Interview Q&A / AWS & Cloud
AWS & Cloud interview questions
EC2, S3, Lambda, IAM and VPC basics, with when to pick which service.
Prefer rapid revision? Practise AWS & Cloud short interview answers →
- What is Amazon S3 and what are its storage classes?
S3 is AWS's object storage. You store files as objects inside buckets and access them by key over HTTPS. Storage classes trade storage cost against access speed and retrieval cost, from S3 Standard for frequently used data to the Glacier classes for archives you rarely read.
BeginnerIn-depth4 min read - What is the difference between an AWS Region and an Availability Zone?
A Region is a separate geographic area, like Mumbai, with its own set of data centres. An Availability Zone is one or more isolated data centres inside a Region, with its own power and networking. You spread an app across AZs to survive a data-centre failure, and across Regions to survive a whole-area outage or to be closer to users.
BeginnerIn-depth3 min read - What is the difference between EC2 and Lambda, and when would you pick each?
EC2 gives you a virtual server that you run and manage, billed while it is running. Lambda runs your function only when an event arrives, scales automatically and bills per request and execution time. Pick Lambda for short, spiky, event-driven work; pick EC2 for long-running, steady or highly customised workloads.
BeginnerIn-depth4 min read - What is the difference between IAM users, groups, roles and policies in AWS?
A user is an identity for one person or app with long-term credentials. A group is a set of users that share permissions. A role is an identity that anyone or anything trusted can assume to get temporary credentials. A policy is the JSON document that says what is allowed or denied. Grant only the permissions needed, which is least privilege.
BeginnerIn-depth4 min read - What is a VPC, and what is the difference between public and private subnets?
A VPC is your own private network inside AWS. A public subnet has a route to an internet gateway, so resources with public IPs can be reached from the internet. A private subnet has no such route; its servers reach the internet only outbound, through a NAT gateway placed in a public subnet.
IntermediateIn-depth4 min read - What is the difference between a security group and a network ACL in AWS?
A security group is a stateful firewall attached to an instance's network interface, with allow rules only. A network ACL is a stateless firewall on a subnet, with numbered allow and deny rules checked in order. Because NACLs are stateless, you must allow return traffic explicitly, usually on ephemeral ports.
IntermediateIn-depth4 min read - What is the difference between RDS and DynamoDB, and when would you use each?
RDS is a managed relational database service running engines like MySQL or PostgreSQL, with SQL, joins and transactions. DynamoDB is a serverless key-value and document database that gives fast, predictable performance at very large scale if you design around known access patterns. Use RDS for relational data and flexible queries; use DynamoDB for simple, high-volume lookups by key.
IntermediateIn-depth4 min read - How do an Auto Scaling group and a load balancer work together on AWS?
An Auto Scaling group keeps the right number of healthy EC2 instances running, adding or removing them based on policies such as target CPU. A load balancer spreads incoming traffic across those instances in multiple AZs. The ASG registers new instances with the load balancer's target group and replaces any that fail health checks.
AdvancedIn-depth4 min read - How do you read an EC2 instance type name like m5.large or c7g.xlarge?
The letter is the family (m general purpose, c compute, r memory, t burstable), the number is the generation, extra letters mark features such as g for Graviton, and the part after the dot is the size.
BeginnerQuick answer1 min read - How does Amazon CloudFront speed up a website?
CloudFront is a content delivery network that caches copies of your content at edge locations close to users. A request is served from the nearest edge if cached; otherwise it fetches from your origin, such as S3 or an ALB, and keeps a copy.
BeginnerQuick answer1 min read - How many usable IP addresses does a /24 subnet in an AWS VPC have?
A /24 has 256 addresses, but AWS reserves five in every subnet, so 251 are usable. The reserved ones are the network address, VPC router, DNS, one for future use, and the broadcast address.
BeginnerQuick answer1 min read - How should you protect and use the AWS account root user?
Enable MFA on the root user, do not create access keys for it, and use it only for the few tasks that need it. For daily work use IAM Identity Center or IAM users and roles with least privilege.
BeginnerQuick answer1 min read - What are S3 lifecycle rules and what can they do?
Lifecycle rules automatically move objects to cheaper storage classes after a set number of days, or delete them. They also clean up old versions and incomplete multipart uploads.
BeginnerQuick answer1 min read - What are the main limits of AWS Lambda, such as timeout and memory?
A Lambda function can run for at most 15 minutes per invocation and be given 128 MB to 10,240 MB of memory. CPU power scales with the memory you choose. It also has limits on package size and account concurrency.
BeginnerQuick answer1 min read - What are the types of Elastic Load Balancer and when do you use each?
Application Load Balancer works at layer 7 for HTTP and HTTPS with path and host routing. Network Load Balancer works at layer 4 for TCP, UDP and TLS with very high performance and static IPs. Gateway Load Balancer fronts network appliances. Classic is legacy.
BeginnerQuick answer1 min read - What does the AWS shared responsibility model mean in practice for EC2, RDS and S3?
AWS is responsible for security of the cloud: facilities, hardware and the managed service layers. You are responsible for security in the cloud: your data, access control, and configuration. The more managed the service, the more AWS handles.
BeginnerQuick answer1 min read - What is a Lambda cold start and how can you reduce it?
A cold start is the extra delay when Lambda has to create a new execution environment and load your code before running it. Reduce it with smaller packages, lighter runtimes, less work outside the handler, or provisioned concurrency.
BeginnerQuick answer1 min read - What is an AMI and how is it used when launching EC2 instances?
An Amazon Machine Image is a template holding the operating system, installed software and settings used to start an EC2 instance. You can launch many identical instances from one AMI, and copy it across Regions.
BeginnerQuick answer1 min read - What is an Elastic IP address and how is it different from a normal public IP on EC2?
A normal public IP is assigned from AWS's pool and can change when the instance is stopped and started. An Elastic IP is a static public IPv4 address you own in your account until you release it and can remap to another instance.
BeginnerQuick answer1 min read - What is the difference between Amazon ECS and Amazon EKS?
ECS is AWS's own container orchestrator with a simpler, AWS-specific model. EKS runs managed Kubernetes, so you get the standard Kubernetes API and tooling, with more features and more complexity to learn.
BeginnerQuick answer1 min read - What is the difference between Amazon EFS and Amazon EBS?
EBS is a block disk attached to one EC2 instance in one AZ. EFS is a managed shared file system using NFS that many instances across multiple AZs can mount at the same time.
BeginnerQuick answer1 min read - What is the difference between an internet gateway and a NAT gateway?
An internet gateway lets resources with public IPs in a public subnet talk to the internet in both directions. A NAT gateway lets private-subnet instances start outbound connections, such as updates, while blocking inbound connections from the internet.
BeginnerQuick answer1 min read - What is the difference between DynamoDB on-demand and provisioned capacity modes?
On-demand charges per request and scales automatically, good for unpredictable traffic. Provisioned lets you set read and write capacity units, often cheaper for steady traffic, and can use auto scaling.
BeginnerQuick answer1 min read - What is the difference between ElastiCache for Redis and ElastiCache for Memcached?
Memcached is a simple, multi-threaded key-value cache for plain caching. Redis supports richer data types, persistence, replication with failover, and features like pub/sub, so it suits caching plus sessions, leaderboards and queues.
BeginnerQuick answer1 min read - What is the difference between Query and Scan in DynamoDB?
Query finds items by partition key, optionally narrowing by sort key, and reads only matching items. Scan reads every item in the table or index and filters afterwards, so it is slower and costlier on big tables.
BeginnerQuick answer1 min read - What is the difference between RDS Multi-AZ and a read replica?
Multi-AZ keeps a synchronous standby copy in another AZ for automatic failover, improving availability. A read replica is an asynchronous copy that serves read traffic to scale performance and can be promoted if needed.
BeginnerQuick answer1 min read - What is the difference between S3 Standard-IA and S3 One Zone-IA?
Both are for data accessed rarely but needed quickly. Standard-IA stores copies across at least three Availability Zones. One Zone-IA keeps data in a single AZ at lower cost, so it is lost if that AZ is destroyed.
BeginnerQuick answer1 min read - Why use an IAM role for an EC2 instance instead of storing access keys on it?
A role gives the instance temporary credentials that AWS rotates automatically, so no long-lived secret sits on disk or in code. Access keys can leak through code repos, images or logs and stay valid until someone revokes them.
BeginnerQuick answer1 min read - How do EBS snapshots work and how can you use them to move data to another AZ or Region?
A snapshot is a point-in-time backup of an EBS volume, stored in S3-managed storage. After the first full copy, later snapshots are incremental. You can create a new volume from a snapshot in any AZ of the Region, or copy the snapshot to another Region.
IntermediateQuick answer1 min read - How do you choose a good partition key in DynamoDB?
Pick an attribute with many distinct values that requests spread across evenly, such as user ID or order ID. A key where most traffic hits a few values creates a hot partition that gets throttled.
IntermediateQuick answer1 min read