How many AWS interview questions should I actually prepare?

For a fresher or internship screen, the fundamentals, EC2, S3, IAM, VPC and RDS topics are enough — roughly 250 questions. For a mid-level cloud or DevOps role add Lambda, containers, messaging, CI/CD, monitoring and infrastructure as code. Senior and architect loops lean heavily on the architecture, high-availability, security, cost and troubleshooting sets, where the interviewer cares far more about how you reason through trade-offs than about recalling service limits.

Do I need an AWS certification to clear an AWS interview?

No, but it helps you get shortlisted, especially at service companies and AWS partners where certifications count towards partnership tier. Solutions Architect Associate maps closely to the junior and mid questions here; Solutions Architect Professional and the DevOps Engineer Professional map to the senior and architecture sets. A certification with no hands-on stories behind it is transparent in an interview, so build something small on the free tier and be ready to talk about it.

What is the most common reason candidates fail an AWS interview?

Answering from memorised definitions instead of from consequences. Anyone can say what a security group is; far fewer can say why a stateless NACL blocked their return traffic, or why an IAM policy that looks correct still returns AccessDenied. Every answer in this guide includes the consequence, because that is what separates a pass from a fail.

How is an AWS interview different from a GCP or Azure interview?

The service names differ but the reasoning is almost identical — networking, identity, storage classes, scaling and cost trade-offs all transfer. AWS interviews tend to push harder on IAM policy evaluation, VPC networking including the security group and NACL distinction, the multi-account model with Organizations and SCPs, and the breadth of the service catalogue. If you already know another cloud, learning the mapping explicitly is worth doing, because interviewers often ask for it directly.

Are these questions suitable for freshers with no cloud experience?

Yes. Every topic starts at junior level and there is a dedicated freshers set that assumes no prior cloud exposure. What you cannot skip is hands-on time — open a free-tier account, launch one EC2 instance, create one S3 bucket, deploy one Lambda function and one RDS database, and you will be able to answer the practical follow-ups that pure theory leaves you stranded on.

AWS Interview Questions and Answers (1003+, Freshers to Senior, 2026)

A sample from every topic. Open any topic above for the full set of answers on that service.

Junior level

What is AWS?

Answer: Amazon Web Services is the largest public cloud provider, offering more than two hundred services covering compute, storage, networking, databases, analytics, machine learning, security and developer tooling, delivered on demand and billed by consumption. It removes the need to buy and operate physical infrastructure.

Why interviewers ask this: Interviewers listen for consumption billing and on-demand provisioning rather than a list of services. Adding that AWS launched in 2006 with S3 and EC2 and has the largest market share and service catalogue of the major providers gives useful context.

Junior level

What is the difference between a Region, an Availability Zone and an Edge Location?

Answer: A Region is a separate geographic area such as ap-south-1 in Mumbai, containing multiple Availability Zones. An Availability Zone is one or more discrete data centres with independent power, cooling and networking, connected to other AZs in the region by low-latency links. An Edge Location is a CloudFront point of presence used for caching and for services like Route 53 and Global Accelerator.

Why interviewers ask this: The follow-up is always high availability: deploy across at least two AZs to survive a data-centre failure, and across regions for regional resilience and data residency. Noting that AZ identifiers like ap-south-1a map to different physical zones in different accounts — AWS shuffles them — is a strong detail.

Junior level

What is Amazon EC2?

Answer: EC2 provides resizable virtual servers in the cloud. You choose an instance type, an Amazon Machine Image, storage, networking and security groups, and you control the guest operating system upwards. Billing is per second for most Linux instances with a 60-second minimum, or per hour for some purchasing options.

Why interviewers ask this: The framing to give is IaaS with full OS control, which is what distinguishes it from ECS, Lambda or Beanstalk. Naming per-second billing and the 60-second minimum shows familiarity with the current pricing model rather than the original hourly one.

Junior level

What are the EC2 instance families and when do you use each?

Answer: General purpose (T, M) for balanced workloads and web servers; compute optimised (C) for CPU-bound work like batch processing and gaming servers; memory optimised (R, X, Z) for in-memory databases and caches; storage optimised (I, D, H) for high local IOPS or throughput; and accelerated computing (P, G, Inf, Trn) for GPU and ML workloads.

Why interviewers ask this: The naming convention is worth explaining — family letter, generation number, optional capability letters, then size — so m6i.large parses as general purpose, sixth generation, Intel, large. Knowing that Graviton instances carry a "g" and usually offer better price-performance is a strong practical detail.

Junior level

What is Amazon S3?

Answer: S3 is object storage. You store files as objects — up to 5 TB each — inside buckets with globally unique names, addressed by key over HTTP, with eleven nines of durability. It is used for backups, static assets, data lakes, logs and media, and it scales without you provisioning capacity.

Why interviewers ask this: The framing to give is object storage, not a filesystem: there are no real directories, and the slashes in a key are just characters that the console renders as folders. Candidates who describe S3 as a mounted disk usually stumble on the next question.

Mid level

What are the S3 storage classes?

Answer: Standard for frequent access; Intelligent-Tiering which moves objects automatically based on access patterns; Standard-Infrequent Access and One Zone-IA for less frequent access with a 30-day minimum; Glacier Instant Retrieval for archive with millisecond access; Glacier Flexible Retrieval for minutes-to-hours retrieval; and Glacier Deep Archive for the cheapest storage with hours-long retrieval and a 180-day minimum.

Why interviewers ask this: The traps to name are the minimum storage durations and the per-object retrieval fees — deleting an IA object after a week still bills 30 days. One Zone-IA is also worth flagging as the one class that loses data if its single AZ is destroyed, so it is only for reproducible data.

Junior level

What is Amazon EBS?

Answer: Elastic Block Store provides network-attached block storage volumes for EC2, presented as raw devices you format and mount. Volumes live in one Availability Zone, are replicated within it for durability, persist independently of the instance, and can be snapshotted and resized while in use.

Why interviewers ask this: The zonal scope is the constraint that shapes design: a volume cannot be attached to an instance in another AZ, so a stateful workload pinned to an EBS volume is pinned to an AZ. Snapshots, which are stored in S3 regionally, are how you move data across AZs.

Mid level

What EBS volume types exist and how do you choose?

Answer: gp3 is the general-purpose default with baseline performance and independently provisionable IOPS and throughput. gp2 is the older type where performance scales with size. io2 and io2 Block Express provide high provisioned IOPS with higher durability for critical databases. st1 is throughput-optimised HDD for sequential workloads, sc1 is cold HDD for infrequent access.

Why interviewers ask this: The gp2-to-gp3 migration is the concrete, low-risk saving worth naming — roughly 20% cheaper with IOPS decoupled from capacity, so you no longer over-provision storage just to get performance. That decoupling was a real cost distortion in gp2.

Junior level

What is a VPC?

Answer: A Virtual Private Cloud is a logically isolated virtual network in an AWS region where you define your own IP address range, subnets, route tables and gateways. It is regional — a VPC cannot span regions — and it contains subnets that each live in a single Availability Zone.

Why interviewers ask this: The regional scope is worth stating explicitly because it drives multi-region design: you need a VPC per region plus peering or Transit Gateway to connect them, unlike GCP where the VPC is global. That contrast comes up frequently.

Mid level

How do you plan CIDR ranges for a VPC?

Answer: Choose a private RFC 1918 range large enough for growth but non-overlapping with on-premises networks, partner networks and other VPCs you may ever peer with — typically a /16. Subnet it by AZ and tier, leaving room to add subnets. Remember AWS reserves five IP addresses in every subnet.

Why interviewers ask this: Overlapping CIDRs are effectively unfixable without renumbering, since peering and Transit Gateway both require uniqueness. Naming the five reserved addresses — network, VPC router, DNS, future use and broadcast — is the detail that shows you have sized a subnet properly.

Junior level

What is AWS IAM?

Answer: Identity and Access Management controls authentication and authorisation for AWS. It manages identities — users, groups and roles — and policies that define what actions are allowed or denied on which resources under which conditions. It is global rather than regional and is free to use.

Why interviewers ask this: The framing to give is that IAM answers "who can do what to which resource under what conditions", with conditions being the part candidates most often overlook. IAM being global means a user or role exists across all regions, unlike most other resources.

Junior level

What is the difference between an IAM user and an IAM role?

Answer: A user is a permanent identity with long-lived credentials — a password or access keys — usually representing a person or a legacy application. A role is an identity assumed temporarily by a trusted principal, delivering short-lived credentials through STS. Roles are the recommended mechanism for almost everything.

Why interviewers ask this: The reason roles are preferred is credential lifetime: assumed-role credentials expire automatically, so a leak has a bounded window, whereas an access key remains valid until someone notices and revokes it. Naming that as the security argument, rather than just "best practice", is what scores.

Mid level

What is AWS KMS?

Answer: Key Management Service creates and controls cryptographic keys used across AWS services and in your applications. Keys never leave KMS unencrypted, every use is logged in CloudTrail, access is controlled by key policies and IAM, and keys support automatic annual rotation.

Why interviewers ask this: The envelope encryption model is what to explain: KMS generates a data key, returns it in plaintext and encrypted form, your application encrypts with the plaintext key and stores the encrypted one alongside the data. That keeps large data encryption local and only key operations in KMS.

Senior level

What is the difference between an AWS managed key, a customer managed key and an AWS owned key?

Answer: AWS owned keys are used by a service across many accounts and are invisible to you. AWS managed keys are created by a service in your account, visible in KMS but with a policy you cannot change and rotation you cannot control. Customer managed keys are created by you, with a key policy, rotation setting, tags and full CloudTrail visibility.

Why interviewers ask this: The reason to use a customer managed key is control and revocability: you can disable it to render data unreadable, restrict which principals may use it, and audit every operation. The trade-off is a monthly key charge and per-request costs.

Junior level

What is Amazon RDS?

Answer: RDS is AWS's managed relational database service supporting MySQL, PostgreSQL, MariaDB, Oracle, SQL Server and Aurora. AWS handles provisioning, patching, backups, replication and failover while you keep standard SQL and normal client drivers. You do not get operating-system access.

Why interviewers ask this: The boundary to name is what you give up: no OS access, restricted parameter tuning, a supported subset of extensions and versions. That is precisely the trade-off that decides between RDS and self-managing a database on EC2.

Mid level

What is the difference between Multi-AZ and a read replica?

Answer: Multi-AZ maintains a synchronous standby in another AZ that serves no traffic and is failed over to automatically — it is a high-availability feature. A read replica replicates asynchronously, has its own endpoint, serves read queries, can be cross-region, and must be promoted manually — it is a scaling and DR feature.

Why interviewers ask this: This is the most-asked RDS question. The consequences to add: Multi-AZ gives near-zero RPO but no read capacity, while a read replica adds read capacity but has replication lag, so reads that must reflect a just-completed write cannot go to it.

Junior level

What is DynamoDB?

Answer: DynamoDB is a fully managed, serverless key-value and document database offering single-digit millisecond latency at any scale, with automatic replication across three Availability Zones, no servers to manage, and capacity that can scale on demand. It is accessed over an API rather than a SQL connection.

Why interviewers ask this: The framing to lead with is that it trades query flexibility for guaranteed performance at scale: latency stays flat whether the table holds a thousand items or a billion, because every access is a key lookup rather than a scan.

Junior level

What is a partition key and a sort key?

Answer: The partition key determines which physical partition an item lives on, via a hash of its value. The sort key orders items within a partition and enables range queries. Together they form the primary key, which must be unique. A table can have a partition key alone, or a composite key of both.

Why interviewers ask this: The design consequence is that all items sharing a partition key are stored together and can be retrieved with one efficient Query, ordered by sort key. That single fact drives every DynamoDB data model, including single-table design.

Junior level

What is AWS Lambda?

Answer: Lambda runs your code in response to events without you provisioning or managing servers. You upload a function as a zip or container image, choose a runtime and memory, and Lambda handles provisioning, scaling from zero to thousands of concurrent executions, and availability. You are billed per request and per GB-second of execution.

Why interviewers ask this: The framing to give is event-driven compute with no idle cost. Naming that CPU scales proportionally with configured memory — you cannot set them independently — is the detail that shapes almost every Lambda performance and cost decision.

Mid level

How does Lambda concurrency work?

Answer: Each concurrent execution handles exactly one request at a time — unlike a container that serves many. Concurrency is the number of executions running simultaneously, bounded by an account-level limit per region, defaulting to 1,000 and raisable. Lambda scales by adding execution environments up to that limit.

Why interviewers ask this: The one-request-per-environment model is the single most important difference from Cloud Run or a container service, and it drives cost: an I/O-bound function pays for wall-clock time it spends waiting. That is why heavy I/O sometimes belongs in a container instead.

Junior level

What is Amazon API Gateway?

Answer: API Gateway is a managed service for creating, publishing, securing and monitoring APIs at any scale. It handles request routing, authorisation, throttling, caching, request and response transformation, and integrates with Lambda, HTTP backends, and AWS services directly.

Why interviewers ask this: The framing to give is that it moves cross-cutting concerns — authentication, rate limiting, validation, throttling — out of application code into the platform. That is what distinguishes it from putting a load balancer in front of a service.

Mid level

What is the difference between REST, HTTP and WebSocket APIs?

Answer: REST APIs are the full-featured original with request validation, transformation via mapping templates, caching, usage plans, API keys and WAF. HTTP APIs are newer, significantly cheaper and lower latency, with JWT authorisers and a simpler feature set. WebSocket APIs maintain persistent bidirectional connections for real-time applications.

Why interviewers ask this: The selection rule is to default to HTTP APIs for cost and latency, and use REST APIs only when you need a specific feature they lack — caching, usage plans with API keys, request validation with models, or direct AWS service integrations with transformation.

Junior level

What is Amazon SQS?

Answer: SQS is a fully managed message queue. Producers send messages, consumers poll and receive them, and the message stays hidden but not deleted until the consumer explicitly deletes it. It decouples components in time and scale — the producer does not wait for the consumer, and a slow consumer does not block production.

Why interviewers ask this: The delete-after-processing model is the important mechanic: receiving a message does not remove it, so a consumer that crashes mid-processing causes the message to reappear after the visibility timeout. That is what makes SQS reliable and why idempotency is required.

Mid level

What is the difference between a standard and a FIFO queue?

Answer: Standard queues offer nearly unlimited throughput, at-least-once delivery and best-effort ordering. FIFO queues guarantee exactly-once processing within a deduplication window and strict ordering within a message group, at lower throughput — though high-throughput mode raises that considerably.

Why interviewers ask this: The message group ID is the key concept: ordering is per group, so choosing groups at the right granularity — per customer or per entity rather than one global group — is what preserves both ordering and parallelism. A FIFO queue with one group processes strictly serially.

Junior level

What is Amazon ECS?

Answer: Elastic Container Service is AWS's native container orchestrator. You define tasks in a task definition, run them as standalone tasks or as a service that maintains a desired count behind a load balancer, on either EC2 capacity you manage or Fargate serverless capacity. It integrates directly with IAM, VPC, ALB and CloudWatch.

Why interviewers ask this: The framing to give is that ECS trades Kubernetes's portability and ecosystem for a much simpler operational model with deep AWS integration. That is a legitimate engineering trade-off, and saying so is better than treating Kubernetes as automatically superior.

Mid level

What is the difference between ECS and EKS?

Answer: ECS is AWS-proprietary, simpler to operate, with no control plane to manage and native AWS integration. EKS is managed Kubernetes — you get the full Kubernetes API, ecosystem and portability, at the cost of more concepts, a control-plane charge, version upgrades and a steeper learning curve.

Why interviewers ask this: The decision criterion is team and portability, not capability: choose EKS if you have Kubernetes expertise, need its ecosystem, or want workloads portable across clouds; choose ECS if the team is small and everything is on AWS. Naming the control-plane hourly charge for EKS is the concrete cost difference.

Mid level

What is Amazon Redshift?

Answer: Redshift is AWS's managed data warehouse: a columnar, massively parallel processing database where data is distributed across compute nodes and queries run in parallel across slices. It is optimised for analytical queries scanning large volumes rather than for transactional workloads.

Why interviewers ask this: The columnar plus MPP combination is what makes it fast for aggregation over billions of rows and poor for single-row lookups. Naming RA3 nodes with managed storage, which separates compute from storage, is the detail that shows current knowledge.

Senior level

What is a distribution style in Redshift and why does it matter?

Answer: The distribution style determines how rows are spread across nodes. KEY distributes by the hash of a column, co-locating rows with the same value so joins on that column happen locally. ALL replicates the whole table to every node, suited to small dimensions. EVEN round-robins. AUTO lets Redshift choose and adapt.

Why interviewers ask this: Choosing the join key as the distribution key for the two largest tables avoids redistribution, which is the single biggest Redshift performance lever. A poor choice causes data to be shuffled across the network on every join, which is what makes queries slow.

Mid level

What is Amazon SageMaker?

Answer: SageMaker is AWS's managed machine-learning platform covering the whole lifecycle: Studio for development, Data Wrangler and Processing for data preparation, Feature Store, training jobs with automatic model tuning, a model registry, endpoints for real-time and batch inference, Pipelines for orchestration, and Model Monitor for drift.

Why interviewers ask this: The value to name is that it removes infrastructure management from each lifecycle stage — training clusters are provisioned and torn down per job rather than run continuously. That per-job model is what makes it cheaper than a standing GPU cluster for intermittent training.

Senior level

What is the difference between real-time, serverless, asynchronous and batch inference?

Answer: A real-time endpoint serves low-latency requests from always-running instances you pay for continuously. Serverless inference scales to zero and bills per invocation, suiting intermittent traffic with tolerance for cold starts. Asynchronous inference queues requests for large payloads or long processing. Batch transform runs over a dataset and terminates.

Why interviewers ask this: The cost consequence is the practical point: a model used only for nightly scoring should use batch transform, not a persistent endpoint. Naming that a persistent endpoint bills continuously regardless of traffic is what makes the selection concrete.

Junior level

What is Amazon CloudWatch?

Answer: CloudWatch is AWS's monitoring and observability service: metrics with dashboards and alarms, Logs with search and Insights queries, Events via EventBridge, Synthetics for canaries, RUM for real-user monitoring, and Application Signals for automatic service-level monitoring.

Why interviewers ask this: The framing to give is that it is the default telemetry layer every AWS service publishes into, so you get baseline metrics with no instrumentation. Application-level detail still needs custom metrics or an agent, which is the gap people underestimate.

Mid level

What is the difference between metrics, logs and traces?

Answer: Metrics are numeric time series — cheap to store, good for dashboards and alerting, but cannot explain a single request. Logs are discrete records with detail, good for investigating a specific event but expensive at volume. Traces follow one request across services, showing where time was spent.

Why interviewers ask this: The way to use them together is the substance: alert on metrics because they are cheap and aggregate, use traces to find which service is slow, then logs to find out why. Reaching for logs first for every problem is a slow and expensive workflow.

Junior level

What is AWS CloudFormation?

Answer: CloudFormation is AWS's native infrastructure-as-code service. You describe resources in a YAML or JSON template and it creates, updates and deletes them as a stack, resolving dependencies, tracking state, and rolling back automatically on failure.

Why interviewers ask this: Automatic rollback on failed create or update is a genuine advantage over some alternatives — a failed update returns the stack to its previous state without you intervening. The trade-off versus Terraform is multi-cloud support and ecosystem, which is the standard follow-up.

Mid level

What are the main sections of a CloudFormation template?

Answer: Resources is the only required section. Parameters take input at deploy time, Mappings provide lookup tables such as region-to-AMI, Conditions control whether resources are created, Outputs export values for other stacks or for humans, Metadata carries extra information, and Transform enables macros such as SAM.

Why interviewers ask this: Conditions are the section people underuse — they let one template serve several environments by creating a Multi-AZ database only in production, for example. Outputs with Export are the mechanism for cross-stack references, which is the next question.

Junior level

What are the AWS developer tools for CI/CD?

Answer: CodePipeline orchestrates stages and actions; CodeBuild runs build and test in managed containers; CodeDeploy deploys to EC2, on-premises servers, ECS and Lambda with in-place or blue/green strategies; CodeArtifact hosts package repositories; and CodeConnections links to GitHub, GitLab and Bitbucket.

Why interviewers ask this: The honest framing is that many teams use GitHub Actions or GitLab for build and test and CodeDeploy or CodePipeline only for the deployment half, because the developer experience of the AWS tools is weaker. Being able to say that rather than presenting them as the obvious choice is a credible position.

Mid level

What is a buildspec file?

Answer: buildspec.yml defines what CodeBuild does: phases for install, pre_build, build and post_build, environment variables including references to Parameter Store and Secrets Manager, artifacts to output, cache configuration, and reports for test results.

Why interviewers ask this: Caching dependencies between builds is usually the largest speed win and is configured here. Referencing secrets by parameter rather than as plain environment variables is the security detail, since plain values appear in the build configuration.

YAML

phases:
  install:
    runtime-versions: {nodejs: 22}
  build:
    commands:
      - npm ci && npm test
cache:
  paths: ['node_modules/**/*']

Mid level

What does DevOps mean to you?

Answer: Shared ownership of software from commit to production — developers accountable for how their code runs, and platform engineers building the automation that makes that safe. In practice it shows up as automated delivery, infrastructure as code, observability owned by the team writing the code, and a blameless culture around failure.

Why interviewers ask this: The answer to avoid is "DevOps is a role that does CI/CD". Interviewers listen for cultural and organisational components alongside tooling, and naming the four DORA metrics as how you would measure it is a strong close.

Mid level

What is a container image layer and why does layer order matter?

Answer: An image is built from stacked read-only layers, one per instruction, cached and reused across builds. Order matters because changing one layer invalidates every layer after it — so you copy dependency manifests and install dependencies before copying application source.

Why interviewers ask this: This single optimisation turns a two-minute rebuild into ten seconds. The security corollary is that deleting a file in a later layer does not remove it from the image, so a secret baked into an early layer remains recoverable.

Dockerfile

COPY package*.json ./
RUN npm ci --omit=dev
COPY . .

Junior level

What is high availability and how is it achieved on AWS?

Answer: High availability is designing so the system keeps working when a component fails — no single points of failure, redundant instances across Availability Zones behind a load balancer, health checks and automatic replacement, and managed services with built-in redundancy such as Multi-AZ RDS and S3.

Why interviewers ask this: The capacity point is what candidates miss: with three AZs you should be able to serve peak on two, which means running at roughly 150% of single-AZ need. Otherwise an AZ failure produces a capacity outage rather than a graceful degradation.

Mid level

What is the difference between RTO and RPO?

Answer: Recovery time objective is how long you can be down; recovery point objective is how much data you can afford to lose. A near-zero RPO requires synchronous or continuous replication, which constrains geography and adds write latency. A short RTO requires standby capacity and rehearsed procedures.

Why interviewers ask this: Both cost money, so the business sets them rather than engineering. Mapping them to AWS options — Multi-AZ RDS for near-zero in-region RPO, cross-region replicas for a non-zero RPO with regional protection — turns definitions into a design.

Junior level

How does AWS billing work?

Answer: Charges accrue per service by usage — compute per second or hour, storage per GB-month, requests per million, and data transfer out per GB. Consolidated billing under an Organizations management account aggregates member accounts and shares volume discount tiers and commitment benefits across them.

Why interviewers ask this: Two facts worth naming: data transfer in is generally free while out is charged, and cross-AZ traffic within a region is charged in both directions. The second is an invisible cost in multi-AZ architectures that people rarely account for.

Mid level

What is the difference between Savings Plans and Reserved Instances?

Answer: Reserved Instances commit to a specific instance configuration in a region or AZ. Savings Plans commit to an hourly spend amount: Compute Savings Plans apply across instance family, size, region, tenancy, and to Fargate and Lambda; EC2 Instance Savings Plans are cheaper but locked to a family and region.

Why interviewers ask this: Compute Savings Plans are the current default recommendation because flexibility protects you against stranded commitment when the architecture changes. Naming that they cover Fargate and Lambda is the detail that makes them attractive to a modernising estate.

Mid level

What are the migration strategies, the "7 Rs"?

Answer: Rehost (lift and shift), replatform (lift and optimise, such as moving a database to RDS), repurchase (move to a SaaS product), refactor or re-architect (redesign for cloud-native), relocate (move VMware workloads without conversion), retain (leave it where it is for now) and retire (decommission what nobody uses).

Why interviewers ask this: The valuable part is knowing retire and retain are real answers rather than failures. In most portfolio assessments a meaningful share of applications turn out to be unused or not worth moving, and identifying those early is the cheapest win in the programme.

Senior level

How do you decide which strategy applies to a given application?

Answer: Assess business value, technical fit and change appetite against the deadline. Rehost when a data-centre exit date forces speed and the application works as is. Replatform when a managed service removes real operational burden for limited change. Refactor when the application is strategically important and its architecture blocks the business. Repurchase for commodity functions.

Why interviewers ask this: The driver to name explicitly is the deadline: a hard exit date forces rehost first and modernisation later. Attempting to refactor everything during a time-boxed exit is the classic way these programmes overrun.

Senior level

How do you approach an open-ended AWS design question?

Answer: Clarify requirements before designing: expected scale, latency targets, availability and recovery objectives, data residency and compliance, budget, team skills, and what already exists. Then state assumptions, sketch a high-level design, and go deeper where probed, naming trade-offs at each decision rather than presenting one answer as obviously correct.

Why interviewers ask this: The most common failure is naming services in the first thirty seconds. Asking two or three sharp questions — "what is the read to write ratio?", "is that 99.99% a hard requirement or an aspiration?" — is worth more than any specific architecture.

Senior level

What are the Well-Architected pillars and how do you use them in a design answer?

Answer: Operational excellence, security, reliability, performance efficiency, cost optimisation and sustainability. Use them as axes for evaluating a design, and name explicitly which pillar you are trading away in a given decision — because improving one usually costs something on another.

Why interviewers ask this: Using the framework as a structure prevents presenting a technically elegant design that is operationally unmaintainable. Naming the trade-off rather than claiming a design is optimal on every axis is what a senior interviewer wants to hear.

Mid level

How do you approach a production incident you have never seen before?

Answer: Stabilise first, diagnose second. Establish scope — which users, which region, which service. Look for a recent change, because most incidents follow a deployment or configuration change, and roll back if one correlates. Then work down the stack from user symptom to component using dashboards and traces, communicating status while you work.

Why interviewers ask this: The single most valuable habit is "what changed?", which resolves the majority of incidents faster than root-cause analysis. Interviewers listen for whether you restore service before fully understanding it, which is the correct priority.

Senior level

An ALB returns 502 but the target responds fine when you curl it directly. What is wrong?

Answer: Check target group health first — the health check path, port, protocol and expected status code, and whether the security group allows the load balancer to reach the target port. Then check for a keepalive mismatch, where the target closes idle connections faster than the load balancer expects, producing intermittent 502s.

Why interviewers ask this: The keepalive mismatch is the subtle cause: the target's idle timeout must exceed the load balancer's, or the ALB sends a request on a connection the target is closing. That produces intermittent, hard-to-reproduce 502s that look like nothing is wrong.

Junior level

What is cloud computing?

Answer: Cloud computing is the delivery of computing resources — servers, storage, databases, networking, software — over the internet, on demand, paid for by usage rather than bought up front. Instead of buying and running hardware you rent capacity from a provider and scale it as needed.

Why interviewers ask this: A good fresher answer names the shift from capital to operating expenditure, and from weeks to provision a server to seconds. Adding a concrete example — "we can launch a virtual machine in a minute instead of ordering hardware" — makes it real rather than recited.

Junior level

What are the main benefits of using AWS?

Answer: Elasticity — scale up for a spike and back down after; pay for what you use rather than for peak capacity; global reach without building data centres; managed services that remove operational work; faster time to market; and built-in reliability through multiple Availability Zones.

Why interviewers ask this: Interviewers value honesty about trade-offs: less control, potential lock-in, and the fact that cloud can be more expensive than on-premises for a steady, fully-utilised workload. Naming one downside makes the answer far more credible.

AWS Interview Questions and Answers

All 25 topics

Which interviews is this for?

50 of the most-asked AWS interview questions

What is AWS?

What is the difference between a Region, an Availability Zone and an Edge Location?

What is Amazon EC2?

What are the EC2 instance families and when do you use each?

What is Amazon S3?

What are the S3 storage classes?

What is Amazon EBS?

What EBS volume types exist and how do you choose?

What is a VPC?

How do you plan CIDR ranges for a VPC?

What is AWS IAM?

What is the difference between an IAM user and an IAM role?

What is AWS KMS?

What is the difference between an AWS managed key, a customer managed key and an AWS owned key?

What is Amazon RDS?

What is the difference between Multi-AZ and a read replica?

What is DynamoDB?

What is a partition key and a sort key?

What is AWS Lambda?

How does Lambda concurrency work?

What is Amazon API Gateway?

What is the difference between REST, HTTP and WebSocket APIs?

What is Amazon SQS?

What is the difference between a standard and a FIFO queue?

What is Amazon ECS?

What is the difference between ECS and EKS?

What is Amazon Redshift?

What is a distribution style in Redshift and why does it matter?

What is Amazon SageMaker?

What is the difference between real-time, serverless, asynchronous and batch inference?

What is Amazon CloudWatch?

What is the difference between metrics, logs and traces?

What is AWS CloudFormation?

What are the main sections of a CloudFormation template?

What are the AWS developer tools for CI/CD?

What is a buildspec file?

What does DevOps mean to you?

What is a container image layer and why does layer order matter?

What is high availability and how is it achieved on AWS?

What is the difference between RTO and RPO?

How does AWS billing work?

What is the difference between Savings Plans and Reserved Instances?

What are the migration strategies, the "7 Rs"?

How do you decide which strategy applies to a given application?

How do you approach an open-ended AWS design question?

What are the Well-Architected pillars and how do you use them in a design answer?

How do you approach a production incident you have never seen before?

An ALB returns 502 but the target responds fine when you curl it directly. What is wrong?

What is cloud computing?

What are the main benefits of using AWS?

AWS interview FAQs

How many AWS interview questions should I actually prepare?

Do I need an AWS certification to clear an AWS interview?

What is the most common reason candidates fail an AWS interview?

How is an AWS interview different from a GCP or Azure interview?

Are these questions suitable for freshers with no cloud experience?

Prepared? Now find the role.