Explain the difference between EC2 and AWS Lambda and when you would use each.

Start by defining each service and the execution model, then compare billing, scaling, and operational overhead. Explain that EC2 is server-based, good for long-running or stateful workloads, while Lambda is serverless, event-driven, and best for short-lived, stateless tasks. Give a concrete example: use EC2 for a legacy application that requires persistent file storage and custom OS configuration, and use Lambda for processing image uploads where each function runs under a minute and scales automatically with events. Mention how Lambda integrates with S3 and API Gateway for event-driven APIs. Tip: avoid saying serverless solves every problem, because cold starts, execution time limits, and external dependency management can be constraints. When answering, state trade-offs clearly, for example control versus operational simplicity.

How does Amazon S3 provide durability and availability for objects?

Explain the underlying principles: S3 replicates objects across multiple Availability Zones and uses checksums and versioning to detect and protect against corruption. Discuss durability targets, read-after-write consistency for new objects in most regions, and storage classes that trade cost for retrieval time. Give an example of using S3 versioning and lifecycle policies to protect against accidental deletion and to move cold data to Glacier or Glacier Deep Archive. Explain how cross-region replication can provide geographic redundancy for disaster recovery use cases. Tip: avoid claiming S3 is a drop-in replacement for a block store. Mention common gotchas like eventual consistency on overwrite or delete in rare older cases, and think about object size limits and request rate considerations when designing a solution.

Describe IAM best practices for managing permissions in AWS.

Start with core principles: apply least privilege, use roles for applications and services, and prefer groups for user permissions to keep policies manageable. Discuss avoiding long-term access keys for users, enabling MFA, and using AWS Organizations with Service Control Policies for account-level guards. Provide a technique: create job-role specific IAM roles with narrow policies, use temporary credentials via STS for cross-account access, and attach permissions boundary for delegates. Mention using IAM Access Analyzer and AWS CloudTrail to audit permission usage. Tip: avoid granting wide wildcard permissions like iam:* or s3:*, and do not attach policies directly to users when roles or groups solve the problem. Emphasize testing policies with the IAM policy simulator before rolling them out.

How would you design a highly available web application on AWS?

Outline a multi-AZ architecture: public subnets with load balancers, private subnets with application servers, and separate DB instances in multiple AZs for failover. Include health checks, auto scaling groups across AZs, and using managed services like RDS Multi-AZ or DynamoDB for durability and automatic failover. Give a concrete stack: Route 53 for DNS with health checks, an Application Load Balancer distributing to EC2 or ECS tasks in multiple AZs, RDS with Multi-AZ or Aurora for primary-replica setups, and S3 + CloudFront for static assets. Add cross-region replication and Read Replicas if you need geographic resilience. Tip: avoid single points of failure such as a single NAT instance or single AZ databases. When describing failover, mention RTO and RPO targets and how your design meets them.

What is VPC peering and when would you use it versus AWS Transit Gateway?

Describe VPC peering as a direct network connection between two VPCs that routes traffic privately, without a gateway, while Transit Gateway is a central hub to connect many VPCs and on-prem networks. Explain limitations: peering is simple and low cost for a few VPCs, but does not support transitive routing, whereas Transit Gateway supports scalable, transitive connectivity. Provide an example: use VPC peering for two environments that need direct low-latency communication and there are only a couple of VPCs. Use Transit Gateway when you have many VPCs, multiple accounts, or need to attach VPNs and Direct Connect in a hub-and-spoke pattern. Tip: avoid oversimplifying cost; Transit Gateway has higher fixed costs but simplifies routing at scale. Mention routing table complexity with peering and the need to update route tables manually for many peering connections.

How do you approach troubleshooting a slow application on AWS?

Start with data: gather metrics from CloudWatch, check X-Ray traces if available, and review logs in CloudWatch Logs or an external logging system to pinpoint where latency occurs. Break the problem into tiers: network, application, database, and external services, and test each layer independently. Give a technique: reproduce the issue in a staging environment, load test the application to see whether CPU, memory, or DB connections are saturated, and use X-Ray to follow slow traces to a specific downstream call or database query. Add concrete fixes like increasing DB read replicas, adding caching with ElastiCache, or tuning slow queries. Tip: avoid making configuration changes in production without a rollback plan. When you propose fixes, note the impact on cost and complexity, and prioritize changes that give measurable latency improvements.

Explain Auto Scaling and how you would set scaling policies for a web tier.

Describe Auto Scaling as a service that monitors instances and adjusts capacity using policies based on metrics, scheduled actions, or target tracking. Explain different policies: simple scaling, step scaling, and target tracking, and when each is appropriate based on traffic patterns. Offer an example policy: use target tracking based on average CPU or request count per target to maintain performance, add step scaling for sudden traffic spikes, and include cooldown periods to avoid rapid thrashing. Combine Auto Scaling with health checks from the load balancer to remove unhealthy instances automatically. Tip: avoid scaling solely on CPU for applications where bottlenecks are I/O or database related. Consider using custom CloudWatch metrics like queue length or latency, and test scaling behavior with load tests before production events.

What are the trade-offs between RDS and DynamoDB for a transactional application?

Start by comparing relational versus NoSQL models: RDS offers SQL, strong transactional support, and complex queries, while DynamoDB provides single-digit millisecond performance, automatic scaling, and a schema-less key-value model. Discuss consistency models, query flexibility, and operational overhead such as backups and patching. Give a real scenario: pick RDS for an application that relies on complex joins, strong ACID transactions, and reporting queries. Choose DynamoDB for a high-traffic, simple-key access pattern where predictable latency and horizontal scaling matter, and use DynamoDB transactions for multi-item consistency when needed. Tip: avoid saying one is always faster; performance depends on access patterns and data modeling. Mention common pitfalls like DynamoDB hot partitions and RDS vertical scaling limits, and plan capacity and indexing accordingly.

How do you secure data in transit and at rest on AWS?

Explain encryption options: for data in transit use TLS with managed certificates via ACM and enforce HTTPS at load balancers; for data at rest use AWS-managed keys (SSE-S3), KMS-managed CMKs, or customer-managed keys when you need control. Also mention network controls like security groups, NACLs, and VPC endpoints to limit exposure. Provide an example: enable encryption at rest for RDS using KMS keys, configure S3 bucket policies with encryption required, and place APIs behind API Gateway with TLS and WAF rules for filtering. Use IAM policies to restrict who can decrypt keys and audit key usage with CloudTrail. Tip: avoid storing sensitive keys in code or insecure locations. When discussing keys, mention key rotation policies and least privilege on KMS key grants to reduce blast radius.

What is CloudFormation and how do you manage templates in a team environment?

Start with CloudFormation as an Infrastructure as Code tool that describes AWS resources in YAML or JSON templates and manages lifecycle via stacks. Explain modular templates, parameters, and nested stacks as ways to keep templates maintainable and reusable. Give a team workflow: store templates in version control, use CI to validate and lint templates, run change sets to preview stack updates, and apply them through a controlled pipeline with approvals. Use parameters and mappings for environment differences, and consider the CloudFormation registry or modules for common components. Tip: avoid making manual console changes to stack-managed resources because it can drift from the template. When scaling IaC, consider drift detection and break templates into logical units to reduce conflict between teams.

Tell me about a time you resolved a production outage.

Situation: In one role a critical API started returning 500 errors during peak traffic and customer impact grew quickly. Task: You were responsible for stabilizing the service, identifying root cause, and restoring traffic with minimal customer disruption. Action: You triaged logs and traces to identify a database connection pool exhaustion, increased pool size temporarily, put a rate limiter in front of the API to reduce incoming load, and rolled back a recent deployment that changed connection behavior. Result: The API recovered within 20 minutes, customer errors dropped to near zero, and you implemented a permanent fix with connection pooling changes and improved monitoring to prevent recurrence.

Describe a time you had to convince stakeholders to adopt a technical change.

Situation: Your team needed to migrate a legacy application to a managed database to reduce ops overhead and costs. Task: You had to present a migration plan and get buy-in from engineering, product, and finance stakeholders who were concerned about risk and cost. Action: You prepared a pilot migration with metrics showing lower operational effort and cost projections, documented rollback steps and a staged migration plan, and held demos to show parity and reliability improvements. Result: Stakeholders approved the phased migration, the pilot reduced weekend on-call incidents by 60 percent, and the full migration completed with fewer operational incidents than expected.

Give an example of when you handled conflicting priorities on a project.

Situation: Your team faced a security audit while also needing to deliver a new feature with a hard launch date. Task: You had to balance finishing the feature and addressing audit findings without delaying commitments. Action: You negotiated a scope split, moved noncritical feature elements to a later phase, assigned a small focused team to handle urgent audit items, and set clear checkpoints to monitor both efforts. Result: The audit passed with only minor follow-ups, and the core feature shipped on time, maintaining customer trust and compliance.

How does AWS Route 53 support routing policies and how would you use them?

Explain that Route 53 supports simple, weighted, latency, failover, geolocation, and multi-value answer routing policies to control how DNS responses are returned. Describe each briefly and when it applies, for example latency routing for directing traffic to the lowest-latency region and weighted routing for gradual traffic shifts. Give a concrete use case: use weighted records to perform a blue-green deployment by gradually shifting traffic from the old environment to the new one, then move to latency-based routing for directing users to the nearest healthy region. Pitfalls: avoid relying on DNS alone for instant failover because TTLs and client DNS caching can delay changes, and monitor health checks closely when using failover or latency policies.

What is AWS CloudWatch and how do you set up meaningful alerts?

Start by defining CloudWatch as the monitoring and observability service for metrics, logs, and events, and explain how it collects data from AWS services and custom sources. Discuss creating metric filters, dashboards, and alarms, and the use of CloudWatch Logs Insights for querying logs. Provide an example: set alarms on error rate and latency thresholds for a web service, create composite alarms to reduce noise when multiple alerts fire, and notify on-call teams through SNS to PagerDuty for escalation. Add dashboards that combine key metrics to give a quick operational view. Pitfalls: avoid setting overly sensitive thresholds that create alert fatigue, and make sure alerts include actionable runbook links so responders know how to investigate and remediate quickly.

Explain how to secure an S3 bucket that needs to be publicly accessible for static website hosting.

Explain that even for public websites you should enforce encryption at rest, restrict write permissions, and use bucket policies that allow only required read access. Discuss enabling S3 Block Public Access at the account level selectively and then using specific bucket policies for public read if needed. Give a configuration example: enable SSE-S3 or KMS encryption, set a bucket policy that only allows s3:GetObject for anonymous users on the website assets, and put CloudFront in front of the bucket with an origin access control to avoid direct bucket access. Pitfalls: avoid leaving write permissions open or granting broad IAM principals access. Also monitor logs with S3 access logging or CloudTrail to detect unusual access patterns.

How do you design a fault-tolerant architecture for a stateful database on AWS?

Start by explaining options: use managed services like RDS Multi-AZ for automated failover, Aurora for shared storage with fast failover, or deploy clustering with backups for self-managed databases. Discuss replication, backups, automated failover, and cross-region read replicas for disaster recovery. Provide a pattern: choose Aurora for high availability with writer and reader endpoints, enable automated backups and snapshot exports, and configure cross-region replicas for DR while testing failover procedures regularly. Also include automated monitoring and runbooks for failover steps. Pitfalls: avoid assuming failover is instant; test recovery time and data consistency under real conditions. Consider network latency and replication lag for cross-region setups and have a clear RPO and RTO documented.

Provide a short Terraform example to create an S3 bucket and attach a lifecycle rule.

Explain that Terraform manages AWS resources declaratively and that you should use the AWS provider with versioned state storage for teams. Show the basic idea: declare an aws_s3_bucket resource with versioning enabled and an aws_s3_bucket_lifecycle_configuration to transition objects to Glacier after a given number of days. Example snippet: resource "aws_s3_bucket" "site" { bucket = "example-site-bucket" versioning { enabled = true } } resource "aws_s3_bucket_lifecycle_configuration" "lifecycle" { bucket = aws_s3_bucket.site.id rule { id = "archive" status = "Enabled" transition { days = 30 storage_class = "GLACIER" } } } Pitfalls: avoid storing state locally in team environments, and watch for differences between provider versions. Also test lifecycle rules on noncritical buckets first to ensure you do not accidentally archive or delete important data.

aws Interview Questions: Complete Guide

Expect a mix of phone screens, technical deep dives, and system design or behavioral interviews when preparing for aws interview questions. You will face scenario-based questions, whiteboard architecture, and hands-on questions about specific services, so plan to explain trade-offs clearly and concisely. Be honest about gaps, show your problem solving, and focus on how your experience maps to the role.

Common Interview Questions

Behavioral Questions (STAR Method)

STAR Method: Structure your answers using Situation, Task, Action, and Result to tell compelling stories about your experience.

Technical Questions

Questions to Ask the Interviewer

Show your interest by asking thoughtful questions

•What does success look like in this role after the first six months, and how will it be measured?
•Can you describe the team structure and how this role collaborates with platform, security, and product teams?
•What are the biggest technical challenges the team is currently facing on AWS?
•How do you approach post-incident reviews and continuous improvement after outages?
•What tools and processes do you have for infrastructure as code, testing, and CI/CD in this environment?

Interview Preparation Tips

1
Practice concise architecture explanations using diagrams or a whiteboard, focusing on components, trade-offs, and failure modes.
2
Prepare a few short stories using metrics that show impact, and rehearse them to keep answers under two minutes each.
3
Review the job description and map your experience to specific services and patterns they use, so your answers feel directly relevant.
4
During system design questions, state assumptions up front, ask clarifying questions, and iterate on the design while explaining trade-offs.

aws Interview Questions: Complete Guide

Emily Thompson

Common Interview Questions

Behavioral Questions (STAR Method)

Technical Questions

Questions to Ask the Interviewer

Interview Preparation Tips

Related guides

aws solutions architect Interview Questions: Complete Guide

agile Interview Questions: Complete Guide

algorithms Interview Questions: Complete Guide

angular Interview Questions: Complete Guide

aws Interview Questions: Complete Guide

Emily Thompson

Common Interview Questions

Q1Explain the difference between EC2 and AWS Lambda and when you would use each.

Q2How does Amazon S3 provide durability and availability for objects?

Q3Describe IAM best practices for managing permissions in AWS.

Q4How would you design a highly available web application on AWS?

Q5What is VPC peering and when would you use it versus AWS Transit Gateway?

Q6How do you approach troubleshooting a slow application on AWS?

Q7Explain Auto Scaling and how you would set scaling policies for a web tier.

Q8What are the trade-offs between RDS and DynamoDB for a transactional application?

Q9How do you secure data in transit and at rest on AWS?

Q10What is CloudFormation and how do you manage templates in a team environment?

Behavioral Questions (STAR Method)

B1Tell me about a time you resolved a production outage.

B2Describe a time you had to convince stakeholders to adopt a technical change.

B3Give an example of when you handled conflicting priorities on a project.

Technical Questions

T1How does AWS Route 53 support routing policies and how would you use them?

T2What is AWS CloudWatch and how do you set up meaningful alerts?

T3Explain how to secure an S3 bucket that needs to be publicly accessible for static website hosting.

T4How do you design a fault-tolerant architecture for a stateful database on AWS?

T5Provide a short Terraform example to create an S3 bucket and attach a lifecycle rule.

Questions to Ask the Interviewer

Interview Preparation Tips

Related guides

aws solutions architect Interview Questions: Complete Guide

agile Interview Questions: Complete Guide

algorithms Interview Questions: Complete Guide

angular Interview Questions: Complete Guide