Would you like to learn how to master the technical part of the cloud architect interview?
Well if so, this video is for you.
Hi, my name is Michael Gibbs and I've been working in technology for over 25 years. I've
worked in networking, I've worked in security, and I've worked in cloud computing and I've
been teaching, coaching, or mentoring others for well over 20 years.
Today we're going to be talking about how to master the technical component of the cloud
architect interview. See, as hiring managers it's up to us to find strong, capable individuals
that can competently perform the job and improve the quality of our team, and how we gauge
competency is not based upon the number of years experience you have, it's not based
on the number of certifications you have, but it's going to be based upon the technical
interview.
Now there's a lot of things we learn from this technical interview. It is not just your
technical capabilities. We learn your level of competency. To a certain degree we can
gauge your soft skills. We can check your emotional intelligence and the way you respond
to these. We can check your communication skills, and we can even check your sales skills
because you're effectively going to be selling yourself to the hiring manager. So we learn
a lot in this interview.
So the best way to do this, and the best way we gauge it is by asking open-ended cloud
architect interview questions. The reason they're open-ended is we're not looking for
a multiple choice answer. That doesn't tell us anything. Anyone can basically memorize
that this does this. But as an architect we need to be able to interact with customers,
ask the right questions, look at the customer's business, legal, technical, and regulatory
requirements, and then design a solution.
So we're going to have to ask these open-ended questions. So as I mentioned in the last video,
we're going to have a video every week for the next eight weeks and we are going to give
you 50 of the most common best cloud architect interview questions that we've seen.
So the first question we're going to ask people is, "How do you secure a VPC"? And the reason
we ask this question is we want to know if someone truly understands security, or if
they've learned just a security term. See, when I ask the question and someone says,
use a NACAL in a security group, I know they've read a book or passed an exam, but I know
they don't understand security. If someone says to me, you secure your VPC in layers,
use a firewall at the edge of your network to keep a strong perimeter and keep outsiders
out behind the firewall using IDS, IBS, IPS system, to see what's going on if there's
an intrusion, and if so thwart the intrusion as it occurs. Use some DDoS protection outside
of your domain and then inside of your domain, keep unwanted traffic out of your subnets
within the ARC ACL.
Keep unwanted traffic out of your servers with the security group, better yet add a
host based firewall to your security group. Then you're going to add components such as
IAM, then you're going to provide components such as locking down your systems to make
sure they don't have any unnecessary services and patching for vulnerabilities, and it goes
on and goes on and goes on.
When I hear that from a candidate, I know they understand security. When I just hear
one or two service names I know they passed an exam. So when you're on these interviews
it is up to you to show that you're competent. So show them, show some depth of knowledge
so that you understand it, and you'll always be hired because it's very hard to find qualified
people that can answer questions like this.
Now the next kind of thing that I ask people, and I've seen asked a lot is, "An organization
wants to use cloud as a disaster recovery site". And then I went and I would say, "What
are the options, and what are the strengths and weaknesses of each option"? See, this
gives us good information about the person's architectural abilities. There really are
four options with regards to using the cloud for disaster recovery, and each one of these
has strengths and weaknesses and I want to know if the potential employee knows. If they
tell me that you have basically four options for using the cloud as disaster recovery,
option one is a completely cold standby where basically you put machine images of your servers
in the remote location, and basically you periodically send your data there to the remote
location. I know that's the first type. Then they can say the advantage of this is that
it's super cheap, but the disadvantage is it's going to take a long time to come back
to service, should you have a primary failure.
Then they could say the next type is something that's a little better. For example you make
machine images of say your web layer and your application layer, but you keep a standby
database that's active and receiving the information to be synchronized. They could say the advantage
of that is you still have a slow failover, but it's much faster because your data is
always up to date. I could say, "Okay they get it". And then if they tell me the third
option is to basically replicate your environment but use very small instances in the disaster
recovery site, but basically place them in an auto scaling group, that tells me that
they've thought of all the ways an architect can do things.
Basically you could use an auto scaling group, and by using an auto scaling group, basically
if their primary site fails all the traffic through DNS will be shifted to your disaster
recovery site and the systems will scale out and you'll have more computing performance.
If they know that I know that's good, but I also want them to say, "When you use this
approach, it might take 10 to 30 minutes for your systems to auto-scale so it's not the
fastest".
And then I also want my potential cloud architect to say, "Your fourth option is this. You can
just run a standby everything, a complete hot standby. So whatever you have in one location
you have in the other location, and the only time it'll take is for DNS to detect one site
down and it will reroute your traffic to the other one". That's how I know that someone's
an architect, and that's how I know someone can design systems.
See these open-ended questions give us so much information. The next question I like
to ask people, but it's commonly asked is, "When should you use a direct connection,
and when should you use a VPN"? Why do I ask this question? This question gives us an indication
if someone understands networking, or at least components of networking. See, we know that
from a networking world in a performance world, if you create effectively a wire between two
locations, and a direct connection is not exactly a wire but logically it's a wire between
two locations, your latency is going to be consistent and you're going to be guaranteed
to have the performance of that entire wire.
If an organization needs guaranteed bandwidth and guaranteed consistent latency, they must
use a direct connection. Now for example, if the client or the candidate were to tell
us something different that uses a direct connection just for performance, but they
couldn't explain why the performance, again I know they've passed an exam but I know they
don't understand the concepts.
I would then expect them to say, "You use VPN when you want to create, make it easy
to create one connection to multiple sites, because the Internet's there, you use the
VPN because it's cheaper, and because you've got the flexibility via VPN and everybody
for the most part has internet access. You can create connections on demand, and it's
very easy to connect to multiple remote locations. The downside is you're dependent upon internet
bandwidth", and when I hear that I know the person understands the VPN concept and the
direct connect concept. So I know they understand a small component of the networking component
of being a cloud architect, but even that is great because it's showing me depth of
knowledge.
Now, another question I'd like to ask, and I like to ask a lot of networking questions
and today we're predominantly talking about networking questions, but the next time we'll
talk about databases or computers or something else, is I like to ask people, "You've got
a site that has 10 remote campuses. The main site is hosted in the cloud and they have
10 remote sites, and not only the 10 remote sites need to talk to the cloud but they need
to talk to each other. How could you do this? What are your architectural approaches"? Why?
Because it's going to teach me if the person understands cloud networking.
See there's three approaches, and each one of them has their strengths. They could create
BUCHANAN connections between the cloud and each remote site and that would work perfectly,
or they could basically set up BPC peering and they can all peer with each other. So
if everybody needs to connect to everybody you're going to have to fully mesh BPC peers.
When you do that, there's advantages to that. Since everyone has a connection to everyone,
should something happen in a central place everybody could still talk to everybody else
that they need to. So there's still a lot of benefits to be gained by fully meshed.
Plus when you're fully meshed your performance is better because you're never more than one
hop away. The downside of fully meshed is when you're fully meshed you will have an
incredible number of peers and they add up rapidly because the number of peers increases
dramatically. So the formula to determine the peers is N times N minus one divided by
two. So if you've got three VPCs that need to peer with each other it's no big deal.
If you have three times three minus one, which is two, which is six divided by two, which
is three.
Now let's say you have 10 locations. In this example, you have 10 times 10 minus one, which
is nine. So that means you've got 90 divided by two, which is 45. So you can see just by
going from three to 10 locations the number of connections just really went up. So that
is the disadvantage.
So the options they have are VPNs, they have fully meshing your peers and they have CloudHub.
And what CloudHub is a way to basically create a hub and spoke VPN connection, at least in
the AWS environment, and allow for the organizations to still talk to each other through the hub
and spoke just like a traditional environment. So I want to know that the potential employee,
the candidate that can actually understand the, how and the why, why we use it.
The last networking question that I tend to ask is it typically about IPSec, and the reason
I ask about IPSec, because people know that it's encryption, but if they really understand
IPSec, they're going to understand all the amazing things that IPSec does beyond just
encryption. So I typically ask, "What functions are achieved by IPSec"? And if the person
says encryption again, I know they've probably passed a certification exam, which is still
good, but I know they don't really understand it.
Now if they say that, "IPSec provides the ability to authenticate each remote end to
prevent man in the middle attacks where someone presents to be someone else, and that it can
ensure the integrity of your data because it uses a hashing algorithm. And since you
know there's data integrity if you've got a message going from point A to point B, someone
can send someone an electronic payment for a hundred dollars and have it changed to a
million dollars, because you can verify that nothing has been changed.
The last thing that comes out of IPSec is something called non-repudiation. Effectively
there's a record of the message, so if this person orders something from this person and
then receives it, this person can't say after the fact, "I didn't order" because that's
the non-repudiation.
So with IPSec, you have the ability to authenticate, you have the ability to determine message
integrity, and you have the ability to verify that messages are sent and provide a non-repudiation
environment. In addition to the encryption, in addition to the ability to tunnel private
IP addresses and private traffic and private routing information over a public network.
So these are the kind of ways that I can actually gauge what people know, and today we covered
five questions. Next week, we will cover five more questions at least, they'll be in a different
part of the cloud. This week we focused heavily on the network, but the network is part of
the cloud. Just remember the cloud is nothing more than a virtualized network in a virtualized
data center.
Let me tell you some free offerings that we offer to the cloud architect community. Every
Monday and Thursday, we have a free how to get your first cloud architect job webinar.
We will talk about what employers desire, how to build a perfect resume, how to get
your name out there, how to get hired and things to do on your interview. So we do that
on Monday and Thursday, they're completely free. Not only do we present in the beginning,
and then afterwards you can ask any questions you want, and we will even help build you
a career plan live on these free calls.
Every Tuesday we have a webinar about how you can get actual cloud architect experience
when you're home to help you get hired, because employers desire experience. The reason they
desire experience is they're looking for competency so that there's a way to build real cloud
architect competency at home and we talk about that free every Tuesday at 9:00 AM.
I want to let you know about something that we are really excited to offer for free to
the cloud architect community. We have just released our AWS certified solution architect
associate training completely free. The complete online course is posted here now on our YouTube
channel.
We did this because we know that sometimes the certification is the first step to helping
someone achieve the job and goal of their dreams. And we know there's so many people
out there that really could benefit from a certification but the cost of a quality course
is beyond their budget, and we want to make it easy on them.
So we have a free AWS certified solution architect ebook. The link is in the description below.
Please fill that out. You'll get a book emailed to you, and have a free AWS certified solution
architect associate course. Use the book, use the course, that's everything you need
to pass the AWS certification of the AWS certified solution architect associate exam, and it's
completely free compliments of Go-Kart Architects.
I'd like to thank you so much for watching this video, and I look forward to seeing you
on another video very soon. Take care, and it's so nice to speak with you today.