Interview Q&A / AWS & Cloud
AWS & Cloud interview questions
EC2, S3, Lambda, IAM and VPC basics, with when to pick which service.
Prefer rapid revision? Practise AWS & Cloud short interview answers →
- What are the Route 53 routing policies and when would you use each?
Simple returns a record. Weighted splits traffic by percentage. Latency sends users to the lowest-latency Region. Failover switches to a backup when the primary is unhealthy. Geolocation routes by user location. Multivalue returns several healthy IPs.
IntermediateQuick answer1 min read - What are the S3 Glacier storage classes and how do their retrieval times differ?
Glacier Instant Retrieval returns data in milliseconds. Glacier Flexible Retrieval takes minutes to hours depending on the option. Glacier Deep Archive is the cheapest and takes hours, typically around 12 hours or more.
IntermediateQuick answer1 min read - What happens when you delete an object in an S3 bucket that has versioning enabled?
S3 does not remove the data. It adds a delete marker as the newest version, so normal reads return 404, but older versions remain and can be restored by removing the marker or fetching a version ID.
IntermediateQuick answer1 min read - What is an S3 presigned URL and when would you use it?
A presigned URL is a temporary link, signed with someone's credentials, that lets a person upload or download one specific S3 object without having AWS credentials. It stops working when it expires.
IntermediateQuick answer1 min read - What is AWS Fargate and how is it different from running containers on EC2?
Fargate is a serverless way to run ECS or EKS containers where AWS manages the servers. With the EC2 launch type you own and patch the instances yourself, which gives more control and can be cheaper at steady high usage.
IntermediateQuick answer1 min read - What is EC2 instance store and how is it different from EBS?
Instance store is disk physically attached to the host computer, giving very fast but temporary storage. Its data is lost when the instance stops, terminates or the hardware fails. EBS is network-attached and persists independently of the instance.
IntermediateQuick answer1 min read - What is EC2 user data and how is it different from instance metadata?
User data is a script or text you give an instance at launch, typically run once to install software. Instance metadata is information about the running instance, such as its ID, IP and IAM role credentials, which the instance reads from a local endpoint.
IntermediateQuick answer1 min read - What is the difference between an alias record and a CNAME record in Route 53?
A CNAME maps one name to another name and cannot be used at the zone apex like example.com. An alias record is a Route 53 feature that can point even the apex to AWS resources, is free to query, and follows the resource's IP changes.
IntermediateQuick answer1 min read - What is the difference between AWS managed keys and customer managed keys in KMS?
AWS managed keys are created and rotated by AWS for a service, with a fixed policy you cannot edit. Customer managed keys are created by you, with your own key policy, optional rotation, and the ability to disable or schedule deletion.
IntermediateQuick answer1 min read - What is the difference between AWS Secrets Manager and Systems Manager Parameter Store?
Both store configuration securely. Secrets Manager is built for secrets, with automatic rotation for supported databases and a per-secret charge. Parameter Store is simpler, has a free standard tier, and can encrypt values with KMS as SecureString.
IntermediateQuick answer1 min read - What is the difference between RDS automated backups and manual snapshots?
Automated backups are taken daily with transaction logs, support point-in-time restore within a retention period of up to 35 days, and are removed with the instance. Manual snapshots are taken on demand and stay until you delete them.
IntermediateQuick answer1 min read - What is the difference between target tracking, step and scheduled scaling in an Auto Scaling group?
Target tracking holds a metric near a value you set, like 50% CPU. Step scaling adds or removes capacity in sized steps based on alarm thresholds. Scheduled scaling changes capacity at set times for predictable load.
IntermediateQuick answer1 min read - What is the difference between VPC peering and AWS Transit Gateway?
VPC peering is a one-to-one private link between two VPCs and it is not transitive. Transit Gateway is a central hub that connects many VPCs and on-premises networks, so each network connects once.
IntermediateQuick answer1 min read - Can you use Spot Instances inside an Auto Scaling group, and how do you do it safely?
Yes. A mixed instances policy lets an ASG combine On-Demand and Spot across several instance types. Keep a small On-Demand base, spread Spot across types and AZs, and make the app handle the two-minute interruption notice.
AdvancedQuick answer1 min read - How does cross-account access work with IAM roles and AWS STS?
The target account creates a role with a trust policy naming the other account, and permissions for what the role can do. A user or service in the other account calls STS AssumeRole and receives temporary credentials for that role.
AdvancedQuick answer1 min read - How many read capacity units does a DynamoDB read use for strongly and eventually consistent reads?
One RCU covers one strongly consistent read per second of an item up to 4 KB, or two eventually consistent reads. Larger items are rounded up to the next 4 KB.
AdvancedQuick answer1 min read - What is a service control policy in AWS Organizations?
A service control policy sets the maximum permissions for accounts in an organization or organizational unit. It never grants permissions by itself; it only limits what IAM policies in those accounts can allow, even for the root user of the member account.
AdvancedQuick answer1 min read - What is a VPC endpoint and what is the difference between gateway and interface endpoints?
A VPC endpoint lets resources in your VPC reach AWS services privately without an internet gateway or NAT. Gateway endpoints, for S3 and DynamoDB, are route-table entries and free. Interface endpoints use PrivateLink with a network interface and are charged.
AdvancedQuick answer1 min read - What is envelope encryption in AWS KMS and why is it used?
Envelope encryption encrypts data with a data key, then encrypts that data key with a KMS key. KMS directly handles only small payloads (up to 4 KB), so large data is encrypted locally with the data key, and only the small data key goes to KMS.
AdvancedQuick answer1 min read - What is RDS Proxy and why would you use it with Lambda?
RDS Proxy sits between your application and the database and pools connections. It stops many short-lived Lambda functions from opening thousands of connections that exhaust the database, and it speeds up failover handling.
AdvancedQuick answer1 min read - What is the difference between a global secondary index and a local secondary index in DynamoDB?
A GSI has its own partition and sort key and can be added any time, with its own throughput. An LSI keeps the table's partition key with a different sort key, must be created with the table, and shares its capacity.
AdvancedQuick answer1 min read - What is the difference between reserved and provisioned concurrency in Lambda?
Reserved concurrency sets aside part of your account's concurrency for one function and also caps it. Provisioned concurrency keeps a number of environments pre-initialised so invocations avoid cold starts, and it is billed for the time it is kept ready.
AdvancedQuick answer1 min read