Top 30 Easy Cloud Platforms Interview Questions and Answers for Freshers
30 easy multiple-choice Cloud Platforms interview questions, the ones an interviewer opens with: definitions, everyday syntax, and the quick checks that you have really used it. They come from 30 bites in the Cloud Platforms library, the gentlest slice of the 130 Cloud Platforms interview questions in the library. Answer them here or read straight down. Every question carries the correct option, why it is correct, and a link to the bite it came from.
AWS, Azure, GCP, serverless, managed services
30 questions. Pick an answer, or open “Show the answer” to read it.
Answers are graded in your browser. Nothing is saved, and no XP or streak is earned here. The app keeps score.
Question 1 of 30
A company provisions virtual servers in the cloud and manages the operating system, middleware, and application code themselves. Which service model is this?
Show the answer
Answer: c · Infrastructure as a Service
This is IaaS: the vendor manages the physical infrastructure and hypervisor, while the customer manages everything from the OS upward. Platform as a Service is a tempting distractor because candidates often mistakenly label managed virtual machines as PaaS, but true PaaS abstracts away the OS and runtime management entirely.
Read the full bite: Explain the difference between IaaS, PaaS, and SaaS with examples
Question 2 of 30
When moving from IaaS to SaaS, which responsibility shifts to the cloud provider?
Show the answer
Answer: c · Patching the guest operating system
In IaaS the customer manages the guest OS, but in SaaS the provider assumes that duty. Many beginners incorrectly think the provider also secures their data in SaaS, yet data classification and protection always remain the customer's responsibility.
Read the full bite: How does shared responsibility shift between IaaS and SaaS?
Question 3 of 30
How does migrating from on-premises infrastructure to the cloud typically change a company's cost model?
Show the answer
Answer: d · It shifts spending from upfront CapEx to ongoing, usage-based OpEx
Cloud replaces large upfront asset purchases with pay-as-you-go operational spend that scales with usage. It does not eliminate costs, runs in the opposite direction of OpEx-to-CapEx, and is a different model, not a guaranteed saving.
Question 4 of 30
Which configuration choice most directly controls what network traffic is allowed to reach a newly launched VM?
Show the answer
Answer: c · The security group rules attached to the instance
Security groups act as a virtual firewall defining permitted inbound and outbound traffic. The image, instance type, and storage size define software and capacity, not network access control.
Read the full bite: Launching a virtual machine in the cloud
Question 5 of 30
Why does a machine image enable fast, reliable auto-scaling more than manually configuring each new instance?
Show the answer
Answer: a · Images let every launched instance be identical and ready without setup steps
An image is a frozen template, so each instance launches identical and pre-provisioned, which is what makes scaling fast and deterministic. Images do not compress memory, bypass networking, or scale CPU on their own.
Read the full bite: What a machine image is and why it matters
Question 6 of 30
Which storage type is the appropriate backing for a relational database that needs low-latency random reads and writes?
Show the answer
Answer: b · Block storage, because it provides a raw low-latency volume to a single instance
Databases need fast in-place random I/O on a volume attached to one host, which is exactly what block storage provides. Object storage reads and writes whole objects over HTTP and is unsuitable for transactional workloads.
Question 7 of 30
How can you serve images from object storage through a CDN while keeping the bucket itself private?
Show the answer
Answer: a · Grant the CDN read access via origin access control and deny all other bucket access
Origin access control lets only the CDN read the bucket while it stays private to everyone else. A public bucket defeats the goal, copying defeats the origin model, and signed URLs are time-limited, not permanent.
Read the full bite: Serving user images securely from object storage
Question 8 of 30
What most fundamentally keeps a database in a private subnet unreachable from the internet?
Show the answer
Answer: c · The private subnet's route table has no route to an internet gateway
Without an internet-gateway route, no inbound internet path exists to the subnet, providing network-level isolation. Security groups add a layer but routing is the structural control, and NAT only enables outbound, not encryption.
Question 9 of 30
A service exposes a custom binary protocol over TCP that needs maximum throughput and source IP preservation. Which load balancer fits best and why?
Show the answer
Answer: d · Layer 4, because it routes on IP and port without reading payload, adding minimal overhead
L4 routes purely on IP and port, so it handles arbitrary protocols at high throughput with low overhead. L7 must terminate and parse HTTP, which it cannot do for a custom binary protocol.
Question 10 of 30
Why might a freshly changed DNS record not take effect immediately for all users worldwide?
Show the answer
Answer: b · Cached answers persist in resolvers until the previous record's TTL expires
Resolvers cache records for the TTL set before the change, so old answers linger until that timer expires. Root servers do not approve individual records, and browsers do cache DNS.
Question 11 of 30
An application on an EC2 instance needs to read from an S3 bucket. What is the most secure way to grant access?
Show the answer
Answer: a · Attach an IAM role to the instance so it obtains temporary credentials
An attached role gives the instance short-lived, auto-rotating credentials with no stored secrets, minimizing leak impact. Embedding long-lived user keys is exactly the anti-pattern roles exist to replace.
Question 12 of 30
A subnet-level filter allows inbound port 443 but connections still fail. Which property most likely explains the broken return traffic?
Show the answer
Answer: d · The NACL is stateless, so outbound ephemeral-port traffic must be explicitly allowed
A NACL is stateless, so the inbound allow does not auto-permit the reply; you must allow outbound traffic on the ephemeral port range. Security groups, by contrast, are stateful and handle returns automatically.
Question 13 of 30
An application needs ad hoc reporting queries, joins across several entities, and multi-row transactional consistency. Which database fits best and why?
Show the answer
Answer: a · A relational service, because it supports joins, flexible queries, and strong transactions
Relational databases excel at joins, ad hoc SQL, and multi-row ACID transactions. DynamoDB requires modeling around known access patterns and does not handle arbitrary joins efficiently.
Read the full bite: Choosing relational vs NoSQL managed databases
Question 14 of 30
An application's read traffic far exceeds its writes and is slowing the primary. How does a read replica help, and what must the app tolerate?
Show the answer
Answer: b · It serves read-only queries to offload the primary, but reads may be slightly stale due to lag
A read replica offloads reads from the primary, scaling read-heavy workloads, but asynchronous replication means replicas can lag and return slightly stale data. It is read-only and not a failover standby.
Read the full bite: Read replicas in managed relational databases
Question 15 of 30
In a cache-aside setup, what happens on a cache miss for a requested key?
Show the answer
Answer: a · The app reads from the database, stores the result in the cache, then returns it
Cache-aside puts the application in control: on a miss it reads the DB, populates the cache, and returns the value. The cache itself does not fetch from the DB, which is the write-through or read-through misconception.
Question 16 of 30
Under the shared responsibility model on a PaaS, which of these remains the customer's responsibility?
Show the answer
Answer: b · Configuring IAM roles, application code, and data access correctly
On PaaS the provider handles the OS, runtime, and hardware, but the customer always owns their code, data, and access configuration. IAM and config mistakes are the customer's responsibility, not the provider's.
Question 17 of 30
Why does saving user uploads to a PaaS instance's local disk fail in production?
Show the answer
Answer: c · The disk is ephemeral and per-instance, so files are lost on restart and unseen by other instances
PaaS instances are ephemeral and horizontally scaled, so local files vanish on redeploy and are invisible to peer instances. Object storage solves durability and sharing, not merely encryption or speed.
Read the full bite: Why not store uploads on local PaaS disk?
Question 18 of 30
On a git-based PaaS like Heroku, what is the role of the Procfile versus requirements.txt?
Show the answer
Answer: d · The Procfile declares the process start command; requirements.txt lists the dependencies to install
requirements.txt tells the buildpack which packages to install, while the Procfile declares how to start each process, such as the web command. Secrets belong in config vars, not the Procfile.
Question 19 of 30
Why copy the dependency manifest and install dependencies before copying the rest of the application code in a Dockerfile?
Show the answer
Answer: d · It lets the dependency install layer stay cached when only application code changes, speeding rebuilds
Docker invalidates the cache from the first changed layer, so installing deps before copying code keeps that expensive layer cached across code-only edits. It is an ordering optimization, not a syntax rule.
Question 20 of 30
Why is a Deployment preferred over creating bare Pods for running an application?
Show the answer
Answer: d · A Deployment self-heals by recreating failed Pods and performs rolling updates and rollbacks
A Deployment is a controller that maintains the desired replica count, recreating dead Pods and doing rolling updates and rollbacks. Bare Pods run containers but are not recreated when they die.
Question 21 of 30
Which change most directly eliminates cold-start latency for a predictably high-traffic serverless endpoint?
Show the answer
Answer: c · Enabling provisioned concurrency to keep initialized environments warm
Provisioned concurrency pre-initializes a pool of environments so requests skip provisioning. Increasing timeout, adding a DLQ, or changing the trigger affect failure handling and invocation style, not the cold-start initialization path.
Read the full bite: Serverless cold starts and how to mitigate them
Question 22 of 30
What setting determines when a repeatedly failing message is moved from a source queue to its Dead-Letter Queue?
Show the answer
Answer: a · The maxReceiveCount in the queue's redrive policy
The redrive policy's maxReceiveCount defines how many failed receives trigger a move to the DLQ. Timeout governs execution length, concurrency governs scaling, and retention governs how long messages persist, none of which route poison messages.
Read the full bite: Purpose and setup of a Dead-Letter Queue
Question 23 of 30
Which advantage of declarative Infrastructure as Code is hardest to replicate with manual console provisioning?
Show the answer
Answer: d · Version-controlled, reviewable, repeatable environments free of configuration drift
IaC's core wins are repeatability, peer review, and drift-free consistency from version-controlled definitions. It does not inherently lower bills, speed individual API calls, or prevent provider outages.
Question 24 of 30
When automating a critical patch across 100 production VMs, which practice most reduces the risk of a fleet-wide outage?
Show the answer
Answer: c · Rolling out in staged waves with a canary and health checks between waves
Staged, canaried rollouts with health checks contain the blast radius if a patch breaks something. Patching everything at once risks a total outage, disabling monitoring hides failures, and manual SSH neither scales nor improves safety.
Question 25 of 30
What is the most fundamental mechanism for attributing a storage cost spike to the responsible team?
Show the answer
Answer: d · Tagging resources with team metadata and grouping the cost report by that tag
Cost-allocation tags let the billing system group spend by team, directly revealing the owner of the spike. Access logs, IAM permissions, and DLQs do not map spend to teams.
Question 26 of 30
A team needs to run a fault-tolerant nightly batch job that can restart any interrupted work. Which purchasing model maximizes savings here?
Show the answer
Answer: b · Spot or Preemptible VMs
Spot/Preemptible VMs give the deepest discount and the job's restartability tolerates reclamation. Reserved Instances would lock a long commitment unnecessarily for an intermittent nightly job.
Read the full bite: On-Demand vs Reserved vs Spot pricing models
Question 27 of 30
When is a data lake the better choice over a traditional data warehouse?
Show the answer
Answer: b · When sources are diverse or unstructured and you want schema-on-read flexibility
Lakes excel at storing diverse, raw, large-volume data cheaply with schema applied at read time. Fast governed SQL over fixed metrics and strict schema-on-write are exactly what a warehouse is built for.
Question 28 of 30
What is the main reason ELT fits modern cloud data warehouses well?
Show the answer
Answer: d · It exploits cheap storage and the warehouse's elastic compute to transform in place
ELT loads raw data cheaply then transforms using the warehouse's scalable compute, keeping raw data for later reuse. It actually retains raw data and does not inherently mask sensitive fields before loading.
Question 29 of 30
Why does a columnar format like Parquet outperform CSV for a query selecting a few columns with a filter?
Show the answer
Answer: d · It reads only needed columns and skips blocks using embedded statistics
Columnar storage lets engines read just the requested columns and prune row groups via min/max statistics, cutting IO. Parquet is binary, not human-readable, and the savings come from access pattern, not a guaranteed smaller size in all cases.
Question 30 of 30
Which scenario most justifies building a custom model instead of using a pre-built AI service?
Show the answer
Answer: d · The task is domain-specific and the generic service is not accurate enough
Custom models pay off when a generic API cannot reach the needed domain-specific accuracy. Common tasks, lack of ML expertise, and avoiding training infrastructure all argue for the managed service instead.
Could you explain these out loud?
That is what an interview actually tests. Tezvyn gives you questions like these with what the interviewer is really checking, the answer that lands, and the mistake that ends the conversation, in the four minutes before your next meeting.
The iPhone app is on the way
We are building it. Until it lands, nothing here is held back from you: every interview card, your saved cards, streaks and the job board all work in Safari, plus hundreds of free practice quizzes of thirty questions each. Sign in and it all carries over to the app the day it arrives.
Want it as an icon? Tap Share at the bottom of Safari, then Add to Home Screen. It opens full screen and the cards you have read stay available offline.