Top 30 Intermediate Cloud Platforms Interview Questions and Answers
30 intermediate multiple-choice Cloud Platforms interview questions, past the definitions: how the pieces fit together, what breaks in practice, and the trade-off behind a choice. They come from 30 bites in the Cloud Platforms library, the middle slice of the 130 Cloud Platforms interview questions in the library. Answer them here or read straight down. Every question carries the correct option, why it is correct, and a link to the bite it came from.
AWS, Azure, GCP, serverless, managed services
30 questions. Pick an answer, or open “Show the answer” to read it.
Answers are graded in your browser. Nothing is saved, and no XP or streak is earned here. The app keeps score.
Question 1 of 30
For a team with limited cloud expertise migrating an existing on-premises monolith, why is IaaS often the better initial choice over PaaS?
Show the answer
Answer: a · IaaS enables a lower-risk lift-and-shift without forcing an immediate app rewrite
IaaS lets the monolith move largely unchanged, reducing risk while skills are thin, with modernization to PaaS later. IaaS still has real ops overhead, PaaS offers less low-level control, and PaaS can run monoliths but usually needs refactoring.
Question 2 of 30
Which scenario specifically demonstrates elasticity rather than just scalability?
Show the answer
Answer: b · An auto-scaling group automatically adds instances during a traffic spike and removes them when it subsides
Elasticity is the automatic, two-way matching of capacity to demand, including scaling back down. Manual additions, code rewrites, and one-time vertical upgrades show scalability but not the automatic contraction that defines elasticity.
Question 3 of 30
In a hybrid cloud setup for a regulated business, which split of components is most appropriate?
Show the answer
Answer: b · Keep regulated data and legacy systems on-premises while running scalable customer-facing front ends in the public cloud
Hybrid keeps sensitive, regulated, and hard-to-migrate systems in the controlled private environment while putting elastic, customer-facing workloads in the public cloud. The other options place regulated data in the cloud or misallocate the elastic and sensitive components.
Read the full bite: When hybrid cloud beats public or private
Question 4 of 30
Before adding an auto-scaling group, what change to the single-VM web app is most essential for scaling to work correctly?
Show the answer
Answer: c · Making the application stateless so any instance can serve any request
Horizontal scaling assumes interchangeable instances, so session state must be externalized. A bigger instance is vertical scaling, and the database engine or disk encryption do not enable horizontal elasticity.
Question 5 of 30
A nightly batch job is fully interruptible and checkpoints its progress. Which pricing model fits best and why?
Show the answer
Answer: b · Spot, because the job tolerates interruption and benefits from the deepest discount
Spot offers the largest discount precisely for interruptible, fault-tolerant work like a checkpointed batch job. Reserved suits steady always-on baselines, and On-Demand needlessly pays full price for tolerant work.
Question 6 of 30
Why is storing user uploads on an auto-scaled instance's local disk a poor design choice?
Show the answer
Answer: d · The data is lost when the instance is terminated or replaced during scaling
Auto-scaled instances are ephemeral, so any durable data on local disk vanishes on replacement. Local disks can store binaries and are often fast; the fatal issue is impermanence, not speed or file type.
Read the full bite: Managing state across ephemeral instances
Question 7 of 30
What is the most security-relevant capability the instance metadata service provides to an application?
Show the answer
Answer: a · It vends temporary, rotating credentials for the instance's attached role
The service delivers short-lived, auto-rotated role credentials so apps avoid hardcoded keys. It is link-local rather than internet-reachable, does not serve external config, and does not handle disk encryption.
Question 8 of 30
A general-purpose SSD volume performs well briefly then suddenly throttles under sustained load. What is the likely cause?
Show the answer
Answer: d · The volume exhausted its I/O burst credit balance
General-purpose SSDs offer a baseline plus burstable IOPS via credits; sustained load depletes the credits and triggers throttling. CPU credits, archiving, and security groups do not govern block-storage I/O.
Read the full bite: Diagnosing high I/O wait on a database volume
Question 9 of 30
What workload pattern most degrades performance on a managed shared network file system at scale?
Show the answer
Answer: d · Metadata-heavy access to millions of tiny files
Each metadata operation on a small file is a network round trip, so millions of tiny files cause severe latency. Large sequential streaming and single-writer workloads are exactly what network file systems handle well.
Read the full bite: Shared file system access across many VMs
Question 10 of 30
Why is a service's advertised eleven-nines durability insufficient protection for critical object data?
Show the answer
Answer: c · It guards against hardware loss, not accidental deletion, corruption, or malicious removal
Eleven-nines durability addresses physical media failure, but a human or buggy process can still delete or overwrite objects. Versioning and object lock, not the durability number, protect against those threats.
Read the full bite: Protecting object storage from accidental loss
Question 11 of 30
What is the core trade-off when moving objects to a colder storage tier like Archive?
Show the answer
Answer: b · Lower storage cost but higher retrieval cost and slower access
Colder tiers reduce per-gigabyte storage cost but charge more to retrieve and add latency or minimum durations. Durability is not reduced, and retrievals are never free in archive tiers.
Read the full bite: Object storage tiers and lifecycle automation
Question 12 of 30
A company expects to grow from two VPCs to forty, all needing to reach shared services. Which approach avoids an unmanageable connectivity mesh?
Show the answer
Answer: d · A Transit Gateway acting as a central hub-and-spoke router
A Transit Gateway centralizes routing so each VPC attaches once, avoiding the N-squared peering mesh. Pairwise peering scales poorly and is non-transitive.
Question 13 of 30
SSH to an instance works and the app process is running, yet the load balancer reports it unhealthy. Which is the LEAST likely useful first check?
Show the answer
Answer: d · Rebooting the entire instance before reading any probe response
Rebooting blindly discards diagnostic state and rarely addresses a probe mismatch. The productive steps reproduce the probe to find a path, port, status, or firewall mismatch.
Read the full bite: Process running but load balancer says unhealthy
Question 14 of 30
For a strict active-passive two-region setup, which DNS policy and supporting mechanism are required?
Show the answer
Answer: b · Failover routing tied to health checks with a low TTL
Failover routing with health checks keeps the passive region in reserve and flips on failure, and a low TTL makes the switch fast. Latency and geolocation distribute live traffic, which is active-active, not passive standby.
Read the full bite: DNS routing policies for active-passive failover
Question 15 of 30
What is the most reliable way to ensure users receive an updated CSS file without serving stale edge copies?
Show the answer
Answer: d · Use a content-hashed filename so the updated asset has a brand-new URL
A content hash changes the URL on every update, so the edge treats it as new and never serves a stale copy. Global purges are slow and propagate unevenly, and a zero TTL defeats CDN caching entirely.
Read the full bite: CDN caching for static and dynamic content
Question 16 of 30
What is the key security benefit of attaching a role to a VM instead of placing access keys on it?
Show the answer
Answer: b · The VM receives short-lived, auto-rotating credentials with no stored secret
An attached role delivers temporary, auto-rotating credentials via the metadata service, so no long-lived secret exists to leak. The other options either remove access control or reintroduce the static-key risk.
Read the full bite: Granting a VM scoped storage access without static keys
Question 17 of 30
A team wants to instantly revoke the ability to decrypt a dataset during an incident, with full audit logs. Which key model best supports this?
Show the answer
Answer: a · Customer-managed keys in a KMS the team controls
Customer-managed keys let you set policy, audit usage, and disable the key to cut decryption on demand. Service-managed keys are opaque and offer no independent revocation or custom policy.
Read the full bite: Service-managed vs customer-managed vs BYOK keys
Question 18 of 30
Which approach best guarantees no new VM is ever launched with a public IP across all accounts?
Show the answer
Answer: d · An organization-level deny policy that blocks the attachment at creation time
A preventive org-level deny policy stops the violation before the resource is created and inherits to all accounts. A nightly scan is detective and leaves an exposure window before remediation.
Read the full bite: Automating a no-public-IP governance rule
Question 19 of 30
A critical operating-system vulnerability is disclosed. Who applies the patch on an EC2 instance versus a managed RDS database?
Show the answer
Answer: a · You patch the EC2 OS; the provider patches the RDS underlying OS and engine
With IaaS you own the guest OS and its patching, while a managed database service shifts OS and engine patching to the provider. The boundary moves with the level of abstraction.
Read the full bite: Shared responsibility model across service tiers
Question 20 of 30
An engineer adds an RDS read replica expecting it to take over automatically if the primary fails. What is wrong with this expectation?
Show the answer
Answer: d · Promotion of a read replica is a manual action; only Multi-AZ provides automatic failover
Read replicas are asynchronous copies for read scaling and must be manually promoted. Automatic failover is the job of a Multi-AZ standby, which is synchronous and passive.
Question 21 of 30
When is choosing eventual consistency over strong consistency the better engineering decision?
Show the answer
Answer: d · When brief staleness is harmless and you want lower latency, cost, and higher availability
Eventual consistency trades momentary staleness for speed, lower cost, and availability, ideal for tolerant data like feed counts. Balance checks need strong consistency, making the first option wrong.
Read the full bite: Strong versus eventual consistency in NoSQL
Question 22 of 30
Why is a columnar data warehouse a poor choice as the primary store for an app doing thousands of single-row updates per second?
Show the answer
Answer: d · Columnar storage is optimized for scanning columns in bulk, not fast single-row transactional writes
Columnar layout and MPP excel at large analytical scans but are inefficient for frequent single-row writes, which row-oriented OLTP handles well. The other options misstate how these systems work.
Question 23 of 30
Why is baking a database connection string into a Docker image a poor way to handle secrets?
Show the answer
Answer: b · Anyone who pulls the image can extract the embedded credential, and it cannot be rotated independently
A secret baked into an image is extractable by anyone with the image and is hard to rotate. Injecting it at runtime via env vars or a secrets manager keeps it out of the artifact and allows rotation.
Question 24 of 30
What is the primary role of a container registry in a build-and-deploy pipeline for Cloud Run?
Show the answer
Answer: c · It stores the built, tagged image so the deploy stage can pull that exact artifact
The registry stores immutable tagged images and is the handoff between build (which pushes) and deploy (which pulls). It does not compile code, run tests, or generate Dockerfiles.
Question 25 of 30
Beyond reducing image size, what is a key benefit of a multi-stage Docker build that leaves the toolchain out of the final image?
Show the answer
Answer: a · It reduces the attack surface and vulnerabilities by excluding compilers, shells, and source code
A minimal final image without build tools, shells, or source has far fewer components to exploit or patch, improving security. It does not change runtime speed, remove the registry, or encrypt the binary.
Question 26 of 30
What does an Ingress (with its controller) provide that a LoadBalancer Service alone does not?
Show the answer
Answer: c · Layer-7 host and path routing for multiple services behind one external entry point, plus TLS termination
An Ingress adds L7 host/path routing and TLS so many services share one external load balancer. A LoadBalancer Service exposes a single service and does no path-based routing.
Read the full bite: Exposing Kubernetes services to the internet
Question 27 of 30
Why is a StatefulSet, not a Deployment, used for a clustered database on Kubernetes?
Show the answer
Answer: b · It gives each Pod a stable identity, dedicated persistent storage, and ordered operations
Stateful apps need stable network identity, per-Pod volumes that follow rescheduling, and ordered rollout, which StatefulSets provide. Deployments treat Pods as interchangeable, and StatefulSets do not replicate data on their own.
Question 28 of 30
Why is a managed state machine preferable to one long-running function when a workflow must wait days for human approval?
Show the answer
Answer: d · It can pause without consuming compute or hitting an execution timeout, persisting state durably
State machines externalize state and pause for days via callback tokens without running compute or timing out. Functions are bounded by a max timeout and bill for idle waits; state machines still cost per transition, just not for idle time.
Read the full bite: State machines versus long-running functions
Question 29 of 30
A consumer runs balance += amount per message under at-least-once delivery. Why is this dangerous and what fixes it?
Show the answer
Answer: d · Redelivery double-applies the increment; use an idempotency key with a conditional write
At-least-once delivery means duplicates occur, so blind increments double-apply. Recording an idempotency key and using a conditional write makes reprocessing a no-op. Timeouts and instance size do not eliminate redelivery.
Question 30 of 30
What single technique lets you reconstruct one request's full path across an API gateway, several functions, and a database?
Show the answer
Answer: a · Propagating a shared trace context so all spans join into one trace
Propagating a trace ID through every hop links spans into a single trace, exposing the slow segment. More verbose but uncorrelated logs, shared networking, or warm starts do not stitch a request together across services.
Could you explain these out loud?
That is what an interview actually tests. Tezvyn gives you questions like these with what the interviewer is really checking, the answer that lands, and the mistake that ends the conversation, in the four minutes before your next meeting.
The iPhone app is on the way
We are building it. Until it lands, nothing here is held back from you: every interview card, your saved cards, streaks and the job board all work in Safari, plus hundreds of free practice quizzes of thirty questions each. Sign in and it all carries over to the app the day it arrives.
Want it as an icon? Tap Share at the bottom of Safari, then Add to Home Screen. It opens full screen and the cards you have read stay available offline.