Cloud Engineer question bank
100 questions. Filter by level and skill, track what you've solved, and see how many people get each one right.
- Who patches the VM operating system?
- Regions and availability zones
- Principle of least privilege
- What makes a subnet public?
- Choosing an S3 storage class
- Horizontal vs vertical scaling
- How serverless functions are billed
- What terraform plan does
- Usable IPs in a /24 subnet
- Shared file system for many servers
- Pointing the zone apex at a load balancer
- Load balancer for path-based routing
- Docker image vs container
- Smallest deployable unit in Kubernetes
- Which identity is the AWS CLI using?
- Alerting on high CPU
- How Prometheus collects metrics
- What Grafana is for
- Storing a token for a CI workflow
- What a Terraform output does
- What OpenTofu is
- What an Azure resource group is
- Google Cloud resource hierarchy
- Why use a managed database
- Keeping CPU near a target
- How EBS snapshots store data
- Showing cloud cost per team
- Protecting the root user
- What HTTPS protects
- Why put a CDN in front of a site
- Users logged out when scaling in
- Shell access without opening port 22
- Well-Architected Framework pillars
- Compute Savings Plans flexibility
- Security groups vs network ACLs
- Outbound internet from a private subnet
- Why remote state needs locking
- Giving a VM access to cloud APIs
- RTO and RPO
- When to use Spot instances
- Reducing serverless cold starts
- Cutting NAT costs for S3 traffic
- Reading an S3 SecureTransport policy
- AccessDenied from a VPC endpoint policy
- Intermittent 502s behind an ALB
- Logs from a crashed container
- Pod stuck Pending: Insufficient cpu
- Container exit code 137 OOMKilled
- Slow Docker builds after every change
- Shrinking a 1.2 GB Go image
- Overly broad GitHub OIDC trust policy
- Renaming a resource without recreating it
- Avoiding downtime on forced replacement
- Detecting drift from console changes
- SQS messages processed twice
- Lambda in a VPC cannot reach an API
- Automatic failover for RDS
- Alarm silent when the app dies
- Requests per second in PromQL
- Prometheus memory explosion
- Cross-account KMS decrypt fails
- Where to keep a database password
- Releasing to 5 percent of traffic first
- Reading VPC Flow Logs for a NACL issue
- DNS failover to a DR region
- Versioned bucket keeps growing
- Azure VM reading Key Vault safely
- HPA shows unknown CPU target
- Policy evaluation with SCPs
- Transitive routing between VPCs
- count vs for_each in Terraform
- S3 consistency model
- Unexpected data transfer bill
- Picking a DR strategy
- Why envelope encryption
- Active-active writes across regions
- aws:SourceIp after adding a VPC endpoint
- Cannot read objects a partner uploaded
- for_each keys unknown until apply
- EKS pods cannot get IP addresses
- Node drain stuck on a PDB
- One NAT gateway for three AZs
- DynamoDB throttling under the limit
- Lambda spike breaks the database
- FIFO queue backlog with idle workers
- CDN cache hit ratio of 4 percent
- Disk latency spike during nightly batch
- Replication skipped existing objects
- A production KMS key scheduled for deletion
- Long session through role chaining
- Securing a role for a SaaS vendor
- Broken p95 latency query
- Fixing alert fatigue with SLOs
- App writes to old primary after failover
- Secrets inside Terraform state
- How much Savings Plan to buy
- Service collapses again after recovery
- Connecting VPCs with the same CIDR
- Exposing one API to 200 customer VPCs
- Liveness probe makes an outage worse