Advanced interview questions in Cloud Platforms
Designing for portability across two clouds
Abstract via containers, Terraform, and open standards; avoid proprietary managed services.
Hybrid cloud bursting from a VMware footprint
Evaluate VMware Cloud on AWS, Azure Arc, Outposts; address connectivity, identity, and data gravity.
Optimizing low-latency VM-to-VM networking
Cluster placement groups, enhanced networking and SR-IOV, larger instances for more bandwidth.
Cost-effective fault-tolerant batch processing
Spot fleets across types, a durable work queue, idempotent checkpointed tasks, retries.
Maximizing object-store throughput for small files
Spread keys across prefixes for partition parallelism, batch small files, parallelize and use multipart uploads.
Object store vs NFS consistency models
S3 gives strong read-after-write per object with no partial updates; NFS offers close-to-open with shared mutable files.
Block storage availability across AZ failure
Block volumes are AZ-bound, so use snapshots, synchronous replication, or app-level replication, trading cost for lower RTO/RPO.
Site-to-Site VPN vs dedicated interconnect
VPN is quick, cheap, encrypted over public internet with variable latency; Direct Connect or ExpressRoute is a private dedicated link with consistent low latency, high bandwidth, longer lead time and…
Stable egress IPs for multi-region outbound traffic
Route outbound traffic through NAT gateways with allocated static IPs, or centralize egress so all regions exit through a fixed small IP set you can whitelist.
Accelerating uncacheable dynamic traffic globally
Terminate TLS at a nearby edge and ride the provider backbone via Global Accelerator or CDN dynamic acceleration; add edge compute; ultimately deploy multi-region.
Dynamic database credential rotation for microservices
A secrets manager issues short-lived per-service credentials, services authenticate by workload identity and fetch or refresh secrets without restart, leases expire and rotate automatically.
Centralized logging and threat detection across accounts
Organization-wide trails ship logs to a locked-down central security account, store in immutable append-only storage, and aggregate threat detection findings centrally with least-privilege…
Architecting for HIPAA or PCI DSS compliance
Isolate sensitive data in restricted networks and accounts, encrypt at rest and in transit with managed keys, enforce least-privilege access, and keep immutable audit logs.
Add a second access pattern to a key-value store
Add a global secondary index on EmailAddress, weighing extra storage, write amplification, and eventual consistency.
Design a global low-latency database
A distributed store with replicas near users, a tuned consistency level, accepting lag, conflicts, and cross-region cost.
CAP theorem and real database tradeoffs
During a partition you pick consistency or availability, CP systems reject requests, AP systems stay available but stale.
Offload long-running tasks from web requests
Enqueue the job to a queue, return immediately, process with separate workers, report status out of band.
Cold starts in serverless environments
A cold start is the delay to provision a fresh instance and initialize the runtime; mitigate with provisioned concurrency and by shrinking init work.
Migrating a stateful monolith to PaaS
Externalize state to backing services, make processes stateless and disposable, read config from the environment per Twelve-Factor.
Grant an EKS pod IAM access to S3
IRSA maps a service account to an IAM role via the cluster OIDC provider, and pods exchange a projected token for short-lived STS credentials.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles