Top 30 Advanced Cloud Platforms Interview Questions and Answers
30 advanced multiple-choice Cloud Platforms interview questions, the deep end: internals, failure modes, and the design calls a senior engineer is expected to defend. They come from 30 bites in the Cloud Platforms library, the hardest slice of the 130 Cloud Platforms interview questions in the library. Answer them here or read straight down. Every question carries the correct option, why it is correct, and a link to the bite it came from.
AWS, Azure, GCP, serverless, managed services
30 questions. Pick an answer, or open “Show the answer” to read it.
Answers are graded in your browser. Nothing is saved, and no XP or streak is earned here. The app keeps score.
Question 1 of 30
What is the most realistic downside a team accepts when prioritizing strict portability across two cloud providers?
Show the answer
Answer: a · They forgo the deepest managed services and slow feature velocity
Portability forces a lowest-common-denominator design, sacrificing best-of-breed managed services and adding overhead that slows delivery. Faster shipping is the opposite of what multi-cloud abstraction produces.
Read the full bite: Designing for portability across two clouds
Question 2 of 30
When bursting compute into the public cloud from on-prem, which factor most often becomes the real bottleneck?
Show the answer
Answer: d · Data gravity and the latency or cost of reaching on-prem data
Compute scales quickly, but the data the workload needs usually lives on-prem, so latency and egress dominate. Instance variety and quotas are minor and easily addressed by comparison.
Read the full bite: Hybrid cloud bursting from a VMware footprint
Question 3 of 30
What is the main trade-off of placing latency-sensitive VMs in a tight cluster placement group?
Show the answer
Answer: d · It reduces fault isolation since instances share the same rack or zone
Packing instances physically close for low latency concentrates them, so a single hardware or zone failure can take down many at once. Placement groups do not cap instance size or disable enhanced networking.
Read the full bite: Optimizing low-latency VM-to-VM networking
Question 4 of 30
In a Spot-based batch system, what mechanism ensures a task is reprocessed when its worker is reclaimed mid-job?
Show the answer
Answer: b · The queue's visibility timeout makes the unacknowledged task available again
If a worker is reclaimed before acknowledging, the message reappears after the visibility timeout for another worker to process. Metadata services, load balancers, and Reserved capacity do not provide this requeue guarantee.
Read the full bite: Cost-effective fault-tolerant batch processing
Question 5 of 30
Why does writing millions of tiny objects under one sequential key prefix limit object-store throughput?
Show the answer
Answer: a · Each tiny write incurs request overhead and a single prefix can hotspot one partition
Throughput is bounded by request rate plus partition distribution, so per-object overhead and a single hot prefix throttle writes. Prefixes do not increase storage size, are not rejected, and small objects are not written twice.
Read the full bite: Maximizing object-store throughput for small files
Question 6 of 30
Two clients concurrently update the same object in a strongly consistent object store. What is the realistic outcome?
Show the answer
Answer: b · Last writer wins and one update is silently lost without coordination
Object stores replace whole objects with no built-in locking, so concurrent PUTs are last-writer-wins and an update is lost unless you use conditional writes. There is no automatic merge, lock, or reconciliation.
Question 7 of 30
Which approach delivers the lowest RTO and RPO for a stateful database when its availability zone fails?
Show the answer
Answer: d · A synchronous standby in another AZ that promotes on failure
A synchronous cross-AZ standby holds committed data and promotes quickly, giving near-zero RTO and RPO. Snapshots and backups lose recent writes and take time to restore, and a bigger same-AZ volume offers no AZ-failure protection.
Read the full bite: Block storage availability across AZ failure
Question 8 of 30
A workload needs predictable single-digit-millisecond latency and steady multi-gigabit throughput to the cloud. Which is the strongest choice and its main cost?
Show the answer
Answer: a · Dedicated interconnect, with higher recurring cost and weeks of lead time
A dedicated interconnect bypasses the public internet for consistent low latency and high bandwidth, but costs more and takes weeks to install. VPNs inherit variable internet latency, so they cannot guarantee it.
Read the full bite: Site-to-Site VPN vs dedicated interconnect
Question 9 of 30
Why is assigning public IPs directly to autoscaling instances a poor way to satisfy a partner's IP allowlist?
Show the answer
Answer: a · Instance public IPs change as the fleet scales, so the allowlist becomes stale
Autoscaling cycles instances and reassigns ephemeral IPs, so an allowlist built on them breaks. Routing through NAT gateways with allocated static IPs gives a stable, whitelistable source set.
Read the full bite: Stable egress IPs for multi-region outbound traffic
Question 10 of 30
Why can a service like Global Accelerator speed up POST-heavy traffic that a standard CDN cache cannot?
Show the answer
Answer: d · It terminates connections at a nearby edge and routes over an optimized backbone
Acceleration shortens handshake round trips at a nearby edge and uses the provider's optimized backbone, helping uncacheable traffic. POSTs are not cacheable, so caching them is not an option.
Read the full bite: Accelerating uncacheable dynamic traffic globally
Question 11 of 30
What design choice most directly enables rotating database credentials without restarting the microservices?
Show the answer
Answer: a · Fetching short-lived leased credentials at runtime and refreshing the pool before expiry
Runtime-fetched, leased credentials that the client refreshes and swaps into the connection pool rotate without a restart. Static env-var or image-baked passwords can only change by restarting or redeploying.
Read the full bite: Dynamic database credential rotation for microservices
Question 12 of 30
Why centralize audit logs into a dedicated, restricted account rather than keeping them in each source account?
Show the answer
Answer: d · A compromised source account could otherwise tamper with or delete its own evidence
Centralizing into a locked-down account with immutable storage prevents an attacker who controls a workload account from erasing the trail of their activity. The other options misstate cost and technical constraints.
Read the full bite: Centralized logging and threat detection across accounts
Question 13 of 30
A team uses a cloud provider's HIPAA-eligible database service and assumes the application is therefore compliant. What is the flaw in this reasoning?
Show the answer
Answer: c · Eligibility enables compliance, but correct configuration and controls remain the customer's responsibility
An eligible service can be used in a compliant way, but the customer must still configure isolation, encryption, access, and logging correctly. Eligibility never certifies the whole deployment automatically.
Read the full bite: Architecting for HIPAA or PCI DSS compliance
Question 14 of 30
To query a DynamoDB table by a non-key attribute without scanning, what is the correct approach and its main tradeoff?
Show the answer
Answer: a · Create a global secondary index on the attribute; it adds storage and write capacity cost and is eventually consistent
A GSI turns the lookup into a targeted query but duplicates data, consumes write capacity per base write, and is eventually consistent. A filtered Scan still reads the whole table, so it is not a real solution.
Read the full bite: Add a second access pattern to a key-value store
Question 15 of 30
A candidate proposes a global multi-region database with low-latency local writes everywhere and full strong global consistency at minimal cost. What is the flaw?
Show the answer
Answer: d · Strong global consistency requires cross-region coordination, which conflicts with the low local write latency goal
Strong global consistency forces synchronous cross-region coordination, raising write latency and cost. You cannot get low local latency, strong global consistency, and low cost at once, which is the core tradeoff.
Question 16 of 30
According to the CAP theorem, when is the consistency-versus-availability tradeoff actually forced on a distributed database?
Show the answer
Answer: c · Only during a network partition, when the system must choose consistency or availability
Partition tolerance is mandatory, so the real choice between consistency and availability only arises during a partition. Outside a partition a system can offer both, and Spanner does not beat CAP.
Question 17 of 30
Why is enqueuing a long-running report job to a message queue better than running it in a background thread inside the web process?
Show the answer
Answer: d · The queue persists the job so it survives worker crashes and restarts, with retries and decoupled scaling
A durable queue keeps the job safe across restarts, enables retries, and lets workers scale independently. An in-process thread dies with the ephemeral instance, silently losing the work.
Read the full bite: Offload long-running tasks from web requests
Question 18 of 30
What directly causes the extra latency of a serverless cold start?
Show the answer
Answer: b · Provisioning a new execution environment and initializing the runtime, code, and dependencies
A cold start is the time to allocate a fresh environment and run runtime and code initialization when no warm instance exists. It is unrelated to ordinary network latency or steady-state GC pauses.
Question 19 of 30
Which change is most essential when migrating a local-disk-dependent monolith to a horizontally scaled PaaS?
Show the answer
Answer: a · Externalizing state to backing services so processes become stateless and disposable
Twelve-Factor requires stateless, disposable processes with state moved to backing services so any instance is interchangeable. Vertical scaling, permanent sticky sessions, and a full rewrite miss or overshoot the core fix.
Question 20 of 30
In IRSA, what actually turns the pod's projected service-account token into usable AWS credentials?
Show the answer
Answer: b · An STS AssumeRoleWithWebIdentity call validated against the cluster OIDC provider
IRSA federates via OIDC: the SDK calls STS AssumeRoleWithWebIdentity with the projected token to obtain temporary credentials. The instance profile would grant identical permissions to every pod on the node, defeating per-workload isolation.
Question 21 of 30
Why might a ResourceQuota that caps total CPU limits silently reject otherwise valid pods in a tenant namespace?
Show the answer
Answer: a · Pods that omit CPU limits violate the quota unless a LimitRange supplies defaults
A quota on limits requires every pod to declare limits; without a LimitRange providing defaults, undeclared pods are rejected. RBAC and the CNI govern access and networking, not whether resource requests satisfy a quota.
Read the full bite: Isolate tenants in a shared Kubernetes cluster
Question 22 of 30
Large requests between pods on different nodes intermittently fail while small ones always work. What is the most likely root cause?
Show the answer
Answer: b · An MTU mismatch from overlay encapsulation dropping oversized packets
Size-dependent failures point to MTU: overlay headers shrink the usable MTU, so large packets are dropped while small ones pass. RBAC and quotas do not inspect packet size, and a thread-pool issue would not correlate with payload size.
Read the full bite: Debug intermittent pod-to-pod connectivity
Question 23 of 30
Why does a high-concurrency serverless API often crash a PostgreSQL backend, and what best addresses it?
Show the answer
Answer: c · Each instance opens its own connection, exhausting the pool; use a proxy to multiplex onto a small pool
Thousands of function instances each opening a connection exceed the database's bounded max_connections. A proxy or pooler multiplexes them onto a small warm pool. Memory, protocol, and DLQ changes do not address connection exhaustion.
Read the full bite: Serverless functions with a relational database
Question 24 of 30
To keep all events for a given user ordered in a high-throughput stream while still scaling, what is the right approach?
Show the answer
Answer: d · Partition the stream by user ID so each user's events stay on one ordered shard
Partitioning by user ID keeps each user's events on one shard where order is preserved, while many shards scale throughput. A global FIFO serializes everything and cannot scale; per-event invocation and no checkpointing hurt cost and reliability.
Read the full bite: High-throughput serverless stream processing
Question 25 of 30
What state strategy best supports many teams managing dev, staging, and prod with the same IaC codebase?
Show the answer
Answer: d · State split per environment and component, with the same versioned modules promoted via variables
Splitting state per environment and component limits blast radius and locking contention while reusing versioned modules keeps environments consistent. Shared state risks fleet-wide breakage, copies drift, and local state cannot be shared safely.
Read the full bite: Strategy for large multi-team IaC projects
Question 26 of 30
What most distinguishes SLO-and-error-budget monitoring from traditional threshold-based alerts?
Show the answer
Answer: d · It alerts on user-facing reliability burn rate and ties release decisions to the budget
SLO-based monitoring pages on how fast you burn an error budget defined by user experience, and uses budget health to gate releases. Threshold alerts fire on raw signals; no approach guarantees 100 percent uptime, which would leave no budget.
Question 27 of 30
What safeguard is most critical when automating cost optimization actions in a cloud environment?
Show the answer
Answer: b · Scoping aggressive actions to non-production and requiring approval plus rollback for production
Limiting destructive actions to non-prod and gating production changes behind approval and rollback prevents cost automation from causing outages. Maximizing deletions, running constantly, or ignoring tags all increase the risk of disrupting production.
Read the full bite: Design automated cloud cost optimization
Question 28 of 30
Why are Compute Savings Plans often preferred over Standard RIs for a fleet mixing EC2, Fargate, and Lambda?
Show the answer
Answer: a · They flexibly cover EC2, Fargate, and Lambda across families and regions
Compute Savings Plans apply an hourly spend commitment across all three compute types and any family or region, which Standard RIs cannot. They actually give a slightly smaller discount than RIs and still require a one or three year term.
Read the full bite: Savings Plans vs Reserved Instances for mixed compute
Question 29 of 30
Why is a Service Control Policy that denies untagged resource creation central to an accurate chargeback model?
Show the answer
Answer: a · It guarantees tags exist so spend is attributable, not voluntary
Enforcing required tags at creation prevents untagged, unattributable spend that breaks chargeback accuracy. The SCP does not reduce cost or replace the CUR pipeline that actually aggregates the spend.
Read the full bite: Designing a multi-account cloud chargeback model
Question 30 of 30
What is the primary purpose of handling the Spot interruption notice in a stateful batch job?
Show the answer
Answer: a · To checkpoint progress and drain before the instance is reclaimed
The roughly two-minute notice lets the job flush a final checkpoint and exit gracefully so a replacement can resume. It cannot extend runtime, convert the instance, or stop the reclamation from happening.
Read the full bite: Resilient stateful batch on Spot Instances
Could you explain these out loud?
That is what an interview actually tests. Tezvyn gives you questions like these with what the interviewer is really checking, the answer that lands, and the mistake that ends the conversation, in the four minutes before your next meeting.
The iPhone app is on the way
We are building it. Until it lands, nothing here is held back from you: every interview card, your saved cards, streaks and the job board all work in Safari, plus hundreds of free practice quizzes of thirty questions each. Sign in and it all carries over to the app the day it arrives.
Want it as an icon? Tap Share at the bottom of Safari, then Add to Home Screen. It opens full screen and the cards you have read stay available offline.