An organisation has 200 cloud accounts created ad hoc, with overlapping IP ranges and no consistent controls. Where do you start?

What the interviewer is testing

Whether you sequence a remediation by what can be fixed later versus what cannot.

The two things that are hardest to change later

IP address planning and account structure. Everything else can be retrofitted; these two get harder every month and block connectivity and policy respectively. So they set the sequence.

The sequence

1. Inventory and ownership. What exists, who owns it, what it costs, what it runs. Nothing can be planned without this, and it is usually a genuine discovery exercise.

2. Establish the organisation structure with organisational units matching how policy should apply, and enrol the existing accounts. This is possible without moving any workload and immediately enables organisation-level controls.

3. Apply preventive guardrails at the organisation level — deny public storage, enforce encryption, restrict regions, require encryption in transit. In warn mode first to size the existing violations, then enforce for new resources, then remediate the backlog. These apply without touching the accounts individually and remove whole classes of risk quickly.

4. Centralise logging to an account the workload teams cannot modify. This is prerequisite to every audit conversation and is independent of everything else.

5. Address the address plan. Allocate a proper scheme, and migrate accounts into it as workloads are touched for other reasons rather than as a campaign. Overlapping ranges only matter where connectivity is needed, so prioritise by that.

6. Enforce tagging at creation so cost attribution becomes possible.

7. Provide a paved road for new accounts, so the problem stops growing while you remediate. This is easy to defer and it is what determines whether the effort converges.

What a strong answer adds

Not attempting a big-bang migration into a new landing zone. That is a multi-year programme that stalls halfway, leaving two estates to govern. Enrol in place, apply controls at the organisation level, and migrate workloads opportunistically.

And the finer account granularity that modern practice favours: an account per workload per environment, treating accounts as cheap and disposable, since the account is the strongest blast radius, security and cost boundary the provider offers.

Common weak answers

Designing an ideal landing zone and planning a full migration. Starting with tagging, which is easy and low-value relative to the account and address decisions.