Cloud Security interview questions
Cloud Security questions a Cybersecurity can be asked, from first job to senior. Open one to see the strongest answer and why it works.
What is the difference between a region and an availability zone?
The strongest answer: A region is a geographic area with several availability zones; each zone is one or more separate data centres with its own power and network, so spreading across zones survives a data-centre failure
Why it works: Right. The zone is the fault boundary you design around; the region is where your data lives.
- Region: a geography with multiple zones.
- Zone: isolated power, cooling and network.
- Spread across zones for availability.
- Spread across regions for disaster recovery.
IaaS, PaaS, SaaS — what does each one leave to you?
The strongest answer: IaaS gives you machines and networks and you run everything on them; PaaS runs the platform and you bring code and data; SaaS is a finished application you configure
Why it works: Exactly. The line that moves is who patches, scales and operates the layer underneath.
- IaaS: VMs, disks, networks — you run the rest.
- PaaS: bring code and data, the platform runs it.
- SaaS: a finished product you configure.
- The difference is who operates each layer.
When would you use object storage rather than a block volume?
The strongest answer: For files you read and write whole over HTTP — uploads, backups, static assets, data-lake files — because object storage is durable, cheap and shared, while a block volume is a disk attached to one machine
Why it works: Right. Whole-object access, shared, durable and cheap; a disk is for a filesystem or a database.
- Object: whole files over HTTP, shared, cheap, durable.
- Block: a disk for one machine's filesystem or database.
- Pick by access pattern, not by speed.
- Static assets and backups belong in object storage.
You create a new storage bucket for user uploads. Who can read it by default, and what should you check?
The strongest answer: Nobody outside your account — buckets are private by default; check that public access stays blocked and grant access through the application's role or signed URLs, never by making the bucket public
Why it works: Right. Private by default, and keep it that way; a signed URL is how a user gets one file.
- Buckets are private by default.
- Keep public access blocked at the account level.
- Serve user files by signed URL or through a role.
- A public bucket of uploads is a data breach waiting.
What is the difference between an IAM user and an IAM role?
The strongest answer: A user is a permanent identity with long-lived credentials for a person; a role is a set of permissions any trusted identity — a service, a machine, a person — assumes temporarily, and workloads should use roles rather than keys
Why it works: Exactly. Temporary credentials via roles are why you never bake access keys into a server.
- User: long-lived identity, for a person.
- Role: assumed temporarily by a trusted principal.
- Workloads get roles, never stored keys.
- Temporary credentials limit the blast of a leak.
A security group allows inbound port 443. Do you also need an outbound rule for the responses?
The strongest answer: No — security groups are stateful, so return traffic for an allowed connection is permitted automatically; a network ACL, by contrast, is stateless and would need both directions
Why it works: Right. Stateful means the response follows the request; NACLs are where both directions are written.
- Security groups are stateful.
- Network ACLs are stateless.
- Return traffic for allowed connections is automatic.
- Write both directions only in a NACL.
What is a VPC, in one sentence?
The strongest answer: A private, isolated network you define inside the cloud — your own address range, subnets, route tables and gateways — where your resources live and which decides what can talk to what
Why it works: Exactly. It is the network boundary everything else sits inside.
- Your own isolated network in the cloud.
- Subnets, route tables, gateways.
- Decides what can reach what.
- Everything else is placed inside it.
Why put a load balancer in front of two web servers instead of pointing DNS at one?
The strongest answer: It spreads traffic across healthy servers, drops a server that fails its health check, ends TLS in one place and lets you add or replace servers without touching DNS
Why it works: Right. Availability, health checking and a stable front door are the reasons.
- Distributes across healthy servers.
- Removes a failing server via health checks.
- One place to terminate TLS.
- Add and replace servers behind a stable address.
What does autoscaling actually do, and what does it not do?
The strongest answer: It adds or removes identical instances according to a metric or schedule so capacity follows demand; it does not make a single slow request faster or fix an application that cannot run as more than one copy
Why it works: Exactly. Horizontal, metric-driven, and it assumes the app is stateless enough to copy.
- Adds and removes copies on a metric.
- Assumes the app runs as many identical copies.
- Throughput, not per-request speed.
- Not a fix for leaks or single-copy apps.
Why choose a managed database service over running the database yourself on a VM?
The strongest answer: Backups, patching, failover and monitoring come with it, so a small team gets reliability it would struggle to build; you pay more per hour and give up some low-level control
Why it works: Right. You are buying operations you would otherwise have to staff.
- Managed: backups, patching, failover included.
- You pay for operations you do not have to staff.
- Less low-level control.
- Self-hosted only when you need what managed cannot do.
What is a cold start in a serverless function?
The strongest answer: The delay when a function runs on an instance that has to be created first — code loaded, runtime started — so the first request after idle is slower than the ones that follow
Why it works: Right. It is why latency-sensitive paths keep instances warm or use provisioned concurrency.
- A fresh instance must start before it can serve.
- First request after idle pays the cost.
- Smaller packages and warm instances reduce it.
- Matters most on user-facing paths.
Cloud is pay for what you use. What is the cost people forget most often?
The strongest answer: Data transfer out — egress to the internet or between regions is billed per gigabyte, so a chatty design or a big download feature can cost more than the compute behind it
Why it works: Right. Egress is the line that surprises new teams; keep data near its consumers and cache at the edge.
- Egress is billed per gigabyte.
- Cross-region traffic counts too.
- Idle resources bill while they exist.
- Design to keep data near where it is read.
A screenshot bucket is world-readable “so the app can load images.” What do you do?
The strongest answer: Make it private and give the app a short-lived URL or a proxy — public by default is how backups and IDs leak
Why it works: Exactly. Public storage is a publication. Signed URLs exist for a reason.
- Private bucket + signed URLs.
- Filenames are not a lock.
- robots.txt is not authz.
- Do not hide secrets in names.