Cloud Engineer Interview Questions (2026) and How to Answer

Behavioural questions (1–10)

How you've handled real situations. Answer each with one true story, in STAR order.

1. 1.Tell me about a cloud migration you worked on.

   What they're really asking: Real migration experience: planning, risk and the cutover.

   Answer outline (STAR)

   • SituationWorkloads moving from on-premises or from another provider.
   • TaskYour part in the move.
   • ActionThe assessment, the pattern chosen (rehost or replatform), the cutover and rollback plans.
   • ResultDowntime, cost and performance after the move.

   Full sample answer (fictional example)

   I worked on moving 40 services from a rented data centre to AWS over nine months. I did the assessment: dependencies, data sizes, and which services could be rehosted and which needed changes. We chose rehost for 28 and replatform for the rest, moving in waves from least to most critical, each with a rollback plan and a weekend cutover. I handled the networking and database replication. Downtime per service stayed under 20 minutes, and monthly infrastructure cost fell 22 percent once we resized instances in the third month.

2. 2.Describe a self-service platform or tool you built for other engineers.

   What they're really asking: Platform thinking: do you treat developers as customers?

   Answer outline (STAR)

   • SituationTeams waiting days on tickets for infrastructure.
   • TaskLet them serve themselves safely.
   • ActionTemplates or modules with guardrails, a golden path, clear documentation.
   • ResultTime to provision before and after, and adoption.

   Full sample answer (fictional example)

   Developers waited four days for infrastructure tickets. I built Terraform modules with guardrails, such as encryption, tagging and private networking by default, and a pipeline where a developer opens a pull request describing a service and gets it provisioned after an automatic policy check. I wrote a one-page guide and ran three walkthroughs. Time to a new service fell from four days to about 40 minutes, and within six months 14 of 17 teams used it. Platform tickets dropped by 70 percent, so my team moved on to improving the modules.

3. 3.Tell me about a security issue you found in a cloud setup.

   What they're really asking: Security awareness in everyday cloud work.

   Answer outline (STAR)

   • SituationA public bucket, an over-broad IAM role or an open security group.
   • TaskFix it without breaking anything.
   • ActionAssess the exposure, tighten access, add a policy check that prevents it.
   • ResultThe risk removed, and the guardrail that now catches it.

   Full sample answer (fictional example)

   During a review I found a storage bucket with customer exports readable by anyone with the link. A script had created it months earlier. I told the security team, restricted the bucket within minutes, and checked access logs: nobody outside the company had read it. Then I fixed the cause: an organisation-wide policy that blocks public buckets, plus a daily scan that opens a ticket if one appears. I also added a section on public access to our module's documentation. The scan has since caught two attempts, both blocked.

4. 4.Tell me about a time you cut a cloud bill significantly.

   What they're really asking: FinOps awareness, which many cloud job ads now ask for.

   Answer outline (STAR)

   • SituationSpend growing faster than the business.
   • TaskFind savings without hurting reliability.
   • ActionTag resources, rightsize, buy reserved capacity or savings plans, delete idle resources.
   • ResultThe savings, and how you kept them from creeping back.

   Full sample answer (fictional example)

   Our cloud bill had grown 40 percent in a year while traffic grew 10. I tagged every resource by team, then worked through the top five cost lines. We deleted unattached volumes and old snapshots, rightsized oversized instances, moved steady workloads to savings plans, and put dev environments on a schedule that turns them off at night. Monthly spend dropped 31 percent with no reliability impact. To keep the saving, I set budgets and anomaly alerts per team, and a monthly 20-minute cost review with team leads.

5. 5.Tell me about explaining a design decision to non-technical stakeholders.

   What they're really asking: Can you translate cloud trade-offs into business terms?

   Answer outline (STAR)

   • SituationA choice with cost or risk attached, such as going multi-region.
   • TaskGet a decision from people who aren't engineers.
   • ActionFrame the options by cost, risk and time, and recommend one.
   • ResultThe decision, and how it played out.

6. 6.Tell me about designing for compliance or data residency.

   What they're really asking: Can you turn legal requirements into architecture?

   Answer outline (STAR)

   • SituationA rule to keep customer data in one country or region.
   • TaskSatisfy it without duplicating everything.
   • ActionMap rules to controls, choose regions, limit replication and logs, document with compliance.
   • ResultThe audit result, and what the constraint cost.

7. 7.Tell me about hitting a cloud service limit in production.

   What they're really asking: Do you know provider quotas, and how fast you react when one bites?

   Answer outline (STAR)

   • SituationA deploy or traffic spike that hit an account or API quota.
   • TaskRestore service and avoid a repeat surprise.
   • ActionRaise the quota, work around it, add alerts at a safe distance from each limit.
   • ResultTime to recover, and the quota review you set up.

8. 8.Tell me about a disaster recovery test you ran.

   What they're really asking: Do you prove recovery plans, or just write them?

   Answer outline (STAR)

   • SituationA plan that had never been exercised.
   • TaskFind out whether recovery really works.
   • ActionSchedule a drill, restore into a clean account or region, time every step.
   • ResultThe measured recovery time, and the gaps you fixed.

9. 9.Tell me about bringing order to accounts, tags or permissions across many teams.

   What they're really asking: Can you introduce governance that people accept?

   Answer outline (STAR)

   • SituationDozens of teams in one account, with no ownership or cost tags.
   • TaskCreate structure without blocking delivery.
   • ActionPropose an account layout, enforce tags by policy, migrate team by team, offer templates.
   • ResultCost visibility, fewer orphaned resources, and adoption.

10. 10.Tell me about choosing a managed service over running one yourself.

    What they're really asking: Do you weigh engineer time against control and cost?

    Answer outline (STAR)

    • SituationA team about to run its own database, queue or search cluster.
    • TaskDecide on total cost, not the monthly bill alone.
    • ActionCompare operations effort, features, limits and lock-in, then pilot the managed option.
    • ResultThe decision, the cost, and the time the team saved.

Technical and role-skill questions (11–22)

Can you do the work itself? Think out loud and name the trade-offs.

1. 11.Design a highly available web application on your cloud of choice.

   What they're really asking: Can you explain why each component is there and what happens when it fails?

   Answer outline

   • A load balancer across at least two availability zones, with autoscaling instances or containers.
   • A managed database with a standby in another zone, plus backups.
   • A CDN for static assets, with monitoring and alerts.

   Full sample answer (fictional example)

   I'd put a load balancer in front, spread across at least two availability zones, with the application on an autoscaling group or containers that replace unhealthy instances. The database would be a managed one with a standby in a second zone and automated backups. Static assets go behind a CDN. Instances sit in private subnets, with only the load balancer public. I'd add health checks, monitoring and alerts, and test the failover. Then I'd say what's still a single point of failure, probably the region, and what making it multi-region would cost.

2. 12.How do you design a VPC for a new environment?

   What they're really asking: Do you understand cloud networking, or only click through the console?

   Answer outline

   • Public subnets only for load balancers; private subnets for apps and databases.
   • NAT for outbound traffic, route tables, and security groups with least privilege.
   • Plan IP ranges that won't overlap with networks you'll connect later.

3. 13.How does IAM work, and how do you apply least privilege?

   What they're really asking: Identity is the main security boundary in the cloud.

   Answer outline

   • Roles carry policies that allow specific actions on specific resources.
   • Prefer roles and short-lived credentials to long-lived access keys.
   • Start narrow, use access analysis tools and review permissions regularly.

   Full sample answer (fictional example)

   IAM controls who or what can do which actions on which resources. Roles carry policies, and workloads or people assume a role to get temporary credentials. I prefer roles with short-lived credentials to long-lived access keys. For least privilege I start narrow, granting only the actions and resources a job needs, then use the provider's access analysis tools to see which permissions are actually used and trim the rest. I review permissions regularly, require MFA for humans, and keep admin rights time-limited and audited.

4. 14.How do you structure infrastructure as code across modules and environments?

   What they're really asking: Will your code still be safe to change when many teams depend on it?

   Answer outline

   • Reusable modules with versioned releases.
   • Separate state or stacks per environment: the same code with different variables.
   • CI to validate, plan and apply, with policy checks such as OPA or Sentinel.

5. 15.Containers, serverless or virtual machines: how do you choose?

   What they're really asking: Do you choose compute by workload and cost, or by habit?

   Answer outline

   • Serverless for spiky, event-driven work with no servers to manage.
   • Containers for portable services with steady traffic.
   • VMs for legacy software or special OS needs; compare the cost at scale.

6. 16.How do you back up and restore data in the cloud?

   What they're really asking: Recovery planning, which teams often neglect.

   Answer outline

   • Automated backups and snapshots with retention policies.
   • Copies in another region or account, against both disasters and account compromise.
   • Test restores regularly, and know your RPO and RTO.

   Full sample answer (fictional example)

   I'd use automated backups and snapshots with a retention policy matched to the business's needs. Copies go to another region and, as protection against account compromise, to a separate account with restricted delete rights. The part many teams skip is testing restores: I'd schedule a regular restore into a clean environment and time it. That tells us our real recovery time and data loss, which I'd compare with the agreed targets, the RTO and RPO. I'd also include configuration, such as infrastructure code and secrets, in the recovery plan, not only data.

7. 17.What do you look at first when the cloud bill jumps?

   What they're really asking: Can you trace a cost spike to its cause quickly?

   Answer outline

   • Break the cost down by service, account and tag.
   • Usual suspects: data transfer, idle instances, unattached volumes, log volumes.
   • Set budgets and anomaly alerts so the next jump is caught in days, not at month end.

8. 18.What is the shared responsibility model?

   What they're really asking: Do you know where the provider's job ends and yours begins?

   Answer outline

   • The provider secures the underlying infrastructure; you secure what you put on it.
   • The line moves: more is yours with virtual machines, less with managed or serverless services.
   • Give an example: patching a VM is yours, patching a managed database engine is theirs.

9. 19.How do DNS routing and a CDN improve availability and speed?

   What they're really asking: Edge networking basics that affect user experience.

   Answer outline

   • A CDN caches content near users, cutting latency and shielding the origin.
   • DNS routing can send users to the nearest or healthiest region, using health checks.
   • Mind TTLs for failover speed, and cache rules so private data is never shared.

10. 20.How do you manage encryption keys in the cloud?

    What they're really asking: Security basics: who can decrypt what, and who can prove it.

    Answer outline

    • Use the provider's key management service, with separate keys per application or data class.
    • Control use with IAM, enable rotation, and log every key operation.
    • Decide when you need customer-managed keys, and plan for a lost key.

11. 21.How do autoscaling groups and load balancers work together, and what can go wrong?

    What they're really asking: Do you understand the moving parts behind elastic capacity?

    Answer outline

    • The group adds or removes instances on a metric; the balancer routes to healthy ones.
    • Failures: slow warm-up, health checks too strict or too loose, scale-down killing busy instances.
    • Use connection draining, sensible cooldowns and a load test to tune the policy.

12. 22.How would you connect an on-premises network to the cloud?

    What they're really asking: Hybrid networking, still common in real organisations.

    Answer outline

    • A site-to-site VPN is quick and cheap; a dedicated link gives steadier latency and bandwidth.
    • Plan non-overlapping IP ranges, routing and DNS across both sides.
    • Add redundancy with two tunnels or links, and monitor the connection.

Take-home or live exercise: tips

Cloud interviews often include an architecture whiteboard, such as a highly available web app, and sometimes a hands-on task with infrastructure code or a console walkthrough.

• State the requirements first: users, availability target, data sensitivity and budget.
• Draw zones, subnets and trust boundaries, and explain what happens when each part fails.
• Mention the cost and the operating effort of every choice; interviewers listen for both.

Skills employers test for

Technical rounds follow the job ad. These skills are named most often in the 507 newest cloud engineer job ads we analysed (out of 2,035 live postings), shown as the share of ads that mention each. Expect questions on the top few.

1. 1CI/CD63%
2. 2Infrastructure as Code57%
3. 3AWS55%
4. 4Terraform54%
5. 5Kubernetes52%
6. 6Python50%
7. 7Azure45%
8. 8DevOps45%

Full list: Cloud Engineer resume keywords.

From live job ads · computed November 2, 2026 · refreshed daily

Situational questions (23–30)

Scenarios that test judgement: say what you'd do first, and why.

1. 23.A developer needs admin access to production to fix an urgent bug. What do you do?

   What they're really asking: Will you help fast without handing out permanent admin rights?

   Answer outline

   • Grant time-limited, audited access to the specific resources involved.
   • Pair with them, or push the change through the pipeline instead.
   • Remove the access afterwards and fix what made it necessary.

   Full sample answer (fictional example)

   I'd help quickly without giving permanent admin. I'd grant time-limited, audited access scoped to the resources involved, through a break-glass role that expires in an hour, and I'd pair with the developer, or have them push the change through the pipeline where possible. I'd log why the access was needed. Afterwards I'd remove it, and look at what made it necessary: a missing runbook, missing logs or a missing self-service option. If it happens twice, that's a gap in the platform that I should fix.

2. 24.Your provider has a regional outage. What happens to your services?

   What they're really asking: Do you know honestly what would fail, and how fast you'd recover?

   Answer outline

   • Describe the current design honestly: single region, warm standby or active-active.
   • Walk through the failover steps and the RTO and RPO you can really achieve.
   • Say what you'd improve, and what it would cost.

   Full sample answer (fictional example)

   I'd answer honestly about the current design first. Today we run in one region with a warm standby database in another, so the stateless services would need to be started there, which our runbook says takes about 45 minutes, and we'd lose up to five minutes of data. I'd walk through the failover steps, the RTO and RPO we can really achieve, and what's untested. Then I'd say what I'd improve: automating the failover and rehearsing it twice a year, and what each step costs.

3. 25.You find resources in your account that nobody owns. What do you do?

   What they're really asking: Do you clean up safely, without deleting something that matters?

   Answer outline

   • Use tags, audit logs and billing data to trace who created them.
   • Announce, tag for deletion, snapshot, then delete after a deadline.
   • Enforce tagging policies so it doesn't happen again.

4. 26.Your company must move to a different cloud provider within a year. How do you plan it?

   What they're really asking: Can you plan a long, risky programme in stages that can be undone?

   Answer outline

   • Inventory workloads and dependencies, and rank them by risk and value.
   • Migrate in waves, starting with low-risk services, each with a rollback plan.
   • Train the team, and run old and new side by side until stable.

5. 27.A security group change has exposed a database to the internet. How do you respond?

   What they're really asking: Fast containment, honest investigation and prevention.

   Answer outline

   • Close the exposure at once, then record exactly when it opened and closed.
   • Check access logs, rotate credentials, and look for signs of use.
   • Add a guardrail that blocks public database access, and report the event.

   Full sample answer (fictional example)

   I'd close the exposure first by restoring the security group rule, and note the exact time it was open. Then I'd tell the security team and check the logs for connections from unknown addresses during that window. If anything suspicious appears, I'd rotate database credentials and start incident response. If not, I'd still rotate them if the database used a shared password. For prevention, I'd add a policy that blocks public access to databases, and require changes to security groups to go through review in the pipeline.

6. 28.Autoscaling didn't scale during a traffic spike. How do you investigate?

   What they're really asking: Do you read the scaling logic, not just the graphs?

   Answer outline

   • Check the metric, the threshold, the evaluation period and the cooldown.
   • Look for limits: instance quotas, subnet IP space or capacity shortages.
   • Fix the policy, load test it, and alert when desired and actual capacity diverge.

7. 29.A team wants to use a cloud service your company hasn't approved. What do you do?

   What they're really asking: Do you say yes safely, instead of just blocking?

   Answer outline

   • Ask about the need and the data it will touch.
   • Review security, cost and support quickly, with a lightweight checklist.
   • Approve with guardrails, or propose an approved alternative, and publish the decision.

8. 30.A developer deleted a production resource by mistake. What do you do?

   What they're really asking: Recovery first, blame never, then a safer design.

   Answer outline

   • Check for backups, snapshots, versioning or recovery features, and restore.
   • Tell the affected teams what happened and the expected time to recover.
   • Afterwards, add deletion protection, tighter permissions and a pipeline-only change path.

Red flags to avoid in your answers

Each one is quick to fix before the day.

1. Naming services without saying why.

   Give the reason for each choice and the alternative you rejected.

2. Using admin or root rights as the default.

   Describe least privilege, short-lived credentials and how you'd grant emergency access.

3. Ignoring cost.

   Add a rough cost, or a cost-control step, to every design you describe.

4. Claiming 'multi-cloud' as a goal with no reason.

   Tie each portability decision to a risk, and say what it costs in effort.

How to prepare for a cloud engineer interview in 7 days

An hour or two a day is enough; the order matters more than the length.

1. 1

   Day 1: Pin the provider

   Read the ad for the provider and services named, and list its core compute, storage, network and identity services.

2. 2

   Day 2: Draw and explain

   Draw a highly available web architecture and explain each part and its failure mode within 15 minutes.

3. 3

   Day 3: Network and identity

   Design a VPC with public and private subnets, then write least-privilege policies for two roles.

4. 4

   Day 4: Code your stack

   Deploy a small stack with Terraform or the provider's tool, then review its plan as you would a teammate's.

5. 5

   Day 5: Cost and recovery

   Prepare your cost story with numbers, and a backup-and-restore answer that names RPO and RTO.

6. 6

   Day 6: Scenario mock

   Have a friend give you two scenarios, such as a regional outage and a leaked key, and answer aloud.

7. 7

   Day 7: Fill the gaps

   Review exam-level topics you've skipped, prepare three questions on cost ownership and risk, then rest.

Questions to ask the interviewer

Pick two or three; the answers tell you whether you want the job.

1. Which provider do you use, and are you multi-cloud or planning to be?
2. How is infrastructure as code organised, and who reviews the changes?
3. How do teams get new infrastructure today: tickets or self-service?
4. Who owns cloud costs, and how often are they reviewed?
5. What's the biggest risk in the current setup?

Preparation tips

• Know the core services of the provider in the job ad well: compute, storage, networking, IAM and databases.
• Practise drawing a highly available architecture and explaining why each component is there.
• A certification helps, but prepare real examples; interviewers probe beyond the exam.
• Prepare a cost story with numbers: what you saved, and how.

Prepare the general questions too: tell me about yourself, why do you want to work here? and why are you leaving? Afterwards, send a thank-you email; when the offer comes, negotiate the salary.