Cloud and Network Engineer interview questions

Try each question out loud before opening the answer. Shared questions (tagged by skill) also appear on other roles that use the same skill.

Concepts

1. Beginner · Networking fundamentalsHow many addresses are in a /24 and a /20, and how would you split 10.0.0.0/16 into four equal subnets?

   A /24 has 2 to the power 8 = 256 addresses and a /20 has 2 to the power 12 = 4,096. Cloud providers reserve some in every subnet (AWS reserves five). Splitting a /16 into four means adding 2 bits: four /18s, which are 10.0.0.0/18, 10.0.64.0/18, 10.0.128.0/18 and 10.0.192.0/18, each with 16,384 addresses.

2. Beginner · Linux and BashWhat does chmod 640 mean, and what permissions would you give a file holding a service's database password?

   Each digit is owner, group and others, adding read (4), write (2) and execute (1). 640 gives the owner read and write, the group read, and others nothing. For a secret, make the service's own user the owner and use 600 (or 640 with a dedicated group if another process must read it), keep it out of world-readable directories, and prefer a secrets manager that injects it at runtime.

3. Beginner · Linux and BashWhat does set -euo pipefail do in a Bash script?

   -e exits when a command fails; -u treats unset variables as errors instead of empty strings; -o pipefail makes a pipeline fail if any command in it fails, not just the last. Together they stop scripts carrying on after an error, which is how scripts delete the wrong files or deploy broken builds. Know the caveats: -e is ignored in some contexts (conditions, parts of && lists), so still check important commands explicitly.

4. Beginner · Docker and containersWhat is the difference between a container and a virtual machine?

   A virtual machine runs a full guest operating system with its own kernel on a hypervisor. A container is an isolated process on the host's kernel, using namespaces (what it can see) and cgroups (what it can use). Containers start faster and are smaller, but share the kernel, so isolation is weaker; a kernel vulnerability affects all containers on the host. That is why containers should run as non-root with minimal privileges, and why some platforms run containers inside lightweight VMs.

5. Beginner · Monitoring and observabilityWhat are the four golden signals?

   From Google's SRE book: latency (how long requests take, separating successful and failed requests), traffic (demand, such as requests per second), errors (rate of failed requests, including wrong content) and saturation (how full the system is: CPU, memory, connection pools, queue length). Monitoring these for every user-facing service catches most problems users feel.

6. Beginner · Networking fundamentalsWalk through the network layers involved when a browser loads an HTTPS page, and where common problems appear.

   Application (HTTP), presentation and session concerns handled by TLS, transport (TCP, or QUIC over UDP for HTTP/3), network (IP routing), data link (Ethernet or Wi-Fi frames, MAC addresses, ARP) and physical. Before any of that, DNS resolves the name. Typical problems per layer: DNS returning the wrong address, routes or firewalls dropping packets (timeouts), nothing listening on the port (connection refused), TLS certificate or name mismatches, and HTTP errors from the application or a proxy. Troubleshoot bottom-up or with a quick test at each layer.

7. Beginner · Networking fundamentalsWhat is the difference between TCP and UDP, and when is each used?

   TCP is connection-oriented: a three-way handshake, ordered and reliable delivery with retransmission, and flow and congestion control. It suits web traffic, APIs, databases and file transfer. UDP sends independent datagrams with no handshake, ordering or retransmission, so it has less overhead and no head-of-line blocking; it suits DNS queries, streaming, voice, games and newer protocols such as QUIC, which builds its own reliability on top of UDP.

8. Beginner · Networking fundamentalsWhat are A, AAAA, CNAME, MX, TXT and NS records, and what is a TTL?

   A maps a name to an IPv4 address, AAAA to an IPv6 address. CNAME makes a name an alias of another name (not allowed at the zone apex in standard DNS, which is why providers offer alias records). MX lists mail servers. TXT holds text, used for domain verification and email security (SPF, DKIM, DMARC). NS delegates a zone to name servers. The TTL tells resolvers how long to cache an answer; lower it well before a planned change so the new value spreads quickly.

9. Beginner · Cloud platforms (AWS, Azure, Google Cloud)What are regions and availability zones, and how do they affect your design?

   A region is a geographic area with its own set of services and data residency; an availability zone is one or more isolated data centres within a region, with independent power and networking but low latency to other zones. For high availability, run every tier in at least two zones (instances or nodes, load balancers, databases with standbys). Regions protect against larger failures and serve users closer to them, but add replication, cost and complexity, and matter for regulations such as data residency.

10. Beginner · Cloud platforms (AWS, Azure, Google Cloud), Security compliance and data protectionWhat is the shared responsibility model?

    The cloud provider secures the cloud itself: data centres, hardware, the virtualisation layer and managed service infrastructure. The customer secures what they put in the cloud: identities and permissions, network configuration, data and its encryption, operating systems and applications on virtual machines, and configuration of managed services. The split shifts with the service type: more is the provider's responsibility for fully managed services than for virtual machines. Most cloud breaches are on the customer side, such as public buckets or leaked keys.

11. Beginner · Identity and access managementWhen should you use an IAM role instead of an IAM user with access keys?

    Almost always. Roles give temporary credentials that expire, so there is no long-lived secret to leak or rotate. People should sign in through single sign-on and assume roles; workloads use roles through instance profiles, Kubernetes service account identity or OIDC federation from CI. IAM users with access keys are a last resort for systems that cannot use any of these, with keys rotated, scoped narrowly and monitored.

12. Intermediate · Cloud platforms (AWS, Azure, Google Cloud), Networking fundamentalsWhat is the difference between a security group and a network ACL in AWS?

    Security groups attach to network interfaces (instances, load balancers, tasks), support only allow rules and are stateful: return traffic is allowed automatically. They can reference other security groups, which is the cleanest way to say "only the load balancer may reach the app". Network ACLs apply to whole subnets, support allow and deny rules evaluated in order, and are stateless, so return traffic (ephemeral ports) must be allowed explicitly. Most designs rely on security groups and keep NACLs simple.

13. Intermediate · Identity and access managementA user has one policy that allows s3:DeleteObject on a bucket and another that denies it on part of the bucket. What happens?

    In AWS policy evaluation an explicit Deny always overrides an Allow, so deletes are denied where the Deny matches and allowed elsewhere in the bucket. Everything not explicitly allowed is denied by default. Organisations use this for guard rails (service control policies, permission boundaries) that no individual policy can override.

14. Intermediate · Cloud platforms (AWS, Azure, Google Cloud)How would you give a pipeline access to cloud storage securely?

    Run it with its own role or service identity, not personal keys. Grant only the actions and prefixes it needs (read raw, write clean), with short-lived credentials, encryption on the bucket, public access blocked, and access logged. Keep write paths separate from trigger paths to avoid loops.

15. Intermediate · CI/CD, Identity and access managementHow should a CI pipeline get credentials to deploy to the cloud?

    Avoid long-lived keys stored as CI secrets. Use OpenID Connect federation: the CI platform issues a signed token for each job, and the cloud exchanges it for short-lived credentials of a role whose trust policy only accepts tokens from specific repositories and branches. Scope the role's permissions to what the deploy needs, separate roles per environment, and restrict production deploys to protected branches or approved environments.

16. Intermediate · Infrastructure as codeWhat is Terraform state, and how should a team manage it?

    State maps resources in your code to real resources and stores their attributes, so Terraform can calculate changes. For a team, keep it in a remote backend (for example an object storage bucket) with locking so two applies cannot run at once, encryption, and restricted access, because state often contains secrets. Split state by environment and component so a mistake has a limited blast radius, and never edit state by hand; use terraform state commands or import and moved blocks.

17. Intermediate · Networking fundamentals, KubernetesHow does a request from the internet reach a pod in Kubernetes?

    Typically: DNS points to a cloud load balancer, which forwards to an ingress controller (or gateway) running in the cluster. The ingress routes by host and path to a Service. The Service has a stable virtual IP and name, and forwards to the ready pods matching its selector, through kube-proxy or the CNI's data path. Readiness probes decide which pods receive traffic. Network policies can restrict which pods may talk to which.

18. Intermediate · KubernetesWhat are resource requests and limits in Kubernetes, and how do you set them?

    Requests are what the scheduler reserves for a container and decide which node it fits on; limits are the maximum it may use. Going over the memory limit kills the container (OOMKilled); going over the CPU limit throttles it. Set requests from measured normal usage (for example around the 90th percentile) and memory limits with headroom above peak. Many teams avoid CPU limits or set them generously because throttling hurts latency. Missing requests lead to overcommitted nodes and evictions.

19. Intermediate · Cloud platforms (AWS, Azure, Google Cloud), Networking fundamentalsWhat is the difference between a layer 4 and a layer 7 load balancer?

    A layer 4 load balancer (such as AWS Network Load Balancer) forwards TCP or UDP connections based on addresses and ports, without looking inside; it is fast, handles huge connection counts and can preserve the client IP. A layer 7 load balancer (such as AWS Application Load Balancer) understands HTTP: it can terminate TLS, route by host, path or header, add headers, and do HTTP health checks. Choose layer 7 for web routing and layer 4 for non-HTTP protocols or extreme performance.

20. Intermediate · Networking fundamentalsA route table has routes for 10.0.0.0/8, 10.30.0.0/16 and 0.0.0.0/0. Where does traffic to 10.30.4.12 go, and why?

    To the 10.30.0.0/16 route. Routers use longest prefix match: of all routes containing the destination, the most specific one (the longest prefix, here /16) wins. 10.0.0.0/8 also matches but is less specific, and 0.0.0.0/0 is the default route used only when nothing else matches. This is how a direct peering can override a broader route through a transit gateway.

21. Intermediate · Networking fundamentals, Security fundamentalsHow does a site-to-site VPN work, and what do you need to agree with the other side?

    Two gateways establish an encrypted tunnel (usually IPsec, sometimes WireGuard) over the internet, and each side routes the other side's subnets into the tunnel. To set one up you agree the peer public IPs, authentication (pre-shared key or certificates), encryption and key-exchange parameters, which subnets are reachable (or BGP settings for dynamic routing), and firewall rules. Subnets must not overlap. For availability, cloud VPNs provide two tunnels to different endpoints; configure and monitor both.

22. Intermediate · Cloud platforms (AWS, Azure, Google Cloud)What are RTO and RPO, and how do they drive a disaster recovery design?

    Recovery time objective is how long a service may be down after a disaster; recovery point objective is how much data, measured in time, may be lost. They come from the business, not from engineering. Low RPO needs frequent backups or continuous replication; low RTO needs standby capacity and automation. Options range from backup and restore (cheap, hours) to pilot light, warm standby and active-active (expensive, minutes or seconds). Test regularly and measure real RTO and RPO, because untested plans fail.

23. Intermediate · Cloud platforms (AWS, Azure, Google Cloud), Security fundamentalsHow does encryption at rest with a cloud key management service work?

    With envelope encryption: the service generates a data key to encrypt your data, and the data key itself is encrypted by a key held in the KMS that never leaves it. To read data, the service asks the KMS to decrypt the data key, which requires permission on the KMS key. That gives you central control: key policies decide who can decrypt, every use is logged, and disabling the key makes the data unreadable. Choose customer-managed keys when you need your own policies, rotation or separation of duties.

24. Advanced · Infrastructure as codeHow do you design reusable Terraform modules for many teams?

    Give each module one clear purpose, a small set of documented inputs with validation and sensible secure defaults, and useful outputs. Version modules and pin versions in callers, so changes roll out deliberately. Avoid hard-coded providers, regions and names; compose small modules instead of building one giant one; and test them (validate, plan against fixtures, policy checks). Publish examples and a changelog so other teams can adopt them without asking you.

25. Advanced · Identity and access management, Networking fundamentals, Security fundamentalsWhat does zero trust mean for network design?

    No implicit trust based on network location: being inside the corporate network or VPC does not grant access. Every request is authenticated and authorised based on identity (user or workload), device posture and context, with least privilege and short-lived credentials. In practice: identity-aware proxies instead of broad VPN access, mutual TLS or workload identity between services, micro-segmentation with default-deny rules, and continuous logging and verification. Networks still matter, but as one layer rather than the main control.

Case studies

1. Beginner · Linux and Bash, Networking fundamentalsA service will not start because its port is already in use. How do you find out why?

   ss -ltnp | grep :8080 (or lsof -i :8080) shows the listening process and PID. ps -o pid,user,cmd -p PID shows what it is. Often it is an old instance that did not stop, a second copy started by another unit, or a different service configured on the same port. Stop it cleanly with systemctl stop or SIGTERM, and fix the root cause, such as a duplicate unit or a missing stop in a deploy script.

2. Intermediate · Git and GitHub, Security fundamentalsSomeone pushed a cloud access key to a Git repository. What do you do?

   First revoke or rotate the key immediately, because anything pushed may already be copied, especially in public repositories. Then check audit logs for use of the key since it was pushed. Remove it from history (git filter-repo or BFG) and coordinate a force push if the repository must be cleaned, but treat that as secondary. Prevent a repeat: secret scanning in CI and push protection, pre-commit hooks, and moving the workload to short-lived credentials so there is no key to leak.

3. Intermediate · Networking fundamentalsA service cannot reach api.partner.com. How do you narrow down the cause?

   Go layer by layer. Name resolution: getent hosts api.partner.com or dig (wrong record, private DNS zone, stale cache). Routing and firewalls: can you connect to the IP and port, for example with nc -vz or curl -v? A quick "connection refused" means nothing listens; a timeout usually means a firewall, security group, NACL or missing route (a private subnet without NAT). TLS: openssl s_client -connect host:443 -servername host for certificate and name errors. HTTP: status codes and headers. Compare with the same request from another machine.

4. Intermediate · Infrastructure as codeSomeone changed a security group in the console, and now terraform plan wants to revert it. What do you do?

   Find out why the change was made: if it was an emergency fix that should stay, add it to the code and apply so code and reality match; if it was a mistake, let Terraform revert it. Then address the process: restrict console write access in production, detect drift regularly (a scheduled plan that alerts on changes), and make the fast path through code quick enough that people do not need the console.

5. Intermediate · KubernetesA pod is in CrashLoopBackOff. How do you debug it?

   kubectl describe pod shows events, the last state, the exit code and the reason (OOMKilled, Error, failed probes). kubectl logs pod --previous shows the output of the crashed container. Common causes: the app exits on bad configuration or a missing secret, the liveness probe fails before the app is ready, the container exceeds its memory limit (exit 137, OOMKilled), or the command is wrong. Fix the cause; do not just raise restart limits.

6. Intermediate · Cloud platforms (AWS, Azure, Google Cloud), Security compliance and data protection, Security fundamentalsYou discover that a storage bucket with customer documents has been publicly readable. What do you do?

   Contain first: block public access on the bucket (and at account level) immediately. Then assess: which objects were exposed, since when, and whether they were accessed (server access logs or CloudTrail data events). Follow the incident process: inform security and legal, because personal data exposure may need notifying under laws such as India's DPDP Act or GDPR. Then prevent recurrence: account-level public access block, policy checks in CI for infrastructure code, alerts on configuration changes, and a review of how it happened.

7. Advanced · CI/CD, Infrastructure as codeHow would you set up Terraform so changes are safe in a team?

   All changes go through pull requests. CI runs fmt, validate, a security scanner and terraform plan, and posts the plan for review. Apply only from CI, using the reviewed plan, with a role that has the needed permissions, and require approval for production. Use remote state with locking, separate state per environment, and policy as code to block dangerous changes (public buckets, open security groups). Watch plans for replacements of stateful resources, and use prevent_destroy on critical ones.

8. Advanced · Identity and access management, Kubernetes, Security fundamentalsHow would you secure workloads running in a Kubernetes cluster?

   Layer controls: RBAC with least-privilege service accounts (no cluster-admin for apps, no auto-mounted tokens where not needed); workload identity for cloud access instead of stored keys; pod security settings (non-root, read-only filesystem, no privilege escalation, dropped capabilities) enforced by admission policies; network policies that default-deny and allow only needed traffic; signed images from a trusted registry; secrets from a secrets manager; and audit logs. Keep the cluster and nodes patched.

9. Advanced · Cloud platforms (AWS, Azure, Google Cloud), Networking fundamentalsA company has 15 VPCs and two offices that all need some connectivity. How would you design it?

   Start with a non-overlapping IP plan. Use a hub (AWS Transit Gateway or an Azure hub VNet) rather than a mesh of peerings, since peering is not transitive and a full mesh of 15 VPCs needs 105 links. Use separate hub route tables to segment environments (dev cannot reach prod), connect the offices with site-to-site VPN with BGP (or dedicated links for predictable bandwidth), centralise internet egress and inspection if required, and share private DNS zones and resolver rules. Add flow logs, reachability checks and cost estimates, since hubs and data processing are billed.

10. Advanced · Cloud platforms (AWS, Azure, Google Cloud), Monitoring and observabilityThe cloud bill doubled in three months. How do you investigate and reduce it?

    Break the bill down by service, account, tag and resource to find what grew, and match it to changes (new features, traffic, forgotten test environments). Common culprits: idle or oversized instances, unattached volumes and old snapshots, NAT gateway and cross-zone or internet data transfer, logs kept forever, and dev environments running all night. Fix with rightsizing from utilisation data, autoscaling and schedules, storage lifecycle rules, commitments (savings plans or reservations) for steady load, and budgets with alerts. Enforce tagging so costs have owners.

11. Advanced · Security compliance and data protection, Infrastructure as codeAn auditor asks you to prove that all storage in your cloud accounts is encrypted and not public. How do you provide evidence?

    Show controls that are enforced and continuously checked, not screenshots: infrastructure code with encryption and public access blocks, CI policy checks that reject non-compliant changes, account-level guard rails (public access block, service control policies), and a configuration compliance tool (for example AWS Config rules or a CSPM scanner) reporting all resources against the control over time, with exceptions documented and approved. Export the reports with dates, and explain how new accounts inherit the controls.

12. Advanced · CI/CD, Identity and access managementHow would you let GitHub Actions deploy to production in AWS without storing any AWS keys?

    Configure GitHub as an OpenID Connect identity provider in AWS. Create a deploy role whose trust policy accepts tokens only from GitHub's issuer with the right audience, and whose subject condition limits it to your repository and to the production environment or main branch. The workflow requests an ID token and exchanges it for short-lived role credentials. Scope the role's permissions to the deployment, require environment approval in GitHub for production, and log every assumption in CloudTrail.

System design

1. Advanced · Cloud platforms (AWS, Azure, Google Cloud), Networking fundamentals, System designDesign a highly available web application on a cloud provider.

   DNS pointing at a managed load balancer spanning at least two availability zones; stateless application servers or containers in private subnets across those zones in an autoscaling group or Kubernetes; a managed database with a synchronous standby in another zone and automated backups; object storage and a CDN for static content; secrets in a secrets manager; NAT per zone for outbound traffic. Add health checks, SLO monitoring and alerts, infrastructure as code, and tested backups. For regional failures, state the RTO and RPO and whether you need a warm standby region.

Behavioural

1. Intermediate · Communication, Monitoring and observabilityTell me about a production issue you handled.

   Use a STAR story. Show how you detected it (alert, user report), how you limited the damage first (rollback, feature flag, scaling), how you found the root cause with evidence (logs, metrics, traces), how you communicated during the incident, and what changed afterwards (a test, an alert, a runbook, a design fix) as part of a blameless review. Interviewers look for calm prioritisation and learning, not heroics.

2. Intermediate · Communication, Stakeholder managementTell me about a time you automated away repetitive work.

   Use a STAR story. Quantify the toil before (hours per week, error rate, delays), explain how you chose what to automate and how you made it safe (tests, dry runs, rollback), how you got people to adopt it, and the result in numbers. Mention what you did not automate and why. Interviewers look for judgement and measurable impact, not just a script.

3. Intermediate · Communication, Stakeholder managementTell me about a change you made that caused a problem. What did you learn?

   Use a STAR story and own it. Explain the change and its intent, how the problem was detected, how you limited the impact (rollback, communication), the root cause, and the concrete safeguards you added afterwards (a test, a staged rollout, a pre-change checklist, a peer review rule). Interviewers look for honesty, calm handling and systemic fixes rather than blame.