Question 1

What is Amazon EBS?

Accepted Answer

Elastic Block Store provides network-attached block storage volumes for EC2, presented as raw devices you format and mount. Volumes live in one Availability Zone, are replicated within it for durability, persist independently of the instance, and can be snapshotted and resized while in use. The zonal scope is the constraint that shapes design: a volume cannot be attached to an instance in another AZ, so a stateful workload pinned to an EBS volume is pinned to an AZ. Snapshots, which are stored in S3 regionally, are how you move data across AZs.

Question 2

What EBS volume types exist and how do you choose?

Accepted Answer

gp3 is the general-purpose default with baseline performance and independently provisionable IOPS and throughput. gp2 is the older type where performance scales with size. io2 and io2 Block Express provide high provisioned IOPS with higher durability for critical databases. st1 is throughput-optimised HDD for sequential workloads, sc1 is cold HDD for infrequent access. The gp2-to-gp3 migration is the concrete, low-risk saving worth naming — roughly 20% cheaper with IOPS decoupled from capacity, so you no longer over-provision storage just to get performance. That decoupling was a real cost distortion in gp2.

Question 3

What is the difference between EBS and instance store?

Accepted Answer

EBS is network-attached, persists independently of the instance, can be snapshotted, resized and reattached. Instance store is physically attached NVMe on the host with far higher IOPS and lower latency, but ephemeral — data is lost on stop, terminate or host failure. The rule is instance store only for scratch, cache, shuffle or replicated data that can be rebuilt. Suggesting a database's primary data on instance store without a replication story is the answer that fails this question.

Question 4

How do EBS snapshots work?

Accepted Answer

A snapshot is a point-in-time, incremental backup stored in S3 in the region — only blocks changed since the previous snapshot are stored, though each snapshot is independently restorable. Deleting an older snapshot does not break newer ones because AWS reorganises the referenced blocks. The incremental-but-independently-restorable property is what confuses people about deletion. The other detail is lazy loading on restore: a volume from a snapshot is available immediately but blocks are fetched on first access, so initial performance is degraded unless you use Fast Snapshot Restore or pre-warm.

Question 5

What is Fast Snapshot Restore?

Accepted Answer

FSR pre-initialises snapshots in specified Availability Zones so volumes created from them deliver full performance immediately, avoiding the lazy-loading penalty. It is charged per snapshot per AZ per hour while enabled. It matters for recovery-time objectives: without it, a restored database volume performs poorly for its first pass over the data, which can extend a recovery well beyond expectations. The hourly cost means you enable it for snapshots that are part of a DR plan rather than for everything.

Question 6

How do you resize an EBS volume?

Accepted Answer

Modify the volume to a larger size, which can be done online with no downtime, then extend the partition and filesystem inside the guest with growpart and resize2fs for ext4 or xfs_growfs for XFS. Volumes can only be grown, never shrunk. Stopping at the AWS-side modification is the half-answer that loses marks — the volume is bigger but the filesystem still reports the old size. To shrink, you create a smaller volume and copy the data, which is the constraint people discover too late.

Question 7

What is EBS Multi-Attach?

Accepted Answer

Multi-Attach lets an io1 or io2 volume attach to up to 16 Nitro-based instances in the same AZ simultaneously. It requires a cluster-aware filesystem or application that coordinates access, because the volume itself provides no locking — a normal filesystem mounted twice will corrupt. The clustered-filesystem requirement is the point: this is not a shared filesystem, it is shared block access. For applications that expect a normal shared filesystem, EFS is the right answer and Multi-Attach is a trap.

Question 8

What is Amazon EFS?

Accepted Answer

Elastic File System is managed NFS providing a POSIX filesystem that many EC2 instances, containers and Lambda functions can mount read-write simultaneously across Availability Zones. Capacity grows and shrinks automatically with no provisioning, and it is charged per GB stored. The multi-AZ, many-writer property is what distinguishes it from EBS and makes it the answer to "my application needs a shared filesystem". The trade-off is higher latency and cost per GB than EBS, since every operation is a network round trip.

Question 9

What EFS storage classes and throughput modes exist?

Accepted Answer

Storage classes are Standard, One Zone, and Infrequent Access variants of each, with lifecycle management moving files to IA after a period of no access and optionally back on access. Throughput modes are Elastic, which scales automatically and is the current default, Bursting, and Provisioned for consistently high throughput. The classic EFS problem was burst credit exhaustion: throughput scaled with stored data, so a small filesystem with heavy access ran out of credits and slowed dramatically. Elastic throughput removed that trap, and knowing it existed shows you have operated EFS before.

Question 10

What is Amazon FSx and which variants exist?

Accepted Answer

FSx provides managed third-party filesystems: FSx for Windows File Server with SMB and Active Directory integration; FSx for Lustre for high-performance computing with S3 integration; FSx for NetApp ONTAP with multi-protocol access and snapshots; and FSx for OpenZFS. FSx for Windows is the answer for lift-and-shift of Windows workloads needing SMB shares and AD authentication, which EFS cannot provide. FSx for Lustre linking to an S3 bucket, so data is loaded on demand and results written back, is the pattern for HPC and ML training.

Question 11

When would you choose S3, EBS, EFS or FSx?

Accepted Answer

S3 for object data accessed over an API — backups, assets, data lakes. EBS for a single instance needing block storage with low latency, such as a database. EFS when many instances need a shared POSIX filesystem. FSx when you need SMB and Active Directory, or a specialised high-performance filesystem. The question behind this is usually "my legacy application writes to a shared directory" — the answer is EFS or FSx, not S3, because those applications expect POSIX semantics like partial writes and file locking that object storage does not provide.

Question 12

What is AWS Storage Gateway?

Accepted Answer

Storage Gateway is a hybrid service presenting cloud storage through on-premises protocols: File Gateway offers NFS and SMB backed by S3, Volume Gateway offers iSCSI block volumes backed by S3 with EBS snapshots, and Tape Gateway presents a virtual tape library to existing backup software. Tape Gateway is the underrated one because it lets an organisation retire physical tape infrastructure without changing its backup software at all, which is often the cheapest possible modernisation step. Local caching for hot data is what makes the file variants usable.

Question 13

What is AWS Backup?

Accepted Answer

AWS Backup centralises backup policy across EBS, RDS, DynamoDB, EFS, FSx, EC2, S3, Storage Gateway and more, with backup plans defining schedule, retention, lifecycle to cold storage, cross-region and cross-account copy, and Vault Lock for immutability, plus compliance reporting. Vault Lock in compliance mode is the ransomware control: backups become immutable so even an attacker with full account access cannot delete them. Cross-account copy is the complementary control, since backups in the same account share the workload's blast radius.

Question 14

How would you design a backup strategy for a production workload?

Accepted Answer

Define RPO and RTO with the business first. Use AWS Backup plans matching those objectives, with cross-region and cross-account copies for the critical tiers, Vault Lock for compliance and ransomware resilience, lifecycle to cold storage for long retention, and — critically — a scheduled restore test that is actually executed and timed. The restore test is what most plans lack: an unverified backup is a hope, not a control, and restore time is frequently much longer than assumed. Naming that you would measure actual restore duration against the stated RTO is the mark of experience.

Question 15

What is the difference between a backup and a snapshot?

Accepted Answer

A snapshot is a point-in-time copy of a specific resource, managed per service. A backup in the AWS Backup sense is a policy-managed, catalogued copy with retention, lifecycle, cross-account copy and compliance reporting applied consistently across services. Technically many backups are snapshots underneath. The difference that matters operationally is governance: individually-managed snapshots drift, accumulate cost and are inconsistently retained, while a backup plan applies one policy across the estate and reports compliance. That consistency is the reason AWS Backup exists.

Question 16

How do you encrypt EBS volumes and what happens to snapshots?

Accepted Answer

Encryption uses KMS and covers the volume, its snapshots and any volumes created from them. It can be enabled by default per region and account. An unencrypted volume cannot be encrypted in place — you snapshot it, copy the snapshot with encryption, and create a new volume. The cannot-encrypt-in-place constraint makes encryption a day-one decision, and the account-level default setting is the control that stops anyone creating an unencrypted volume. Cross-account snapshot sharing also requires sharing the KMS key, which is the detail people miss.

Question 17

What are EBS performance characteristics you should know?

Accepted Answer

IOPS and throughput are provisioned or scale with size depending on type, but are also bounded by the instance's EBS bandwidth, which varies by instance size. So a large volume on a small instance is limited by the instance, not the volume. EBS-optimised instances have dedicated bandwidth for storage traffic. The instance-level ceiling is the fact that explains "we provisioned 20,000 IOPS and only get 6,000" — the instance type caps it. Checking both the volume and the instance limits is the diagnostic step that resolves most EBS performance complaints.

Question 18

How do you improve EBS performance for a database?

Accepted Answer

Choose io2 Block Express or gp3 with sufficient provisioned IOPS and throughput; pick an instance type with enough EBS bandwidth; use a filesystem and block size matched to the workload; consider RAID 0 across volumes for aggregate throughput, accepting increased failure exposure; and pre-warm volumes restored from snapshots. RAID 0 for throughput is worth naming with its caveat: it multiplies the chance of failure because any volume loss destroys the array, so it requires a solid replication and backup story. RAID 1 is generally unnecessary because EBS already replicates within the AZ.

Question 19

What is a Data Lifecycle Manager policy?

Accepted Answer

DLM automates the creation, retention and deletion of EBS snapshots and EBS-backed AMIs on a schedule, based on resource tags, including cross-region copy and fast snapshot restore. It replaces hand-rolled scripts for snapshot lifecycle. The tag-based targeting is what makes it scale: tag a volume with a backup policy tag and it is covered automatically, with no per-resource configuration. Without lifecycle automation, snapshots accumulate indefinitely and become a significant cost line.

Question 20

How do you move data between AZs and regions?

Accepted Answer

Between AZs, snapshot the EBS volume and create a new volume in the target AZ, or use EFS which is already multi-AZ. Between regions, copy the snapshot to the target region, or use S3 with cross-region replication, DataSync, or AWS Backup cross-region copy. The point to make is that EBS volumes themselves are immovable — everything goes through a snapshot. Naming the encryption implication for cross-region snapshot copy, where the target region needs its own KMS key, is the operational detail.

Question 21

What is Amazon FSx for Lustre and its S3 integration?

Accepted Answer

FSx for Lustre is a high-performance parallel filesystem for HPC and machine learning, capable of hundreds of gigabytes per second. Linked to an S3 bucket, it presents objects as files, loads data lazily on first access, and can export results back to S3, so the filesystem is a fast working layer over durable object storage. The lazy-load-and-export pattern is what makes it economical: you run the cluster and filesystem only for the duration of the job, with S3 as the persistent home. That ephemeral-compute-over-durable-storage shape is the same idea as ephemeral EMR clusters.

Question 22

How do you share files between ECS or Fargate tasks?

Accepted Answer

Mount an EFS filesystem as a volume in the task definition — supported on both EC2 and Fargate launch types — using EFS Access Points to enforce a specific path, user and permissions per application. Fargate ephemeral storage is not shared and is lost when the task stops. EFS Access Points are the detail worth naming because they enforce POSIX identity and a root directory per application, so one filesystem can serve several workloads without them seeing each other's data. That is how you avoid a filesystem per service.

Question 23

What are the durability and availability characteristics of these services?

Accepted Answer

S3 Standard offers eleven nines of durability across at least three AZs. EBS volumes are replicated within a single AZ with high durability but are AZ-scoped, so an AZ failure makes them unavailable. EFS Standard stores data across multiple AZs. One Zone variants of both S3 and EFS trade AZ redundancy for cost. The distinction between durability and availability is the substance: an EBS volume is durable but unavailable if its AZ is down, which is why snapshots and multi-AZ designs exist. One Zone classes are only appropriate for reproducible data.

Question 24

How do you handle storage for a stateful workload on Kubernetes?

Accepted Answer

Use the EBS CSI driver for single-writer persistent volumes, accepting that a zonal volume pins the pod to an AZ, or the EFS CSI driver for ReadWriteMany shared access across AZs. Use StatefulSets with volumeClaimTemplates for stable per-pod storage, and plan backup with AWS Backup or volume snapshots. The AZ pinning from a zonal EBS volume is the trap that quietly undermines a multi-AZ cluster — the pod cannot reschedule to another AZ. Naming that, and EFS as the alternative when cross-AZ rescheduling matters, is what shows real experience.

Question 25

What is the cost model for EBS and how do you reduce it?

Accepted Answer

Charged per provisioned GB-month regardless of use, plus provisioned IOPS and throughput above baseline on gp3 and io2, plus snapshot storage. Reduce it by deleting unattached volumes and orphaned snapshots, migrating gp2 to gp3, right-sizing over-provisioned volumes, and using lifecycle policies for snapshot retention. Unattached volumes are the classic silent waste — terminating an instance leaves additional volumes behind by default, and nobody notices. A scheduled report or Config rule flagging unattached volumes is the control that catches it.

Question 26

What is the difference between EFS Standard and One Zone?

Accepted Answer

EFS Standard stores data redundantly across multiple Availability Zones, so it survives an AZ failure. EFS One Zone stores data in a single AZ at significantly lower cost, and data is lost if that AZ is destroyed, so it suits development, reproducible data or workloads with their own replication. The recommendation is Standard for anything production-critical, One Zone for development environments and derived data. Pairing One Zone with AWS Backup to another AZ is the middle path when cost matters but total loss is unacceptable.

Question 27

How would you migrate a file server to AWS?

Accepted Answer

For Windows shares, FSx for Windows File Server joined to Active Directory, migrating data with DataSync which preserves ACLs and metadata. For Linux NFS, EFS with DataSync. For very large volumes or poor connectivity, Snowball. Cut over by repointing DNS after a final incremental sync. Preserving ACLs and metadata is the requirement that rules out a simple copy, and DataSync handling it is the reason to use the managed tool. The final incremental sync during a short freeze window is what keeps downtime minimal.

Question 28

What is the AWS Snow family?

Accepted Answer

Physical devices for data transfer and edge compute: Snowcone for small transfers and rugged edge use, and Snowball Edge in storage-optimised and compute-optimised variants for large transfers and disconnected processing. You load data locally and ship the device to AWS for ingest into S3. The decision is arithmetic: compute how long the transfer would take over available bandwidth, and if it exceeds a few weeks, shipping devices is faster. Naming the edge-compute use case — running processing at a remote site with no connectivity — shows breadth beyond migration.

Question 29

What is Vault Lock in AWS Backup and why does it matter?

Accepted Answer

Vault Lock enforces retention on a backup vault so backups cannot be deleted before their retention expires. In governance mode privileged users can override; in compliance mode, once the lock period passes, nobody including the root user can shorten retention or delete backups. Compliance mode is the control that survives a fully compromised account, which is the ransomware scenario worth designing for. The irreversibility is the operational risk, so it should be tested in a non-production vault before being applied broadly.

Question 30

How do you test a disaster recovery plan?

Accepted Answer

Execute it: restore backups into an isolated environment and validate the data; fail over to the secondary region in a scheduled exercise; and measure the actual recovery time against the stated RTO. Document what went wrong and fix it. Anything less leaves the objectives unverified. The line that matters is that an untested DR plan has an unknown recovery time, which is functionally the same as not having one. AWS Elastic Disaster Recovery is worth naming as the managed replication and drill tooling.

Question 31

What is AWS Elastic Disaster Recovery?

Accepted Answer

Elastic Disaster Recovery continuously replicates source servers — on-premises or cloud — into a low-cost staging area in AWS, and can launch them as EC2 instances in minutes for a drill or a real failover, with point-in-time recovery to earlier states. The staging-area model is what makes it cheap: you pay for lightweight storage and small replication instances rather than a running warm standby. Non-disruptive drills are the feature that makes DR testing practical rather than theoretical.

Question 32

What is the difference between RTO and RPO, and how do they drive storage design?

Accepted Answer

Recovery time objective is how long you can be down; recovery point objective is how much data you can afford to lose. A near-zero RPO requires synchronous or continuous replication. A short RTO requires warm or hot standby capacity and rehearsed procedures. Both cost money, so the business sets them. Mapping them to AWS options — snapshots for a long RTO, cross-region replication for a shorter one, Multi-AZ for near-zero RPO in region — turns the definitions into a design. Backup and restore, pilot light, warm standby and hot standby is the standard ladder.

Question 33

How do you protect storage against ransomware?

Accepted Answer

S3 versioning with MFA delete and Object Lock in compliance mode; AWS Backup with Vault Lock and cross-account copies into an account with a separate trust boundary; least-privilege on delete permissions with SCP guardrails; and monitoring for mass deletion or unusual encryption activity through GuardDuty and CloudTrail alarms. The cross-account copy is the control that matters most, because backups in the same account share the blast radius of a compromised credential. Compliance-mode immutability plus a separate account is the combination that actually holds.

Question 34

What is an AMI and how does it relate to snapshots?

Accepted Answer

An Amazon Machine Image is a template for launching instances, consisting of one or more EBS snapshots plus launch permissions and block device mapping. Deregistering an AMI does not delete its underlying snapshots, which continue to be billed. The orphaned-snapshot cost from deregistered AMIs is a very common source of unexplained EBS charges. Automating AMI and snapshot lifecycle with Data Lifecycle Manager or Image Builder is the control that prevents it accumulating.

Question 35

How do you monitor storage in AWS?

Accepted Answer

CloudWatch metrics for EBS volume read and write IOPS, throughput, queue length and burst balance; for EFS, throughput, IO limit percentage and client connections; for S3, request metrics and Storage Lens for organisation-wide usage. Alert on volume queue length, burst balance depletion and unexpected growth. Burst balance depletion on gp2 and older EFS modes is the metric that explains sudden unexplained slowness, and it is invisible unless you alert on it. Volume queue length is the direct indicator that a volume is the bottleneck rather than the application.

Question 36

What is a filesystem consistency concern when snapshotting a running volume?

Accepted Answer

A snapshot captures the volume as it is on disk, which may include partially-written data if the filesystem or application has buffered writes. For crash-consistent snapshots that is usually acceptable; for application-consistent snapshots you should flush and freeze the filesystem, or quiesce the application, before snapshotting. The distinction between crash-consistent and application-consistent is what interviewers are testing. AWS Backup with the Windows VSS integration, or a pre-script that flushes and freezes on Linux, is how you get application consistency in practice.

Question 37

How do you share data between an on-premises data centre and AWS?

Accepted Answer

Storage Gateway for protocol-level access to S3-backed storage with local caching; DataSync for scheduled or one-off bulk transfer with verification; FSx for NetApp ONTAP with SnapMirror for existing NetApp estates; or Direct Connect with EFS or FSx mounted directly if latency permits. The latency consideration is what usually rules out direct mounting: NFS over a WAN performs badly for metadata-heavy workloads. Local caching via Storage Gateway is the pattern that makes hybrid file access usable.

Question 38

What happens to EBS volumes when an instance is terminated?

Accepted Answer

The root volume is deleted by default because DeleteOnTermination is true; additional attached volumes default to false and survive. Instance store data is always lost. Snapshots taken earlier are stored independently and are unaffected. The differing default between root and additional volumes is what this question tests, and it is also the source of orphaned volumes accumulating cost. Setting DeleteOnTermination deliberately, and enabling termination protection on stateful instances, are the two guards.

Question 39

Design the storage architecture for a media processing platform on AWS.

Accepted Answer

Ingest via presigned S3 uploads into a Standard bucket with lifecycle tiering to IA and Glacier for masters. Processing on Fargate or EC2 with FSx for Lustre linked to S3 for high-throughput working storage, or EFS where shared POSIX access across many workers is needed. Outputs to a separate bucket served by CloudFront with Origin Access Control. AWS Backup with cross-account, Vault-Locked copies for the masters, versioning and Object Lock against accidental or malicious deletion, and lifecycle rules aborting incomplete multipart uploads. The closing scenario. The senior markers are choosing FSx for Lustre as an ephemeral working layer over durable S3 rather than storing everything on expensive fast storage, separating input and output buckets to prevent recursive processing, and protecting the irreplaceable masters differently from derived files.

AWS EBS, EFS, FSx & Backup Interview Questions and Answers

How to use this set