Cloud spend is up 60 percent year on year and security keeps finding the same misconfigurations. Design the org wide guardrail and cost governance model for 50 teams.
What they are really testing: They want to know if you can change engineer behaviour at scale without becoming a review board. The subtext is whether you understand that policy which is only enforced by humans reading tickets does not survive 50 teams.
A real interview question
Cloud spend is up 60 percent year on year and security keeps finding the same misconfigurations. Design the org wide guardrail and cost governance model for 50 teams.
What most people say
drag me
“I would set up a cloud security posture tool and a cost dashboard, then send reports to the teams so they can fix the issues and reduce their spend. We would also write a policy document.”
Dashboards and policy documents change nothing unless something is enforced or someone is accountable. It gives no enforcement point, no ownership of spend, no exception process, and no measurable target, so the same findings will reappear next quarter.
The follow-ups they ask next
A senior team lead says your policy is blocking a customer deadline. What do you do?
Use the exception path immediately with a 30 day expiry, unblock them today, and then fix the root cause so the next team does not hit it.
How do you avoid becoming a central review board?
Policy as code in the pipeline, not humans in tickets. The platform team writes rules, not approvals, and measures how many changes flow through with zero human touch.
How do you actually bring the 60 percent growth down?
Attribute first, then attack the top three line items with a named owner and a target, and reserve or commit only after usage stabilises.
What the interviewer is listening for
- Distinguishes preventive, proactive, and detective controls and chooses deliberately
- Puts cost in front of the team that spends it, weekly and by tag
- Every guardrail has an exception path with an owner and an expiry
- Names a measurable trigger for when the guardrails have gone too far
What sinks the answer
- Relies on dashboards, reports, and policy documents with no enforcement
- Makes the platform or security team the approver of every change
- No exception process, so teams route around the guardrails entirely
- Cannot attribute a single dollar of spend to a specific team
If you genuinely do not know
Say this instead of freezing. Reasoning out loud from what you do know beats silence every single time, and a good interviewer is listening for exactly that.
“I have not run governance for 50 teams, but here is how I would reason about it: if the same five findings keep coming back, the defaults are wrong, so I would make those five impossible to create rather than write another policy document.”
Keep going with system design
Mid
Design a log and metrics ingestion pipeline for a platform with about 200 services. Engineers need to search logs and alert on metrics.
Mid
Design an image upload and processing service for a marketplace app. Users upload photos from their phone, and we need thumbnails and a moderation check before the listing goes live. Walk me through it.
Senior
Design an event-driven order processing system for an e-commerce site. Payment, inventory, and shipping are separate services.
Senior
Design an analytics pipeline that produces a daily report for the leadership team by 8am. The data comes from a production database and a stream of app events.
Senior
Design a system that must never lose a message. It ingests payment notifications from a partner and each one must be processed exactly once.
Senior
We have about 50 product teams and every one of them has rolled their own pipeline. Design a CI/CD platform that all 50 can use. Take me through it.
Knowing the answer is not the same as recalling it under pressure
Sign in to send the questions you fumble to spaced recall, so they come back right before you would forget them, and learn the concepts behind them with hands-on labs.
Start free