Top 30 Cloud Platforms Interview Questions and Answers
30 multiple-choice questions on Cloud Platforms, of the kind that come up in a technical interview, drawn from 30 bites in the Cloud Platforms library. Answer them here or read straight down. Every question carries the correct option, why it is correct, and a link to the bite it came from.
AWS, Azure, GCP, serverless, managed services
30 questions. Pick an answer, or open “Show the answer” to read it.
Answers are graded in your browser. Nothing is saved, and no XP or streak is earned here. The app keeps score.
Question 1 of 30
A company provisions virtual servers in the cloud and manages the operating system, middleware, and application code themselves. Which service model is this?
Show the answer
Answer: c · Infrastructure as a Service
This is IaaS: the vendor manages the physical infrastructure and hypervisor, while the customer manages everything from the OS upward. Platform as a Service is a tempting distractor because candidates often mistakenly label managed virtual machines as PaaS, but true PaaS abstracts away the OS and runtime management entirely.
Read the full bite: Explain the difference between IaaS, PaaS, and SaaS with examples
Question 2 of 30
When moving from IaaS to SaaS, which responsibility shifts to the cloud provider?
Show the answer
Answer: c · Patching the guest operating system
In IaaS the customer manages the guest OS, but in SaaS the provider assumes that duty. Many beginners incorrectly think the provider also secures their data in SaaS, yet data classification and protection always remain the customer's responsibility.
Read the full bite: How does shared responsibility shift between IaaS and SaaS?
Question 3 of 30
How does migrating from on-premises infrastructure to the cloud typically change a company's cost model?
Show the answer
Answer: d · It shifts spending from upfront CapEx to ongoing, usage-based OpEx
Cloud replaces large upfront asset purchases with pay-as-you-go operational spend that scales with usage. It does not eliminate costs, runs in the opposite direction of OpEx-to-CapEx, and is a different model, not a guaranteed saving.
Question 4 of 30
For a team with limited cloud expertise migrating an existing on-premises monolith, why is IaaS often the better initial choice over PaaS?
Show the answer
Answer: a · IaaS enables a lower-risk lift-and-shift without forcing an immediate app rewrite
IaaS lets the monolith move largely unchanged, reducing risk while skills are thin, with modernization to PaaS later. IaaS still has real ops overhead, PaaS offers less low-level control, and PaaS can run monoliths but usually needs refactoring.
Question 5 of 30
Which scenario specifically demonstrates elasticity rather than just scalability?
Show the answer
Answer: b · An auto-scaling group automatically adds instances during a traffic spike and removes them when it subsides
Elasticity is the automatic, two-way matching of capacity to demand, including scaling back down. Manual additions, code rewrites, and one-time vertical upgrades show scalability but not the automatic contraction that defines elasticity.
Question 6 of 30
In a hybrid cloud setup for a regulated business, which split of components is most appropriate?
Show the answer
Answer: b · Keep regulated data and legacy systems on-premises while running scalable customer-facing front ends in the public cloud
Hybrid keeps sensitive, regulated, and hard-to-migrate systems in the controlled private environment while putting elastic, customer-facing workloads in the public cloud. The other options place regulated data in the cloud or misallocate the elastic and sensitive components.
Read the full bite: When hybrid cloud beats public or private
Question 7 of 30
What is the most realistic downside a team accepts when prioritizing strict portability across two cloud providers?
Show the answer
Answer: a · They forgo the deepest managed services and slow feature velocity
Portability forces a lowest-common-denominator design, sacrificing best-of-breed managed services and adding overhead that slows delivery. Faster shipping is the opposite of what multi-cloud abstraction produces.
Read the full bite: Designing for portability across two clouds
Question 8 of 30
When bursting compute into the public cloud from on-prem, which factor most often becomes the real bottleneck?
Show the answer
Answer: d · Data gravity and the latency or cost of reaching on-prem data
Compute scales quickly, but the data the workload needs usually lives on-prem, so latency and egress dominate. Instance variety and quotas are minor and easily addressed by comparison.
Read the full bite: Hybrid cloud bursting from a VMware footprint
Question 9 of 30
Which configuration choice most directly controls what network traffic is allowed to reach a newly launched VM?
Show the answer
Answer: c · The security group rules attached to the instance
Security groups act as a virtual firewall defining permitted inbound and outbound traffic. The image, instance type, and storage size define software and capacity, not network access control.
Read the full bite: Launching a virtual machine in the cloud
Question 10 of 30
Why does a machine image enable fast, reliable auto-scaling more than manually configuring each new instance?
Show the answer
Answer: a · Images let every launched instance be identical and ready without setup steps
An image is a frozen template, so each instance launches identical and pre-provisioned, which is what makes scaling fast and deterministic. Images do not compress memory, bypass networking, or scale CPU on their own.
Read the full bite: What a machine image is and why it matters
Question 11 of 30
Before adding an auto-scaling group, what change to the single-VM web app is most essential for scaling to work correctly?
Show the answer
Answer: c · Making the application stateless so any instance can serve any request
Horizontal scaling assumes interchangeable instances, so session state must be externalized. A bigger instance is vertical scaling, and the database engine or disk encryption do not enable horizontal elasticity.
Question 12 of 30
A nightly batch job is fully interruptible and checkpoints its progress. Which pricing model fits best and why?
Show the answer
Answer: b · Spot, because the job tolerates interruption and benefits from the deepest discount
Spot offers the largest discount precisely for interruptible, fault-tolerant work like a checkpointed batch job. Reserved suits steady always-on baselines, and On-Demand needlessly pays full price for tolerant work.
Question 13 of 30
Why is storing user uploads on an auto-scaled instance's local disk a poor design choice?
Show the answer
Answer: d · The data is lost when the instance is terminated or replaced during scaling
Auto-scaled instances are ephemeral, so any durable data on local disk vanishes on replacement. Local disks can store binaries and are often fast; the fatal issue is impermanence, not speed or file type.
Read the full bite: Managing state across ephemeral instances
Question 14 of 30
What is the most security-relevant capability the instance metadata service provides to an application?
Show the answer
Answer: a · It vends temporary, rotating credentials for the instance's attached role
The service delivers short-lived, auto-rotated role credentials so apps avoid hardcoded keys. It is link-local rather than internet-reachable, does not serve external config, and does not handle disk encryption.
Question 15 of 30
What is the main trade-off of placing latency-sensitive VMs in a tight cluster placement group?
Show the answer
Answer: d · It reduces fault isolation since instances share the same rack or zone
Packing instances physically close for low latency concentrates them, so a single hardware or zone failure can take down many at once. Placement groups do not cap instance size or disable enhanced networking.
Read the full bite: Optimizing low-latency VM-to-VM networking
Question 16 of 30
In a Spot-based batch system, what mechanism ensures a task is reprocessed when its worker is reclaimed mid-job?
Show the answer
Answer: b · The queue's visibility timeout makes the unacknowledged task available again
If a worker is reclaimed before acknowledging, the message reappears after the visibility timeout for another worker to process. Metadata services, load balancers, and Reserved capacity do not provide this requeue guarantee.
Read the full bite: Cost-effective fault-tolerant batch processing
Question 17 of 30
Which storage type is the appropriate backing for a relational database that needs low-latency random reads and writes?
Show the answer
Answer: b · Block storage, because it provides a raw low-latency volume to a single instance
Databases need fast in-place random I/O on a volume attached to one host, which is exactly what block storage provides. Object storage reads and writes whole objects over HTTP and is unsuitable for transactional workloads.
Question 18 of 30
How can you serve images from object storage through a CDN while keeping the bucket itself private?
Show the answer
Answer: a · Grant the CDN read access via origin access control and deny all other bucket access
Origin access control lets only the CDN read the bucket while it stays private to everyone else. A public bucket defeats the goal, copying defeats the origin model, and signed URLs are time-limited, not permanent.
Read the full bite: Serving user images securely from object storage
Question 19 of 30
A general-purpose SSD volume performs well briefly then suddenly throttles under sustained load. What is the likely cause?
Show the answer
Answer: d · The volume exhausted its I/O burst credit balance
General-purpose SSDs offer a baseline plus burstable IOPS via credits; sustained load depletes the credits and triggers throttling. CPU credits, archiving, and security groups do not govern block-storage I/O.
Read the full bite: Diagnosing high I/O wait on a database volume
Question 20 of 30
What workload pattern most degrades performance on a managed shared network file system at scale?
Show the answer
Answer: d · Metadata-heavy access to millions of tiny files
Each metadata operation on a small file is a network round trip, so millions of tiny files cause severe latency. Large sequential streaming and single-writer workloads are exactly what network file systems handle well.
Read the full bite: Shared file system access across many VMs
Question 21 of 30
Why is a service's advertised eleven-nines durability insufficient protection for critical object data?
Show the answer
Answer: c · It guards against hardware loss, not accidental deletion, corruption, or malicious removal
Eleven-nines durability addresses physical media failure, but a human or buggy process can still delete or overwrite objects. Versioning and object lock, not the durability number, protect against those threats.
Read the full bite: Protecting object storage from accidental loss
Question 22 of 30
What is the core trade-off when moving objects to a colder storage tier like Archive?
Show the answer
Answer: b · Lower storage cost but higher retrieval cost and slower access
Colder tiers reduce per-gigabyte storage cost but charge more to retrieve and add latency or minimum durations. Durability is not reduced, and retrievals are never free in archive tiers.
Read the full bite: Object storage tiers and lifecycle automation
Question 23 of 30
Why does writing millions of tiny objects under one sequential key prefix limit object-store throughput?
Show the answer
Answer: a · Each tiny write incurs request overhead and a single prefix can hotspot one partition
Throughput is bounded by request rate plus partition distribution, so per-object overhead and a single hot prefix throttle writes. Prefixes do not increase storage size, are not rejected, and small objects are not written twice.
Read the full bite: Maximizing object-store throughput for small files
Question 24 of 30
Two clients concurrently update the same object in a strongly consistent object store. What is the realistic outcome?
Show the answer
Answer: b · Last writer wins and one update is silently lost without coordination
Object stores replace whole objects with no built-in locking, so concurrent PUTs are last-writer-wins and an update is lost unless you use conditional writes. There is no automatic merge, lock, or reconciliation.
Question 25 of 30
Which approach delivers the lowest RTO and RPO for a stateful database when its availability zone fails?
Show the answer
Answer: d · A synchronous standby in another AZ that promotes on failure
A synchronous cross-AZ standby holds committed data and promotes quickly, giving near-zero RTO and RPO. Snapshots and backups lose recent writes and take time to restore, and a bigger same-AZ volume offers no AZ-failure protection.
Read the full bite: Block storage availability across AZ failure
Question 26 of 30
What most fundamentally keeps a database in a private subnet unreachable from the internet?
Show the answer
Answer: c · The private subnet's route table has no route to an internet gateway
Without an internet-gateway route, no inbound internet path exists to the subnet, providing network-level isolation. Security groups add a layer but routing is the structural control, and NAT only enables outbound, not encryption.
Question 27 of 30
A service exposes a custom binary protocol over TCP that needs maximum throughput and source IP preservation. Which load balancer fits best and why?
Show the answer
Answer: d · Layer 4, because it routes on IP and port without reading payload, adding minimal overhead
L4 routes purely on IP and port, so it handles arbitrary protocols at high throughput with low overhead. L7 must terminate and parse HTTP, which it cannot do for a custom binary protocol.
Question 28 of 30
Why might a freshly changed DNS record not take effect immediately for all users worldwide?
Show the answer
Answer: b · Cached answers persist in resolvers until the previous record's TTL expires
Resolvers cache records for the TTL set before the change, so old answers linger until that timer expires. Root servers do not approve individual records, and browsers do cache DNS.
Question 29 of 30
A company expects to grow from two VPCs to forty, all needing to reach shared services. Which approach avoids an unmanageable connectivity mesh?
Show the answer
Answer: d · A Transit Gateway acting as a central hub-and-spoke router
A Transit Gateway centralizes routing so each VPC attaches once, avoiding the N-squared peering mesh. Pairwise peering scales poorly and is non-transitive.
Question 30 of 30
SSH to an instance works and the app process is running, yet the load balancer reports it unhealthy. Which is the LEAST likely useful first check?
Show the answer
Answer: d · Rebooting the entire instance before reading any probe response
Rebooting blindly discards diagnostic state and rarely addresses a probe mismatch. The productive steps reproduce the probe to find a path, port, status, or firewall mismatch.
Read the full bite: Process running but load balancer says unhealthy
Could you explain these out loud?
That is what an interview actually tests. Tezvyn gives you questions like these with what the interviewer is really checking, the answer that lands, and the mistake that ends the conversation, in the four minutes before your next meeting.
The iPhone app is on the way
We are building it. Until it lands, nothing here is held back from you: every interview card, your saved cards, streaks and the job board all work in Safari, plus hundreds of free practice quizzes of thirty questions each. Sign in and it all carries over to the app the day it arrives.
Want it as an icon? Tap Share at the bottom of Safari, then Add to Home Screen. It opens full screen and the cards you have read stay available offline.