Why Cloud Engineer Candidates Freeze on the Simplest Questions

Interview Insights · Cloud Engineer

Why Cloud Engineer Candidates Freeze on the Simplest Questions

SECTION 01Why basic cloud questions cause the longest silences

I often open a technical round with a question I consider simple, such as 'what is the difference between a region and an Availability Zone?'. I am not trying to trap anyone. I want to see the foundation before we build on it. Yet these questions produce more long pauses than the hard ones.

There are three common reasons. First, the candidate suspects a trick, because the question feels too easy for a technical round. Second, they memorised a definition and are now trying to recall the exact words. Third, they learned the term from videos without ever drawing it, so there is no picture to describe. Below are the questions where this happens most, and what I am really checking.

Interviewer: What makes a subnet public in AWS?

Candidate: (thinks: there must be more to this...)
(8 seconds of silence)

Candidate: When we create it, we choose public?

Interviewer: Is there a public option when you create
a subnet?

Candidate: ... I think there is.

Interviewer: What makes a subnet public in AWS?

Candidate:
It is about routing, not a setting on the subnet.
A subnet is public when its route table has a route
for 0.0.0.0/0 pointing to an internet gateway.

For example, in my lab the ALB sits in public subnets
with that route, and the app servers sit in private
subnets whose default route goes to a NAT Gateway.

Instances in a public subnet also need a public IP
to be reachable, so I turn on auto-assign public IP
only where I need it.

Notice the second answer starts by correcting the common misunderstanding: 'it is about routing, not a setting'. That opening shows I understand the concept, and it buys a few calm seconds to build the rest of the answer.

SECTION 02The three-layer answer for any foundation question

The cure for freezing is to stop looking for the perfect answer and start with a small one you are sure of. I teach a three-layer method. Layer one is a one-sentence definition in plain words. Layer two is an example from a setup you have actually built or studied. Layer three is one deeper detail that shows you understand how it behaves.

You can stop after any layer. If the interviewer looks satisfied after layer two, move on. If they wait, add layer three. This method also prevents the opposite problem: reciting every feature you have ever read about the service.

# Security group: stateful, attached to instances.
# Allowing inbound 443 automatically allows the reply.
resource "aws_security_group" "web" {
  name   = "web-sg"
  vpc_id = aws_vpc.main.id

  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

# NACL: stateless, attached to subnets, rules by number.
# The reply traffic must be allowed explicitly.
resource "aws_network_acl" "public" {
  vpc_id     = aws_vpc.main.id
  subnet_ids = [aws_subnet.public_a.id]

  ingress {
    rule_no    = 100
    protocol   = "tcp"
    action     = "allow"
    cidr_block = "0.0.0.0/0"
    from_port  = 443
    to_port    = 443
  }

  # Replies go back to the client's ephemeral port
  egress {
    rule_no    = 100
    protocol   = "tcp"
    action     = "allow"
    cidr_block = "0.0.0.0/0"
    from_port  = 1024
    to_port    = 65535
  }
}

The NACL example is the kind of detail that turns a simple question into a strong one. Saying 'with a NACL I must also allow the ephemeral port range outbound, because it is stateless' proves you have seen it break, which is exactly what an interviewer hopes to hear.

SECTION 03Learn the basics as pictures, not as definitions

Candidates freeze on basics mostly because they stored them as words. Words are fragile under pressure. Pictures are not. If you have drawn a VPC with two AZs, two public subnets, two private subnets, an internet gateway and a NAT Gateway, you can describe it from memory even when nervous.

The best way to build the picture is to create the network yourself, then inspect it from the CLI. When you see with your own eyes that the only difference between a public and private subnet is one route, the definition becomes something you understand instead of something you recite.

resource "aws_route_table" "public" {
  vpc_id = aws_vpc.main.id
  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.main.id
  }
}

resource "aws_route_table" "private_a" {
  vpc_id = aws_vpc.main.id
  route {
    cidr_block     = "0.0.0.0/0"
    nat_gateway_id = aws_nat_gateway.a.id
  }
}

resource "aws_route_table_association" "public_a" {
  subnet_id      = aws_subnet.public_a.id
  route_table_id = aws_route_table.public.id
}

resource "aws_route_table_association" "private_a" {
  subnet_id      = aws_subnet.private_a.id
  route_table_id = aws_route_table.private_a.id
}

# Which route table does this subnet use, and where
# does its default route go?
aws ec2 describe-route-tables \
  --filters Name=association.subnet-id,Values=subnet-0a1b2c3d4e5f67890 \
  --query "RouteTables[].Routes[?DestinationCidrBlock=='0.0.0.0/0'].[GatewayId,NatGatewayId]" \
  --output text

# igw-...  -> public subnet
# nat-...  -> private subnet with outbound internet
# nothing  -> isolated subnet
#
# No result at all? The subnet has no explicit association
# and uses the VPC's main route table, so check that too.

Once you have done this once, a simple question such as 'how does a private instance download updates?' becomes easy: the private route table sends internet traffic to the NAT Gateway in a public subnet, which sends it out through the internet gateway. You are describing a picture you have seen, not a sentence you memorised.

SECTION 04Drill list for basic cloud questions

Practise these questions out loud using the three layers. Time yourself: the first sentence should come within five seconds. Do not aim for perfect wording. Aim for a calm, correct start.

Answer each in three layers: define, example, detail.

[ ] Region vs Availability Zone
[ ] What makes a subnet public?
[ ] Why do private subnets need a NAT Gateway?
[ ] Security group vs NACL
[ ] What is a CIDR block? What does /24 mean?
[ ] What is VPC peering, and is it transitive?
[ ] What is an Elastic IP?

Rule: first sentence within 5 seconds.
Rule: stop after layer 2 if it feels complete.

[ ] EC2 instance vs AMI
[ ] What does an Auto Scaling group do?
[ ] EBS vs instance store
[ ] EBS vs S3 vs EFS: when to use each
[ ] What are S3 storage classes?
[ ] What does S3 versioning protect against?
[ ] On-Demand vs Reserved vs Spot instances

For each, finish this sentence aloud:
"In my lab, I used this when ____."
If you cannot, build a tiny example this week.

[ ] IAM user vs IAM role
[ ] What is an instance profile?
[ ] What is the principle of least privilege?
[ ] Identity-based vs resource-based policy
[ ] What happens if a policy has both Allow and Deny?
[ ] Why avoid using the root account?
[ ] What does MFA protect against?

Layer 3 hint for Allow vs Deny:
an explicit Deny always wins over an Allow.

SECTION 05Habits that stop the freeze before it starts

Freezing is a habit that forms under pressure. These small habits make the first seconds of every basic answer predictable.

• Assume no trick — Treat every simple question as genuine. If there is a twist, the interviewer will add a follow-up, and you will already have a calm start.
• Lead with the plain sentence — Say the simplest correct definition first, in your own words, before reaching for any official phrasing.
• Anchor to your lab — Follow the definition with 'in my setup' and describe something real. Examples are much harder to forget than definitions.
• Correct the myth — Many basics have a common misunderstanding, such as public subnets being a checkbox. Naming it shows depth in one line.
• Know when to stop — After two layers, pause. A short complete answer is better than a long recital that drifts into features nobody asked about.

SECTION 06Interview Q&A — Simple cloud questions

SECTION 07Test yourself — Simple cloud questions quiz

SECTION 08Frequently asked questions

SECTION 09Related reads