Cloud engineer screening questions: accounts, identity, networking and certifications versus practice
On this page
- Operations, build, migration or architecture: place the candidate
- Certifications versus practice
- Accounts, identity and guardrails
- Networking: a scenario anyone can score
- Migrations: count what they moved
- Cost, backups and reliability
- How cloud resumes overstate the work
- Logistics, knockout checklist and scorecard
- Questions people ask
Cloud engineer screening questions should find out what the candidate has built and run inside a cloud provider, not which certifications they passed. Ask how many accounts, subscriptions or projects they managed, how people signed in and who set the guardrails, how the networks connected, what they migrated themselves, and what the monthly bill was. Engineers with real practice answer with names, numbers and one thing that broke. Candidates whose experience is mostly exam preparation answer with the vocabulary of the exam.
This page covers the platform side: landing zones, identity, networking, migrations and certifications. Pipelines, Kubernetes operations and release on-call are in DevOps engineer screening questions, and on-premises routing and firewalls are in network engineer screening questions. Use those alongside this one when the role mixes the work.
Operations, build, migration or architecture: place the candidate
"Cloud engineer" covers at least four jobs. The client usually wants one of them and the resume often describes another. Settle this in the first five minutes.
| Flavor of the role | What the week looks like | Ask for | Common mismatch |
|---|---|---|---|
| Cloud operations or support | Access requests, monitoring alerts, patching virtual machines, resizing, backups, tickets | Ticket types, environments supported, what they automated | Ticket work described as "designed cloud infrastructure" |
| Cloud build or platform | Landing zones, account vending, networks, identity, guardrails, infrastructure code | What they created from nothing, and who uses it | Worked inside a platform another team built |
| Migration engineer | Moving servers, databases and applications from a data center or another cloud | Workloads moved personally, waves, cutovers, rollbacks | Present on a migration program; cannot name what they moved |
| Cloud architect | Designs, reviews, standards, cost and security trade-offs, stakeholder meetings | A design they wrote that others built, and one they rejected | Senior engineer with the architect title but no design authority |
None of these is better than the others. A strong operations engineer is a poor fit for a greenfield landing-zone build, and an architect who has not touched a console in three years is a poor fit for a hands-on migration contract. Write down which one you are screening for before the call.
Certifications versus practice
Cloud resumes often list several certifications, because the providers publish clear exam paths and the exams can be passed with study alone. That makes a certification useful evidence of structured knowledge and weak evidence of production work. Know what the common ones are and what their issuers say about them.
| Certification | Level | What the issuer says, as of September 2026 |
|---|---|---|
| AWS Certified Solutions Architect – Associate | Associate | Aimed at people with at least one year of hands-on experience designing on AWS; 65 questions in 130 minutes; valid for three years, per AWS. |
| AWS Certified CloudOps Engineer – Associate | Associate | Formerly AWS Certified SysOps Administrator – Associate; the new name applies to people who pass the latest exam version (SOA-C03), per AWS. Expect both names on resumes. |
| AWS Certified Solutions Architect – Professional | Professional | Aimed at people with two or more years designing and implementing on AWS; 75 questions in 180 minutes, per AWS. |
| Microsoft Certified: Azure Administrator Associate | Associate (exam AZ-104) | Renews every 12 months through a free online assessment, per Microsoft Learn. |
| Microsoft Certified: Azure Solutions Architect Expert | Expert (exam AZ-305) | Requires the Azure Administrator Associate certification as a prerequisite, per Microsoft Learn. |
| Google Cloud Associate Cloud Engineer | Associate | Recommends six months or more of hands-on Google Cloud experience; valid for three years, per Google Cloud. |
| Google Cloud Professional Cloud Architect | Professional | Recommends three or more years of industry experience including a year designing on Google Cloud; valid for two years, per Google Cloud. |
Two details catch recruiters out. First, validity differs by provider: AWS certifications last three years and can be renewed by passing the latest exam or, for some, a higher-level one, per AWS's recertification page; Microsoft's role-based certifications expire unless renewed each year, while its Fundamentals certifications, such as AZ-900, do not expire, per Microsoft's renewal page. A lapsed certification on an experienced engineer is common and not a reason to reject; a lapsed one described as current is a labeling problem to fix before the client sees it.
Second, verification. AWS says the way to verify is to ask the earner for their digital badge link, which is issued through Credly and shows the issue date, per its certification FAQ. Google Cloud badges sit in a Credential Wallet also powered by Credly, per Google's help center. Microsoft candidates can generate a share link to their transcript from their Learn profile, per Microsoft Learn.
Turning a certification into a practice question
| They say | Ask | Strong answer | Red flag |
|---|---|---|---|
| "I'm a certified Solutions Architect." | "Which design from the exam have you actually built at work?" | Names one, such as a multi-account setup or a highly available web tier, and what was different in real life. | "The exam covered everything I do." |
| "I have AZ-104." | "What did you configure in Entra ID or Azure networking last quarter?" | A specific change: a conditional access policy, a peering, a private endpoint. | Describes the exam objectives, not a task. |
| "Five AWS certifications." | "Which one was hardest, and what did you have to learn that you had never done at work?" | An honest gap and how they closed it. | All passed in a few months with no production role in between, described as experience. |
| "Professional Cloud Architect." | "Tell me about a design you proposed that was rejected." | A real trade-off lost to cost, time or security. | Has never had a design reviewed by anyone. |
Accounts, identity and guardrails
This is where cloud engineers differ most in depth, and where mistakes cost clients the most. The answers come with numbers and product names when the candidate has done the work.
| Question | What a strong answer sounds like | Red flags |
|---|---|---|
| How many accounts, subscriptions or projects were in the environment, and how were they organized? | A number and a structure: "About 40 AWS accounts in an organization, split by environment and business unit." Or management groups in Azure, folders in Google Cloud. | "One big account for everything," with no awareness that this is a design choice. |
| How did engineers sign in, and who approved access? | Single sign-on through IAM Identity Center, Entra ID or Google identity, with roles and an approval step. | Shared logins or long-lived access keys, described without concern. |
| What guardrails stopped people doing dangerous things? | Names the mechanism: service control policies, Azure Policy, Google organization policies, and one rule they wrote. | No guardrails, or "we trusted people." |
| How did a team get a new account or subscription? | A request process or an automated vending step, with a baseline applied on creation. | Someone created it by hand and configured it from memory. |
| Tell me about an access problem you fixed. | A specific case: an over-broad role, a leaked key, an orphaned admin account, and what changed afterwards. | Has never reviewed who had access. |
Networking: a scenario anyone can score
Networking is where exam knowledge and practice separate fastest. You do not need to know the answer to score this scenario; you need the checklist below.
Read this to the candidate
"An application on a virtual machine in a private subnet cannot reach an external API it used to reach yesterday. Nothing in the application changed. Walk me through what you would check."
Tick each item they mention:
- The route table for that subnet, and whether the default route still points somewhere.
- The NAT gateway or other outbound path, and whether it exists and is healthy.
- Security groups or network security group rules on outbound traffic.
- Network ACLs or a firewall appliance between the subnet and the internet.
- DNS: whether the API's name still resolves from inside the network.
- Whether the API provider changed something, such as an IP allowlist that expects a fixed outbound address.
- Recent infrastructure changes: who deployed what yesterday, and whether it was in code.
Five or more, in a sensible order, from someone who says "first I'd check" rather than reciting a list, is strong. Two or fewer for a mid-level role is a flag.
Then ask about how the cloud connects to everything else:
- "How did the cloud network connect to the office or data center?" Strong: names the link (site-to-site VPN, AWS Direct Connect, Azure ExpressRoute, Google Cloud Interconnect) and who configured each side. Red flag: "the network team handled that" for a hybrid-heavy role.
- "How did you plan IP address ranges?" Strong: a scheme, and a story about overlapping ranges when two networks had to be joined. Red flag: default ranges everywhere.
- "How did services in different accounts or virtual networks talk to each other?" Strong: peering, a transit gateway or hub-and-spoke design, private endpoints. Red flag: everything over the public internet.
Migrations: count what they moved
"Led the migration to Azure" is a common cloud resume line, and it can mean anything from running the program to attending the stand-ups. Ask for the size, the approach and the candidate's own part.
Checking a migration claim (invented example)
The resume says: "Migrated 400 servers from on-premises to Azure." You ask:
- "How many of those did you move yourself?" — "About 60 across three waves, mostly SQL Server hosts."
- "What did you do for each?" — "Wrote the runbook, ran the replication, did the cutover on the weekend, and owned the rollback plan."
- "Were they moved as they were, or rebuilt?" — "Rehosted, except two databases we moved to managed instances."
That is 60 ÷ 400 = 15 percent of the servers, with end-to-end ownership of each. It is a strong, specific result. Record it that way, not as "led a 400-server migration."
- "What went wrong on a cutover, and what did you do?" Strong: a real failure, the decision to roll back or push through, and who they told. Red flag: every cutover was perfect.
- "What did you decide not to migrate, and why?" Strong: a workload left behind or retired, with a reason. Red flag: never questioned the list.
- "How did you prove it worked after the move?" Strong: tests with the application owner, performance compared to before. Red flag: "no one complained."
Cost, backups and reliability
Cloud engineers are often the first to see the bill. For how to check a percentage savings claim with arithmetic, use the worked example in the DevOps page; the questions below cover the platform side.
| Question | What a strong answer sounds like | Red flags |
|---|---|---|
| Roughly what was the monthly spend in the environment you ran? | A figure, even approximate, and who owned the budget. | Never saw the bill. |
| How could you tell which team or product was spending what? | Tags or labels enforced at creation, cost reports by tag, budgets with alerts. | "We couldn't really tell." |
| Did you buy commitments such as Savings Plans, Azure reservations or committed use discounts? | Knows who decided, how much of the usage was covered, and the risk of over-buying. | Claims the full saving from a purchase finance made. |
| When did you last restore something from a backup? | A date, what was restored, how long it took. | Backups were configured but never tested. |
| What would happen if one availability zone or region went down? | Describes what fails over and what does not, honestly. | "Everything is highly available," with no detail. |
How cloud resumes overstate the work
| Pattern | What it looks like | How to check |
|---|---|---|
| Certifications as experience | Four badges and a short, unrelated job history | "Which of these have you used in production?" |
| Console clicks as infrastructure code | "Provisioned infrastructure with Terraform" | "Which resources were created by hand, and which from code you wrote?" |
| Equal multi-cloud depth | AWS, Azure and GCP listed as peers | "Which one did you use every day last year?" |
| Implementer as architect | "Architected the landing zone" | "Who wrote the design document, and what did you change in it?" |
| Program member as migration lead | "Led a 400-server migration" | "How many did you move yourself?" |
| Scanner results as security work | "Improved cloud security posture" | "Which finding did you fix, and how did you stop it recurring?" |
| Sandbox as production | Personal account projects listed as work | "Was that at work or on your own?" Personal labs are good; the label matters. |
Logistics, knockout checklist and scorecard
| Question | What a strong answer sounds like | Red flags |
|---|---|---|
| Changes go out in a Saturday maintenance window once a month, and there is an on-call rotation. Can you commit to that? | A clear yes or a clear limit. Describe the schedule; do not ask about family to judge it. | Accepts without asking how often pages happen. |
| The client's workloads run in a government cloud region with access restrictions. Is that a problem? | A direct answer. Ask the client for the exact requirement in writing and ask every candidate the same question; wording is covered in cybersecurity analyst screening questions. | Guessing at eligibility without the client's requirement. |
| What salary are you looking for? | A number or range. Ask expectations, not current pay; see salary expectation questions. | Only a salary-site figure. |
| Are you legally authorized to work in the US, and will you now or in the future need visa sponsorship? | A direct answer to both. | None. Ask everyone the same two questions. |
Must-ask on every cloud engineer screen
- Which flavor: operations, build, migration or architecture.
- Primary cloud and the size of the environment in accounts, subscriptions or projects.
- How identity and access worked, and one guardrail they wrote.
- The networking scenario, scored against the checklist.
- What they migrated personally, with a number.
- Monthly spend and one cost or backup story.
- Certifications with status and verification link, if the client requires them.
- Maintenance windows and on-call, salary expectation, notice, other processes, work authorization.
Knock out, or flag to the client before submitting, if:
- The role builds landing zones and the candidate has only worked inside ones others built.
- The client's cloud is a must-have and the candidate has only certification-level knowledge of it.
- The candidate scores two or fewer on the networking checklist for a mid-level or senior role.
- A certification the client requires is expired and described as current.
| Area | 1 | 2 | 3 | 4 |
|---|---|---|---|---|
| Platform ownership | Worked inside what existed | Changed existing accounts and networks | Built environments others use | Designed the structure and guardrails |
| Identity and security | Requested access | Granted access by hand | Built roles and single sign-on | Wrote guardrails and fixed a real exposure |
| Networking | 0–2 checklist items | 3–4 items | 5–6 items and a hybrid story | All items, in order, with a design they owned |
| Migrations and cost | None | Attended a migration | Moved workloads end to end | Led waves with measured cost or performance results |
| Logistics fit | Deal-breaker | Two open questions | One open question | All aligned |
Write down the candidate's own numbers and phrasing: "moved about 60 of the 400, owned each cutover" tells an engineering manager more than "cloud migration expert." Interview Signal attaches quotes like that to each score from the call. If the platform work leans toward servers and directory services, pair this page with systems administrator screening questions.
Questions people ask
Is an AWS, Azure or Google Cloud certification enough to hire a cloud engineer?
Not on its own. A certification shows the candidate studied the platform and passed a timed exam; it does not show they have run production accounts, fixed a routing problem or cut over a migration. Treat it as a reason to ask practice questions, and weigh it more heavily for junior roles where there is little production history to test.
How do I verify a cloud certification a candidate lists?
Ask for the issuer's link. As of September 2026, AWS and Google Cloud issue digital badges through Credly that show the issue date, and Microsoft lets candidates share a transcript link from their Microsoft Learn profile. Check the expiry date as well as the name.
What is the difference between a cloud engineer and a DevOps engineer?
The titles overlap. Cloud engineers usually own the platform itself: accounts, identity, networks, guardrails and migrations. DevOps engineers usually own how code gets to that platform: pipelines, deployment tooling and on-call for releases. Ask what the candidate's last month of work produced rather than trusting either title.
Should a cloud engineer know all three major clouds?
Rarely. Most engineers work in one cloud every day and have lighter exposure to a second. A candidate who claims equal depth in AWS, Azure and Google Cloud usually has shallow depth in two of them; ask which one they used every day last year.