Interview Q&A / AWS & Cloud

1. How do an Auto Scaling group and a load balancer work together on AWS?

   An Auto Scaling group keeps the right number of healthy EC2 instances running, adding or removing them based on policies such as target CPU. A load balancer spreads incoming traffic across those instances in multiple AZs. The ASG registers new instances with the load balancer's target group and replaces any that fail health checks.

   AdvancedIn-depth4 min read
2. Can you use Spot Instances inside an Auto Scaling group, and how do you do it safely?

   Yes. A mixed instances policy lets an ASG combine On-Demand and Spot across several instance types. Keep a small On-Demand base, spread Spot across types and AZs, and make the app handle the two-minute interruption notice.

   AdvancedQuick answer1 min read
3. How does cross-account access work with IAM roles and AWS STS?

   The target account creates a role with a trust policy naming the other account, and permissions for what the role can do. A user or service in the other account calls STS AssumeRole and receives temporary credentials for that role.

   AdvancedQuick answer1 min read
4. How many read capacity units does a DynamoDB read use for strongly and eventually consistent reads?

   One RCU covers one strongly consistent read per second of an item up to 4 KB, or two eventually consistent reads. Larger items are rounded up to the next 4 KB.

   AdvancedQuick answer1 min read
5. What is a service control policy in AWS Organizations?

   A service control policy sets the maximum permissions for accounts in an organization or organizational unit. It never grants permissions by itself; it only limits what IAM policies in those accounts can allow, even for the root user of the member account.

   AdvancedQuick answer1 min read
6. What is a VPC endpoint and what is the difference between gateway and interface endpoints?

   A VPC endpoint lets resources in your VPC reach AWS services privately without an internet gateway or NAT. Gateway endpoints, for S3 and DynamoDB, are route-table entries and free. Interface endpoints use PrivateLink with a network interface and are charged.

   AdvancedQuick answer1 min read
7. What is envelope encryption in AWS KMS and why is it used?

   Envelope encryption encrypts data with a data key, then encrypts that data key with a KMS key. KMS directly handles only small payloads (up to 4 KB), so large data is encrypted locally with the data key, and only the small data key goes to KMS.

   AdvancedQuick answer1 min read
8. What is RDS Proxy and why would you use it with Lambda?

   RDS Proxy sits between your application and the database and pools connections. It stops many short-lived Lambda functions from opening thousands of connections that exhaust the database, and it speeds up failover handling.

   AdvancedQuick answer1 min read
9. What is the difference between a global secondary index and a local secondary index in DynamoDB?

   A GSI has its own partition and sort key and can be added any time, with its own throughput. An LSI keeps the table's partition key with a different sort key, must be created with the table, and shares its capacity.

   AdvancedQuick answer1 min read
10. What is the difference between reserved and provisioned concurrency in Lambda?

    Reserved concurrency sets aside part of your account's concurrency for one function and also caps it. Provisioned concurrency keeps a number of environments pre-initialised so invocations avoid cold starts, and it is billed for the time it is kept ready.

    AdvancedQuick answer1 min read