Cloud architecture & system design
Turn vague requirements into a design you can defend under failure.
- Availability zones and regions
- Caching, queues, back-pressure
- Consistency and replication
- Multi-tenant isolation
cloudinterviewprep.com · cloud & agentic systems
Design for the outage.
Design for the outage.
Defend the tradeoff.
CloudInterviewPrep is built to be the best place on the web to prepare for a cloud interview: architecture, Kubernetes, networking, security, reliability and cost, and the agentic AI systems now running on top of them. Learn the reasoning a senior interviewer pushes on, not a list of service names.
Free to read. No account, no paywall, no email gate.
Every answer names its assumptions.
The question behind every design
What breaks first?
01 / The territory
Eight tracks.
Eight tracks.
One way of reasoning.
A cloud interview moves between layers in minutes: a DNS question becomes a failover question, then a cost question. Prepare across all of them, in the order interviewers usually connect them.
See all 40 questionsCompute, containers & Kubernetes
Know what the scheduler decides for you, and when it decides badly.
- VMs, containers, serverless
- Requests, limits, autoscaling
- Rollouts and pod disruption
- Cold starts and capacity
Networking & traffic
Follow a packet from a browser to a private database and back.
- VPC and CIDR planning
- DNS, L4 and L7 load balancing
- Private connectivity and peering
- Egress paths and NAT
Identity, security & compliance
Least privilege that still lets the team ship.
- IAM and workload identity
- Keys, envelope encryption, secrets
- Guardrails across accounts
- Audit and data residency
Data & storage
Choose the store from the access pattern, not the brand.
- Object, block and file
- Relational, key-value, analytical
- Partitioning and hot keys
- Backups you have restored
Reliability & observability
Set the objective, spend the budget, find the cause.
- SLOs and error budgets
- Metrics, logs and traces
- Incident response
- Disaster recovery, RTO and RPO
Cost & FinOps
Price the design before the interviewer does.
- Unit economics per request
- Commitments, spot, rightsizing
- Data transfer and egress
- Showback and ownership
Agentic systems & AI infrastructure
Run models and agents as production cloud workloads.
- Agent runtimes and tool gateways
- Identity and sandboxing for agents
- Model endpoints and GPU capacity
- Evaluation, tracing and cost
02 / The new round
The agent is a workload.
The agent is a workload.
Interview it like one.
Agentic systems put a planner in the request path. Its credentials, retries, spend and blast radius are all cloud problems, and interviews for cloud, platform and AI infrastructure roles increasingly include them.
Read the agentic systems guide- 01
Whose credentials does the agent act with?
Short-lived, task-scoped credentials from workload identity, issued on behalf of a user where the action is theirs. A shared admin key fails this question.
- 02
A tool call timed out. Did the side effect happen?
Idempotency keys, durable execution, and compensating actions. Retrying a payment because a socket closed is how agents double-charge.
- 03
One request fans out into forty model calls. Who notices?
Per-task step and token budgets, tracing attributed by tenant, and a cheaper model for steps that don't need the large one.
- 04
The agent can run code. Where?
In an ephemeral sandbox with a hardened kernel boundary, no ambient credentials, and network egress denied unless allowlisted.
- 05
How do you know version two is better?
A fixed evaluation set, graded traces, and a canary with a rollback gate. If you only read sample outputs, you don't know.
03 / On the whiteboard
The prompt is one line.
The prompt is one line.
The follow-ups go deep.
Interviewers rarely want the diagram. They want to watch you find the assumption that breaks it. Here is a typical first question and the reasoning it is really testing.
Reliability · Worked case
Region A just went dark.
Region A just went dark.
What do your users see?
You run an active-passive service: primary in Region A, a standby in Region B with an asynchronously replicated database. The primary region becomes unreachable at peak traffic. Walk through the next fifteen minutes.
Work through the full case- Detection. Health checks fail, but who decides it is a regional outage and not a flapping probe? Automatic failover on a false positive is its own incident.
- Traffic. A global load balancer shifts quickly. DNS-based failover waits on record TTLs and on resolvers that ignore them.
- Capacity. Was Region B warm, or scaled down to save money? Check quotas there before you need them.
- Data. Writes not yet replicated are gone or stranded. That window is your RPO, whether anyone agreed to it or not.
- Fencing. Promote the replica, then make sure the old primary cannot accept writes when it comes back.
Follow-up: Region A returns forty minutes later holding writes that never replicated. What do you do with them?
04 / Who it's for
Six roles.
Six roles.
One shared core.
Every cloud role is tested on the same fundamentals. What changes is where the interviewer spends the time and how deep they go.
Cloud engineer
Hands-on infrastructure: networking, IAM, infrastructure as code, and debugging a broken deployment while someone watches.
Solutions architect
Whiteboard designs under business constraints, migration plans, and explaining a tradeoff to someone who owns the budget.
Platform & DevOps engineer
Kubernetes internals, CI/CD, multi-tenant clusters, and the developer experience of everything you build.
Site reliability engineer
SLOs, incident command, capacity planning, and the postmortem question about what you would change.
Cloud security engineer
Identity design, detection, encryption and key management, and threat-modelling a system you have not seen before.
Customer, sales & forward deployed engineer
Design with a customer in the room: discovery, a credible architecture, and an honest answer when the product doesn't fit.
05 / Concept first, provider second
Same idea.
Same idea.
Three product names.
Interviewers at one provider will happily accept an answer framed in another provider's terms, as long as the concept is right. Learn the idea once and translate it.
| Concept | AWS | Google Cloud | Microsoft Azure |
|---|---|---|---|
| Private network | Amazon VPC (regional) | VPC network (global, regional subnets) | Virtual Network (regional) |
| Identity for workloads | IAM roles, EKS Pod Identity | Service accounts, Workload Identity Federation | Managed identities, Entra Workload ID |
| Object storage | Amazon S3 | Cloud Storage | Blob Storage |
| Managed Kubernetes | Amazon EKS | Google Kubernetes Engine | Azure Kubernetes Service |
| Serverless containers | AWS Fargate, App Runner | Cloud Run | Azure Container Apps |
| Functions | AWS Lambda | Cloud Run functions | Azure Functions |
| Messaging | SQS, SNS, EventBridge | Pub/Sub, Eventarc | Service Bus, Event Grid |
| Globally distributed database | DynamoDB global tables, Aurora DSQL | Spanner | Azure Cosmos DB |
| Key management | AWS KMS | Cloud KMS | Azure Key Vault |
| Managed models & agents | Amazon Bedrock, Bedrock AgentCore | Vertex AI, Vertex AI Agent Engine | Microsoft Foundry, Foundry Agent Service |
Service names as of October 2026. Equivalents are close, not identical. The differences, such as a global versus a regional network, are good interview material in their own right.
The standard we hold ourselves to
You should be able to
You should be able to
check the reasoning.
Cloud interview advice is full of confident lists. We would rather show the work: what the question is testing, which assumption the answer depends on, and what would change it.
Assumptions statedEvery answer says what load, budget and failure model it assumes.
Concept before productProvider names appear only after the idea is clear.
Dated factsLimits, prices and service names change. We date them.
No invented interviewsWe never claim a question was asked at a named company.
06 / Questions about the site
Frequently asked
What is CloudInterviewPrep?
CloudInterviewPrep (cloudinterviewprep.com) is an interview preparation site for cloud roles. It covers cloud architecture and system design, compute and Kubernetes, networking, identity and security, data, reliability, cost, and the agentic AI systems that now run on cloud infrastructure. Each question explains what the interviewer is testing and how a strong answer reasons through the tradeoffs.
Which roles is CloudInterviewPrep for?
Cloud engineers, solutions architects, platform and DevOps engineers, site reliability engineers, cloud security engineers, and customer-facing technical roles such as customer engineers, sales engineers and forward deployed engineers. Engineers moving into AI infrastructure and agent platform work will find a dedicated agentic systems track.
Is the material specific to AWS, Google Cloud or Azure?
The material teaches the concept first and the provider second. Interviewers at cloud providers and cloud-native companies test whether you understand failure domains, identity, networking and cost, not whether you can recite a product catalogue. Where provider names matter, a mapping table translates the same concept across AWS, Google Cloud and Microsoft Azure.
What is an agentic systems interview?
An agentic systems interview asks you to design, operate or debug software in which a language model plans and calls tools to complete a task. On the cloud side, the questions are about identity and credentials for agents, sandboxed code execution, durable workflows and idempotent tool calls, cost and token budgets, evaluation, tracing, and the GPU or model-endpoint capacity behind it all.
How should I prepare for a cloud system design interview?
Practise one repeatable sequence: clarify requirements and service-level objectives, estimate load, choose data stores by access pattern and consistency need, place the design across zones and regions, then walk through failure, security and cost. Interviewers reward candidates who name the tradeoff they are making and say what would change their mind. The cloud system design guide walks through the sequence with a worked example.
Is CloudInterviewPrep free?
Yes. Everything published on cloudinterviewprep.com today is free to read, with no account and no email required.
From knowing the services to owning the design