Skip to content
masterclassBuddyTech Buzz5 fresh blogs · 5:00 AM IST
Start learning

Interview questions with answers

AWS services interview questions and answers

EC2, S3, Lambda, IAM, VPC, DynamoDB, RDS, SQS and the rest of the core. Open any question to read its model answer; the multiple-choice set marks the right option and explains it.

Subjective
30
Objective
30

Subjective questions 30

1Explain IAM users, roles and policies.Asked almost every time

IAM controls who can do what in AWS. Policies are JSON documents allowing or denying actions on resources. Users are long-lived identities for people or legacy apps; groups bundle users. Roles are identities assumed temporarily, giving short-lived credentials to services (an EC2 instance, a Lambda function), other accounts or federated users. Best practice: roles over access keys, least privilege, and MFA.

2What are the main storage options and when do you use each?Asked almost every time

S3 for object storage (files, backups, static sites, data lakes) with near-unlimited scale. EBS for block volumes attached to one EC2 instance (databases, boot disks). EFS for shared NFS file systems across many instances. Glacier storage classes for cheap archives. Pick by access pattern, sharing needs and cost.

3EC2 vs. Lambda vs. ECS/Fargate: how do you choose?Asked almost every time

EC2 gives full virtual machines you manage, good for long-running or specialised workloads. Lambda runs functions on events with no servers, scales to zero and bills per request and duration, with limits (15-minute max). ECS or EKS run containers; Fargate runs them without managing servers. Choose by runtime length, control needed, traffic pattern and team skills.

4How do you design a highly available web application on AWS?Asked almost every time

Spread across at least two Availability Zones: an Application Load Balancer in front of an Auto Scaling group (or ECS service) in private subnets, a Multi-AZ RDS or Aurora database, ElastiCache for caching, S3 and CloudFront for static assets, Route 53 for DNS with health checks, and CloudWatch alarms. Keep app servers stateless.

5How do you secure an AWS account from day one?Asked almost every time

Lock away the root user with MFA and no access keys, use AWS Organizations with separate accounts per environment, sign in through IAM Identity Center, grant least-privilege roles, enable CloudTrail in all regions, GuardDuty and Security Hub, block public S3 access by default, and set budgets and alerts.

6How do you design a serverless API on AWS?Asked almost every time

API Gateway (HTTP API) in front of Lambda functions, DynamoDB for data, Cognito or a JWT authorizer for auth, SQS or EventBridge for async work, Step Functions for multi-step workflows, CloudWatch and X-Ray for observability, and IaC (CDK, SAM or Terraform) for deployment.

7What is Lambda cold start and how do you reduce it?Asked almost every time

A cold start happens when Lambda creates a new execution environment: downloading code, starting the runtime and running init code. Reduce it with smaller packages, fewer heavy imports, lazy initialisation, more memory (which adds CPU), SnapStart for Java, Python and .NET, or provisioned concurrency for latency-critical paths.

8How do you design for disaster recovery on AWS?Asked almost every time

Choose a strategy by RTO and RPO: backup and restore (cheapest, slowest), pilot light, warm standby, or multi-site active-active. Use cross-region backups and replication (S3 CRR, Aurora Global Database, DynamoDB global tables), Route 53 failover and regular recovery drills.

9Explain a VPC and its parts.Very often asked

A Virtual Private Cloud is your isolated network. It has subnets per Availability Zone: public subnets route to an Internet Gateway, private subnets reach the internet through a NAT Gateway. Route tables direct traffic; security groups are stateful firewalls on resources; network ACLs are stateless rules on subnets. VPC endpoints reach AWS services privately.

10SQS vs. SNS vs. EventBridge?Very often asked

SQS is a queue: messages wait until a consumer processes them (standard or FIFO). SNS is pub/sub: one message pushed to many subscribers (SQS, Lambda, email, HTTP). EventBridge is an event bus with content-based routing rules, schedules and integrations with SaaS and AWS events. A common pattern is SNS fan-out to several SQS queues.

11RDS vs. Aurora vs. DynamoDB?Very often asked

RDS runs managed relational engines (PostgreSQL, MySQL, etc.) with backups, patching and Multi-AZ. Aurora is AWS's cloud-native MySQL/PostgreSQL-compatible engine with shared distributed storage, faster failover and up to 15 read replicas. DynamoDB is a serverless key-value and document database with single-digit millisecond latency at any scale, designed around access patterns rather than joins.

12What is S3's consistency, durability and security model?Very often asked

S3 offers strong read-after-write consistency for all operations, 11 nines of durability across multiple AZs, and storage classes for cost. Buckets are private by default with Block Public Access; access is through IAM and bucket policies, encryption at rest is on by default, and pre-signed URLs give temporary access to single objects.

13How do you monitor and troubleshoot on AWS?Very often asked

CloudWatch for metrics, logs, dashboards and alarms; X-Ray or OpenTelemetry for distributed traces; CloudTrail for an audit log of API calls; AWS Config for resource configuration history; and Health Dashboard for AWS-side issues.

14What is DynamoDB single-table design?Very often asked

Storing several entity types in one table with generic keys (PK, SK) shaped around access patterns, so related items are fetched with one query. Global secondary indexes add other access patterns. It is efficient but requires knowing your queries up front.

15What is the difference between security groups and NACLs?Very often asked

Security groups are stateful, attached to network interfaces, and only allow rules. Network ACLs are stateless, attached to subnets, evaluate numbered allow and deny rules in order, and need explicit return traffic rules.

16How does auto scaling work for EC2?Very often asked

An Auto Scaling group keeps a desired number of instances across Availability Zones using a launch template, replaces unhealthy ones, and scales with target tracking (for example 50% CPU), step or scheduled policies. An Application Load Balancer spreads traffic across them.

17What is Step Functions for?Very often asked

Orchestrating multi-step workflows as state machines: calling Lambda and other services, with retries, error handling, branching, parallel steps, waits and human approval. Standard workflows suit long-running, auditable processes; Express workflows suit high-volume, short ones.

18How do you store secrets on AWS?Very often asked

Use Secrets Manager (with automatic rotation for databases) or SSM Parameter Store SecureString, encrypted with KMS. Grant access through IAM roles, fetch at runtime and cache, and never put secrets in code, AMIs or plain environment variables in IaC.

19What is the difference between ALB and NLB?Very often asked

An Application Load Balancer works at layer 7: HTTP routing by path and host, WebSockets, authentication and Lambda targets. A Network Load Balancer works at layer 4: TCP and UDP, very high throughput, static IPs and preserving client IPs.

20How do you control AWS costs?Often asked

Right-size instances, use Savings Plans or Reserved Instances for steady load and Spot for interruptible work, auto-scale and turn off idle resources, use S3 lifecycle rules and Intelligent-Tiering, watch data transfer, tag resources, and set AWS Budgets alerts and Cost Explorer reviews.

21What is CloudFront and why use it?Often asked

AWS's CDN: it caches content at edge locations worldwide, terminates TLS close to users, shields origins (S3, ALB, API Gateway), and adds features such as signed URLs, WAF integration and edge functions.

22How does API Gateway work with Lambda?Often asked

API Gateway receives HTTP or WebSocket requests, handles routing, authorisation (IAM, Cognito, JWT, Lambda authorisers), throttling and request validation, then invokes a Lambda function and returns its response. HTTP APIs are cheaper and simpler; REST APIs have more features.

23How do you deploy infrastructure as code on AWS?Often asked

CloudFormation templates, or AWS CDK to write them in TypeScript or Python, or Terraform. Changes go through review and pipelines (CodePipeline, GitHub Actions with OIDC roles) instead of console clicks, giving repeatable environments and drift detection.

24What is KMS and envelope encryption?Often asked

KMS manages encryption keys. Envelope encryption encrypts data with a data key, then encrypts that data key with a KMS key. Services like S3 and EBS use it so large data is encrypted locally while the master key never leaves KMS.

25What are VPC endpoints?Often asked

Private connections from a VPC to AWS services without going through the internet or a NAT gateway: gateway endpoints for S3 and DynamoDB, and interface endpoints (PrivateLink) for most others. They improve security and can reduce NAT costs.

26How do you choose an S3 storage class?Often asked

S3 Standard for frequent access, Intelligent-Tiering when access patterns are unknown, Standard-IA and One Zone-IA for infrequent access, and Glacier classes for archives. Lifecycle rules move or expire objects automatically.

27What is ECR and how is it used?Often asked

Elastic Container Registry stores container images privately, scans them for vulnerabilities and integrates with ECS, EKS and Lambda container images. CI pushes images there; deployments pull them by tag or digest.

28What is Route 53 used for?Often asked

DNS hosting and domain registration, with routing policies (simple, weighted, latency, failover, geolocation) and health checks, enabling blue-green releases and regional failover.

29What is the shared responsibility model?Sometimes asked

AWS secures the cloud itself: hardware, facilities, network and managed service infrastructure. You secure what you put in it: data, IAM, network rules, OS patches on EC2, encryption settings and application code. The split shifts with how managed the service is.

30What is Amazon Bedrock?Sometimes asked

A managed service for using foundation models from several providers through one API, with features like knowledge bases for RAG, agents, guardrails and model evaluation, keeping data within your AWS account controls.

Objective questions 30

1Which service gives temporary credentials to an EC2 instance?Asked almost every time
  1. AIAM user access keys
  2. BAn IAM role (instance profile)Correct answer
  3. CRoot account
  4. DS3 bucket policy

Why: Roles provide rotating short-lived credentials.

2Which service stores objects such as images and backups?Asked almost every time
  1. AS3Correct answer
  2. BRDS
  3. CEFS
  4. DEBS

Why: S3 is object storage.

3What is the maximum run time of a Lambda invocation?Asked almost every time
  1. A5 minutes
  2. B15 minutesCorrect answer
  3. C1 hour
  4. DNo limit

Why: Lambda functions time out after at most 15 minutes.

4What should be done with the root user?Asked almost every time
  1. AEnable MFA and avoid daily useCorrect answer
  2. BShare it with the team
  3. CCreate access keys
  4. DUse it for CI

Why: Use IAM roles instead.

5Which feature removes Lambda cold starts for steady traffic?Asked almost every time
  1. AProvisioned concurrencyCorrect answer
  2. BReserved concurrency
  3. CLayers
  4. DAliases

Why: Environments are pre-initialised.

6Security groups are stateful; NACLs are…Asked almost every time
  1. AOnly for S3
  2. BStatelessCorrect answer
  3. CAlso stateful
  4. DOnly for IPv6

Why: NACLs need explicit return rules.

7Which component lets private subnets reach the internet outbound?Very often asked
  1. AInternet Gateway directly
  2. BNAT GatewayCorrect answer
  3. CSecurity group
  4. DRoute 53

Why: NAT lets outbound traffic out without allowing inbound.

8Security groups are…Very often asked
  1. AOnly for S3
  2. BStateless
  3. CStatefulCorrect answer
  4. DApplied to whole regions

Why: Return traffic is allowed automatically.

9Which service decouples producers and consumers with a queue?Very often asked
  1. AIAM
  2. BSNS
  3. CSQSCorrect answer
  4. DCloudFront

Why: SQS stores messages until processed.

10Which database suits millisecond key-value access at any scale?Very often asked
  1. ADynamoDBCorrect answer
  2. BAthena
  3. CGlacier
  4. DRedshift

Why: DynamoDB is a serverless key-value/document store.

11Which service records every API call for auditing?Very often asked
  1. ACloudTrailCorrect answer
  2. BX-Ray
  3. CConfig Rules only
  4. DCloudWatch Metrics

Why: CloudTrail logs who did what and when.

12Which service orchestrates multi-step workflows with retries?Very often asked
  1. ASNS
  2. BCloudFront
  3. CRoute 53
  4. DStep FunctionsCorrect answer

Why: State machines.

13Which service rotates database passwords automatically?Very often asked
  1. AS3
  2. BConfig
  3. CSecrets ManagerCorrect answer
  4. DCloudTrail

Why: Rotation via Lambda.

14Which load balancer routes by URL path?Very often asked
  1. AGateway Load Balancer
  2. BClassic only
  3. CApplication Load BalancerCorrect answer
  4. DNetwork Load Balancer

Why: Layer 7 routing.

15Which DR strategy has the lowest RTO?Very often asked
  1. AMulti-site active-activeCorrect answer
  2. BBackup and restore
  3. CPilot light
  4. DCold storage

Why: Traffic already runs in both regions.

16What does a DynamoDB GSI add?Very often asked
  1. AAnother access pattern with different keysCorrect answer
  2. BBackups
  3. CEncryption
  4. DStreams

Why: Global secondary index.

17What does Multi-AZ RDS provide?Often asked
  1. ACross-region backup only
  2. BFree storage
  3. CMore read throughput
  4. DA synchronous standby for failoverCorrect answer

Why: It is for availability; read replicas are for read scaling.

18Which runs containers without managing servers?Often asked
  1. AFargateCorrect answer
  2. BLightsail
  3. CElastic Beanstalk only
  4. DEC2

Why: Fargate is serverless compute for ECS and EKS.

19Which service is AWS's CDN?Often asked
  1. ACloudFrontCorrect answer
  2. BRoute 53
  3. CDirect Connect
  4. DGlobal Accelerator

Why: CloudFront caches content at edge locations.

20S3 durability is designed for…Often asked
  1. A99%
  2. B99.9%
  3. C99.999999999% (11 nines)Correct answer
  4. D100%

Why: Objects are stored redundantly across AZs.

21Which endpoint type is used for S3 from a VPC?Often asked
  1. ANAT gateway
  2. BInternet gateway
  3. CGateway endpointCorrect answer
  4. DInterface endpoint only

Why: Free and private.

22Which storage class suits unknown access patterns?Often asked
  1. AReduced Redundancy
  2. BS3 Intelligent-TieringCorrect answer
  3. CGlacier Deep Archive
  4. DOne Zone-IA

Why: Moves objects between tiers.

23Which service stores container images?Often asked
  1. AECS
  2. BEFS
  3. CEBS
  4. DECRCorrect answer

Why: Elastic Container Registry.

24Which Route 53 policy switches to a backup on failure?Often asked
  1. AMultivalue only
  2. BFailoverCorrect answer
  3. CSimple
  4. DWeighted only

Why: Uses health checks.

25What is envelope encryption?Often asked
  1. AEncrypting emails
  2. BCompressing data
  3. CSigning URLs
  4. DData keys encrypted by a master keyCorrect answer

Why: Used by KMS-integrated services.

26Auto Scaling target tracking adjusts capacity to keep…Often asked
  1. AA fixed instance count
  2. BCosts at zero
  3. CLatency random
  4. DA metric at a target valueCorrect answer

Why: For example 50% CPU.

27Which purchase option is cheapest for interruptible workloads?Sometimes asked
  1. ADedicated Hosts
  2. BReserved for 1 month
  3. COn-Demand
  4. DSpot InstancesCorrect answer

Why: Spot uses spare capacity at large discounts, with interruptions.

28Which service sends one message to many subscribers?Sometimes asked
  1. AStep Functions
  2. BSQS FIFO
  3. CSNSCorrect answer
  4. DKinesis only

Why: SNS is publish/subscribe fan-out.

29Which service gives managed access to foundation models?Sometimes asked
  1. AAmazon Lex only
  2. BAWS Glue
  3. CAmazon MQ
  4. DAmazon BedrockCorrect answer

Why: One API for many providers.

30Which service detects threats from logs automatically?Sometimes asked
  1. ACloud9
  2. BGuardDutyCorrect answer
  3. CCloudFormation
  4. DLightsail

Why: Analyses CloudTrail, VPC and DNS logs.

Track what you have practised and search every bank in your dashboard.

Start learning