AWS Cloud Engineer · 5-8 Years
Architecture, scalability, reliability, security, cost, and cross-team ownership.
Try each answer before revealing the suggested coaching answer.
25 questions
01Design a scalable and secure approach for EC2 lifecycle in a mid-sized engineering organization.
A system-design answer
Say this first: EC2 lifecycle should be explained through its purpose, the boundary where it applies, and the evidence that shows it is working.
Use a real scenario
Imagine a customer-facing API that must survive a regional dependency failure. The team must decide how to apply EC2 lifecycle, verify the result, and explain the user impact. For an AWS Cloud Engineer, attach the explanation to a runbook and recovery test result.
Show judgment
- define boundaries, ownership, failure modes, and the operational feedback loop.
- State the constraint that could change your decision, such as scale, data sensitivity, recovery target, or team ownership.
- Call out a broad outage or an untested recovery path and the control that reduces it.
Evidence to mention
Track availability, recovery time, and cost per request. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.
request or change → guardrail / validation → EC2 lifecycle → observable result → owner reviewPractice prompt: Show how the team uses runbook and recovery test result rather than relying on an informal agreement.
02What trade-offs would you consider while choosing a solution for AMI and launch templates?
A system-design answer
Say this first: AMI and launch templates should be explained through its purpose, the boundary where it applies, and the evidence that shows it is working.
Use a real scenario
Imagine a customer-facing API that must survive a regional dependency failure. The team must decide how to apply AMI and launch templates, verify the result, and explain the user impact. For an AWS Cloud Engineer, attach the explanation to a runbook and recovery test result.
Show judgment
- define boundaries, ownership, failure modes, and the operational feedback loop.
- State the constraint that could change your decision, such as scale, data sensitivity, recovery target, or team ownership.
- Call out a broad outage or an untested recovery path and the control that reduces it.
Evidence to mention
Track availability, recovery time, and cost per request. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.
request or change → guardrail / validation → AMI and launch templates → observable result → owner reviewPractice prompt: Show how the team uses runbook and recovery test result rather than relying on an informal agreement.
03How would you improve reliability, security, and cost around VPC design?
A system-design answer
Say this first: VPC design should be explained through its purpose, the boundary where it applies, and the evidence that shows it is working.
Use a real scenario
Imagine a customer-facing API that must survive a regional dependency failure. The team must decide how to apply VPC design, verify the result, and explain the user impact. For an AWS Cloud Engineer, attach the explanation to a runbook and recovery test result.
Show judgment
- define boundaries, ownership, failure modes, and the operational feedback loop.
- State the constraint that could change your decision, such as scale, data sensitivity, recovery target, or team ownership.
- Call out a broad outage or an untested recovery path and the control that reduces it.
Evidence to mention
Track availability, recovery time, and cost per request. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.
request or change → guardrail / validation → VPC design → observable result → owner reviewPractice prompt: Show how the team uses runbook and recovery test result rather than relying on an informal agreement.
04How would you review an existing implementation of subnets and route tables and identify design gaps?
A system-design answer
Say this first: subnets and route tables should be explained through its purpose, the boundary where it applies, and the evidence that shows it is working.
Use a real scenario
Imagine a customer-facing API that must survive a regional dependency failure. The team must decide how to apply subnets and route tables, verify the result, and explain the user impact. For an AWS Cloud Engineer, attach the explanation to a runbook and recovery test result.
Show judgment
- define boundaries, ownership, failure modes, and the operational feedback loop.
- State the constraint that could change your decision, such as scale, data sensitivity, recovery target, or team ownership.
- Call out a broad outage or an untested recovery path and the control that reduces it.
Evidence to mention
Track availability, recovery time, and cost per request. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.
request or change → guardrail / validation → subnets and route tables → observable result → owner reviewPractice prompt: Show how the team uses runbook and recovery test result rather than relying on an informal agreement.
05How would you handle failure scenarios related to security groups vs NACLs at scale?
A system-design answer
Say this first: security groups vs NACLs is a choice between approaches with different strengths. The useful answer is the decision rule, not a dictionary definition.
Use a real scenario
Imagine a customer-facing API that must survive a regional dependency failure. The team must decide how to apply security groups vs NACLs, verify the result, and explain the user impact. For an AWS Cloud Engineer, attach the explanation to a runbook and recovery test result.
Show judgment
- define boundaries, ownership, failure modes, and the operational feedback loop.
- Choose the option that fits the workload and constraints; do not present one option as universally superior.
- Call out a broad outage or an untested recovery path and the control that reduces it.
Concrete check
Review the least-privilege policy, then test the denied path as well as the allowed path.Evidence to mention
Track availability, recovery time, and cost per request. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.
request or change → guardrail / validation → security groups vs NACLs → observable result → owner reviewPractice prompt: Show how the team uses runbook and recovery test result rather than relying on an informal agreement.
06Design a scalable and secure approach for IAM users roles and policies in a mid-sized engineering organization.
A system-design answer
Say this first: IAM users roles and policies should be explained through its purpose, the boundary where it applies, and the evidence that shows it is working.
Use a real scenario
Imagine a customer-facing API that must survive a regional dependency failure. The team must decide how to apply IAM users roles and policies, verify the result, and explain the user impact. For an AWS Cloud Engineer, attach the explanation to a runbook and recovery test result.
Show judgment
- define boundaries, ownership, failure modes, and the operational feedback loop.
- State the constraint that could change your decision, such as scale, data sensitivity, recovery target, or team ownership.
- Call out a broad outage or an untested recovery path and the control that reduces it.
Evidence to mention
Track availability, recovery time, and cost per request. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.
request or change → guardrail / validation → IAM users roles and policies → observable result → owner reviewPractice prompt: Show how the team uses runbook and recovery test result rather than relying on an informal agreement.
07What trade-offs would you consider while choosing a solution for S3 storage classes?
A system-design answer
Say this first: Retrieval-augmented generation fetches relevant, approved context at answer time so a model can ground its response in current source material.
Use a real scenario
Imagine a customer-facing API that must survive a regional dependency failure. The team must decide how to apply S3 storage classes, verify the result, and explain the user impact. For an AWS Cloud Engineer, attach the explanation to a runbook and recovery test result.
Show judgment
- define boundaries, ownership, failure modes, and the operational feedback loop.
- State the constraint that could change your decision, such as scale, data sensitivity, recovery target, or team ownership.
- Call out a broad outage or an untested recovery path and the control that reduces it.
Evidence to mention
Track availability, recovery time, and cost per request. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.
request or change → guardrail / validation → S3 storage classes → observable result → owner reviewPractice prompt: Show how the team uses runbook and recovery test result rather than relying on an informal agreement.
08How would you improve reliability, security, and cost around S3 security?
A system-design answer
Say this first: S3 security should be explained through its purpose, the boundary where it applies, and the evidence that shows it is working.
Use a real scenario
Imagine a customer-facing API that must survive a regional dependency failure. The team must decide how to apply S3 security, verify the result, and explain the user impact. For an AWS Cloud Engineer, attach the explanation to a runbook and recovery test result.
Show judgment
- define boundaries, ownership, failure modes, and the operational feedback loop.
- State the constraint that could change your decision, such as scale, data sensitivity, recovery target, or team ownership.
- Call out a broad outage or an untested recovery path and the control that reduces it.
Concrete check
Review the least-privilege policy, then test the denied path as well as the allowed path.Evidence to mention
Track availability, recovery time, and cost per request. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.
request or change → guardrail / validation → S3 security → observable result → owner reviewPractice prompt: Show how the team uses runbook and recovery test result rather than relying on an informal agreement.
09How would you review an existing implementation of RDS backup and scaling and identify design gaps?
A system-design answer
Say this first: RDS backup and scaling should be explained through its purpose, the boundary where it applies, and the evidence that shows it is working.
Use a real scenario
Imagine a customer-facing API that must survive a regional dependency failure. The team must decide how to apply RDS backup and scaling, verify the result, and explain the user impact. For an AWS Cloud Engineer, attach the explanation to a runbook and recovery test result.
Show judgment
- define boundaries, ownership, failure modes, and the operational feedback loop.
- State the constraint that could change your decision, such as scale, data sensitivity, recovery target, or team ownership.
- Call out a broad outage or an untested recovery path and the control that reduces it.
Evidence to mention
Track availability, recovery time, and cost per request. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.
request or change → guardrail / validation → RDS backup and scaling → observable result → owner reviewPractice prompt: Show how the team uses runbook and recovery test result rather than relying on an informal agreement.
10How would you handle failure scenarios related to load balancers at scale?
A system-design answer
Say this first: The important point about load balancers is how an engineer recognizes the unsafe path early and prevents it from becoming customer impact.
Use a real scenario
Imagine a customer-facing API that must survive a regional dependency failure. The team must decide how to apply load balancers, verify the result, and explain the user impact. For an AWS Cloud Engineer, attach the explanation to a runbook and recovery test result.
Show judgment
- define boundaries, ownership, failure modes, and the operational feedback loop.
- Start with containment and evidence. Changing several variables at once makes the incident harder to understand.
- Call out a broad outage or an untested recovery path and the control that reduces it.
Evidence to mention
Track availability, recovery time, and cost per request. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.
request or change → guardrail / validation → load balancers → observable result → owner reviewPractice prompt: Show how the team uses runbook and recovery test result rather than relying on an informal agreement.
11Design a scalable and secure approach for Auto Scaling Groups in a mid-sized engineering organization.
A system-design answer
Say this first: Auto Scaling Groups should be explained through its purpose, the boundary where it applies, and the evidence that shows it is working.
Use a real scenario
Imagine a customer-facing API that must survive a regional dependency failure. The team must decide how to apply Auto Scaling Groups, verify the result, and explain the user impact. For an AWS Cloud Engineer, attach the explanation to a runbook and recovery test result.
Show judgment
- define boundaries, ownership, failure modes, and the operational feedback loop.
- State the constraint that could change your decision, such as scale, data sensitivity, recovery target, or team ownership.
- Call out a broad outage or an untested recovery path and the control that reduces it.
Evidence to mention
Track availability, recovery time, and cost per request. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.
request or change → guardrail / validation → Auto Scaling Groups → observable result → owner reviewPractice prompt: Show how the team uses runbook and recovery test result rather than relying on an informal agreement.
12What trade-offs would you consider while choosing a solution for CloudWatch logs and alarms?
A system-design answer
Say this first: CloudWatch logs and alarms should be explained through its purpose, the boundary where it applies, and the evidence that shows it is working.
Use a real scenario
Imagine a customer-facing API that must survive a regional dependency failure. The team must decide how to apply CloudWatch logs and alarms, verify the result, and explain the user impact. For an AWS Cloud Engineer, attach the explanation to a runbook and recovery test result.
Show judgment
- define boundaries, ownership, failure modes, and the operational feedback loop.
- State the constraint that could change your decision, such as scale, data sensitivity, recovery target, or team ownership.
- Call out a broad outage or an untested recovery path and the control that reduces it.
Evidence to mention
Track availability, recovery time, and cost per request. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.
request or change → guardrail / validation → CloudWatch logs and alarms → observable result → owner reviewPractice prompt: Show how the team uses runbook and recovery test result rather than relying on an informal agreement.
13How would you improve reliability, security, and cost around Route 53 routing?
A system-design answer
Say this first: Route 53 routing should be explained through its purpose, the boundary where it applies, and the evidence that shows it is working.
Use a real scenario
Imagine a customer-facing API that must survive a regional dependency failure. The team must decide how to apply Route 53 routing, verify the result, and explain the user impact. For an AWS Cloud Engineer, attach the explanation to a runbook and recovery test result.
Show judgment
- define boundaries, ownership, failure modes, and the operational feedback loop.
- State the constraint that could change your decision, such as scale, data sensitivity, recovery target, or team ownership.
- Call out a broad outage or an untested recovery path and the control that reduces it.
Evidence to mention
Track availability, recovery time, and cost per request. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.
request or change → guardrail / validation → Route 53 routing → observable result → owner reviewPractice prompt: Show how the team uses runbook and recovery test result rather than relying on an informal agreement.
14How would you review an existing implementation of Lambda basics and identify design gaps?
A system-design answer
Say this first: Lambda basics should be explained through its purpose, the boundary where it applies, and the evidence that shows it is working.
Use a real scenario
Imagine a customer-facing API that must survive a regional dependency failure. The team must decide how to apply Lambda basics, verify the result, and explain the user impact. For an AWS Cloud Engineer, attach the explanation to a runbook and recovery test result.
Show judgment
- define boundaries, ownership, failure modes, and the operational feedback loop.
- State the constraint that could change your decision, such as scale, data sensitivity, recovery target, or team ownership.
- Call out a broad outage or an untested recovery path and the control that reduces it.
Evidence to mention
Track availability, recovery time, and cost per request. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.
request or change → guardrail / validation → Lambda basics → observable result → owner reviewPractice prompt: Show how the team uses runbook and recovery test result rather than relying on an informal agreement.
15How would you handle failure scenarios related to API Gateway at scale?
A system-design answer
Say this first: The important point about API Gateway is how an engineer recognizes the unsafe path early and prevents it from becoming customer impact.
Use a real scenario
Imagine a customer-facing API that must survive a regional dependency failure. The team must decide how to apply API Gateway, verify the result, and explain the user impact. For an AWS Cloud Engineer, attach the explanation to a runbook and recovery test result.
Show judgment
- define boundaries, ownership, failure modes, and the operational feedback loop.
- Start with containment and evidence. Changing several variables at once makes the incident harder to understand.
- Call out a broad outage or an untested recovery path and the control that reduces it.
Evidence to mention
Track availability, recovery time, and cost per request. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.
request or change → guardrail / validation → API Gateway → observable result → owner reviewPractice prompt: Show how the team uses runbook and recovery test result rather than relying on an informal agreement.
16Design a scalable and secure approach for EKS basics in a mid-sized engineering organization.
A system-design answer
Say this first: EKS basics should be explained through its purpose, the boundary where it applies, and the evidence that shows it is working.
Use a real scenario
Imagine a customer-facing API that must survive a regional dependency failure. The team must decide how to apply EKS basics, verify the result, and explain the user impact. For an AWS Cloud Engineer, attach the explanation to a runbook and recovery test result.
Show judgment
- define boundaries, ownership, failure modes, and the operational feedback loop.
- State the constraint that could change your decision, such as scale, data sensitivity, recovery target, or team ownership.
- Call out a broad outage or an untested recovery path and the control that reduces it.
Evidence to mention
Track availability, recovery time, and cost per request. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.
request or change → guardrail / validation → EKS basics → observable result → owner reviewPractice prompt: Show how the team uses runbook and recovery test result rather than relying on an informal agreement.
17What trade-offs would you consider while choosing a solution for ECS vs EKS?
A system-design answer
Say this first: ECS vs EKS is a choice between approaches with different strengths. The useful answer is the decision rule, not a dictionary definition.
Use a real scenario
Imagine a customer-facing API that must survive a regional dependency failure. The team must decide how to apply ECS vs EKS, verify the result, and explain the user impact. For an AWS Cloud Engineer, attach the explanation to a runbook and recovery test result.
Show judgment
- define boundaries, ownership, failure modes, and the operational feedback loop.
- Choose the option that fits the workload and constraints; do not present one option as universally superior.
- Call out a broad outage or an untested recovery path and the control that reduces it.
Evidence to mention
Track availability, recovery time, and cost per request. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.
request or change → guardrail / validation → ECS vs EKS → observable result → owner reviewPractice prompt: Show how the team uses runbook and recovery test result rather than relying on an informal agreement.
18How would you improve reliability, security, and cost around Secrets Manager and KMS?
A system-design answer
Say this first: Secrets Manager and KMS should be explained through its purpose, the boundary where it applies, and the evidence that shows it is working.
Use a real scenario
Imagine a customer-facing API that must survive a regional dependency failure. The team must decide how to apply Secrets Manager and KMS, verify the result, and explain the user impact. For an AWS Cloud Engineer, attach the explanation to a runbook and recovery test result.
Show judgment
- define boundaries, ownership, failure modes, and the operational feedback loop.
- State the constraint that could change your decision, such as scale, data sensitivity, recovery target, or team ownership.
- Call out a broad outage or an untested recovery path and the control that reduces it.
Evidence to mention
Track availability, recovery time, and cost per request. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.
request or change → guardrail / validation → Secrets Manager and KMS → observable result → owner reviewPractice prompt: Show how the team uses runbook and recovery test result rather than relying on an informal agreement.
19How would you review an existing implementation of CloudFormation vs Terraform and identify design gaps?
A system-design answer
Say this first: CloudFormation vs Terraform is a choice between approaches with different strengths. The useful answer is the decision rule, not a dictionary definition.
Use a real scenario
Imagine a customer-facing API that must survive a regional dependency failure. The team must decide how to apply CloudFormation vs Terraform, verify the result, and explain the user impact. For an AWS Cloud Engineer, attach the explanation to a runbook and recovery test result.
Show judgment
- define boundaries, ownership, failure modes, and the operational feedback loop.
- Choose the option that fits the workload and constraints; do not present one option as universally superior.
- Call out a broad outage or an untested recovery path and the control that reduces it.
Evidence to mention
Track availability, recovery time, and cost per request. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.
request or change → guardrail / validation → CloudFormation vs Terraform → observable result → owner reviewPractice prompt: Show how the team uses runbook and recovery test result rather than relying on an informal agreement.
20How would you handle failure scenarios related to AWS cost optimization at scale?
A system-design answer
Say this first: The important point about AWS cost optimization is how an engineer recognizes the unsafe path early and prevents it from becoming customer impact.
Use a real scenario
Imagine a customer-facing API that must survive a regional dependency failure. The team must decide how to apply AWS cost optimization, verify the result, and explain the user impact. For an AWS Cloud Engineer, attach the explanation to a runbook and recovery test result.
Show judgment
- define boundaries, ownership, failure modes, and the operational feedback loop.
- Start with containment and evidence. Changing several variables at once makes the incident harder to understand.
- Call out a broad outage or an untested recovery path and the control that reduces it.
Evidence to mention
Track availability, recovery time, and cost per request. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.
request or change → guardrail / validation → AWS cost optimization → observable result → owner reviewPractice prompt: Show how the team uses runbook and recovery test result rather than relying on an informal agreement.
21Design a scalable and secure approach for Well-Architected Framework in a mid-sized engineering organization.
A system-design answer
Say this first: Well-Architected Framework should be explained through its purpose, the boundary where it applies, and the evidence that shows it is working.
Use a real scenario
Imagine a customer-facing API that must survive a regional dependency failure. The team must decide how to apply Well-Architected Framework, verify the result, and explain the user impact. For an AWS Cloud Engineer, attach the explanation to a runbook and recovery test result.
Show judgment
- define boundaries, ownership, failure modes, and the operational feedback loop.
- State the constraint that could change your decision, such as scale, data sensitivity, recovery target, or team ownership.
- Call out a broad outage or an untested recovery path and the control that reduces it.
Evidence to mention
Track availability, recovery time, and cost per request. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.
request or change → guardrail / validation → Well-Architected Framework → observable result → owner reviewPractice prompt: Show how the team uses runbook and recovery test result rather than relying on an informal agreement.
22What trade-offs would you consider while choosing a solution for high availability design?
A system-design answer
Say this first: high availability design should be explained through its purpose, the boundary where it applies, and the evidence that shows it is working.
Use a real scenario
Imagine a customer-facing API that must survive a regional dependency failure. The team must decide how to apply high availability design, verify the result, and explain the user impact. For an AWS Cloud Engineer, attach the explanation to a runbook and recovery test result.
Show judgment
- define boundaries, ownership, failure modes, and the operational feedback loop.
- State the constraint that could change your decision, such as scale, data sensitivity, recovery target, or team ownership.
- Call out a broad outage or an untested recovery path and the control that reduces it.
Evidence to mention
Track availability, recovery time, and cost per request. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.
request or change → guardrail / validation → high availability design → observable result → owner reviewPractice prompt: Show how the team uses runbook and recovery test result rather than relying on an informal agreement.
23How would you improve reliability, security, and cost around disaster recovery patterns?
A system-design answer
Say this first: disaster recovery patterns should be explained through its purpose, the boundary where it applies, and the evidence that shows it is working.
Use a real scenario
Imagine a customer-facing API that must survive a regional dependency failure. The team must decide how to apply disaster recovery patterns, verify the result, and explain the user impact. For an AWS Cloud Engineer, attach the explanation to a runbook and recovery test result.
Show judgment
- define boundaries, ownership, failure modes, and the operational feedback loop.
- State the constraint that could change your decision, such as scale, data sensitivity, recovery target, or team ownership.
- Call out a broad outage or an untested recovery path and the control that reduces it.
Evidence to mention
Track availability, recovery time, and cost per request. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.
request or change → guardrail / validation → disaster recovery patterns → observable result → owner reviewPractice prompt: Show how the team uses runbook and recovery test result rather than relying on an informal agreement.
24How would you review an existing implementation of private connectivity and identify design gaps?
A system-design answer
Say this first: private connectivity should be explained through its purpose, the boundary where it applies, and the evidence that shows it is working.
Use a real scenario
Imagine a customer-facing API that must survive a regional dependency failure. The team must decide how to apply private connectivity, verify the result, and explain the user impact. For an AWS Cloud Engineer, attach the explanation to a runbook and recovery test result.
Show judgment
- define boundaries, ownership, failure modes, and the operational feedback loop.
- State the constraint that could change your decision, such as scale, data sensitivity, recovery target, or team ownership.
- Call out a broad outage or an untested recovery path and the control that reduces it.
Evidence to mention
Track availability, recovery time, and cost per request. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.
request or change → guardrail / validation → private connectivity → observable result → owner reviewPractice prompt: Show how the team uses runbook and recovery test result rather than relying on an informal agreement.
25How would you handle failure scenarios related to AWS security best practices at scale?
A system-design answer
Say this first: The important point about AWS security best practices is how an engineer recognizes the unsafe path early and prevents it from becoming customer impact.
Use a real scenario
Imagine a customer-facing API that must survive a regional dependency failure. The team must decide how to apply AWS security best practices, verify the result, and explain the user impact. For an AWS Cloud Engineer, attach the explanation to a runbook and recovery test result.
Show judgment
- define boundaries, ownership, failure modes, and the operational feedback loop.
- Start with containment and evidence. Changing several variables at once makes the incident harder to understand.
- Call out a broad outage or an untested recovery path and the control that reduces it.
Concrete check
Review the least-privilege policy, then test the denied path as well as the allowed path.Evidence to mention
Track availability, recovery time, and cost per request. Say what baseline you compared against, what would trigger a rollback or escalation, and who owns the follow-up.
request or change → guardrail / validation → AWS security best practices → observable result → owner reviewPractice prompt: Show how the team uses runbook and recovery test result rather than relying on an informal agreement.
No questions match. Try another term.
Further reading
These are original practice questions and suggested answers. Adapt them to your own work and explain evidence, trade-offs, and limitations.