Cloud Platforms Interview Questions & Answers

Security groups act as a virtual firewall for individual instances or network interfaces and are stateful, meaning return traffic for an allowed connection is automatically permitted. NACLs are attached at the subnet level and are stateless, so both inbound and outbound rules must be explicitly defined, and only NACLs support explicit deny rules, since security groups can only allow traffic.

A stateful app like Jenkins needs its data to survive even if the pod restarts or moves to a different node, and to keep working if a whole zone goes down. A PersistentVolumeClaim backed by a Regional Persistent Disk gives you exactly that durability, whereas hostPath and emptyDir are tied to one node's local disk (gone if the pod moves), and a storage bucket isn't built to act like a real filesystem.

Cloud providers typically charge a per-GB fee for traffic that crosses Availability Zone boundaries, even though it never leaves the region, which surprises teams who assume 'same region' means free. Common mitigations include colocating latency-sensitive, chatty services in the same AZ or using AZ-aware service discovery and load balancing to prefer same-AZ targets, while still accepting some cross-AZ traffic as the tradeoff for the availability benefit Multi-AZ provides. Traffic within a region is NOT automatically free, and that exact misconception is what causes bills like this.

The less often you access data, the cheaper AWS lets you store it, in exchange for slightly different retrieval behavior. S3 Glacier Instant Retrieval is built exactly for data you touch about once a quarter, it's the cheapest per-GB of these four while still giving you your data back in milliseconds if you need it.

Storing IAM keys anywhere (a config file, environment variables, user data) creates a secret that can be copied or leaked. Attaching an IAM Role to the EC2 instance instead lets AWS automatically hand out short-lived, auto-rotating credentials through the instance itself, so there's never a long-lived key sitting around to steal in the first place.

FedRAMP High demands that every layer be locked down: Azure CNI gives fine-grained network rules per pod (something the simpler kubenet networking can't do), a firewall controls what traffic can leave, a private cluster hides the API server from the public internet, and customer-managed keys mean you control the encryption of etcd's stored secrets. Azure Policy alone doesn't provide any of these network or encryption controls.

A static website is just files, no server-side code needed, so you don't need a server at all. Azure Blob Storage can serve those files directly over HTTP, which is why it's the cheapest option here, whereas App Service, a VM, or Functions all spin up compute you'd be paying for and don't need.

Layer 7 load balancers operate at the application layer and can read the actual contents of an HTTP request, so they support content-based routing such as path-based or host-based rules to different target groups. Layer 4 load balancers only see IP, port, and TCP-level information, and route purely based on that, with no visibility into the HTTP path itself.

Terraform state is just a file that tracks what resources it's already created, and it needs one consistent home so it doesn't get out of sync. Terraform Cloud gives you a single backend that works for both AWS and Azure, with locking and version history built in, instead of juggling two separate, differently-secured storage locations.

'11 nines' of durability means the odds of ever losing your data are astronomically small, and Amazon S3 gets there by automatically storing multiple copies of every object across different data centers in a region. EBS, EFS, and RDS are built to be fast and available, but they aren't engineered for that same extreme level of data durability.