AWS Interview Questions: What Each One Tests

Most lists of AWS interview questions and answers are definitions. "What is a security group?" "What is S3?" Interviewers do ask those, usually in the first few minutes. Then they turn the definition into a scenario, and the scenario is where the score comes from.

This post groups the common AWS interview questions by area. Each one comes with a short answer and what the interviewer is checking for. After those come the operational questions that cloud engineer interviews add, and a way to turn any definition into an answer that scores. The questions recur in published AWS interview lists, and none is taken from any company's interview loop.

What AWS interview questions test

There are two kinds of question. A definition question ("What's the difference between a security group and a network ACL?") checks that you know the service. A scenario question ("This instance can't reach the internet. Why?") checks whether you can use what you know. Both get asked, and only the second separates candidates.

Scenario answers are graded on the same five signals as a system design round: requirements, data model, scaling story, trade-offs and communication. The system design interview questions post explains each one.

Compute questions

What's the difference between EC2, Lambda and Fargate?

EC2 gives you virtual servers that you patch and scale. Lambda runs your code per event, bills per request and duration, and stops a single invocation at 15 minutes (Lambda quotas). Fargate runs containers without servers to manage. The interviewer is checking that you pick by workload: run time, traffic shape and how much operations work the team can take on.

How does Auto Scaling decide when to add capacity?

Through scaling policies. Target tracking keeps a metric such as average CPU at a target, and step and scheduled scaling cover the other cases (scaling policies). The question is really about the metric. CPU is the default, but request count per target or queue depth often tracks load better.

Storage questions

S3, EBS or EFS: when would you use each?

S3 stores objects you reach over HTTP. EBS is a block device attached to an instance in one Availability Zone. EFS is a file system that many instances can mount at once. This one tests the data model, so start from the access pattern.

How do you protect S3 data from accidental deletion?

Versioning keeps earlier versions when an object is overwritten or deleted. S3 Object Lock stops deletion for a set retention period. Replication to another account or Region protects against a compromised account (data protection in S3). A good answer separates the cases: a user's mistake, a bad deployment and an attacker each need a different control.

Networking questions

What's the difference between a security group and a network ACL?

A security group is stateful and attached to an instance or network interface, and it holds allow rules only. A network ACL is stateless and attached to a subnet. It evaluates numbered allow and deny rules in order (network ACLs). The follow-up is about the return path: because a network ACL is stateless, the response traffic needs its own rule on the ephemeral ports.

How does an instance in a private subnet reach the internet, and how does it reach S3 without it?

Internet traffic goes out through a NAT gateway. S3 and DynamoDB traffic can take a gateway VPC endpoint instead, which costs nothing extra and keeps that traffic out of the NAT gateway (gateway endpoints). The interviewer wants to hear cost as well as connectivity.

How do you connect many VPCs?

VPC peering links two VPCs and doesn't route traffic onward through a third (peering limitations). Transit Gateway acts as a hub that many VPCs and on-premises networks attach to. A few peerings are simple. A mesh of dozens is not, and that trade-off is what's being tested.

IAM and security questions

How do you give an application access to another AWS account?

An IAM role in the target account, with a trust policy that names who may assume it and a permissions policy scoped to least privilege. The application gets temporary credentials and no long-lived keys. Reaching for a role first is the whole test.

When do you use an IAM role and when an IAM user?

AWS recommends federation with temporary credentials for people and IAM roles for workloads (IAM best practices). Long-lived access keys are a last resort for the few cases that can't use either. Interviewers ask it to see whether you know the current recommendation.

Database questions

DynamoDB or RDS for this workload?

DynamoDB suits key-value access at any scale when you know the queries up front. RDS suits joins, transactions and queries you can't predict. Name the queries before the engine.

How do you scale a database that has hit its limits?

Read replicas for read load, a cache in front of hot reads, and partitioning when writes outgrow one node, roughly in that order. This is a scaling-story question, so put a number on the load that justifies each step.

Messaging and reliability questions

SQS, SNS or EventBridge?

SQS is a queue that one consumer group works through. SNS fans one message out to many subscribers. EventBridge routes events by their content to different targets. The follow-up is usually what happens to a message nobody can process. The answer is a dead-letter queue.

How would you make a web application highly available on AWS?

Start from the availability target. Then spread it across several Availability Zones, put a load balancer in front with health checks, and say what happens when one zone fails. The target decides how far you go, which makes this a requirements question.

How would you design disaster recovery across Regions?

State RTO and RPO first, then choose among backup and restore, pilot light, warm standby and active/active, each with its cost (disaster recovery options). The AWS solutions architect interview questions post takes this one deeper.

Cost questions

How would you cut the cost of this architecture?

Find the lines that grow with traffic (compute, data transfer, NAT, storage) and work on those, then commit to steady usage. It's the scaling story, applied to money.

Savings Plans or Reserved Instances?

Savings Plans commit to a spend per hour and apply across instance families and, for Compute Savings Plans, to Fargate and Lambda too. Reserved Instances commit to a specific instance configuration. The Savings Plans vs Reserved Instances post compares them in full.

AWS cloud engineer interview questions

Cloud engineer interviews lean operational. Something is broken, or about to change, and you have to find out why without guessing. These questions come up in published lists for cloud engineer and cloud operations roles.

An instance in a private subnet can't reach the internet. How do you troubleshoot it?

Walk the path in order. Does the subnet's route table send 0.0.0.0/0 to a NAT gateway? If it's a zonal NAT gateway, does its public subnet route to the internet gateway? Do the security group's outbound rules allow the traffic? Does the network ACL allow it both ways, ephemeral ports included? Is DNS resolving? VPC Reachability Analyzer and flow logs show you where it stops. The interviewer wants a method you can follow out loud.

How do you know a service is unhealthy before users tell you?

Put CloudWatch alarms on what users feel, such as error rate and latency, and add logs you can search and a dashboard someone actually looks at. The question is whether your alarms track user pain or server load.

Someone changed a resource by hand that your infrastructure code manages. What now?

Detect the drift: CloudFormation has drift detection, and terraform plan shows the difference. Decide whether to bring the change into code or revert it, then make it harder to repeat with tighter permissions. Fixing the process as well as the resource is what scores.

An application gets AccessDenied. How do you find the cause?

Find the call in CloudTrail and read the error, which often says which type of policy denied it. Then check every place a deny can come from: the identity policy, a resource policy, a permissions boundary, a service control policy, a KMS key policy (troubleshooting access denied). Candidates who check only the identity policy miss most of the list.

How do you deploy a change safely, and roll it back?

Shift traffic gradually with a blue/green or canary deployment, using weighted target groups, Lambda aliases or CodeDeploy. Gate each step on health checks, and roll back automatically when an alarm fires (CodeDeploy rollbacks). Plan the rollback before the rollout.

How do you know your backups work?

Back up with AWS Backup, copy to another account or Region, and test restores on a schedule. AWS's own disaster recovery guidance says a backup strategy has to include testing the backups (backup and restore). The point is to think past the backup to the restore.

Turning a definition into an answer that scores

A definition makes a good first sentence. Take "What's the difference between a security group and a network ACL?" and add three moves:

1. Say what each one is, in one sentence each.
2. Say when it matters in a real system. Here, that's a NACL blocking return traffic because the ephemeral ports were left closed.
3. Say what you'd do and what it costs: keep NACLs broad and do the fine-grained control in security groups, accepting one fewer layer of filtering.

Thirty seconds, and the interviewer has something to write in the trade-offs row.

Where architect rounds go deeper

Solutions architect loops take the same questions further. They want to know what fails, what it costs and what you'd change at ten times the load. The AWS solutions architect interview questions post covers that round. If the loop includes a whiteboard design, start with the system design interview questions. If the role asks for a certification, the AWS certification path shows which exam fits.

FAQ

How do I prepare for an AWS interview?

Start with the services the job ad names. Answer the questions on this page out loud in your own words, then practise scenarios where you have to choose a service and defend the choice. Finish with at least one timed design round, because that's where a definition stops being enough.

Are AWS interview questions different for experienced engineers?

Yes. Entry-level rounds stay closer to definitions: what a service is and when you'd use it. Experienced candidates get scenarios and follow-ups instead: why this service, what fails first, what it costs, and how you'd run it.

Which AWS services should I know for a cloud engineer interview?

VPC networking, IAM, EC2 with Auto Scaling, S3, one database (RDS or DynamoDB), CloudWatch, and whichever infrastructure-as-code tool the team uses. The job ad usually names the rest.

Practising the scenario questions

Definitions you can learn from a list. Scenarios need someone asking follow-ups. Pick five questions from this page, answer each out loud, and have a friend ask "why?" after every sentence. The system design interview prep post shows how to run that as a proper mock.

In a coaching session I run AWS scenario questions and a design round against the clock, score them on the five signals, and send you the written scorecard within a day.