Skip to content

Cloud architecture in a Staff interview

Our Staff cloud questions add a second constraint the first answer has to survive: a bill, a partner's connection limit, an account boundary, a setting nobody can undo. They test whether the design still holds once that constraint is priced in.

An axis of our Staff fullstack target.

The check comes with every pass, covers all 12 competencies of our Staff fullstack target, and takes about 24 minutes. It reports each one as Ready, Borderline or a Gap for this level. It never predicts a pass.

Patterns our questions are designed to test at Staff

These are the distinctions the questions on this axis are written to separate — our judgement from writing them and having them reviewed, not a measurement of candidates. We have run no study, so nothing here is a statistic and none of it is phrased as one.

  1. 1.

    Cost treated as a total rather than a function

    When forty spoke VPCs are already attached to a Transit Gateway, moving their interface endpoints into one hub replaces an hourly charge per endpoint, per zone and per VPC with a charge per gigabyte crossing the gateway. In GKE Autopilot, billed per Pod request, an init container that runs for ten seconds can set what the Pod is billed for as long as it runs. Our Staff questions ask what the bill is a function of, because that decides whether a design gets cheaper or dearer as it grows.

  2. 2.

    One limit fixed by breaking another

    Raising maximum instances to absorb a peak can exceed the connection limit of a downstream partner. An API Gateway endpoint that waits for a Step Functions Express workflow covers the usual eight seconds and fails the caller on the ninety-second run, while the workflow runs to completion with nobody waiting for it. In several of our questions the value that fixes the first symptom causes the second, and the answer is a range or a different shape.

  3. 3.

    Ownership across accounts

    Whether a replicated object belongs to the source or the destination account depends on a setting: with Bucket owner enforced on the destination bucket its owner owns every replica, and with the object-writer setting replicas stay owned by the source account unless the replication rule overrides that. Organisation policies, cross-account roles and shared networks each draw a line like that, and a design that spans accounts has to say on which side every object and permission sits.

  4. 4.

    Irreversibility as the thing you buy

    A compliance-mode vault lock is worth something because once its grace period ends nobody can undo it, an administrator included. The same property makes a mistake in its retention permanent. Our Staff questions ask what a change makes impossible, for you as well as for an attacker.

What a strong answer sounds like: A strong answer gives the range that works, bounded on both sides, and says which bound moves if the traffic or the price does.

How the check measures it

3 questions drawn on this axis alone — 1 medium and 2 hard for a Staff target, because the bar is the level. Hard counts for one and a half times a medium, which is what makes the verdict relative:

Medium rightHard rightVerdict
1 of 12 of 2Ready
0 of 12 of 2Ready
1 of 11 of 2Borderline
0 of 11 of 2Gap
1 of 10 of 2Gap
0 of 10 of 2Gap

Three questions is coarse and the report says so beside every verdict. It is enough to separate this axis from the others in your target, which is what the check is for — there is no total, no percentage and no single number anywhere in the report.

What there is to practise

215 questions on this axis
143 medium, 72 hard. Easy is not drawn for a Staff target.

Every answer cites the source it was checked against.

Drawn from AWS (129), Google Cloud (89), System Design (7), Messaging & Event Streaming (5), Microsoft Azure (1).

Practised in the System design and Operations and reliability rounds
Design a system to requirements and defend the trade-offs: storage, messaging, caching, capacity and cost. Running it in production: reliability, observability, Kubernetes, infrastructure as code, incidents and cost.

Practice is arranged by interview round rather than by topic, so you can work through it one round at a time.

Questions here most often also test security, networking, reliability & failure modes and data modelling & storage. Few questions on this axis test it alone, which is why the check reports every competency separately rather than averaging them.

One of them, in full

A question from the free demo, not written for this page. A demo quiz opens with it; the answer, the explanation and the source come when you submit — no account needed.

Cloud architecturehard

Your team attaches an existing Lambda function to a VPC so it can query an RDS database, selecting the subnets the RDS instance sits in. After the change, the function starts timing out when calling a public third-party API it previously called successfully. Those subnets route 0.0.0.0/0 to an Internet Gateway, the function's security group allows all outbound traffic, and the calls fail on every invocation rather than only on the first after an idle period. What is the cause?

Answer it on the demo

One axis is not the loop

This axis is one of 12 in our Staff fullstack target, and being strong here says nothing about the others. The check covers all of them in one sitting and reports each separately, so what comes back is a profile rather than a score.