Interview Q&A / AWS & Cloud
AWS & Cloud interview questions
EC2, S3, Lambda, IAM and VPC basics, with when to pick which service.
Prefer rapid revision? Practise AWS & Cloud short interview answers →
- How do EBS snapshots work and how can you use them to move data to another AZ or Region?
A snapshot is a point-in-time backup of an EBS volume, stored in S3-managed storage. After the first full copy, later snapshots are incremental. You can create a new volume from a snapshot in any AZ of the Region, or copy the snapshot to another Region.
IntermediateQuick answer1 min read - How do you choose a good partition key in DynamoDB?
Pick an attribute with many distinct values that requests spread across evenly, such as user ID or order ID. A key where most traffic hits a few values creates a hot partition that gets throttled.
IntermediateQuick answer1 min read - How does an Application Load Balancer route requests to different services?
An ALB listener evaluates rules in priority order. Each rule has conditions, such as path, host header, HTTP header or query string, and an action, usually forward to a target group. A default rule catches everything else.
IntermediateQuick answer1 min read - How does AWS decide whether a request is allowed or denied when several IAM policies apply?
By default everything is denied. A request is allowed only if some policy explicitly allows it, and any explicit Deny in any applicable policy overrides every Allow.
IntermediateQuick answer1 min read - How is Amazon Aurora different from a standard RDS database?
Aurora is AWS's cloud-built MySQL- and PostgreSQL-compatible database. It stores data in a shared cluster volume copied six ways across three AZs, supports up to 15 low-lag replicas, and fails over faster than standard RDS.
IntermediateQuick answer1 min read - How would you give a user read-only access to one specific S3 bucket?
Attach an identity policy that allows s3:ListBucket on the bucket ARN and s3:GetObject on the objects inside it using the bucket ARN with /*. Nothing else is allowed, so the user can read but not write or delete.
IntermediateQuick answer1 min read - Is Amazon S3 eventually consistent or strongly consistent?
S3 gives strong read-after-write consistency for all object operations. After a successful PUT, overwrite or DELETE, any later GET or LIST immediately reflects the change.
IntermediateQuick answer1 min read - What are EC2 placement groups and what are the three strategies?
A placement group controls how instances sit on physical hardware. Cluster packs them close for low latency, spread puts each on separate hardware to limit correlated failure, and partition groups them in racks that do not share hardware.
IntermediateQuick answer1 min read - What are lazy loading and write-through caching strategies?
Lazy loading fills the cache only when a read misses, then stores the result. Write-through updates the cache at the same time as the database on every write, so reads are rarely stale but the cache holds data that may never be read.
IntermediateQuick answer1 min read - What are the main Amazon EBS volume types and when do you use each?
gp3 and gp2 are general-purpose SSDs for most workloads. io2 and io1 are provisioned-IOPS SSDs for databases needing high, steady IOPS. st1 is throughput-optimised HDD for big sequential data, and sc1 is cold HDD for rarely used data.
IntermediateQuick answer1 min read - What are the Route 53 routing policies and when would you use each?
Simple returns a record. Weighted splits traffic by percentage. Latency sends users to the lowest-latency Region. Failover switches to a backup when the primary is unhealthy. Geolocation routes by user location. Multivalue returns several healthy IPs.
IntermediateQuick answer1 min read - What are the S3 Glacier storage classes and how do their retrieval times differ?
Glacier Instant Retrieval returns data in milliseconds. Glacier Flexible Retrieval takes minutes to hours depending on the option. Glacier Deep Archive is the cheapest and takes hours, typically around 12 hours or more.
IntermediateQuick answer1 min read - What happens when you delete an object in an S3 bucket that has versioning enabled?
S3 does not remove the data. It adds a delete marker as the newest version, so normal reads return 404, but older versions remain and can be restored by removing the marker or fetching a version ID.
IntermediateQuick answer1 min read - What is an S3 presigned URL and when would you use it?
A presigned URL is a temporary link, signed with someone's credentials, that lets a person upload or download one specific S3 object without having AWS credentials. It stops working when it expires.
IntermediateQuick answer1 min read - What is AWS Fargate and how is it different from running containers on EC2?
Fargate is a serverless way to run ECS or EKS containers where AWS manages the servers. With the EC2 launch type you own and patch the instances yourself, which gives more control and can be cheaper at steady high usage.
IntermediateQuick answer1 min read - What is EC2 instance store and how is it different from EBS?
Instance store is disk physically attached to the host computer, giving very fast but temporary storage. Its data is lost when the instance stops, terminates or the hardware fails. EBS is network-attached and persists independently of the instance.
IntermediateQuick answer1 min read - What is EC2 user data and how is it different from instance metadata?
User data is a script or text you give an instance at launch, typically run once to install software. Instance metadata is information about the running instance, such as its ID, IP and IAM role credentials, which the instance reads from a local endpoint.
IntermediateQuick answer1 min read - What is the difference between an alias record and a CNAME record in Route 53?
A CNAME maps one name to another name and cannot be used at the zone apex like example.com. An alias record is a Route 53 feature that can point even the apex to AWS resources, is free to query, and follows the resource's IP changes.
IntermediateQuick answer1 min read - What is the difference between AWS managed keys and customer managed keys in KMS?
AWS managed keys are created and rotated by AWS for a service, with a fixed policy you cannot edit. Customer managed keys are created by you, with your own key policy, optional rotation, and the ability to disable or schedule deletion.
IntermediateQuick answer1 min read - What is the difference between AWS Secrets Manager and Systems Manager Parameter Store?
Both store configuration securely. Secrets Manager is built for secrets, with automatic rotation for supported databases and a per-secret charge. Parameter Store is simpler, has a free standard tier, and can encrypt values with KMS as SecureString.
IntermediateQuick answer1 min read - What is the difference between RDS automated backups and manual snapshots?
Automated backups are taken daily with transaction logs, support point-in-time restore within a retention period of up to 35 days, and are removed with the instance. Manual snapshots are taken on demand and stay until you delete them.
IntermediateQuick answer1 min read - What is the difference between target tracking, step and scheduled scaling in an Auto Scaling group?
Target tracking holds a metric near a value you set, like 50% CPU. Step scaling adds or removes capacity in sized steps based on alarm thresholds. Scheduled scaling changes capacity at set times for predictable load.
IntermediateQuick answer1 min read - What is the difference between VPC peering and AWS Transit Gateway?
VPC peering is a one-to-one private link between two VPCs and it is not transitive. Transit Gateway is a central hub that connects many VPCs and on-premises networks, so each network connects once.
IntermediateQuick answer1 min read