Cloud engineer interview questions test whether you can build and run infrastructure on a public cloud safely: networking, identity and access, reliability, cost, automation, and how you handle an outage. The three questions you are most likely to get are "Walk me through how you would set up a network for a three-tier web app", "How do you give a service only the access it needs?" and "Tell me about an incident you handled." This guide gives you 30 questions grouped by topic, what a strong answer shows for each, five sample answers we wrote, and the vendor frameworks interviewers expect you to know, checked on the vendors' own documentation as of October 2026.
How the cloud engineer interview usually runs
Stages vary by employer. A cloud team at a software company often looks like a DevOps loop, while a consultancy or enterprise IT team may weight certifications and migrations more. Ask the recruiter which provider the team uses most and which rounds you will get.
| Stage | What it usually covers | How to prepare |
|---|---|---|
| Recruiter screen | Providers you have used, scale, certifications | Name concrete services, account sizes and what you owned |
| Technical screen | Networking, IAM, Linux, scripting basics | Explain fundamentals without reaching for a console |
| Hands-on or take-home | Write Terraform or a script, fix a broken config | Practice small modules from a blank file |
| Design round | Design a highly available, secure, cost-aware app | Draw the network first, then compute, data and security |
| Troubleshooting or incident | "The site is down, go" | Use a fixed order: scope, recent changes, signals, rollback |
| Behavioral | Ownership, on-call, disagreements, mistakes | Four or five STAR stories, including one outage |
The frameworks interviewers expect you to know
Design questions are often scored against the provider's own well-architected framework, so it helps to use its vocabulary. As of October 2026:
- The AWS Well-Architected Framework has six pillars: operational excellence, security, reliability, performance efficiency, cost optimization and sustainability (AWS documentation).
- The Azure Well-Architected Framework has five pillars: reliability, security, cost optimization, operational excellence and performance efficiency (Microsoft Learn).
- The Google Cloud Well-Architected Framework has six pillars: operational excellence; security, privacy, and compliance; reliability; cost optimization; performance optimization; and sustainability (Google Cloud documentation).
- AWS describes its shared responsibility model as security "of" the cloud (AWS runs the hardware, network and facilities) versus security "in" the cloud (you configure what you deploy, such as a guest operating system on EC2 or access permissions on S3 data) (AWS shared responsibility model).
Common certifications you may be asked about include AWS Certified Solutions Architect - Associate, Microsoft Certified: Azure Administrator Associate (exam AZ-104) and Google Cloud's Associate Cloud Engineer. A certification can get you the interview; the questions below are what decide it.
Networking and identity questions
- Design a network for a three-tier web app. A strong answer shows public subnets only for load balancers, private subnets for app and data tiers, at least two availability zones, and a controlled path out to the internet.
- What is the difference between a public and a private subnet? Shows you know it comes down to the route table: a route to an internet gateway makes a subnet public.
- How does an instance in a private subnet reach the internet for updates? Shows a NAT gateway (or equivalent) for outbound only, and awareness of its cost.
- Security groups versus network ACLs on AWS? Shows security groups are stateful and attach to resources, while network ACLs are stateless and apply at the subnet level.
- How would you connect two VPCs, or a VPC to an on-premises network? Shows peering, a transit hub, VPN and dedicated links, plus the overlapping CIDR problem.
- How do you give an application access to a storage bucket without keys in the code? Shows roles or managed identities attached to the workload, not long-lived access keys.
- What does least privilege mean in practice? Shows starting from narrow policies, scoping by resource and action, and reviewing unused permissions.
- How would you manage secrets? Shows a secrets manager or key vault, rotation, audit logs, and keeping secrets out of images and repos.
Compute, storage and reliability questions
- Regions versus availability zones? Shows zones are isolated locations inside a region; multi-zone protects against a data-center failure, multi-region against a regional one.
- How do you make a web app highly available? Shows a load balancer across zones, an autoscaling group, health checks, a replicated database and no single points of failure.
- VMs, containers or serverless functions: how do you choose? Shows trade-offs in control, cold starts, run time limits, cost model and team skills.
- How do you scale a database that is the bottleneck? Shows read replicas, caching, connection pooling, vertical scaling, then partitioning, in roughly that order.
- Object, block and file storage: when do you use each? Shows object for blobs and static assets, block for a VM disk or database, file for shared mounts.
- How would you back up and restore a production database? Shows automated snapshots, point-in-time recovery, copies in another region or account, and tested restores.
- What are RTO and RPO? Shows recovery time (how long you can be down) versus recovery point (how much data you can lose), and how each drives the design.
- How do you deploy without downtime? Shows rolling, blue-green or canary releases, health checks, and a fast rollback path.
Cost, automation and operations questions
- Your cloud bill jumped 40% this month. What do you do? Shows cost explorer by service and tag, then the usual suspects: idle resources, data transfer, NAT, logs, oversized instances.
- How do you reduce compute cost for a steady workload? Shows right-sizing first, then commitment discounts, and spot or preemptible capacity for interruptible work.
- Why use infrastructure as code? Shows repeatability, review in pull requests, drift detection and rebuilding an environment from scratch. Deeper tool questions are in our Terraform interview questions.
- How do you handle Terraform state for a team? Shows remote state with locking, separate state per environment, and no secrets committed in state files.
- What do you monitor for a cloud workload? Shows latency, traffic, errors and saturation, plus cost and security alerts, routed to the right on-call person.
- How do you organize accounts or subscriptions? Shows separation by environment and team, central logging, guardrail policies and consolidated billing.
- How do you run containers in production? Shows a managed orchestrator, image scanning, resource limits and autoscaling. See Kubernetes interview questions for that depth.
- How would you migrate an on-premises app to the cloud? Shows discovery, choosing between rehost, replatform and refactor, a pilot, data migration plan and cutover with rollback.
Troubleshooting, behavioral and situational questions
- Users report the site is down. Walk me through your first ten minutes. Shows scoping impact, checking recent changes, reading dashboards and logs, and rolling back before root-causing.
- An instance can't reach the database. How do you debug it? Shows a layer-by-layer check: DNS, route tables, security rules, the database listener, then credentials.
- Tell me about an incident you handled. Shows calm triage, clear communication, the fix, and the follow-up work that stopped a repeat.
- Tell me about a time you pushed back on a risky change. Shows you can raise risk with evidence and offer a safer path rather than just saying no.
- A developer needs admin access to production to fix something urgently. What do you do? Shows time-boxed, logged break-glass access instead of a permanent grant.
- How do you keep up with cloud services that change every month? Shows a real habit, such as release notes for the services you run and small hands-on tests.
Sample answers to common cloud engineer interview questions
These are examples we wrote. Swap in your own services, numbers and stories.
"Design a network for a three-tier web app."
Example (mid-level): "I'd create one VPC with a CIDR block large enough to grow, say a /16, and split it across two or three availability zones. In each zone I'd put a public subnet for the load balancer and NAT gateway, a private subnet for the app servers, and a separate private subnet for the database. Only the load balancer accepts traffic from the internet. The app tier accepts traffic only from the load balancer's security group, and the database only from the app tier on its port. App servers reach the internet for patches through NAT. I'd add flow logs and keep the whole thing in Terraform so it's reviewed and repeatable."
"How do you give an application access to a storage bucket?"
Example (any level): "I'd attach a role to the workload itself, an instance profile on EC2 or a service account for a pod, so there are no access keys in code or config. The policy would allow only the actions it needs, maybe read and write, on that one bucket or prefix. I'd turn on access logging, and if the data is sensitive, encrypt with a managed key and add a bucket policy that denies anything not coming from the expected role."
"Your cloud bill jumped 40% this month."
Example (experienced hire): "I'd open the cost breakdown by service and by tag and compare it with last month to find which line moved. In my experience the culprits are usually data transfer, NAT gateway processing, log ingestion, or something left running after a test. Once I find it, I fix the cause and add a budget alert on that service so we hear about it in days, not at month end. Last year this exact process found a debug log level left on in production that had tripled our logging cost."
"Users report the site is down. Walk me through it."
Example (on-call engineer): "First I confirm and scope it: is it everyone or one region, all pages or one endpoint? I post in the incident channel so people know someone owns it. Then I check what changed in the last hour, because a deploy or config change is the most common cause. If there was one, I roll it back first and debug after. If not, I go through the load balancer health checks, error rates, and saturation on the app and database tiers. Once service is restored, I write up the timeline for a blameless review."
"Tell me about an incident you handled."
Example (STAR, mid-level): "Our checkout API started timing out on a Friday evening. I was on call. I saw database connections pinned at the maximum right after a deploy that had raised the app's pool size, so twelve instances were opening far more connections than the database allowed. I rolled the deploy back, and errors cleared within about five minutes. In the review, we added a check that compares total pool size against the database limit in CI, and we added an alert on connection saturation."
What interviewers listen for, by skill
| Skill | Sample question | What they are listening for |
|---|---|---|
| Networking | Design a VPC for a three-tier app | Subnet layout, routing, multi-zone, least exposure |
| Identity and access | App access to a bucket | Roles over keys, narrow policies, logging |
| Reliability | Make this app highly available | No single points of failure, tested restores |
| Cost | The bill jumped 40% | A method, the usual culprits, alerts afterward |
| Automation | Why infrastructure as code? | Review, repeatability, state handling |
| Operations | The site is down | Scope, recent changes, rollback first, then root cause |
Questions to ask the interviewer
- "Which provider and services does the team run most, and is anything multi-cloud?"
- "How is infrastructure changed today: all through code review, or still some console changes?"
- "What does on-call look like, and what was the last major incident?"
- "What would you want this person to have fixed or built in the first six months?"
For more, see our full list of questions to ask the interviewer.
How to practice cloud engineer interview questions
- Draw the three-tier network from memory and explain each line out loud in under three minutes.
- Build it once in a personal account with infrastructure as code, then tear it down so you understand every resource and its cost.
- Prepare one incident story and one cost story with real numbers you can defend.
- Pick five questions from each group above and answer them aloud, timing yourself.
CoPilot Interview's Mock Interview builds questions from your résumé and the job description, reads them aloud and scores each spoken answer out of 10 with what to fix and a model answer. The free browser mock interview includes DevOps and system design tracks. For provider-specific depth, use our AWS interview questions; for the next role over, see site reliability engineer interview questions and solutions architect interview questions.
Practice cloud scenarios out loud
The free browser mock interview has DevOps and system design tracks. Talk through a design or an outage, get a score, and see what to tighten.
Try a free AI mock interviewFAQ
What are the most common cloud engineer interview questions?
The most common are designing a network for a three-tier app, public versus private subnets, how to give a workload least-privilege access, how to make an app highly available across zones, how to cut a rising cloud bill, and how you handled a production incident.
Do I need a certification to pass a cloud engineer interview?
No. Certifications such as AWS Certified Solutions Architect - Associate, Azure Administrator Associate (AZ-104) or Google Associate Cloud Engineer can help you get an interview, but the questions test hands-on judgment, so be ready to explain real systems you built or ran.
Should I prepare for AWS, Azure or Google Cloud?
Prepare for the provider in the job description, and learn the concepts that carry across all three: networks and subnets, identity and roles, zones and regions, autoscaling, managed databases and infrastructure as code. Interviewers usually accept an answer in another provider's terms if the concepts are right.
What are the pillars of the AWS Well-Architected Framework?
As of October 2026, AWS lists six pillars: operational excellence, security, reliability, performance efficiency, cost optimization and sustainability.
How technical is a cloud engineer interview?
Very. Expect networking and IAM fundamentals, a design round, troubleshooting scenarios and often a hands-on Terraform or scripting task. Behavioral questions focus on incidents, on-call and how you handle risky changes.
How can I practice cloud engineer interview questions for free?
Build a small three-tier setup in a personal account with infrastructure as code, then answer the questions out loud. CoPilot Interview has a free browser mock interview with DevOps and system design tracks that scores your spoken answers.