trusted principal.
- Workloads get roles, never stored keys.
- Temporary credentials limit the blast of a leak.
A security group allows inbound port 443. Do you also need an outbound rule for the responses?
The strongest answer: No — security groups are stateful, so return traffic for an allowed connection is permitted automatically; a network ACL, by contrast, is stateless and would need both directions
Why it works: Right. Stateful means the response follows the request; NACLs are where both directions are written.
- Security groups are stateful.
- Network ACLs are stateless.
- Return traffic for allowed connections is automatic.
- Write both directions only in a NACL.
What is a VPC, in one sentence?
The strongest answer: A private, isolated network you define inside the cloud — your own address range, subnets, route tables and gateways — where your resources live and which decides what can talk to what
Why it works: Exactly. It is the network boundary everything else sits inside.
- Your own isolated network in the cloud.
- Subnets, route tables, gateways.
- Decides what can reach what.
- Everything else is placed inside it.
Why put a load balancer in front of two web servers instead of pointing DNS at one?
The strongest answer: It spreads traffic across healthy servers, drops a server that fails its health check, ends TLS in one place and lets you add or replace servers without touching DNS
Why it works: Right. Availability, health checking and a stable front door are the reasons.
- Distributes across healthy servers.
- Removes a failing server via health checks.
- One place to terminate TLS.
- Add and replace servers behind a stable address.
What does autoscaling actually do, and what does it not do?
The strongest answer: It adds or removes identical instances according to a metric or schedule so capacity follows demand; it does not make a single slow request faster or fix an application that cannot run as more than one copy
Why it works: Exactly. Horizontal, metric-driven, and it assumes the app is stateless enough to copy.
- Adds and removes copies on a metric.
- Assumes the app runs as many identical copies.
- Throughput, not per-request speed.
- Not a fix for leaks or single-copy apps.
A weekend experiment VM is still running on Monday month-end. What is the lesson?
The strongest answer: Cost is a design: tags, budgets, and a destroy path — I do not treat idle as free because it is “only a t-shirt size”
Why it works: Exactly. Idle is a bill. Tags and a destroy path are the habit.
- Tag who owns it.
- Budget and alert.
- Destroy when done.
- Do not call idle “free.”
Why choose a managed database service over running the database yourself on a VM?
The strongest answer: Backups, patching, failover and monitoring come with it, so a small team gets reliability it would struggle to build; you pay more per hour and give up some low-level control
Why it works: Right. You are buying operations you would otherwise have to staff.
- Managed: backups, patching, failover included.
- You pay for operations you do not have to staff.
- Less low-level control.
- Self-hosted only when you need what managed cannot do.
What is a cold start in a serverless function?
The strongest answer: The delay when a function runs on an instance that has to be created first — code loaded, runtime started — so the first request after idle is slower than the ones that follow
Why it works: Right. It is why latency-sensitive paths keep instances warm or use provisioned concurrency.
- A fresh instance must start before it can serve.
- First request after idle pays the cost.
- Smaller packages and warm instances reduce it.
- Matters most on user-facing paths.
Cloud is pay for what you use. What is the cost people forget most often?
The strongest answer: Data transfer out — egress to the internet or between regions is billed per gigabyte, so a chatty design or a big download feature can cost more than the compute behind it
Why it works: Right. Egress is the line that surprises new teams; keep data near its consumers and cache at the edge.
- Egress is billed per gigabyte.
- Cross-region traffic counts too.
- Idle resources bill while they exist.
- Design to keep data near where it is read.
The bill jumped. Compute looks flat. Where do you look next?
The strongest answer: Data-transfer, NAT, idle disks / snapshots, and forgotten IPs — I do not only stare at the instance list
Why it works: Exactly. The quiet line items. Transfer and leftovers move bills.
- Check transfer and NAT.
- Check idle disks and snapshots.
- Check leftover IPs.
- Do not scale out to “fix” the bill.
Finance asks who owns $4k of “misc” cloud. What should already have been true?
The strongest answer: Mandatory tags (team, env, service) and a policy that refuses untagged spend — I do not answer with a week of detective work
Why it works: Exactly. Tags at create, refuse untagged. Detective week is a process failure.
- Tag at create.
- Refuse untagged.
- Team / env / service.
- Do not defer to a yearly sheet.
A board slide says “active-active multi-cloud this year.” What do you write back?
The strongest answer: The cost is two of everything and a data story — I will offer multi-AZ and a practiced DR first unless they have a regulator or a vendor-risk reason they can name
Why it works: Exactly. Multi-cloud is a product of reasons, not a slide. AZ + DR is the usual first mile.
- Ask for the reason.
- Price two of everything.
- Do multi-AZ and DR first.
- Do not ban managed for a slogan.
Finance loves spot / preemptible nodes for the web tier. What do you require?
The strongest answer: A disruption budget and a mix of on-demand so a reclaim does not take the SLO — I do not put the only writer or the database on spot
Why it works: Exactly. Spot is a discount with a reclaim. Mix and PDB. Not the data writer.
- Mix on-demand.
- Set a PDB.
- Keep writers / data off spot.
- Do not 100% spot the SLO path.
A new pipeline will scan every object in a huge bucket every hour. When do you talk about cost?
The strongest answer: In the design review, with an order-of-magnitude (list/GET/egress) — I do not wait for the invoice to be the first review
Why it works: Exactly. Order-of-magnitude in the review. Cheap-each × huge × hourly is a bill.
- Cost in the design review.
- Count list/GET/egress roughly.
- Do not wait for finance.
- Do not round huge × hourly to zero.
How do you slice cloud accounts for a company that is no longer a startup?
The strongest answer: By blast radius (prod vs non-prod, and sometimes by domain), with org-level guardrails — I do not put everything in one account because billing is simpler
Why it works: Exactly. Accounts are firewalls. Tags help bills; they do not contain a leaked role.
- Prod / non-prod at minimum.
- Org guardrails.
- Do not one-account the company.
- Do not one-account-per-human.
Engineering says cloud cost is “finance’s number.” What do you install?
The strongest answer: Showback (and later chargeback if you must) by team tags, plus a monthly look at the top drivers — I do not throw a raw invoice into Slack
Why it works: Exactly. Make drivers visible to the people who can change them. Invoices and freezes are blunt.
- Showback by team.
- Look at drivers monthly.
- Do not Slack a raw bill as the process.
- Do not freeze-hire as cost control.
A managed service would save a year and lock you in. How do you talk about it?
The strongest answer: I name the lock, the exit cost, and the year we buy — I do not refuse managed on principle and I do not hide the lock in a footnote
Why it works: Exactly. A grown-up trade: time versus exit. Abstractions are not free and not zero lock.
- Name the lock.
- Name the year you buy.
- Name the exit.
- Do not claim a free zero-lock wrapper.