Remote cloud engineer interview questions and how to answer them
Remote cloud engineer interviews are mostly scenarios. After a screening call you'll usually face a technical round on networking and IAM, a design question ("build this app so it survives a data centre failure"), sometimes a hands-on task in a sandbox account, and a final round on how you work with clients and teams.
The examples below use AWS names because they come up most, but say the Azure or Google Cloud equivalent when you know it. Interviewers like candidates who understand the idea, not just one vendor's product name.
Updated October 2026 by the WorkRemote careers team
On this page
About the role and your experience
Openers that check you understand the job and have done the work.
We run on Azure but your experience is mostly AWS. How would you get up to speed?
Why they ask
Many candidates know one cloud. They want to see you can map concepts and learn fast.
How to answer
Show you already know the mappings, and give a concrete plan for the first weeks.
Show a sample answerHide the sample answer
Most of the ideas carry over. VPCs become virtual networks, security groups become network security groups, IAM is split between Entra ID and Azure role-based access, and EC2, S3 and RDS map to Azure VMs, Blob Storage and Azure SQL. In my first weeks I'd read your Terraform or Bicep, work through the free AZ-104 paths on Microsoft Learn, and pair on a few changes before making any alone. I'd aim to sit AZ-104 within a few months.
Why did you choose cloud engineering, and why our company?
Why they ask
They want to see real interest and that you've looked at their setup, not just that you want a dollar salary.
How to answer
Give a specific reason you like cloud work, link it to something about their company (their cloud, their customers, their scale), and mention what you've built.
Show a sample answerHide the sample answer
I started in IT support for a logistics company in Lagos, and the part I enjoyed most was moving our file server and email to Microsoft 365 and Azure. Since then I've passed AZ-104 and built a Terraform project for a three-tier app. Your job ad mentions moving workloads from on-premise to Azure and cutting costs, which is exactly the work I want to do more of.
Technical questions
What you know and how you'd do the work, often with a live task or test.
What makes a subnet public or private?
Why they ask
The most basic cloud networking question. A wrong answer usually ends the technical round.
How to answer
It's the route table, not a setting on the subnet. A public subnet has a route to an internet gateway; a private one doesn't. Private instances reach out through a NAT gateway.
Show a sample answerHide the sample answer
A subnet is public when its route table sends
0.0.0.0/0to an internet gateway, and instances there also need a public IP to be reachable. A private subnet has no route to the internet gateway. If instances in it need to download updates, I route0.0.0.0/0to a NAT gateway sitting in a public subnet, which allows outbound connections but nothing inbound from the internet. I'd put load balancers in public subnets and app servers and databases in private ones.What is the difference between a security group and a network ACL?
Why they ask
Checks whether you understand stateful and stateless filtering, which matters when debugging blocked traffic.
How to answer
Security groups attach to instances or network interfaces, are stateful and only have allow rules. Network ACLs attach to subnets, are stateless, have allow and deny rules, and are evaluated in rule-number order.
Show a sample answerHide the sample answer
A security group works at the instance level and is stateful, so if I allow inbound HTTPS, the reply traffic goes out automatically. It only has allow rules. A network ACL works at the subnet level and is stateless, so I have to allow the return traffic too, usually the ephemeral port range. NACLs can have deny rules and are checked in order by rule number. I mostly use security groups and keep NACLs for broad blocks.
An EC2 instance in a private subnet can't download packages from the internet. How do you troubleshoot it?
Why they ask
A real ticket that tests routing, security and DNS together, and how methodically you work.
How to answer
Go hop by hop: route table to a NAT gateway, the NAT gateway itself sitting in a public subnet with a route to the internet gateway, outbound security group rules, NACLs in both directions, then DNS.
Show a sample answerHide the sample answer
First I'd check the private subnet's route table has
0.0.0.0/0pointing to a NAT gateway, and that the NAT gateway is in a public subnet whose route table points to an internet gateway. Then the instance's security group outbound rules, and the NACLs on both subnets, remembering they're stateless so return traffic on ephemeral ports must be allowed. If an IP works but a hostname doesn't, it's DNS, so I'd check DNS resolution is enabled on the VPC. VPC Reachability Analyzer can confirm the path.Walk me through what happens when someone types app.example.com into a browser.
Why they ask
DNS sits under almost every outage and migration. They want to see you understand the full resolution chain.
How to answer
Browser and OS caches, the hosts file, the recursive resolver, then root, TLD and authoritative name servers, and TTLs at each step. Then the TCP and TLS connection to the IP you got back. Mention CNAME and alias records.
Show a sample answerHide the sample answer
The browser checks its own cache, then the operating system's cache and hosts file. If there's no answer, the query goes to a recursive resolver, often the ISP's or something like 1.1.1.1. If that resolver hasn't cached it, it asks a root server, which points to the .com servers, which point to example.com's authoritative name servers, for example Route 53. Those return the record, maybe a CNAME to a load balancer's hostname that then resolves to IPs. Each answer is cached for its TTL. Then the browser opens a TCP connection to the IP, does the TLS handshake and sends the HTTP request. On Route 53 I'd use an alias record at the zone apex, because a CNAME isn't allowed there.
Why should an application on EC2 use an IAM role instead of access keys?
Why they ask
Leaked access keys are one of the most common causes of cloud breaches and surprise bills.
How to answer
Roles give temporary credentials that rotate automatically through the instance profile, so there's nothing long-lived to leak. Tie it to least privilege.
Show a sample answerHide the sample answer
With a role attached through an instance profile, the app gets temporary credentials from the instance metadata service that rotate automatically. There are no keys to copy into code, a config file or a Git repo. I'd scope the role's policy to exactly what the app needs, like read and write on one S3 bucket, and require IMDSv2 on the instance. The same idea applies on Azure with managed identities and on Google Cloud with service accounts.
Design a highly available web application on AWS.
Why they ask
The standard design question. It shows how you think about failure, cost and simplicity.
How to answer
Ask about traffic, budget and recovery targets first. Then spread across at least two availability zones: load balancer, auto scaling app tier in private subnets, multi-AZ database, static files on S3 with a CDN. Say what you'd leave out to keep it simple.
Show a sample answerHide the sample answer
I'd ask how much downtime is acceptable and what the budget is. For a typical app: a VPC across two or three availability zones, an Application Load Balancer in public subnets, an auto scaling group or ECS service in private subnets, and RDS with Multi-AZ so a standby takes over if the primary fails. Static assets on S3 behind CloudFront. Route 53 for DNS, CloudWatch alarms on errors and latency, automated backups, and everything in Terraform. If they needed to survive a whole region failing, that's a bigger and more expensive conversation.
What is the difference between Multi-AZ, read replicas and a multi-region setup for a database?
Why they ask
People often confuse availability with scaling. This tests whether you know what each protects against.
How to answer
Multi-AZ is for failover inside a region. Read replicas spread read load and can be promoted, but replication is asynchronous. Multi-region protects against a regional outage at higher cost and complexity. Link it to RTO and RPO.
Show a sample answerHide the sample answer
Multi-AZ keeps a standby in another availability zone and fails over automatically, so it protects against a zone failure. Read replicas take read traffic off the primary; they replicate asynchronously, so a promoted replica can be slightly behind. Multi-region, with cross-region replicas or a global database, protects against losing a whole region but costs more and complicates writes. I'd pick based on RTO, how long we can be down, and RPO, how much data we can afford to lose.
How do you secure an S3 bucket that holds customer documents?
Why they ask
Exposed buckets are a classic breach. They want layered thinking, not one setting.
How to answer
Block Public Access, a tight bucket policy, encryption, versioning, logging, and pre-signed URLs for downloads. Mention IAM least privilege for the app.
Show a sample answerHide the sample answer
Block Public Access on, at the account and bucket level. A bucket policy that only allows the app's IAM role and denies requests that aren't over HTTPS. Encryption at rest, with KMS if they need control of the keys. Versioning so a bad delete can be recovered, and access logging or CloudTrail data events for audits. Customers would download through short-lived pre-signed URLs, so the bucket never needs to be public.
Explain the shared responsibility model.
Why they ask
A basic concept that shows you know where the cloud provider's job ends and yours begins.
How to answer
The provider secures the cloud itself (data centres, hardware, the virtualisation layer); you secure what you put in it (data, IAM, network rules, OS patching on VMs). The split shifts with managed services.
Show a sample answerHide the sample answer
AWS is responsible for the security of the cloud: buildings, hardware, network and the hypervisor. We're responsible for security in the cloud: our IAM, security groups, data encryption, and patching the operating system on our EC2 instances. With a managed service like RDS or Lambda, AWS takes on more, such as patching the database engine or the runtime, but our data and access settings are still ours.
When would you choose Lambda, ECS or EKS for a new service?
Why they ask
Tests whether you can match the tool to the team rather than defaulting to Kubernetes.
How to answer
Lambda for event-driven or spiky, short work with no servers to manage. ECS (often on Fargate) for containers with little operational overhead. EKS when the team already uses Kubernetes or needs its ecosystem. Mention limits and cost.
Show a sample answerHide the sample answer
Lambda for things like processing an upload or a webhook: it scales to zero and there are no servers, but runs are capped at 15 minutes and cold starts can matter. ECS on Fargate if it's a normal long-running container service and the team is small, because there's very little to operate. EKS only if they already know Kubernetes, need tools like Helm or Argo CD, or want to stay portable, because running Kubernetes well takes real effort.
Behavioural questions
Past situations. Answer with a real example: what happened, what you did, what changed.
Tell me about a cloud mistake that cost money or caused downtime.
Why they ask
Everyone who has run cloud infrastructure has a story. They want honesty and the safeguards you added.
How to answer
Real, recoverable, owned. What happened, how you noticed, how you fixed it, and what control you added.
Show a sample answerHide the sample answer
On a client project I left a test NAT gateway and a load balancer running in a second region after a demo. Nobody noticed until the monthly bill, about $90 extra. I told the client, deleted them, and then set up a budget with email alerts and a weekly check for untagged resources. Since then every resource I create gets an owner and project tag through Terraform.
How would you explain to a non-technical founder why moving to the cloud won't automatically save money?
Why they ask
Client-facing cloud engineers spend a lot of time managing expectations about cost.
How to answer
Plain language, a simple comparison, and what actually makes the cloud cheaper.
Show a sample answerHide the sample answer
I'd say the cloud is like renting instead of buying. You stop paying for servers that sit idle, but if you rent the same big machines and leave them on all the time, it can cost more than what you have now. The savings come from switching things off at night, sizing servers to what you really use, and using managed services so you need fewer people looking after them. I'd show a rough monthly estimate for both options.
Situational questions
Hypotheticals about problems you'd meet in the job.
The AWS bill went up 40% this month. Where do you start?
Why they ask
Cost control is a big part of the job, and clients notice it before anything else.
How to answer
Cost Explorer grouped by service, then usage type, then tags or account. Look for the usual suspects. Fix the cause and put alerts in place.
Show a sample answerHide the sample answer
I'd open Cost Explorer, compare this month with last month by service, then drill into usage type to see exactly what grew. Common culprits are data transfer, NAT gateway processing, a large instance someone forgot, unattached EBS volumes, old snapshots or logs with no retention. If resources are tagged by team or project, I can tell who owns the increase. Then I'd fix it, set a budget alert for that account, and suggest Savings Plans if the steady usage is predictable.
A developer asks you for AdministratorAccess to 'unblock' them. What do you do?
Why they ask
Shows whether you'll hold the line on least privilege while still being helpful.
How to answer
Don't refuse and walk away. Find out what they're blocked on, grant the specific permission, and grant temporary, time-limited admin access only if it is genuinely urgent.
Show a sample answerHide the sample answer
I'd ask what they're trying to do and look at the exact access-denied error. Nine times out of ten they need one or two actions on a specific resource, so I'd add those to their role. If it's urgent and wide, I'd give time-limited admin access through our access process and remove it afterwards. Then I'd update the role in Terraform so the next developer doesn't hit the same wall.
Remote work questions
How you'll work from Nigeria with a team elsewhere: hours, power, internet, communication.
A migration cutover is scheduled for 2am New York time. How would you handle it from Lagos?
Why they ask
Cutovers happen out of hours. They want to know you'll be alert, prepared and reachable.
How to answer
Do the time maths, describe your preparation and backup setup, and how you'd communicate during and after.
Show a sample answerHide the sample answer
2am in New York is 7am or 8am in Lagos depending on the season, so that's actually a comfortable time for me. I'd write a runbook with each step, a check after it and a rollback plan, and share it a few days before. On the day, I'd have the inverter charged, my fibre line plus a MiFi on another network, and run the changes from CloudShell so a drop on my side doesn't stop them. I'd post updates in the channel at each step and a summary at the end.
What does your home setup look like for remote infrastructure work?
Why they ask
Employers who've hired in Nigeria know power and internet can fail. Cloud changes can't be left half-done.
How to answer
Be specific and realistic: backup power, two connections, MFA device, and what you do if everything fails.
Show a sample answerHide the sample answer
I have an inverter with batteries that runs my laptop and router for about eight hours, and solar panels to recharge it. My main connection is fibre and the backup is a MiFi on a different network. My MFA is on a hardware key and my phone, so losing one doesn't lock me out. If both connections failed during work, I'd message the team from my phone first, then move to a co-working space nearby.
Remote interview tips
Have a sandbox ready. Some interviews ask you to share your screen and build or fix something. Keep a practice account with budget alerts on, and know how to get to the console and CLI quickly. If they provide an account, log in early and check access.
Draw while you talk. For design questions, use a whiteboard tool like Excalidraw or draw.io and sketch the VPC, subnets and services as you explain. It's much easier for the interviewer to follow than words alone.
State your assumptions. Before designing, ask about traffic, budget, compliance and recovery targets. If they say "you decide", say your assumptions out loud and design to them.
Confirm the time zone in writing. Write both times when you agree an interview ("3pm GMT / 4pm WAT" in winter, "9am EDT / 2pm WAT" in the US summer). Lagos doesn't change its clocks; the UK and US do in March and October or November.
Bring cost into your answers. Saying what a design costs, and what you'd do to make it cheaper, sets you apart from candidates who only describe the ideal setup.
Questions people ask
What networking questions come up in cloud engineer interviews?
Public versus private subnets, CIDR ranges, route tables, NAT and internet gateways, security groups versus network ACLs, VPC peering and VPNs, load balancers and DNS. Expect at least one "this can't connect, why?" scenario.
Do cloud engineer interviews include coding?
Usually light coding: a Bash, Python or PowerShell script, or writing some Terraform. Few cloud roles ask algorithm puzzles, but many ask you to read and fix infrastructure code.
Will they ask about a cloud I don't know?
Sometimes. Answer with the concept and the cloud you do know, then name the equivalent if you can. Interviewers care more that you understand networking and permissions than about product names.
Do I need a certification to pass a cloud interview?
No, but it helps you get the interview in the first place, especially with consultancies. The interview itself tests whether you can design and troubleshoot, which a certificate alone doesn't prove.
Updated October 2026 by the WorkRemote careers team
Interview questions for roles close to cloud engineer
- DevOps Engineer
A DevOps engineer builds and runs the machinery that takes code from a developer's laptop to production: CI/CD pipelines, Docker images, Kubernetes clusters and Terraform-managed infrastructure. It is very doable remotely from Nigeria, but it is rarely a first tech job, because employers are handing you access to production.
- Site Reliability Engineer
A site reliability engineer (SRE) keeps a company's software up and fast, using code, monitoring, SLOs and well-run incident response instead of heroics. Nigerians do this job remotely for UK, European and US companies, but it is almost never an entry-level role, and with a US team on-call usually means being woken at night in Lagos.
- Cybersecurity Analyst
A cybersecurity analyst watches an organisation's systems for attacks, investigates suspicious alerts and helps contain incidents, usually from a security operations centre (SOC). Remote SOC work from Nigeria is possible, mostly through managed security providers and private companies, but many security jobs abroad require citizenship, security clearance or local background checks, and entry-level remote roles are scarce.
- Database Administrator
A database administrator (DBA) keeps a company's databases fast, backed up, secure and available, from tuning slow queries to restoring data after a bad deploy. Remote DBA work from Nigeria is realistic for experienced people, but it is rarely a first tech job, and many remote ads now fold the role into DevOps, site reliability or data platform engineering.