Question 1

What is Amazon EC2?

Accepted Answer

EC2 provides resizable virtual servers in the cloud. You choose an instance type, an Amazon Machine Image, storage, networking and security groups, and you control the guest operating system upwards. Billing is per second for most Linux instances with a 60-second minimum, or per hour for some purchasing options. The framing to give is IaaS with full OS control, which is what distinguishes it from ECS, Lambda or Beanstalk. Naming per-second billing and the 60-second minimum shows familiarity with the current pricing model rather than the original hourly one.

Question 2

What are the EC2 instance families and when do you use each?

Accepted Answer

General purpose (T, M) for balanced workloads and web servers; compute optimised (C) for CPU-bound work like batch processing and gaming servers; memory optimised (R, X, Z) for in-memory databases and caches; storage optimised (I, D, H) for high local IOPS or throughput; and accelerated computing (P, G, Inf, Trn) for GPU and ML workloads. The naming convention is worth explaining — family letter, generation number, optional capability letters, then size — so m6i.large parses as general purpose, sixth generation, Intel, large. Knowing that Graviton instances carry a "g" and usually offer better price-performance is a strong practical detail.

Question 3

What are T-series burstable instances and how do CPU credits work?

Accepted Answer

T-family instances provide a baseline CPU level and accumulate CPU credits while running below it, spending credits to burst above baseline. When credits are exhausted the instance is throttled to baseline. Unlimited mode allows sustained bursting for an additional charge instead of throttling. The failure mode to name is a production workload on a T instance that exhausts credits and becomes mysteriously slow — CPU utilisation looks low because the instance is being throttled. Monitoring CPUCreditBalance is the specific alarm that catches it.

Question 4

What are the EC2 purchasing options?

Accepted Answer

On-Demand with no commitment at the highest rate; Reserved Instances committing to a specific configuration for one or three years; Savings Plans committing to an hourly spend amount for one or three years with more flexibility; Spot Instances using spare capacity at up to 90% off but interruptible with a two-minute warning; and Dedicated Hosts or Instances for physical isolation and licensing. The comparison that matters is Savings Plans versus Reserved Instances: Compute Savings Plans apply across instance family, size, region, and even to Fargate and Lambda, which makes them far more resilient to architectural change. Recommending them as the default commitment is the current best practice.

Question 5

What is the difference between Standard and Convertible Reserved Instances?

Accepted Answer

Standard RIs give the deepest discount but can only be modified within limits — you can change AZ, size within a family, and networking type, but not the instance family. Convertible RIs discount less but can be exchanged for a different family, OS or tenancy during the term. Savings Plans have largely superseded both because they offer similar flexibility with a simpler model. Saying that, while still knowing the RI distinctions, shows currency rather than reciting older material.

Question 6

How do Spot Instances work and when are they appropriate?

Accepted Answer

Spot uses spare EC2 capacity at a large discount, and AWS reclaims the instance with a two-minute interruption notice when capacity is needed or the price exceeds your maximum. They suit fault-tolerant, restartable work: batch processing, CI runners, rendering, big data, and stateless web tiers behind a load balancer with on-demand baseline capacity. The design requirement is handling the interruption notice — checkpoint progress, drain connections, deregister from the load balancer. Naming capacity-optimized allocation strategy and diversifying across instance types and AZs is what actually reduces interruption rates in practice.

Question 7

What is an EC2 Auto Scaling group?

Accepted Answer

An ASG maintains a desired number of instances launched from a launch template, spread across the AZs and subnets you specify, replacing instances that fail health checks and scaling in response to policies. It integrates with load balancers and can mix on-demand and spot capacity. The health check choice is the detail to name: an ASG using only EC2 status checks replaces instances that are hardware-unhealthy, while ELB health checks also catch an application that is running but not serving. Production groups should use ELB health checks.

Question 8

What Auto Scaling policies exist and which would you use?

Accepted Answer

Target tracking maintains a metric at a target value — for example average CPU at 60% or requests per target — and is the recommended default. Step scaling adds or removes a defined number of instances at metric thresholds. Simple scaling is the older single-adjustment form. Scheduled scaling changes capacity at known times. Predictive scaling uses machine learning to pre-scale for forecast demand. Target tracking is the right default because it computes the adjustment for you and handles both directions. Predictive scaling is worth naming for workloads with a strong daily pattern, since reactive scaling always lags the spike by the instance boot time.

Question 9

What is a launch template and how does it differ from a launch configuration?

Accepted Answer

A launch template defines instance configuration — AMI, instance type, key pair, security groups, IAM instance profile, user data, block device mappings — and supports versioning, mixed instance policies, and newer features. Launch configurations are the older, immutable, non-versioned predecessor and are now deprecated for new use. The version support is the practical advantage: you can update a template, point the ASG at the new version and start an instance refresh, with the previous version available for rollback. Mixed instance policies, which combine spot and on-demand across several types, require a template.

Question 10

What is an instance refresh?

Accepted Answer

An instance refresh rolls out a new launch template version across an Auto Scaling group, replacing instances gradually while respecting a minimum healthy percentage and an instance warmup period, with the option to check a health signal and roll back automatically on failure. It is the ASG equivalent of a rolling deployment, and the warmup period is what prevents the group replacing instances faster than they can become useful. Without it, a refresh can take out capacity while replacements are still booting.

Question 11

What is an AMI and how do you manage them?

Accepted Answer

An Amazon Machine Image is a template containing the OS, installed software and configuration used to launch instances. You maintain them by building golden images with a pipeline — EC2 Image Builder or Packer — on a regular cadence so patches are baked in, and deprecating old versions so nobody launches from a stale image. The immutable-infrastructure argument is the one to make: baking the image and replacing instances is more reliable than patching running servers, because every instance matches a tested artefact. Naming EC2 Image Builder as the managed pipeline shows you know the AWS-native option.

Question 12

What is EC2 user data and how does it differ from a custom AMI?

Accepted Answer

User data is a script passed at launch and executed by cloud-init on first boot, used to install packages and fetch configuration. A custom AMI bakes that work into the image ahead of time. User data is flexible and easy to change; a baked AMI boots far faster and is reproducible. The rule is bake what is stable, script what is environment-specific. Long user-data scripts are a common cause of autoscaling that is too slow to respond to a spike, because every new instance repeats minutes of installation.

Question 13

What is the EC2 instance metadata service and what is IMDSv2?

Accepted Answer

The instance metadata service is an HTTP endpoint at 169.254.169.254 exposing instance metadata, user data and temporary credentials for the attached IAM role. IMDSv2 requires a session token obtained by a PUT request before any metadata read, which defeats server-side request forgery attacks that could otherwise steal role credentials. IMDSv2 should be enforced — set HttpTokens to required — because the SSRF-to-credential-theft path via IMDSv1 caused real, well-publicised breaches. Knowing that it is enforceable at the instance level and via an account-wide default is the practical control.

Question 14

What is an IAM instance profile?

Accepted Answer

An instance profile is a container for an IAM role that can be attached to an EC2 instance, so applications on that instance obtain temporary credentials from the metadata service automatically. It removes the need to store long-lived access keys on the instance. The security point to volunteer is that hardcoded access keys on an instance are the classic AWS credential leak, and an instance profile eliminates them entirely with automatically-rotated short-lived credentials. That is the single most important EC2 security practice.

Question 15

What is a placement group and what types exist?

Accepted Answer

Cluster packs instances close together in one AZ for the lowest network latency and highest throughput, suited to HPC. Spread places instances on distinct underlying hardware, up to seven per AZ, to minimise correlated failure. Partition divides instances into partitions on separate racks, used by large distributed systems like HDFS and Cassandra. The trade-off in a cluster group is that low latency comes with correlated failure risk, since everything is in one AZ on adjacent hardware. Spread and partition trade some network performance for fault isolation, which is the axis interviewers want you to articulate.

Question 16

What are EC2 instance states and what does each cost?

Accepted Answer

Running incurs compute charges. Stopped incurs no compute charge but you still pay for attached EBS volumes and any Elastic IP that is not attached to a running instance. Terminated releases everything, deleting root volumes by default. Hibernated saves memory to the root volume and charges for that storage. The "why is my bill not zero after stopping everything" question is answered by EBS and idle Elastic IPs, and naming both is the point. Hibernation is worth knowing because it preserves in-memory state across a stop, avoiding a long application warm-up.

Question 17

What happens to data when an EC2 instance is stopped or terminated?

Accepted Answer

On stop, EBS volumes persist and instance store volumes are lost. On terminate, the root EBS volume is deleted by default because DeleteOnTermination is true, additional EBS volumes default to persisting, and instance store data is always lost. The differing default between root and additional volumes is exactly what this question tests. Enabling termination protection and setting DeleteOnTermination to false on stateful volumes are the two guards worth naming.

Question 18

What is the difference between EBS and instance store?

Accepted Answer

EBS is network-attached block storage that persists independently of the instance, can be snapshotted, resized and reattached. Instance store is physically attached NVMe or SSD on the host, offering much higher IOPS and lower latency but ephemeral — data is lost on stop, terminate or host failure. The rule is instance store only for scratch, cache, shuffle or replicated data that can be rebuilt. Suggesting a database's primary data on instance store without a replication story is the answer that fails this question.

Question 19

How do you connect to an EC2 instance without opening port 22?

Accepted Answer

Use Systems Manager Session Manager, which brokers a shell through the SSM agent making outbound calls, so no inbound port is open, no key pair is needed, access is controlled by IAM and every session can be logged to S3 or CloudWatch. EC2 Instance Connect Endpoint is the alternative for SSH without a public IP. The comparison to make is with a bastion host, which you must patch, monitor and secure and which becomes a high-value target. Session Manager removes it entirely and gives per-identity audit, which is a substantial security improvement.

Question 20

How do you patch a fleet of EC2 instances?

Accepted Answer

Either with Systems Manager Patch Manager, using patch baselines and maintenance windows with compliance reporting, or by rebuilding immutable golden AMIs and rolling the Auto Scaling group onto the new version with an instance refresh. The immutable approach is preferable where the workload allows. Stating a preference with a reason is what makes this a senior answer: immutable rebuild guarantees the fleet matches a tested artefact, while in-place patching leaves each instance with a unique history. Patch Manager remains right for long-lived stateful servers.

Question 21

What is EC2 Auto Recovery?

Accepted Answer

Auto recovery restarts an impaired instance on new underlying hardware, preserving instance ID, private IP, Elastic IP and EBS volumes, when a CloudWatch status check fails due to a host problem. It is enabled by default on most current instance types. The limitation to name is that it recovers from *host* failures, not from an operating system or application failure — the instance comes back with the same problem if the issue is inside the guest. For that, an ASG with ELB health checks is the right mechanism.

Question 22

What is the difference between EC2 status checks?

Accepted Answer

The system status check monitors the underlying AWS infrastructure — host, network, power — and a failure usually requires AWS action or a stop-start to move to new hardware. The instance status check monitors the instance itself — network configuration, kernel, exhausted memory — and a failure is your responsibility to fix. Knowing which check maps to which responsibility is what makes triage fast: a system check failure means stop and start the instance to migrate it, while an instance check failure means log in and investigate the guest.

Question 23

What is a dedicated host versus a dedicated instance?

Accepted Answer

A Dedicated Instance runs on hardware not shared with other AWS accounts but you have no visibility or control over placement. A Dedicated Host gives you the physical server itself, with visibility of sockets and cores and control over instance placement, which is what per-physical-core software licensing requires. The licensing driver is the practical reason Dedicated Hosts exist — bring-your-own Windows Server or Oracle licences counted per physical core. Naming that specific requirement is more useful than the isolation framing alone.

Question 24

What is EC2 Fleet and Spot Fleet?

Accepted Answer

They provision capacity across multiple instance types, sizes, AZs and purchasing options from a single request, with an allocation strategy such as capacity-optimized or lowest-price. EC2 Fleet supports on-demand and spot together; Spot Fleet is the older spot-focused version. Diversification is the key idea: requesting many instance types across AZs dramatically reduces spot interruption because AWS can satisfy the request from whichever pool has spare capacity. A single-type spot request is the fragile version people complain about.

Question 25

How would you reduce EC2 costs by 40%?

Accepted Answer

Right-size using Compute Optimizer recommendations; stop non-production instances outside working hours; move fault-tolerant workloads to Spot; apply Compute Savings Plans to the steady baseline; migrate suitable workloads to Graviton instances for better price-performance; delete unattached EBS volumes, old snapshots and idle Elastic IPs; and switch gp2 volumes to gp3. The gp2-to-gp3 change is a concrete, low-risk saving of roughly 20% on EBS with independently configurable IOPS. The framing to lead with is baseline versus burst — commit to the floor, autoscale the peak, run interruptible work on Spot.

Question 26

What are Graviton instances and why would you use them?

Accepted Answer

Graviton instances use AWS-designed ARM-based processors and generally offer better price-performance than comparable x86 instances, often 20% or more, with lower energy use. The requirement is that your software runs on ARM64, which most interpreted languages and modern compiled toolchains do. The migration caveat to name is native dependencies and container base images that must be built for ARM64, and any commercial software that is x86-only. Testing on a Graviton instance before committing is the practical step.

Question 27

What is Elastic IP and when should you use one?

Accepted Answer

An Elastic IP is a static public IPv4 address allocated to your account that you can attach to an instance or a NAT gateway and remap. Use it when you need a fixed address for DNS or for a third party to allowlist. Unattached Elastic IPs are charged, and all public IPv4 addresses now carry an hourly charge. The current pricing change matters: since 2024 all public IPv4 addresses are charged hourly whether attached or not, so architectures with many public IPs became noticeably more expensive. Preferring a load balancer or NAT gateway over per-instance public IPs is now a cost decision as well as a security one.

Question 28

What is the difference between a security group attached to an instance and one referenced by another security group?

Accepted Answer

A security group rule can reference another security group as its source instead of a CIDR range, meaning "allow traffic from any instance in that group". This is the idiomatic AWS pattern — the web tier group allows the load balancer group, the database group allows the application group — and it survives IP changes and scaling. Security-group referencing is what makes tiered architectures maintainable, because you never hardcode instance IPs. Candidates who only use CIDR ranges usually end up with brittle rules that break when the fleet scales.

Question 29

What is EC2 hibernation and when is it useful?

Accepted Answer

Hibernation writes the instance's memory contents to the encrypted root EBS volume and stops the instance; on start, memory is restored and processes resume where they left off. It is useful for workloads with long initialisation — large in-memory caches, JVM warm-up, machine-learning model loading. The prerequisites are an encrypted root volume large enough for the RAM, a supported instance type and OS, and hibernation enabled at launch. It also cannot be turned on for an already-running instance, which is the constraint people discover too late.

Question 30

How do you achieve high availability with EC2?

Accepted Answer

Run an Auto Scaling group across at least two, preferably three, Availability Zones behind a load balancer, with ELB health checks so failed instances are replaced; keep the application stateless with state in RDS, DynamoDB, ElastiCache and S3; size the group so losing one AZ still leaves enough capacity for peak; and use immutable deployments so replacement is routine. The capacity point is the one candidates miss: with three AZs you should be able to serve peak on two, which means running at roughly 150% of single-AZ need. Otherwise an AZ failure produces a capacity outage rather than a graceful degradation.

Question 31

What is the difference between an ASG scaling in and an instance being terminated by Spot?

Accepted Answer

Scale-in is a deliberate ASG action that selects an instance by termination policy and can be preceded by a lifecycle hook allowing graceful shutdown. A Spot interruption is initiated by AWS with a two-minute notice delivered through instance metadata and EventBridge, and the instance goes regardless of your readiness. The design consequence is that spot workloads must poll the interruption notice or subscribe to the EventBridge event and react within two minutes, whereas scale-in can use a lifecycle hook with a longer window. Naming both mechanisms shows practical experience.

Question 32

What is an Auto Scaling lifecycle hook?

Accepted Answer

A lifecycle hook pauses an instance in a pending or terminating state so you can run custom actions — install software, register with a service, drain connections, upload logs — before the instance enters service or is terminated, with a timeout after which the transition continues. The log-upload use case on terminate is the one worth naming because otherwise diagnostic data on the instance is lost when it is destroyed. Naming the timeout and the need to complete or abandon the hook explicitly shows you have implemented one.

Question 33

How does EC2 handle the underlying host needing maintenance?

Accepted Answer

AWS schedules an instance retirement or a maintenance event and notifies you through the Personal Health Dashboard and EventBridge, with a deadline by which you should stop and start the instance to migrate it to healthy hardware. Some events are handled transparently through live update, but the retirement path requires customer action. The architectural consequence is that instances are not permanent, so any design that treats a specific instance as irreplaceable is fragile. Reacting to the EventBridge health event automatically — draining and replacing the instance — is the mature operational answer.

Question 34

What is EC2 Image Builder?

Accepted Answer

A managed service that automates creating, testing and distributing golden AMIs and container images on a schedule, using a pipeline of build and test components, and can share the resulting images across accounts and regions with automatic version tracking. The value over hand-built AMIs is repeatability and patch cadence: a scheduled pipeline means the base image is never months out of date. Naming automated testing in the pipeline — booting the image and validating it — is what separates it from a scripted snapshot.

Question 35

What are EC2 Compute Optimizer recommendations based on?

Accepted Answer

Compute Optimizer analyses CloudWatch metrics over a lookback period — CPU, memory if the agent is installed, network and disk — and recommends instance types that would improve price or performance, flagging over-provisioned and under-provisioned instances. The caveat that matters is memory: without the CloudWatch agent, memory utilisation is invisible to AWS, so recommendations may under-size a memory-bound workload. Installing the agent before trusting the recommendations is the practical prerequisite.

Question 36

What is the difference between scaling based on CPU and scaling based on request count?

Accepted Answer

CPU is an indirect proxy that lags demand and is distorted by other work on the instance. Request count per target, available when the ASG is attached to an Application Load Balancer, measures actual demand and responds sooner. For queue-driven workers, queue depth or backlog per instance is better still. The general principle is to scale on the metric closest to the work rather than on a resource symptom. Naming backlog-per-instance for SQS workers, calculated as queue depth divided by instance count, is the specific pattern interviewers look for.

Question 37

What are EC2 network performance characteristics you should know?

Accepted Answer

Network bandwidth scales with instance size, so a small instance has a low ceiling and may be burstable. Enhanced networking with ENA and, for the highest performance, Elastic Fabric Adapter for HPC, reduce latency and jitter. Cluster placement groups give the highest inter-instance throughput. The gotcha is burstable network on smaller instances — sustained transfer is throttled to a baseline in the same way T-family CPU is. A data-transfer job that starts fast and slows down is usually hitting that ceiling rather than a source or destination limit.

Question 38

How would you troubleshoot an EC2 instance you cannot SSH into?

Accepted Answer

Check the instance is running and both status checks pass; use EC2 Serial Console or the instance screenshot to see boot output; verify the security group allows port 22 from your source and the NACL permits both directions; confirm the route table and internet gateway or NAT path; check the key pair and OS user; and confirm sshd is running inside the guest. The Serial Console is the strongest move because it works when the network stack or sshd is broken — it is the only way in. Naming Session Manager as the alternative that avoids the whole class of problem is the preventive half.

Question 39

What is the difference between an ENI, a secondary IP and an EIP?

Accepted Answer

An elastic network interface is a virtual network card with a MAC address, one or more private IPs, security groups and optionally a public or Elastic IP. Secondary private IPs are additional addresses on an ENI. An Elastic IP is a static public address that maps to a private address on an ENI. The use case for a detachable ENI is a failover pattern: a management or licensing interface with a fixed private IP and MAC can be moved to a standby instance, preserving the address. That is a specific, practical reason ENIs exist as separate objects.

Question 40

Design a resilient, cost-efficient web tier on EC2.

Accepted Answer

An Auto Scaling group across three AZs behind an Application Load Balancer, launched from a versioned golden AMI built by Image Builder, with ELB health checks and a target-tracking policy on request count per target. Mixed instance policy with on-demand baseline plus diversified Spot for the burst, covered by a Compute Savings Plan for the steady floor. Instances in private subnets with no public IPs, egress through NAT gateways, access via Session Manager, IAM instance profile instead of keys, IMDSv2 enforced, gp3 root volumes, and lifecycle hooks to drain connections and ship logs on termination. The closing question. The senior markers are scaling on request count rather than CPU, diversifying Spot across types and AZs, sizing for AZ loss, and eliminating both SSH and stored credentials — because those four are where most real EC2 fleets fall short.

AWS EC2 Interview Questions and Answers

How to use this set