Skip to content
DevOps
All coursesPlacement Report
‹ Back to previous sectionCourse homeAll page URLs

Cloud Engineer Interview Questions & Answers

40 questions for Cloud Engineer interviews — 3 easy, 31 medium, 6 hard.

About the Cloud Engineer role

A cloud engineer designs, builds and operates infrastructure on AWS, Azure or Google Cloud. They set up VPCs, IAM, compute, storage and databases, automate everything with Infrastructure as Code, and focus on security, availability and cost. They often handle migrations from on-premises data centres to the cloud. Cloud certifications such as AWS Solutions Architect Associate help a lot for this role in India.

AWS networking and IAM Terraform modules High availability design Cloud cost optimisation Cloud migration
Solved for this roleStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
3 questions free Unlock the rest in seconds
01

When would you choose ECS, EKS or Lambda?

AWS Cloud for DevOpsMedium
Save to ▾
Show answer
Lambda runs functions without servers, billed per request and duration, ideal for event-driven tasks with short runtimes up to 15 minutes. ECS is AWS's simpler container orchestrator, good when you want containers without Kubernetes complexity, often with Fargate. EKS is managed Kubernetes, chosen for portability, a rich ecosystem and existing Kubernetes skills, but it needs more operational knowledge.
02

Write an IAM policy that gives read-only access to one S3 bucket.

AWS Cloud for DevOpsMedium
Save to ▾
Show answer
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": ["s3:ListBucket"], "Resource": "arn:aws:s3:::acme-reports" }, { "Effect": "Allow", "Action": ["s3:GetObject"], "Resource": "arn:aws:s3:::acme-reports/*" } ] } ListBucket applies to the bucket ARN and GetObject to object ARNs, so both resources are needed.
03

You need to bring existing manually created cloud resources under Terraform. How?

Infrastructure as Code (Terraform and Ansible)Medium
Save to ▾
Show answer
Write the resource blocks in code, then import the real resources into state. Since Terraform 1.5 you can declare import blocks with the resource ID and run plan; terraform plan -generate-config-out can even draft the configuration. Older versions use the terraform import CLI command. Run plan until it shows no changes, which proves code matches reality.
04

How do you handle secrets in Terraform and Ansible?

Infrastructure as Code (Terraform and Ansible)Hard
Save to ▾
Show answer
Do not hard-code secrets in .tf files or playbooks. In Terraform, read them from AWS Secrets Manager or Vault data sources, mark variables sensitive, and protect state because it may still hold values. In Ansible, encrypt secret variable files with ansible-vault and supply the vault password from CI secrets, or look up values from Vault at runtime. Rotate anything exposed in Git.
05

Explain the Linux boot process briefly.

Linux and Shell ScriptingHard
Save to ▾
Show answer
The firmware (BIOS or UEFI) runs hardware checks and loads the bootloader, usually GRUB. GRUB loads the kernel and the initramfs, which contains drivers needed to mount the real root file system. The kernel then starts PID 1, which is systemd on most modern distributions. systemd mounts file systems and starts services in parallel according to unit dependencies and the default target.
06

A production server is very slow. How do you troubleshoot high CPU usage?

Linux and Shell ScriptingMedium
Save to ▾
Show answer
Start with uptime and top or htop to see load and which processes use CPU. Check whether it is user, system or iowait time, and use pidstat or ps -eo pid,pcpu,cmd --sort=-pcpu for detail. For a Java process, take thread dumps; for others, use perf or strace. Correlate with recent deployments, cron jobs or traffic spikes before deciding to scale, roll back or fix code.
07

An EC2 instance in a private subnet cannot download packages from the internet. Why?

AWS Cloud for DevOpsMedium
Save to ▾
Show answer
A private subnet has no direct route to the Internet Gateway. Check that its route table sends 0.0.0.0/0 to a NAT Gateway placed in a public subnet, that the NAT Gateway has an Elastic IP, and that the security group and NACL allow outbound traffic and return ports. For AWS services like S3, a VPC endpoint avoids NAT data charges.
08

What are Terraform modules?

Infrastructure as Code (Terraform and Ansible)Medium
Save to ▾
Show answer
A module is a reusable folder of Terraform files with input variables and outputs, for example a vpc module or an eks-cluster module. The root module calls child modules with different values for each environment. Modules reduce duplication and enforce standards across teams. They can come from local paths, Git or the Terraform Registry and should be pinned to versions.
09

The application cannot connect to an RDS database. What do you check?

AWS Cloud for DevOpsMedium
Save to ▾
Show answer
Confirm the endpoint, port, username and password. Check that the RDS security group allows inbound traffic on the database port from the application's security group, and that both are in reachable subnets of the same VPC or peered networks. Test with nc -zv endpoint 5432 from the app host. Also check the instance status, max connections and SSL requirements.
10

Someone made an S3 bucket with customer files public. What do you do?

AWS Cloud for DevOpsMedium
Save to ▾
Show answer
Immediately block public access on the bucket and remove the public policy or ACLs. Check S3 server access logs or CloudTrail data events to see whether objects were downloaded, and involve security if customer data was exposed. Then enable Block Public Access at the account level, use AWS Config rules to detect public buckets, and require bucket changes through reviewed IaC.
11

What is load average in Linux and how do you read it?

Linux and Shell ScriptingMedium
Save to ▾
Show answer
Load average is the average number of processes running or waiting for CPU (and uninterruptible I/O) over 1, 5 and 15 minutes, shown by uptime or top. Compare it with the number of CPU cores: a load of 4 on a 4-core machine means full use, while 12 means work is queuing. A high load with low CPU use often points to disk or network I/O waits.
12

How do you configure an S3 remote backend with locking?

Infrastructure as Code (Terraform and Ansible)Medium
Save to ▾
Show answer
terraform { backend "s3" { bucket = "acme-terraform-state" key = "prod/network/terraform.tfstate" region = "ap-south-1" encrypt = true use_lockfile = true } } Then run terraform init (add -migrate-state if moving local state). Enable versioning on the bucket. Older setups use dynamodb_table = "tf-locks" instead of use_lockfile for locking.
13

Tell me about a time you reduced cloud costs.

AWS Cloud for DevOpsMedium
Save to ▾
Show answer
Situation: our dev and test AWS accounts cost almost as much as production. Task: my manager asked me to cut waste without slowing teams. Action: I tagged resources by owner, found idle instances and old snapshots, scheduled non-production instances to stop at night with a Lambda, and moved CI agents to Spot. Result: non-production spend fell about 40 percent within two months.
14

How do you count unique client IP addresses in an nginx access log?

Linux and Shell ScriptingMedium
Save to ▾
Show answer
awk '{print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | head -10 # total number of unique IPs awk '{print $1}' access.log | sort -u | wc -l The first field in the default log format is the client IP. uniq -c only collapses adjacent lines, so sort must run before it; the final sort -rn shows the busiest IPs first.
15

What does set -euo pipefail do in a bash script?

Linux and Shell ScriptingMedium
Save to ▾
Show answer
set -e exits the script when any command fails, set -u treats unset variables as errors, and set -o pipefail makes a pipeline fail if any command in it fails, not just the last. Together they stop a script from silently continuing after an error, which matters in CI and deployment scripts. Commands that may fail on purpose need explicit handling such as || true.
16

You suspect a memory leak in a production service. How do you confirm and handle it?

Monitoring, Logging and SREHard
Save to ▾
Show answer
Look at memory graphs over days: a leak shows steady growth that drops only on restart, often with OOM kills. Correlate the start with a deployment. Take heap dumps or profiles, for example jmap for Java or pprof for Go, and compare them over time. As a short-term fix, set memory limits and schedule restarts or roll back, then fix the code and add a memory alert.
17

What is remote state and state locking in Terraform?

Infrastructure as Code (Terraform and Ansible)Medium
Save to ▾
Show answer
Remote state stores the state file in a shared backend such as an S3 bucket, Azure Storage or Terraform Cloud, so the whole team and CI use the same state. Locking prevents two runs from changing state at the same time, avoiding corruption; on S3 it uses a lock file or a DynamoDB table. Enable versioning and encryption on the backend for recovery and security.
18

What is the difference between declarative and imperative IaC, and between Terraform and Ansible?

Infrastructure as Code (Terraform and Ansible)Medium
Save to ▾
Show answer
Declarative tools describe the end state and the tool works out the steps; imperative tools describe the steps. Terraform is declarative, keeps a state file and is best at provisioning cloud resources. Ansible is procedural with mostly idempotent modules, agentless over SSH, and best at configuring servers and deploying software. Many teams use Terraform to create VMs and Ansible to configure them.
19

What is an inode in Linux?

Linux and Shell ScriptingMedium
Save to ▾
Show answer
An inode is a data structure that stores a file's metadata: owner, permissions, size, timestamps, link count and pointers to data blocks, but not the file name. Names live in directory entries that map to inode numbers. A file system has a fixed number of inodes, so millions of tiny files can exhaust them while disk space is still free; check with df -i.
20

Explain the main components of an AWS VPC.

AWS Cloud for DevOpsMedium
Save to ▾
Show answer
A VPC is your private network with a CIDR range like 10.0.0.0/16. It is split into subnets in each Availability Zone. Public subnets have a route to an Internet Gateway; private subnets reach the internet only through a NAT Gateway in a public subnet. Route tables control traffic, security groups and NACLs filter it, and VPC endpoints give private access to services like S3.
21

Explain stdin, stdout, stderr and what 2>&1 means.

Linux and Shell ScriptingEasy
Save to ▾
Show answer
Every process gets three file descriptors: 0 is stdin, 1 is stdout and 2 is stderr. > redirects stdout to a file, 2> redirects errors, and 2>&1 sends stderr to wherever stdout currently points. So command > out.log 2>&1 captures both normal output and errors in one file. Order matters: 2>&1 placed before > out.log would still print errors to the terminal.
22

What is configuration drift and how do you detect it with Terraform?

Infrastructure as Code (Terraform and Ansible)Hard
Save to ▾
Show answer
Drift is when real infrastructure differs from code, usually because someone changed it manually in the console. terraform plan, or plan -refresh-only, shows differences between state and reality. Teams run scheduled plans in CI and alert on any diff. Prevent drift by restricting console write access, applying only through pipelines, and either reverting manual changes or codifying them.
23

What are Ansible roles?

Infrastructure as Code (Terraform and Ansible)Medium
Save to ▾
Show answer
A role is a standard folder structure that packages tasks, handlers, templates, files, variables and defaults for one purpose, for example a nginx or postgres role. Playbooks then just list roles for host groups, keeping them short and reusable across projects. Roles can be shared through Ansible Galaxy or collections, and tested with Molecule.
24

What is the difference between count and for_each in Terraform?

Infrastructure as Code (Terraform and Ansible)Medium
Save to ▾
Show answer
count creates N copies indexed by number, such as aws_instance.web[0]. Removing an item in the middle shifts indexes and can destroy and recreate resources unexpectedly. for_each iterates over a map or set of strings and keys each instance by name, such as aws_s3_bucket.b["logs"], so adding or removing one item affects only that item. Prefer for_each for named collections.
25

A production deployment failed halfway. What do you do?

CI/CD PipelinesMedium
Save to ▾
Show answer
Assess impact quickly using monitoring and error rates. If users are affected, roll back to the last good version, which should be a single pipeline action redeploying the previous artefact. Communicate status to stakeholders. Then check pipeline logs and application logs to find the cause, fix it in a branch and redeploy. Afterwards, hold a blameless review and add a check to catch it earlier.
26

Two engineers ran terraform apply at the same time. What could go wrong and how do you prevent it?

Infrastructure as Code (Terraform and Ansible)Hard
Save to ▾
Show answer
Without locking, both runs read the same state and write conflicting updates, which can corrupt state or create duplicate resources. Use a remote backend with state locking so the second run waits or fails. Better still, run apply only from a CI pipeline on merge to main, so changes are serialised and reviewed. If a lock is stuck after a crash, use terraform force-unlock carefully.
27

What is the difference between CMD and ENTRYPOINT?

Docker and ContainersMedium
Save to ▾
Show answer
ENTRYPOINT defines the main executable that always runs, while CMD provides default arguments or a default command that can be overridden from docker run. For example, ENTRYPOINT ["python", "app.py"] with CMD ["--port", "8000"] lets users change only the port. Use the exec (JSON array) form so the process runs as PID 1 and receives signals properly.
28

Write a bash script that checks whether a service is running and restarts it if not.

Linux and Shell ScriptingMedium
Save to ▾
Show answer
#!/bin/bash set -u SERVICE="nginx" if ! systemctl is-active --quiet "$SERVICE"; then echo "$(date) $SERVICE down, restarting" >> /var/log/svc-check.log systemctl restart "$SERVICE" if ! systemctl is-active --quiet "$SERVICE"; then echo "$SERVICE failed to start" | mail -s "ALERT" ops@example.com fi fi Run it from cron every few minutes; a real setup would rely on systemd Restart= plus monitoring.
29

Write a script that alerts when any disk partition is above 80 percent used.

Linux and Shell ScriptingMedium
Save to ▾
Show answer
#!/bin/bash THRESHOLD=80 df -hP | awk 'NR>1 {gsub("%","",$5); print $5, $6}' | while read -r used mount; do if [ "$used" -ge "$THRESHOLD" ]; then echo "WARNING: $mount is ${used}% full on $(hostname)" fi done df -P keeps each entry on one line, awk strips the percent sign, and the loop compares each value with the threshold.
30

What does idempotency mean in Ansible?

Infrastructure as Code (Terraform and Ansible)Medium
Save to ▾
Show answer
Idempotency means running the same playbook many times gives the same result without unwanted changes. Modules check current state first: the apt module installs a package only if missing and reports ok instead of changed. The shell and command modules are not idempotent by default, so use creates, removes or changed_when conditions, or prefer a dedicated module.
31

Write an Ansible playbook to install and start nginx.

Infrastructure as Code (Terraform and Ansible)Easy
Save to ▾
Show answer
- name: Configure web servers hosts: web become: true tasks: - name: Install nginx ansible.builtin.apt: name: nginx state: present update_cache: true - name: Deploy site config ansible.builtin.template: src: site.conf.j2 dest: /etc/nginx/conf.d/site.conf notify: Reload nginx - name: Ensure nginx is running ansible.builtin.service: name: nginx state: started enabled: true handlers: - name: Reload nginx ansible.builtin.service: name: nginx state: reloaded
32

The host disk is filling up because of Docker. How do you clean up and prevent it?

Docker and ContainersMedium
Save to ▾
Show answer
Check usage with docker system df. Remove stopped containers, dangling images and unused networks with docker system prune, and old build cache with docker builder prune; be careful with the volumes flag. Container logs are a common culprit, so configure log rotation with max-size and max-file in daemon.json. In CI agents, schedule regular pruning jobs.
33

How do you create an EKS cluster with eksctl and connect kubectl to it?

AWS Cloud for DevOpsMedium
Save to ▾
Show answer
eksctl create cluster \ --name shop-dev \ --region ap-south-1 \ --nodegroup-name workers \ --node-type t3.medium \ --nodes 2 --nodes-min 2 --nodes-max 5 \ --managed aws eks update-kubeconfig --name shop-dev --region ap-south-1 kubectl get nodes eksctl builds CloudFormation stacks for the VPC, control plane and node group. In production, teams usually manage EKS with Terraform modules instead.
34

How do an Application Load Balancer and an Auto Scaling group work together?

AWS Cloud for DevOpsMedium
Save to ▾
Show answer
The Auto Scaling group launches EC2 instances from a launch template across several Availability Zones and keeps the count between min and max, scaling on policies such as target 60 percent CPU. It registers instances with the ALB's target group. The ALB spreads HTTP traffic across healthy targets, routes by path or host, and health checks let the group replace failed instances.
35

Tell me about a time you automated a repetitive manual task.

Linux and Shell ScriptingMedium
Save to ▾
Show answer
Situation: our team manually cleaned old build artefacts on shared servers every week, which took two hours and sometimes deleted the wrong files. Task: I offered to automate it. Action: I wrote a bash script with dry-run mode, logging and a retention rule, tested it on staging and scheduled it with cron. Result: zero manual effort and no more full-disk alerts for six months.
36

How do you prioritise when several teams ask you for infrastructure work at the same time?

AWS Cloud for DevOpsMedium
Save to ▾
Show answer
I list the requests with their business impact and deadline, and check which are blocking production or a release. Production issues and security fixes come first. For the rest I agree priority with my lead and the requesting teams openly, give realistic timelines and share progress. Where requests repeat, I build self-service templates so teams are not waiting on me.
37

Tell me about a mistake you made in infrastructure work and what you learned.

Infrastructure as Code (Terraform and Ansible)Medium
Save to ▾
Show answer
Situation: I applied a Terraform change that renamed a security group, which forced replacement and briefly cut access to a staging database. Task: fix it and prevent repeats. Action: I restored access quickly, explained it openly to my lead, and then added plan review in pull requests plus lifecycle create_before_destroy rules. Result: no similar outage since, and I now read every destroy line in a plan.
38

How do you assume an IAM role in another account using the AWS CLI?

AWS Cloud for DevOpsMedium
Save to ▾
Show answer
# ~/.aws/config [profile prod-admin] role_arn = arn:aws:iam::123456789012:role/DevOpsAdmin source_profile = default region = ap-south-1 aws s3 ls --profile prod-admin # manual way aws sts assume-role \ --role-arn arn:aws:iam::123456789012:role/DevOpsAdmin \ --role-session-name ravi-session The role's trust policy must allow your account. Temporary credentials expire, usually after an hour.
39

The Jenkins controller is slow and builds keep queueing. What do you do?

CI/CD PipelinesHard
Save to ▾
Show answer
Make sure no builds run on the controller by setting its executors to zero. Add agents, ideally dynamic ones on Kubernetes or EC2 that scale with the queue. Check controller heap, disk and plugin count, and remove unused plugins. Discard old builds and artefacts with retention rules. For very large setups, split teams across multiple controllers or move suitable jobs to another CI tool.
40

What is the difference between sudo and su?

Linux and Shell ScriptingEasy
Save to ▾
Show answer
su switches to another user, usually root, and needs that user's password, giving a full shell as them. sudo runs a single command with elevated rights using your own password, and is controlled by rules in /etc/sudoers. sudo is preferred in teams because each action is logged against the real user and access can be limited to specific commands.

Frequently asked questions

What does a Cloud Engineer do?

A cloud engineer designs, builds and operates infrastructure on AWS, Azure or Google Cloud. They set up VPCs, IAM, compute, storage and databases, automate everything with Infrastructure as Code, and focus on security, availability and cost. They often handle migrations from on-premises data centres to the cloud. Cloud certifications such as AWS Solutions Architect Associate help a lot for this role in India.

Which skills are tested in a Cloud Engineer interview?

Expect questions on AWS networking and IAM, Terraform modules, High availability design, Cloud cost optimisation, Cloud migration. Most rounds also ask you to explain a project and solve one practical problem live.

How do I prepare for a Cloud Engineer interview?

Revise AWS Cloud for DevOps, Infrastructure as Code (Terraform and Ansible), Linux and Shell Scripting first using the topic sheets, practise the questions on this page aloud, then do one full mock interview to practise timing.

Topic sheets for this role

AWS Cloud for DevOps questionsInfrastructure as Code (Terraform and Ansible) questionsLinux and Shell Scripting questions

Other roles

Junior DevOps EngineerBuild and Release EngineerDevOps EngineerSite Reliability EngineerPlatform Engineer

More ways to practise

Company-wise DevOps questionsExperience-wise DevOps questionsRole-wise DevOps questionsCity-wise DevOps questionsMost asked DevOps questionsScenario-based questionsPractical / hands-on questionsHR & behavioural questionsDevOps mock interviewOnline assessment questionsTechnical round questionsManagerial round questionsDevOps topic sheets