Interview questions in Cloud Platforms, page 2
Protecting object storage from accidental loss
Enable versioning, MFA delete or object lock, cross-region replication, and least-privilege policies.
Object storage tiers and lifecycle automation
Tiers trade storage price for retrieval cost and latency; automate with lifecycle rules or intelligent tiering.
Maximizing object-store throughput for small files
Spread keys across prefixes for partition parallelism, batch small files, parallelize and use multipart uploads.
Object store vs NFS consistency models
S3 gives strong read-after-write per object with no partial updates; NFS offers close-to-open with shared mutable files.
Block storage availability across AZ failure
Block volumes are AZ-bound, so use snapshots, synchronous replication, or app-level replication, trading cost for lower RTO/RPO.
Public and private subnet VPC design
Web server in a public subnet routed to an internet gateway, database in a private subnet with no inbound from the internet, NAT for outbound.
Layer 4 vs Layer 7 load balancers
L4 routes on IP and TCP/UDP ports fast and protocol-blind; L7 inspects HTTP for host, path, and headers.
How cloud DNS resolves a URL to an IP
Recursive resolver queries root, then TLD, then your authoritative cloud DNS zone; the matching record returns an IP, cached per TTL.
Connecting two VPCs privately
VPC peering is simple but non-transitive and full-mesh; a Transit Gateway scales hub-and-spoke; PrivateLink exposes one service narrowly.
Process running but load balancer says unhealthy
The probe path, port, protocol, or expected status may mismatch; a security group may block the probe; the app may be up but not ready.
DNS routing policies for active-passive failover
A failover policy with health checks routes to primary and flips to secondary on failure; keep TTL low; pair with health checks not just policy.
CDN caching for static and dynamic content
Cache static assets with long TTLs and versioned filenames; bypass or short-cache dynamic per-user responses; invalidate via fingerprinted URLs not purges.
Site-to-Site VPN vs dedicated interconnect
VPN is quick, cheap, encrypted over public internet with variable latency; Direct Connect or ExpressRoute is a private dedicated link with consistent low latency, high bandwidth, longer lead time and…
Stable egress IPs for multi-region outbound traffic
Route outbound traffic through NAT gateways with allocated static IPs, or centralize egress so all regions exit through a fixed small IP set you can whitelist.
Accelerating uncacheable dynamic traffic globally
Terminate TLS at a nearby edge and ride the provider backbone via Global Accelerator or CDN dynamic acceleration; add edge compute; ultimately deploy multi-region.
IAM Role vs IAM User
A user is a fixed identity with long-lived credentials for a person; a role is assumable with temporary credentials for workloads or cross-account access.
Security Groups vs NACLs
A security group is stateful and attached to instances or NICs; a NACL is stateless and applied at the subnet.
Granting a VM scoped storage access without static keys
Attach a least-privilege role or managed identity to the VM so it gets auto-rotating temporary credentials scoped to the bucket.
Service-managed vs customer-managed vs BYOK keys
Service-managed keys are automatic but opaque; CMK gives you control over rotation, policy, and revocation in a KMS; BYOK imports your own key material for compliance.
Automating a no-public-IP governance rule
Use organization-level policy guardrails (SCP, Azure Policy, Org Policy) to deny public IP attachment before creation, applied across all accounts.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles