Cloud & Infrastructure Interview Guide
Every question uses the same frame: what it tests, a scenario, three progressively stronger answers, the flags on both sides, and follow-ups. Strong candidates reason from the workload — what it needs, what it costs to run, what still breaks — never from a product catalogue.
What is the actual difference between a container and a virtual machine, and when would you still choose a VM?
A team wants to move their service to Kubernetes. What do you ask before agreeing, and what would make you say no?
Your database sits in a private subnet with no route to the internet. What does that actually buy you — and what does it not?
A background worker needs to read files from one object storage bucket. Write the permissions you would give it.
What are RPO and RTO, and how would you establish them for a payments system?
A team is picking a compute model for a new service. How do you choose between VMs, managed containers, Kubernetes and functions?
Should you run PostgreSQL on your own instances or use a managed database service? What do you still own either way?
Leadership wants the system to be multi-region for high availability. What do you tell them?
You are configuring autoscaling for a web service. What signal do you scale on, and where do you set the threshold?
What is the difference between a liveness probe and a readiness probe, and what goes wrong when you conflate them?
What is Terraform state, why does it exist, and what happens when a team treats it carelessly?
What is infrastructure drift, how does it happen, and what does the next apply do about it?
How should an application get its database password in production, and what is wrong with the common approaches?
A cloud bill triples with no change in traffic or instance count. Where do you look first, and why is egress so often the answer?
Your instances average 8% CPU. How do you right-size them, and what would make you stop?
Compare rolling, blue-green and canary deployments. Which would you pick for a payments API, and what makes each one fail?
What is the difference between a NAT gateway and an internet gateway, and when does each belong in the design?
What is the difference between object, block and file storage, and how do you choose?
A team wants to move a service to functions to reduce cost. What do you check first?
The board wants a multi-cloud strategy to avoid lock-in and improve reliability. How do you respond?
How do you know your backups actually work, and what does a real backup strategy include beyond taking backups?
Explain the shared responsibility model. Which security failures are still yours after moving to a managed platform?
Universal signals
The reasoning patterns that separate answers, independent of which question was asked.
Starts from the workload rather than a product, names what stays theirs after adopting a managed service, states the cost of every recommendation, and refuses complexity the business never asked for.
Kubernetes because production, managed means somebody else's problem, multi-region means highly available, and a backup that has never been restored counted as recovery.