50 Cloud Computing Interview Questions (With Answers)

Cloud computing interviews test your grasp of fundamental concepts, major provider services, architecture patterns, security, cost management, and real-world trade-offs. This guide covers the 50 most common questions — with concise answers, comparisons, and practical examples.

Quick reference

Core Concepts

1. What is cloud computing?

Cloud computing is the delivery of computing resources — servers, storage, databases, networking, software, analytics, and intelligence — over the internet ("the cloud") on a pay-as-you-go basis.

Key characteristics (NIST definition):

• On-demand self-service — provision resources without human interaction
• Broad network access — accessible from any device over the network
• Resource pooling — shared infrastructure serves multiple tenants
• Rapid elasticity — scale up or down quickly
• Measured service — usage metered and billed accordingly

2. What are the three main cloud service models?

Memory aid: IaaS = renting land; PaaS = renting a house; SaaS = renting a hotel room.

3. What are the four cloud deployment models?

4. What is the difference between cloud and on-premises?

5. What is the shared responsibility model?

The shared responsibility model defines what the cloud provider secures versus what you secure:

Provider is responsible for:

• Physical security of data centres
• Hardware (servers, networking equipment)
• Hypervisor and virtualisation layer
• Core cloud services infrastructure

You are responsible for:

• Data encryption and classification
• Identity and access management (IAM)
• Operating system patching (IaaS)
• Application code security
• Network configuration (security groups, firewalls)
• Compliance and regulatory requirements

The line moves depending on the service model: in SaaS the provider owns far more; in IaaS you own more.

Scalability and Availability

6. What is the difference between horizontal and vertical scaling?

Cloud-native architectures favour horizontal scaling because it provides both capacity and fault tolerance.

7. What is auto-scaling?

Auto-scaling automatically adjusts the number of compute instances based on defined metrics or schedules.

Types:

• Target tracking — maintain a metric at a target value (e.g., keep CPU at 60%)
• Step scaling — add/remove capacity in steps based on alarm thresholds
• Scheduled scaling — scale based on predictable patterns (e.g., Monday mornings)

AWS example — Auto Scaling Group with target tracking:

Desired: 2 instances
Min: 1  Max: 10
Policy: Keep average CPU < 60%
→ CPU hits 80% → ASG launches 2 more instances
→ CPU drops to 30% → ASG terminates 1 instance

8. What is a load balancer and what types exist?

A load balancer distributes incoming traffic across multiple servers to ensure no single server bears too much load.

9. What does "high availability" mean in cloud architecture?

High availability (HA) means designing systems to minimise downtime, typically measured as uptime percentage:

HA patterns:

• Multi-AZ deployment — run instances in multiple availability zones
• Health checks + auto-replace — detect and replace failed instances
• Load balancing — route traffic away from unhealthy instances
• Database replication — standby replica ready for failover
• Circuit breaker — prevent cascade failures

10. What is the difference between high availability and disaster recovery?

RTO (Recovery Time Objective) — maximum tolerable downtime.
RPO (Recovery Point Objective) — maximum tolerable data loss (in time).

Storage

11. What are the three types of cloud storage?

12. What is Amazon S3 and what are its storage classes?

Amazon S3 (Simple Storage Service) is an object storage service with 99.999999999% (11 nines) durability.

13. What is the difference between S3 and EBS?

14. What is a CDN and how does it work?

A Content Delivery Network (CDN) is a globally distributed network of edge servers that cache content closer to users.

How it works:

1. User requests https://example.com/image.jpg
2. DNS routes to nearest CDN edge server
3. If cached (cache hit) — return immediately (low latency)
4. If not cached (cache miss) — fetch from origin, cache, return
5. Next user in same region gets cached copy

Benefits: lower latency, reduced origin load, DDoS protection.

AWS CloudFront is the AWS CDN; Cloudflare and Akamai are provider-agnostic options.

15. What is a data lake vs a data warehouse?

Networking

16. What is a VPC?

A Virtual Private Cloud (VPC) is a logically isolated section of a cloud provider's network where you launch resources.

Key VPC components (AWS):

• Subnets — subdivide the VPC CIDR block into ranges (public and private)
• Route tables — define where traffic is directed
• Internet Gateway — allows public subnets to access the internet
• NAT Gateway — allows private subnets to initiate outbound internet traffic
• Security Groups — stateful firewall at the instance level
• Network ACLs — stateless firewall at the subnet level

17. What is the difference between a public and private subnet?

18. What is the difference between a Security Group and a Network ACL?

19. What is VPN vs Direct Connect (private connectivity)?

20. What is DNS and how does Route 53 work?

DNS (Domain Name System) translates human-readable domain names to IP addresses.

Route 53 is AWS's scalable DNS service. Key routing policies:

Compute

21. What is the difference between a VM, a container, and a serverless function?

22. What is serverless computing?

Serverless computing lets you run code without provisioning or managing servers. The provider automatically handles scaling, patching, and availability.

Key characteristics:

• Event-driven — functions triggered by events (HTTP request, S3 upload, queue message)
• Stateless — no persistent process state between invocations
• Auto-scaling — scales to zero or to millions of concurrent executions
• Pay-per-use — billed in milliseconds of execution time

Examples: AWS Lambda, Azure Functions, Google Cloud Functions.

Limitations: cold starts, execution time limits (15 min for Lambda), no persistent local storage.

23. What are EC2 instance purchasing options?

24. What is containers-as-a-service (CaaS)?

CaaS is a cloud service model that provides a managed platform for deploying, running, and scaling containers.

25. What is a managed service vs a self-managed service?

Managed services cost more but reduce operational burden. Self-managed gives more control but requires more expertise.

Databases

26. What is the difference between RDS and DynamoDB?

27. What are read replicas and multi-AZ in RDS?

28. What is database sharding?

Sharding is a technique to horizontally partition a database by distributing rows across multiple database servers (shards), each holding a subset of the data.

Without sharding:    With sharding:
[All users: 1B rows] [Shard 1: users A-M]
                     [Shard 2: users N-Z]

Benefits: each shard handles smaller data volume, queries are faster.

Challenges: cross-shard queries are expensive, re-sharding is complex, hotspot shards if key distribution is uneven.

29. What is eventual consistency vs strong consistency?

CAP Theorem: a distributed system can guarantee only two of three properties:

• Consistency — every read gets the latest write
• Availability — every request gets a response
• Partition tolerance — system continues despite network partitions

30. What is a connection pool in cloud databases?

A connection pool maintains a set of reusable database connections rather than opening and closing a new connection for each request.

Problem: each DB connection has overhead (~5–10ms setup, memory on DB server). At high scale, thousands of new connections per second overwhelm the DB.

Solution: pool (e.g., RDS Proxy, PgBouncer) maintains open connections, hands them to app functions, returns them after use.

AWS RDS Proxy is particularly useful with Lambda (which opens many short-lived connections).

Security

31. What is IAM and what are its key components?

IAM (Identity and Access Management) controls who can access what in your cloud account.

IAM best practices:

• Enable MFA for root and all users
• Use roles instead of access keys where possible
• Principle of least privilege (grant minimum required permissions)
• Rotate access keys regularly
• Use IAM Access Analyzer to detect over-permissive policies

32. What is the principle of least privilege?

Grant only the permissions required to perform a specific task — nothing more.

Bad practice:

{ "Action": "*", "Resource": "*", "Effect": "Allow" }

Good practice:

{
  "Action": ["s3:GetObject", "s3:PutObject"],
  "Resource": "arn:aws:s3:::my-specific-bucket/*",
  "Effect": "Allow"
}

33. What is encryption at rest vs encryption in transit?

Both are required for compliance (HIPAA, PCI-DSS, SOC 2).

34. What is AWS KMS?

AWS Key Management Service (KMS) is a managed service for creating and controlling encryption keys.

Key concepts:

• CMK (Customer Master Key) — your encryption key; stored in KMS, never exported
• Data key — used to encrypt actual data; itself encrypted by CMK (envelope encryption)
• Key rotation — automatic annual rotation of CMK
• Audit trail — every key usage logged in CloudTrail

Envelope encryption:

Data → encrypted with Data Key
Data Key → encrypted with CMK (stored in KMS)
Only the CMK can decrypt the Data Key

35. What is DDoS protection in cloud?

AWS Shield Standard is automatically applied to all AWS customers. Shield Advanced ($3,000/month) adds 24/7 DDoS response team and financial protection.

Cost Optimisation

36. What are common cloud cost optimisation strategies?

37. What is the difference between CapEx and OpEx in cloud?

Cloud's OpEx model is a primary reason organisations migrate — convert large upfront capital costs to predictable monthly bills.

38. What is cloud cost allocation and tagging?

Cost allocation tags let you categorise cloud resources and attribute costs to teams, projects, or environments.

Example tag strategy:

Environment: production | staging | dev
Team: platform | data | frontend
Project: checkout-service | analytics-pipeline
CostCenter: 12345

Enforce tagging via:

• AWS Tag Policies (prevent untagged resource creation)
• AWS Cost Explorer (filter cost by tag)
• AWS Budgets (alert when team cost exceeds threshold)

Architecture Patterns

39. What is a microservices architecture in cloud?

Microservices is an architectural style that structures an application as a collection of small, independently deployable services, each running in its own process and communicating via APIs.

Cloud-native microservices: each service in containers (ECS/EKS), communicating via REST/gRPC/events (SQS, SNS, Kafka).

40. What is an event-driven architecture?

Event-driven architecture (EDA) decouples services by having producers emit events and consumers react to them asynchronously.

[Order Service] → publishes "order.placed" → [SQS Queue]
                                                   ↓
                                          [Inventory Service]
                                          [Notification Service]
                                          [Analytics Service]

Benefits: loose coupling, independent scaling, replay events, easy to add new consumers.

AWS services: SNS (pub/sub), SQS (queuing), EventBridge (event routing), Kinesis (streaming).

41. What is the difference between SQS and SNS?

Fan-out pattern: SNS topic → multiple SQS queues → each queue consumed by different services.

42. What is Infrastructure as Code (IaC)?

IaC means managing and provisioning infrastructure through machine-readable configuration files rather than manual processes.

Benefits: version control, reproducible environments, peer review, automated testing, consistent deployments.

43. What is blue-green deployment?

Blue-green deployment runs two identical production environments (blue = current, green = new):

Traffic → [Blue: v1.0] (100%)

Deploy v1.1 to [Green] (idle)
Test Green
Switch DNS/load balancer:
Traffic → [Green: v1.1] (100%)

Blue stays up for rollback, then decommissioned

Benefits: zero downtime, instant rollback (flip traffic back to blue).

Cloud implementation: Route 53 weighted routing, ALB target group swap, Lambda aliases with traffic shifting.

44. What is canary deployment?

Canary deployment gradually shifts traffic to a new version:

v1.0: 95% traffic
v1.1: 5% traffic (canary)
→ monitor metrics
→ if healthy: increase to 25%, 50%, 100%
→ if problems: rollback canary to 0%

Named after canary birds used in coal mines to detect gas. AWS CodeDeploy, Lambda aliases, and API Gateway canary releases support this natively.

45. What is the CAP theorem and how does it apply to cloud databases?

CAP theorem states a distributed system can only guarantee two of three:

In cloud (where network partitions are inevitable), you choose between CP and AP. DynamoDB is AP by default; you can request strongly consistent reads for CP behaviour at higher latency cost.

DevOps and Operations

46. What is CI/CD in the cloud?

CI/CD (Continuous Integration / Continuous Delivery) automates building, testing, and deploying applications.

47. What is observability in cloud systems?

Observability is the ability to understand a system's internal state from its external outputs. It consists of three pillars:

Why all three? Metrics tell you something is wrong, logs tell you what happened, traces tell you where it happened in your distributed system.

48. What is a service mesh?

A service mesh is a dedicated infrastructure layer that manages service-to-service communication in a microservices architecture.

Handles:

• Traffic management — load balancing, retries, circuit breakers
• Security — mutual TLS (mTLS) between services
• Observability — automatic metrics, tracing, logging for every request

How: sidecar proxy (Envoy) injected into each pod/container intercepts all traffic.

Examples: AWS App Mesh (Envoy-based), Istio, Linkerd.

49. What is chaos engineering?

Chaos engineering is the practice of intentionally introducing failures into a system to build confidence in its ability to withstand unexpected conditions.

Famous example: Netflix's Chaos Monkey — randomly terminates production EC2 instances to ensure the system is resilient enough to survive instance loss.

Failure types to test:

• Random instance termination
• Network latency injection
• Region or AZ failure simulation
• CPU/memory pressure
• Database failover

AWS Fault Injection Service (FIS) is the managed chaos engineering tool on AWS.

50. What questions should you ask when designing a cloud architecture?

A structured cloud architecture review covers:

Well-architected framework pillars (AWS): Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimisation, Sustainability.

Common mistakes

Cloud computing vs related terms

FAQ

Q: Which cloud provider should I learn first?
AWS has the largest market share (~32%) and most job postings. Azure is dominant in enterprises using Microsoft stack. GCP excels in data/ML. Start with AWS for maximum job market coverage, but core concepts transfer across all three.

Q: Is cloud computing the same as the internet?
No. The internet is the global network infrastructure. Cloud computing runs on top of the internet — it's a model for delivering computing services (storage, compute, databases) over the internet from shared data centres.

Q: What is multi-tenancy in cloud?
Multiple customers (tenants) share the same underlying physical infrastructure (servers, storage, networking). Isolation is achieved through virtualisation, containers, and software-enforced boundaries. Public cloud is multi-tenant; private cloud and dedicated hosts are single-tenant.

Q: What is the Well-Architected Framework?
AWS's Well-Architected Framework is a set of best practices across six pillars (Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimisation, Sustainability). Use the AWS Well-Architected Tool to review architectures against these pillars.

Q: How is cloud computing priced?
Primarily on consumption: compute (per hour/second), storage (per GB/month), network egress (per GB transferred out), requests (per million API calls). Use the AWS Pricing Calculator, Azure Pricing Calculator, or GCP Pricing Calculator to estimate costs before deploying.

Q: What certifications are valuable for cloud computing?
AWS: Cloud Practitioner (entry) → Solutions Architect Associate → Solutions Architect Professional. Azure: AZ-900 → AZ-104 → AZ-305. GCP: Cloud Digital Leader → Associate Cloud Engineer → Professional Cloud Architect. AWS SAA-C03 is the most widely recognised mid-level cloud certification.