Interview Q&A / AWS & Cloud
AWS & Cloud interview questions
EC2, S3, Lambda, IAM and VPC basics, with when to pick which service.
Prefer rapid revision? Practise AWS & Cloud short interview answers →
- How do you read an EC2 instance type name like m5.large or c7g.xlarge?
The letter is the family (m general purpose, c compute, r memory, t burstable), the number is the generation, extra letters mark features such as g for Graviton, and the part after the dot is the size.
BeginnerQuick answer1 min read - How does Amazon CloudFront speed up a website?
CloudFront is a content delivery network that caches copies of your content at edge locations close to users. A request is served from the nearest edge if cached; otherwise it fetches from your origin, such as S3 or an ALB, and keeps a copy.
BeginnerQuick answer1 min read - How many usable IP addresses does a /24 subnet in an AWS VPC have?
A /24 has 256 addresses, but AWS reserves five in every subnet, so 251 are usable. The reserved ones are the network address, VPC router, DNS, one for future use, and the broadcast address.
BeginnerQuick answer1 min read - How should you protect and use the AWS account root user?
Enable MFA on the root user, do not create access keys for it, and use it only for the few tasks that need it. For daily work use IAM Identity Center or IAM users and roles with least privilege.
BeginnerQuick answer1 min read - What are S3 lifecycle rules and what can they do?
Lifecycle rules automatically move objects to cheaper storage classes after a set number of days, or delete them. They also clean up old versions and incomplete multipart uploads.
BeginnerQuick answer1 min read - What are the main limits of AWS Lambda, such as timeout and memory?
A Lambda function can run for at most 15 minutes per invocation and be given 128 MB to 10,240 MB of memory. CPU power scales with the memory you choose. It also has limits on package size and account concurrency.
BeginnerQuick answer1 min read - What are the types of Elastic Load Balancer and when do you use each?
Application Load Balancer works at layer 7 for HTTP and HTTPS with path and host routing. Network Load Balancer works at layer 4 for TCP, UDP and TLS with very high performance and static IPs. Gateway Load Balancer fronts network appliances. Classic is legacy.
BeginnerQuick answer1 min read - What does the AWS shared responsibility model mean in practice for EC2, RDS and S3?
AWS is responsible for security of the cloud: facilities, hardware and the managed service layers. You are responsible for security in the cloud: your data, access control, and configuration. The more managed the service, the more AWS handles.
BeginnerQuick answer1 min read - What is a Lambda cold start and how can you reduce it?
A cold start is the extra delay when Lambda has to create a new execution environment and load your code before running it. Reduce it with smaller packages, lighter runtimes, less work outside the handler, or provisioned concurrency.
BeginnerQuick answer1 min read - What is an AMI and how is it used when launching EC2 instances?
An Amazon Machine Image is a template holding the operating system, installed software and settings used to start an EC2 instance. You can launch many identical instances from one AMI, and copy it across Regions.
BeginnerQuick answer1 min read - What is an Elastic IP address and how is it different from a normal public IP on EC2?
A normal public IP is assigned from AWS's pool and can change when the instance is stopped and started. An Elastic IP is a static public IPv4 address you own in your account until you release it and can remap to another instance.
BeginnerQuick answer1 min read - What is the difference between Amazon ECS and Amazon EKS?
ECS is AWS's own container orchestrator with a simpler, AWS-specific model. EKS runs managed Kubernetes, so you get the standard Kubernetes API and tooling, with more features and more complexity to learn.
BeginnerQuick answer1 min read - What is the difference between Amazon EFS and Amazon EBS?
EBS is a block disk attached to one EC2 instance in one AZ. EFS is a managed shared file system using NFS that many instances across multiple AZs can mount at the same time.
BeginnerQuick answer1 min read - What is the difference between an internet gateway and a NAT gateway?
An internet gateway lets resources with public IPs in a public subnet talk to the internet in both directions. A NAT gateway lets private-subnet instances start outbound connections, such as updates, while blocking inbound connections from the internet.
BeginnerQuick answer1 min read - What is the difference between DynamoDB on-demand and provisioned capacity modes?
On-demand charges per request and scales automatically, good for unpredictable traffic. Provisioned lets you set read and write capacity units, often cheaper for steady traffic, and can use auto scaling.
BeginnerQuick answer1 min read - What is the difference between ElastiCache for Redis and ElastiCache for Memcached?
Memcached is a simple, multi-threaded key-value cache for plain caching. Redis supports richer data types, persistence, replication with failover, and features like pub/sub, so it suits caching plus sessions, leaderboards and queues.
BeginnerQuick answer1 min read - What is the difference between Query and Scan in DynamoDB?
Query finds items by partition key, optionally narrowing by sort key, and reads only matching items. Scan reads every item in the table or index and filters afterwards, so it is slower and costlier on big tables.
BeginnerQuick answer1 min read - What is the difference between RDS Multi-AZ and a read replica?
Multi-AZ keeps a synchronous standby copy in another AZ for automatic failover, improving availability. A read replica is an asynchronous copy that serves read traffic to scale performance and can be promoted if needed.
BeginnerQuick answer1 min read - What is the difference between S3 Standard-IA and S3 One Zone-IA?
Both are for data accessed rarely but needed quickly. Standard-IA stores copies across at least three Availability Zones. One Zone-IA keeps data in a single AZ at lower cost, so it is lost if that AZ is destroyed.
BeginnerQuick answer1 min read - Why use an IAM role for an EC2 instance instead of storing access keys on it?
A role gives the instance temporary credentials that AWS rotates automatically, so no long-lived secret sits on disk or in code. Access keys can leak through code repos, images or logs and stay valid until someone revokes them.
BeginnerQuick answer1 min read - How do EBS snapshots work and how can you use them to move data to another AZ or Region?
A snapshot is a point-in-time backup of an EBS volume, stored in S3-managed storage. After the first full copy, later snapshots are incremental. You can create a new volume from a snapshot in any AZ of the Region, or copy the snapshot to another Region.
IntermediateQuick answer1 min read - How do you choose a good partition key in DynamoDB?
Pick an attribute with many distinct values that requests spread across evenly, such as user ID or order ID. A key where most traffic hits a few values creates a hot partition that gets throttled.
IntermediateQuick answer1 min read - How does an Application Load Balancer route requests to different services?
An ALB listener evaluates rules in priority order. Each rule has conditions, such as path, host header, HTTP header or query string, and an action, usually forward to a target group. A default rule catches everything else.
IntermediateQuick answer1 min read - How does AWS decide whether a request is allowed or denied when several IAM policies apply?
By default everything is denied. A request is allowed only if some policy explicitly allows it, and any explicit Deny in any applicable policy overrides every Allow.
IntermediateQuick answer1 min read - How is Amazon Aurora different from a standard RDS database?
Aurora is AWS's cloud-built MySQL- and PostgreSQL-compatible database. It stores data in a shared cluster volume copied six ways across three AZs, supports up to 15 low-lag replicas, and fails over faster than standard RDS.
IntermediateQuick answer1 min read - How would you give a user read-only access to one specific S3 bucket?
Attach an identity policy that allows s3:ListBucket on the bucket ARN and s3:GetObject on the objects inside it using the bucket ARN with /*. Nothing else is allowed, so the user can read but not write or delete.
IntermediateQuick answer1 min read - Is Amazon S3 eventually consistent or strongly consistent?
S3 gives strong read-after-write consistency for all object operations. After a successful PUT, overwrite or DELETE, any later GET or LIST immediately reflects the change.
IntermediateQuick answer1 min read - What are EC2 placement groups and what are the three strategies?
A placement group controls how instances sit on physical hardware. Cluster packs them close for low latency, spread puts each on separate hardware to limit correlated failure, and partition groups them in racks that do not share hardware.
IntermediateQuick answer1 min read - What are lazy loading and write-through caching strategies?
Lazy loading fills the cache only when a read misses, then stores the result. Write-through updates the cache at the same time as the database on every write, so reads are rarely stale but the cache holds data that may never be read.
IntermediateQuick answer1 min read - What are the main Amazon EBS volume types and when do you use each?
gp3 and gp2 are general-purpose SSDs for most workloads. io2 and io1 are provisioned-IOPS SSDs for databases needing high, steady IOPS. st1 is throughput-optimised HDD for big sequential data, and sc1 is cold HDD for rarely used data.
IntermediateQuick answer1 min read