55 Cloud & AWS interview questions with answers

All Cloud & AWS interview questions

• What is Cloud Computing? Distinguish between IaaS, PaaS, and SaaS.

• What is AWS EC2? What are the common instance types and when should you choose each?

• What is AWS Lambda? When should you use Lambda instead of EC2? Explain cold starts and how to mitigate them.

• What is the difference between ECS and EKS? When should you choose ECS Fargate over EKS?

• What is Amazon API Gateway? What is the difference between REST API and HTTP API? How do you integrate it with Lambda?

• What is a VPC? Explain public subnets vs private subnets and why you need to separate them.

• What is the difference between Security Groups and Network ACLs (NACLs)? When do you use each?

• What is Amazon Route 53? Explain the routing policies and the use case for each.

• What is Amazon CloudFront? Explain how CDN works and the security features of CloudFront.

• What is the difference between Application Load Balancer (ALB), Network Load Balancer (NLB), and Gateway Load Balancer? When do you use each?

• What are Amazon S3 storage classes? Explain lifecycle policies and how to optimize storage costs.

• Compare DynamoDB and RDS. When should you use NoSQL instead of SQL on AWS?

• What is Amazon ElastiCache? What is the difference between Redis and Memcached on ElastiCache? What are common caching patterns?

• What is the difference between EBS, EFS, and Instance Store? What are the use cases and limitations of each?

• What makes Amazon Aurora special? Explain Aurora's architecture and Aurora Serverless v2.

• What is Amazon Redshift? When should you use Redshift instead of RDS? Explain columnar storage and distribution styles.

• What is the difference between SQS, SNS, and EventBridge? When do you use each service in an event-driven architecture?

• What is Amazon Kinesis? Compare Kinesis Data Streams, Firehose, and Analytics. When should you use Kinesis instead of SQS?

• What is AWS Step Functions? Explain Standard vs Express workflows and their appropriate use cases.

• What are AWS CloudFormation and CDK? What is the difference, and when should you use CDK instead of pure CloudFormation?

• What is AWS IAM? Explain the differences between IAM Users, Groups, Roles, and Policies. What are IAM security best practices?

• What are AWS KMS and Secrets Manager? Explain envelope encryption and when to use each service.

• What is Amazon CloudWatch? Explain Metrics, Logs, Alarms, Dashboards, and monitoring best practices.

• What is AWS X-Ray? Explain distributed tracing and how to instrument a Node.js/Lambda application with X-Ray.

• What are the pillars of the AWS Well-Architected Framework? Explain each pillar and its key best practices.

• How do you secure a web application on AWS end-to-end? (WAF, Shield, GuardDuty, Security Hub)

• What is Multi-AZ vs Multi-Region? When is multi-region needed, and what are the trade-offs in complexity and cost?

• Explain Disaster Recovery strategies on AWS: Backup & Restore, Pilot Light, Warm Standby, and Multi-Site Active-Active.

• What are serverless architecture patterns? Explain common patterns: API + Lambda, event-driven, and the saga pattern.

• What are AWS cost optimization strategies? How do you reduce your AWS bill by 30-50% without impacting performance?

• What are auto-scaling strategies on AWS? Explain Target Tracking, Step Scaling, Scheduled Scaling, and Predictive Scaling.

• What are Blue/Green and Canary deployments on AWS? Explain how to implement each strategy.

• What is the AWS Shared Responsibility Model? Who is responsible for what?

• What is the difference between a Region and an Availability Zone (AZ) in AWS?

• What is the difference between stopping and terminating an EC2 instance?

• What is an AMI (Amazon Machine Image)? What is it used for?

• To give an EC2 instance in a private subnet internet access: how do a NAT Gateway and a NAT instance differ?

• What is the difference between VPC Peering and Transit Gateway? When do you use each?

• What is the difference between an Elastic IP and an (auto-assigned) public IP?

• An app on EC2 needs to read files from S3. Why should you not embed access keys in code or environment variables?

• What is an S3 presigned URL? How would you design a user image upload flow with it?

• How long does CloudWatch Logs keep application logs by default? How do you set up alerting on errors?

• How do RDS Multi-AZ and read replicas differ? Does Multi-AZ help offload reads?

• A review turns up an IAM policy with `"Action": "s3:*"` and `"Resource": "*"`. What is wrong, and how do you tighten it?

• GitHub Actions CI/CD needs to deploy to AWS. How do you configure access without storing access keys in secrets?

• Your service sits behind an ALB, the target group reports `unhealthy`, yet the app responds fine when you SSH into the instance. How do you debug?

• Behind a load balancer, your app only logs internal IPs instead of the real client IP. Why, and how do you recover it?

• You put CloudFront in front of S3 for static assets. How do you block direct bucket access, and what do you do when users still get stale files after a deploy?

• A five-person team needs to run a Node.js API on AWS. Would you pick Lambda, ECS Fargate, or EC2, and on what criteria?

• For database passwords and API keys, do you choose Secrets Manager or SSM Parameter Store?

• A Lambda behind API Gateway intermittently returns 502 and 429, and p99 latency spikes to seconds. How do you analyze and fix it?

• After scaling the app to many containers, RDS starts returning "too many connections". What causes it and how do you fix it architecturally?

• A service in a private subnet calls S3 heavily and the NAT Gateway bill jumps. What does NAT Gateway charge for, and how do you optimize it?

• This month's AWS bill nearly doubled while user traffic barely changed. How do you investigate and cut it down?

• A role already has an `Allow s3:GetObject` policy but calls still return `AccessDenied`. In what order does AWS decide allow vs deny?