AWS Interview Questions: Basic to Advanced

1Where exactly does the shared responsibility line fall for EC2 versus S3 versus Lambda?Basicconceptual30 minIn writing
2What is the difference between a Region, an Availability Zone, and an edge location, and why does that distinction drive architecture?Basicconceptual30 minIn writing
3How would you choose a Region for a new workload when latency, data residency, service availability, and price all disagree?Intermediatepractical35 minIn writing
4Why do teams run multiple AWS accounts under Organizations instead of one big account with tags?Intermediateconceptual40 minIn writing
5How do you decide between a managed AWS service and running the same software yourself on EC2?Basicconceptual30 minIn writing
6Walk me through the Well-Architected pillars and name a concrete tradeoff you have made between two of them.Intermediateconceptual35 minIn writing
7A startup is moving off a single rented server onto AWS next quarter. How do you set up accounts, Regions, and guardrails on day one so they do not have to redo it in a year?Scenarioscenario45 minIn writing
8Quiz: can you place shared responsibility, Regions, AZs, account boundaries, and the Well-Architected pillars correctly under time pressure?Basicconceptual20 minIn writing

9What is IAM in AWS, and why does the principle of least privilege matter when granting permissions?Basicconceptual5 min
10Walk me through how IAM evaluates a request when an identity policy allows it, a resource policy is silent, and an SCP denies it.Intermediateconceptual45 minIn writing
11When should a workload use an IAM role instead of an IAM user with access keys?Basicconceptual30 minIn writing
12How does AssumeRole work across accounts, and what does the trust policy on the target role have to say?Intermediatepractical45 minIn writing
13How would you scope an S3 policy so a role can only write to one prefix, only from your VPC endpoint, and only with encryption on?Advancedpractical50 minIn writing
14A team ships a role with s3:* on Resource "*" because "it kept breaking". How do you get them to least privilege without stalling their release?Advancedpractical50 minIn writing
15A leaked access key was found in a public GitHub repo an hour ago. Walk me through your response and then the change that stops it recurring.Scenarioscenario50 minIn writing
16Quiz: policy evaluation order, roles versus users, trust policies, and condition keys.Basicconceptual20 minIn writing

17How do you size a VPC CIDR and lay out subnets across AZs for a workload you expect to grow?Basicconceptual35 minIn writing
18What actually makes a subnet public, and what breaks if you get that wrong?Basicconceptual30 minIn writing
19Explain the difference between a Security Group and a Network ACL in a VPC, and when you'd reach for each.Intermediatepractical5 min
20How do instances in a private subnet reach the internet, and what does that path cost you?Intermediatepractical40 minIn writing
21When would you put a VPC endpoint in front of S3 or an internal service instead of routing through a NAT gateway?Advancedpractical45 minIn writing
22Compare VPC peering, Transit Gateway, and Site-to-Site VPN or Direct Connect for wiring twelve VPCs and an on-prem datacenter together.Advanceddesign50 minIn writing
23An application in a private subnet cannot reach an external payment API, but the same call works from your laptop. How do you diagnose it layer by layer?Scenarioscenario50 minIn writing
24Quiz: route tables, IGW versus NAT, stateful versus stateless filtering, and endpoint types.Basicconceptual20 minIn writing

25How do you pick an EC2 instance family and size for a workload you have never profiled?Basicconceptual30 minIn writing
26Compare On-Demand, Reserved Instances, Savings Plans, and Spot, and say which mix you would run for a steady web tier plus a nightly batch job.Intermediatepractical40 minIn writing
27What belongs in a baked AMI versus user data versus configuration management at boot?Intermediatepractical40 minIn writing
28When do you reach for an Application Load Balancer over a Network Load Balancer, and what do you give up?Intermediateconceptual40 minIn writing
29How do you set health check thresholds and deregistration delay so a deploy does not drop in-flight requests?Advancedpractical45 minIn writing
30Design an Auto Scaling policy for traffic that triples in ninety seconds when a marketing email goes out.Advanceddesign50 minIn writing
31Your Auto Scaling group keeps launching and terminating instances every few minutes while user-facing latency climbs. What is going on and how do you prove it?Scenarioscenario50 minIn writing
32Quiz: instance families, purchase models, load balancer types, health checks, and scaling policies.Basicconceptual20 minIn writing

33How do you decide between ECS and EKS for a team of six with no Kubernetes experience?Intermediateconceptual40 minIn writing
34What do you gain and lose by running tasks on Fargate instead of an EC2 capacity provider?Intermediatepractical40 minIn writing
35How do task roles differ from the task execution role, and which one does your application code use?Intermediatepractical40 minIn writing
36How does awsvpc networking mode change IP allocation and security group design for a busy cluster?Advancedconceptual45 minIn writing
37How do you keep container images in ECR small, scanned, and traceable back to a commit?Intermediatepractical40 minIn writing
38Design a zero-downtime rolling deployment for a containerized service that holds long-lived websocket connections.Advanceddesign50 minIn writing
39ECS tasks are stuck in PENDING and never reach RUNNING. Walk me through every cause you would rule out, in order.Scenarioscenario50 minIn writing
40Quiz: ECS versus EKS, launch types, task roles, awsvpc mode, and ECR basics.Basicconceptual20 minIn writing

41What is the Lambda execution model, and what survives between two invocations of the same function?Basicconceptual30 minIn writing
42What actually causes a cold start, and which of the usual fixes are worth their cost?Intermediatepractical40 minIn writing
43How do reserved and provisioned concurrency differ, and how would you stop one noisy function from starving the rest of the account?Advancedpractical45 minIn writing
44When is API Gateway worth its price over an ALB or a Lambda function URL in front of the same handler?Intermediateconceptual40 minIn writing
45How would you use EventBridge rules and buses to decouple six services that currently call each other over HTTP?Advanceddesign50 minIn writing
46When do you move a multi-step process out of a single Lambda and into Step Functions?Advanceddesign45 minIn writing
47A Lambda triggered by SQS is retrying the same message forever and the queue is growing. Diagnose it and design the fix.Scenarioscenario50 minIn writing
48Quiz: execution model, concurrency controls, event sources, and orchestration choices.Basicconceptual20 minIn writing

49What does eleven nines of durability actually promise, and what does S3 not protect you from?Basicconceptual30 minIn writing
50Design a lifecycle policy for logs that are queried hard for a week, rarely for a year, and kept for seven.Intermediatepractical40 minIn writing
51Bucket policy, IAM policy, Block Public Access, and ACLs all apply to one object. How do they interact?Advancedpractical45 minIn writing
52How do you pick between gp3, io2, and st1, and what does provisioning IOPS actually buy you?Intermediateconceptual40 minIn writing
53A workload needs shared state across ten instances. Walk through EFS, EBS, and instance store and pick one.Intermediateconceptual40 minIn writing
54How do you make S3 fast for millions of small objects and reliable for multi-gigabyte uploads?Advancedpractical45 minIn writing
55Someone deleted a production S3 prefix this morning. What lets you recover it, and what should have been in place beforehand?Scenarioscenario50 minIn writing
56Quiz: storage classes, lifecycle transitions, volume types, and shared-storage choices.Basicconceptual20 minIn writing

57What does Aurora change about the storage layer compared to plain RDS, and when is that worth the price?Intermediateconceptual40 minIn writing
58Multi-AZ and read replicas both give you a second copy. What is each one actually for?Intermediateconceptual40 minIn writing
59How do you choose a partition key, and what happens to a table whose keys are badly distributed?Advanceddesign50 minIn writing
60Model a single-table design for an order service with four known access patterns, and justify each index.Advanceddesign55 minIn writing
61When would you refuse to put a workload in DynamoDB and insist on a relational engine?Intermediateconceptual40 minIn writing
62Your production RDS instance starts rejecting new connections during traffic spikes with 'too many connections' errors. Walk through how you'd diagnose and fix it.Scenarioscenario5 min
63A DynamoDB table is throttling reads during a daily spike even though provisioned capacity looks sufficient in aggregate. Explain and fix it.Scenarioscenario50 minIn writing
64Quiz: Aurora versus RDS, Multi-AZ versus replicas, key design, and capacity modes.Basicconceptual20 minIn writing

65When do you need an SQS FIFO queue, and what does it cost you in throughput?Basicconceptual30 minIn writing
66How do visibility timeout, redrive policy, and a dead-letter queue work together to keep a consumer honest?Intermediatepractical40 minIn writing
67How would you fan one event out to three consumers with different retry needs?Intermediatepractical40 minIn writing
68Compare Kinesis Data Streams, SQS, and EventBridge for ingesting a million clickstream events an hour.Advancedconceptual45 minIn writing
69Nothing here is exactly-once. How do you make a consumer safe to run the same message twice?Advanceddesign50 minIn writing
70One malformed message is blocking a stream shard. How do you drain it without losing the good records behind it?Advancedpractical45 minIn writing
71Orders are occasionally processed twice and customers get charged twice. Walk me from the symptom to the architectural fix.Scenarioscenario50 minIn writing
72Quiz: queue semantics, DLQs, fanout, stream ordering, and idempotency.Basicconceptual20 minIn writing

73Name every place you could cache a response between a user and your database, and what each one is good at.Basicconceptual30 minIn writing
74When does Redis earn its complexity over Memcached for an application cache?Intermediateconceptual35 minIn writing
75Compare TTL, write-through, and explicit invalidation for a product catalog that changes hourly.Advancedpractical45 minIn writing
76How do cache behaviors, origins, and cache keys decide what CloudFront serves and what it forwards?Intermediatepractical40 minIn writing
77How do you serve private media from S3 through CloudFront without ever exposing the bucket?Advancedpractical45 minIn writing
78A popular key expires and a thousand requests hit the database at once. What are your options?Advancedtroubleshooting45 minIn writing
79Cache hit rate dropped from 95% to 40% after a release and origin costs tripled. How do you find what changed?Scenarioscenario50 minIn writing
80Quiz: cache layers, engine choice, invalidation strategies, cache keys, and signed access.Basicconceptual20 minIn writing

81How do CloudWatch namespaces, metrics, and dimensions fit together, and what makes a custom metric expensive?Basicconceptual30 minIn writing
82How would you get structured application logs into CloudWatch and query them during an incident?Intermediatepractical40 minIn writing
83Write the alarm you would actually page a human for on a checkout API, and explain the thresholds.Advancedpractical45 minIn writing
84What does X-Ray show you that metrics and logs cannot, and how do traces propagate across Lambda and SQS?Advancedpractical45 minIn writing
85CloudTrail and CloudWatch both record things. Which question do you take to each?Intermediateconceptual35 minIn writing
86Define SLIs and SLOs for a public API and build the dashboard an on-call engineer opens first.Advanceddesign50 minIn writing
87Users report the site is slow, but every dashboard is green. How do you find the gap in your instrumentation?Scenarioscenario50 minIn writing
88Quiz: metric anatomy, log querying, alarm design, tracing, and CloudTrail scope.Basicconceptual20 minIn writing

89Explain RTO and RPO to a product manager and get real numbers out of them.Basicconceptual30 minIn writing
90What class of failure does multi-AZ not save you from, and when is multi-Region actually justified?Intermediateconceptual40 minIn writing
91Compare backup-and-restore, pilot light, warm standby, and active-active on cost and recovery time.Advanceddesign50 minIn writing
92Design a highly available three-tier web application architecture on AWS that can survive the loss of a single Availability Zone.Advanceddesign5 min
93How does Route 53 health checking and failover routing behave during a partial regional failure?Advancedpractical45 minIn writing
94Set timeouts, retries, and backoff for a service that calls three downstream APIs, and justify each number.Advancedpractical45 minIn writing
95An entire Availability Zone goes dark at 2am. Walk me through what your architecture does automatically and what you have to do by hand.Scenarioscenario55 minIn writing
96Quiz: RTO/RPO, failure domains, DR strategies, failover routing, and retry hygiene.Basicconceptual20 minIn writing

97How does envelope encryption work with KMS, and what is the difference between an AWS-managed and a customer-managed key?Intermediateconceptual40 minIn writing
98Where would you enforce TLS and at-rest encryption across a three-tier application, and how do you prove it stayed on?Basicpractical35 minIn writing
99When is Secrets Manager worth its per-secret cost over SSM Parameter Store, and how does rotation work?Intermediatepractical40 minIn writing
100GuardDuty, Security Hub, Config, and Inspector all send you findings. What does each one actually detect?Intermediateconceptual40 minIn writing
101How would you defend a public API against credential stuffing and a volumetric flood at the same time?Advancedpractical45 minIn writing
102An auditor asks you to prove no unencrypted volume existed in production last quarter. How do you answer?Advanceddesign50 minIn writing
103GuardDuty reports an EC2 instance mining cryptocurrency. Walk me through containment, investigation, and the follow-up controls.Scenarioscenario55 minIn writing
104Quiz: KMS mechanics, secret storage, detective controls, and edge protection.Basicconceptual20 minIn writing

105You are handed a $40k monthly bill you have never seen. What are the first five things you look at?Basicpractical35 minIn writing
106How do you get per-team cost attribution in an account where nothing is tagged consistently?Intermediatepractical40 minIn writing
107How much of a fluctuating compute baseline would you commit to a Savings Plan, and how did you pick that number?Advancedpractical45 minIn writing
108Trace every place data transfer charges appear in a multi-AZ, multi-account architecture.Advancedconceptual45 minIn writing
109How do you find and safely remove idle resources without breaking something nobody remembers owning?Intermediatepractical40 minIn writing
110Redesign a service that costs $9k a month to run at a tenth of the price, and say what you traded away.Advanceddesign50 minIn writing
111The bill jumped 60% month over month with no traffic increase. Find the cause and prevent the next one.Scenarioscenario50 minIn writing
112Quiz: bill drivers, tagging, commitment models, transfer charges, and rightsizing.Basicconceptual20 minIn writing

113Why insist on infrastructure as code, and what does configuration drift look like when you do not?Basicconceptual30 minIn writing
114Compare CloudFormation, CDK, and Terraform for a team that already writes TypeScript.Intermediateconceptual40 minIn writing
115How do you split infrastructure into stacks or state files so one bad apply cannot take down production?Advanceddesign50 minIn writing
116Design a pipeline that promotes the same artifact from dev to staging to production without rebuilding it.Intermediatepractical45 minIn writing
117Compare rolling, blue/green, and canary deployments on AWS and pick one for a database-backed API.Advanceddesign50 minIn writing
118How do build and deploy pipelines get AWS credentials without a long-lived key sitting in CI?Advancedpractical45 minIn writing
119Someone fixed production by hand during an incident and now the next deploy will revert it. How do you handle that, tonight and structurally?Scenarioscenario50 minIn writing
120Quiz: IaC tooling tradeoffs, state boundaries, promotion flow, and deployment strategies.Basicconceptual20 minIn writing

121Design a URL shortener on AWS for 50k writes and 50M reads a day. Justify every service choice.Advanceddesign60 minIn writing
122Design an upload-to-playback video pipeline with transcoding, and explain how it degrades when transcoding falls behind.Advanceddesign60 minIn writing
123A monolith on two datacenter VMs must move to AWS with under an hour of downtime. Plan the migration.Scenarioscenario60 minIn writing
124p99 latency tripled after a deploy but p50 is unchanged. Walk the whole request path and narrow it down.Scenariotroubleshooting55 minIn writing
125Write the postmortem for an outage caused by an expired certificate on an internal load balancer, including the action items you would actually fund.Scenariotroubleshooting50 minIn writing
126Defend a design where you deliberately chose a single Region, and say exactly what would change your mind.Advanceddesign50 minIn writing
127Full mock system design round: build a multi-tenant SaaS backend on AWS end to end, then answer follow-ups on cost, security, and failure modes.Scenariodesign240 minIn writing
128Final review quiz across identity, networking, compute, data, reliability, security, and cost.Basicconceptual30 minIn writing