Question 1

What is cloud computing?

Accepted Answer

Cloud computing is the delivery of computing resources — servers, storage, databases, networking, software — over the internet, on demand, paid for by usage rather than bought up front. Instead of buying and running hardware you rent capacity from a provider and scale it as needed. A good fresher answer names the shift from capital to operating expenditure, and from weeks to provision a server to seconds. Adding a concrete example — "we can launch a virtual machine in a minute instead of ordering hardware" — makes it real rather than recited.

Question 2

What are the main benefits of using AWS?

Accepted Answer

Elasticity — scale up for a spike and back down after; pay for what you use rather than for peak capacity; global reach without building data centres; managed services that remove operational work; faster time to market; and built-in reliability through multiple Availability Zones. Interviewers value honesty about trade-offs: less control, potential lock-in, and the fact that cloud can be more expensive than on-premises for a steady, fully-utilised workload. Naming one downside makes the answer far more credible.

Question 3

What are IaaS, PaaS and SaaS with AWS examples?

Accepted Answer

IaaS gives raw infrastructure and you manage the OS upwards — EC2. PaaS gives a managed runtime where you supply code — Elastic Beanstalk or App Runner. SaaS is finished software you just use — Amazon WorkMail. The higher up the stack, the less you manage and the less control you have. Giving an AWS example for each turns a textbook answer into an AWS one. A useful closing line is that the trade-off is control versus convenience, since you are also giving up the ability to tune what you no longer manage.

Question 4

What is a Region and an Availability Zone?

Accepted Answer

A Region is a separate geographic area such as ap-south-1 in Mumbai, containing multiple Availability Zones. An Availability Zone is one or more discrete data centres with independent power, cooling and networking, connected to the other AZs in the region by low-latency links. Pair the definition with the reason: deploying across at least two AZs means a single data-centre failure does not take your application down. That cause-and-effect is what interviewers are listening for rather than the definition alone.

Question 5

What is an Edge Location?

Accepted Answer

An Edge Location is a CloudFront point of presence used to cache content close to users and to terminate connections for services like Route 53 and Global Accelerator. There are far more edge locations than regions, and they are for delivery rather than for running your workloads. The distinction to make is that you do not deploy applications to edge locations — they cache and route. Lambda@Edge and CloudFront Functions are the exception worth mentioning if you want to show depth.

Question 6

What is Amazon EC2?

Accepted Answer

EC2 provides resizable virtual servers. You choose an instance type, an operating system image, storage and security groups, and you control the guest operating system upwards. Billing is per second for most Linux instances after a one-minute minimum. Naming one or two instance families and what they are for — t and m for general purpose, c for compute-heavy, r for memory-heavy — shows you have actually launched one rather than read the definition.

Question 7

What is Amazon S3?

Accepted Answer

S3 is object storage. You store files as objects inside buckets with globally unique names, accessed over HTTP, with extremely high durability. It is used for backups, static website assets, data lakes, logs and media, and it scales without you provisioning capacity. The framing to give is object storage, not a filesystem: there are no real folders, and the slashes in a key are just characters the console displays as folders. Candidates who describe S3 as a mounted disk usually stumble on the next question.

Question 8

What are the S3 storage classes?

Accepted Answer

Standard for frequent access; Intelligent-Tiering which moves objects automatically based on access; Standard-IA and One Zone-IA for less frequent access; and the Glacier classes — Instant Retrieval, Flexible Retrieval and Deep Archive — for archival at progressively lower cost and slower retrieval. The detail worth adding is the minimum storage duration on the colder classes: deleting an Archive object after a week still bills for the minimum period. That is why lifecycle rules should tier data rather than a script deleting and rewriting it.

Question 9

What is EBS and how is it different from S3?

Accepted Answer

EBS is block storage attached to a single EC2 instance, presented as a raw device you format and mount, living in one Availability Zone. S3 is object storage accessed over an API from anywhere, effectively unlimited, and shared. EBS is for a machine's disk; S3 is for files you store and retrieve. Adding EFS as the third option — a shared filesystem many instances can mount simultaneously — completes the picture. Knowing which of the three fits "my application needs a shared directory" is the practical version of the question.

Question 10

What is a VPC?

Accepted Answer

A Virtual Private Cloud is your own isolated network inside AWS, where you define the IP address range, subnets, route tables and gateways. It is regional — a VPC exists in one region — and subnets within it each live in a single Availability Zone. Knowing that a VPC is regional while a subnet is zonal is the fact interviewers check, because it explains why multi-AZ designs use one subnet per AZ. It also contrasts with GCP, where the VPC is global.

Question 11

What is the difference between a public and a private subnet?

Accepted Answer

A public subnet has a route sending internet-bound traffic to an internet gateway, so resources with public IPs are reachable from and can reach the internet. A private subnet has no such route; outbound access goes through a NAT gateway placed in a public subnet. The correction interviewers look for is that a subnet is public because of its route table, not a setting on the subnet itself. Candidates who think it is a checkbox usually cannot explain why the NAT gateway must live in the public subnet.

Question 12

What is a security group?

Accepted Answer

A security group is a stateful virtual firewall attached to a network interface, controlling inbound and outbound traffic by protocol, port and source or destination. It supports only allow rules, and return traffic for an allowed connection is automatically permitted. The stateful property is the key fact: you allow inbound port 443 and the response goes out automatically without an outbound rule. That is exactly what distinguishes it from a network ACL.

Question 13

What is the difference between a security group and a network ACL?

Accepted Answer

A security group is stateful, attached to an interface, and allow-only. A network ACL is stateless, applies at the subnet level, supports both allow and deny rules, and evaluates them in numbered order — so you must write rules for both directions including the ephemeral return ports. This is one of the most-asked AWS questions at every level. The practical guidance is to do most work with security groups and use NACLs only for coarse subnet-level denies, because stateless rules are easy to get wrong.

Question 14

What is AWS IAM?

Accepted Answer

Identity and Access Management controls who can do what on which AWS resources. You attach policies to identities — users, groups and roles — that allow or deny actions on resources under conditions. IAM is global rather than regional and is free to use. The default-deny principle is worth stating: nothing is allowed unless a policy permits it, and an explicit deny always wins. That single rule explains most IAM behaviour.

Question 15

What is the difference between an IAM user and an IAM role?

Accepted Answer

A user is a permanent identity with long-lived credentials, usually representing a person. A role is assumed temporarily by a trusted principal — an EC2 instance, a Lambda function, another account — and delivers short-lived credentials that expire automatically. The reason roles are preferred is credential lifetime: a leaked temporary credential expires on its own, while an access key stays valid until someone revokes it. Volunteering that security reason is what makes the answer strong.

Question 16

How should an application on EC2 access S3?

Accepted Answer

Attach an IAM role to the instance through an instance profile and grant it a policy allowing the specific S3 actions on the specific bucket. The AWS SDK then obtains temporary credentials automatically from the instance metadata service — no access keys stored anywhere. Hardcoded access keys on an instance are the classic AWS credential leak, so naming the instance role as the answer is the single most important EC2 security practice a fresher can know.

Question 17

What is the AWS root user and how should you treat it?

Accepted Answer

The root user is created with the account and has unrestricted access that IAM cannot limit. It should have MFA enabled, no access keys, a strong stored password, and be used only for the few tasks that require it, such as closing the account or changing the support plan. Naming the specific root-only tasks, and that you would delete any root access keys, shows real familiarity. An alarm on any root usage is the detective control that completes the answer.

Question 18

What is an Elastic IP?

Accepted Answer

An Elastic IP is a static public IPv4 address allocated to your account that you can attach to an instance or NAT gateway and remap. Unlike an auto-assigned public IP, it does not change when the instance stops and starts. The billing detail worth knowing is that public IPv4 addresses are now charged hourly whether attached or not, so hoarding Elastic IPs costs money. That is a common source of small unexplained charges.

Question 19

What is a load balancer and which types does AWS offer?

Accepted Answer

A load balancer distributes incoming traffic across several targets so no single one is overwhelmed, and stops sending traffic to targets that fail health checks. AWS offers the Application Load Balancer for HTTP with path and host routing, the Network Load Balancer for high-performance TCP and UDP, and the Gateway Load Balancer for network appliances. The selection rule is simply whether you need HTTP-aware routing — path rules, headers, host names. That single question chooses between ALB and NLB in almost every case.

Question 20

What is Auto Scaling?

Accepted Answer

An Auto Scaling group maintains a desired number of EC2 instances across Availability Zones, replaces instances that fail health checks, and adds or removes instances in response to scaling policies based on metrics such as CPU or request count. A good addition is that autoscaling requires the application to be stateless, or to keep state elsewhere, because any instance can be replaced at any time. Naming that requirement turns a definition into a design principle.

Question 21

What is high availability?

Accepted Answer

High availability is designing so the system keeps working when a component fails — no single points of failure, redundant instances across Availability Zones behind a load balancer, health checks and automatic replacement. It is measured as a percentage of uptime. A concrete example beats the definition: an Auto Scaling group across three AZs behind an ALB with a Multi-AZ RDS database. Being able to describe one real configuration is what interviewers are testing.

Question 22

What is Amazon RDS?

Accepted Answer

RDS is AWS's managed relational database service for MySQL, PostgreSQL, MariaDB, Oracle, SQL Server and Aurora. AWS handles provisioning, patching, backups, replication and failover, while you use standard SQL and normal client drivers. The trade-off to name is that you do not get operating-system access and are limited to supported versions and extensions. That is exactly what you give up in exchange for AWS handling backups and failover.

Question 23

What is the difference between Multi-AZ and a read replica in RDS?

Accepted Answer

Multi-AZ maintains a standby in another AZ that serves no traffic and is failed over to automatically — it is for high availability. A read replica replicates asynchronously, has its own endpoint and serves read queries — it is for scaling reads, and must be promoted manually. This is the most-asked RDS question. Adding that a read replica has replication lag, so a read immediately after a write may return stale data, is the consequence that shows understanding.

Question 24

What is DynamoDB?

Accepted Answer

DynamoDB is a fully managed, serverless NoSQL key-value and document database offering single-digit millisecond latency at any scale, replicated across three Availability Zones automatically, with no servers to manage. The distinction from RDS is what interviewers check: DynamoDB requires you to know your access patterns in advance because it cannot join or run arbitrary queries efficiently, while a relational database absorbs unanticipated queries.

Question 25

What is AWS Lambda?

Accepted Answer

Lambda runs your code in response to events without you provisioning servers. You upload a function, choose a runtime and memory, and Lambda handles scaling from zero to many concurrent executions, billing per request and per GB-second of execution time. The phrase to use is that you pay nothing when it is idle, which is what makes it different from an always-on server. Mentioning cold starts as the trade-off shows you know it is not free of downsides.

Question 26

What is a cold start?

Accepted Answer

A cold start is the extra latency when a request arrives and no warm execution environment exists, so the platform must create one, load the runtime and run your initialisation before the handler executes. Subsequent requests to that environment are faster. The mitigations worth naming are provisioned concurrency, smaller deployment packages and lighter initialisation. Knowing that heavier runtimes like Java have longer cold starts than Node or Python is a useful practical detail.

Question 27

What is Amazon SQS?

Accepted Answer

SQS is a managed message queue. Producers send messages, consumers poll and receive them, and the message stays hidden but not deleted until the consumer explicitly deletes it. It decouples components so a slow or failed consumer does not block production. The delete-after-processing model is the mechanic to explain: receiving does not remove the message, so a consumer that crashes mid-processing causes it to reappear. That is what makes SQS reliable and why handlers must tolerate duplicates.

Question 28

What is the difference between SQS and SNS?

Accepted Answer

SQS is a queue — one message is processed by one consumer, pulled at the consumer's pace. SNS is publish-subscribe — a message is pushed to all subscribers of a topic, such as several queues, Lambda functions or email addresses. The common pattern is SNS to several SQS queues, so each consumer gets its own copy with independent retry and buffering. Naming that fan-out pattern is what turns two definitions into an architecture.

Question 29

What is Amazon CloudWatch?

Accepted Answer

CloudWatch is AWS's monitoring service: it collects metrics from AWS services and your applications, stores logs, provides dashboards, and triggers alarms that can notify people or take automated actions such as scaling. The distinction from CloudTrail is what interviewers check: CloudWatch tells you how things are performing, CloudTrail records who called which API. Being clear on that pairing is worth more than listing features.

Question 30

What is AWS CloudTrail?

Accepted Answer

CloudTrail records API activity in your account — who called what, from where, when, and whether it succeeded — for auditing, security investigation and compliance. Management events are recorded by default; data events must be enabled explicitly. That data events are off by default is the fact worth knowing, because it means CloudTrail records a bucket being created but not who read the objects inside it. That surprises people during their first incident.

Question 31

What is CloudFront?

Accepted Answer

CloudFront is AWS's content delivery network. It caches content at edge locations close to users, terminates TLS there, and forwards uncached requests to an origin such as S3 or a load balancer, reducing latency and origin load. The security angle worth adding is that CloudFront should be the only public entry point, with the origin locked to accept traffic only from it — otherwise attackers bypass the CDN, WAF and caching entirely.

Question 32

What is Route 53?

Accepted Answer

Route 53 is AWS's managed DNS service, translating domain names to addresses. It also registers domains, performs health checks, and supports routing policies such as latency-based, weighted, failover and geolocation routing. Alias records are the AWS-specific feature to name: they point at AWS resources like a load balancer or CloudFront distribution, work at the zone apex where a CNAME cannot, and are free to query.

Question 33

What is CloudFormation?

Accepted Answer

CloudFormation is AWS's infrastructure-as-code service. You describe resources in a YAML or JSON template and it creates, updates and deletes them as a stack, handling dependencies and rolling back automatically if something fails. The benefit to state is reproducibility and reviewability: infrastructure defined in a file can be version-controlled, reviewed and recreated identically, unlike changes made by clicking in the console.

Question 34

What is the AWS shared responsibility model?

Accepted Answer

AWS is responsible for security *of* the cloud — physical facilities, hardware, the hypervisor and managed service internals. The customer is responsible for security *in* the cloud — IAM, security groups, encryption settings, guest OS patching and application code. The point that shows understanding is that the boundary moves by service: on EC2 you patch the OS, on RDS AWS patches the engine, on Lambda there is no OS at all. Naming that variation turns a memorised diagram into a real answer.

Question 35

What is an AWS account and what is AWS Organizations?

Accepted Answer

An account is the container for resources, billing and identity — every resource belongs to exactly one. Organizations groups accounts under a management account for consolidated billing, centralised policies and organisational units. The architectural point is that the account is the strongest isolation boundary AWS offers, which is why companies use separate accounts per environment rather than separating with tags inside one account.

Question 36

How is AWS billed?

Accepted Answer

By usage — compute per second or hour, storage per GB-month, requests per million, and data transfer out per GB. Data transfer in is generally free. You can set budgets with alerts and view costs in Cost Explorer. The fact worth adding is that budgets only alert by default; they do not stop spending. Knowing that, and that a stopped EC2 instance still incurs EBS charges, covers the two billing surprises freshers most often meet.

Question 37

What is the AWS free tier?

Accepted Answer

It has three parts: 12-month free offers for new accounts such as 750 hours a month of a t2 or t3.micro instance and 5 GB of S3; always-free offers such as 1 million Lambda requests a month; and short-term trials for specific services. The practical advice is to set a billing alarm immediately after opening an account, because free-tier limits are easy to exceed silently — a second instance or a service not covered generates charges quietly.

Question 38

What is the difference between horizontal and vertical scaling?

Accepted Answer

Vertical scaling makes one machine bigger — more CPU or memory — and on EC2 requires a stop and start. Horizontal scaling adds more machines behind a load balancer. Cloud platforms favour horizontal because it gives both elasticity and fault tolerance. The requirement to mention is that horizontal scaling needs the application to be stateless, or to keep state in a shared store. That is why session data belongs in ElastiCache or DynamoDB rather than on the instance.

Question 39

What is the difference between stopping and terminating an EC2 instance?

Accepted Answer

Stopping shuts the instance down and releases its CPU and memory — you stop paying for compute but keep paying for EBS volumes and any reserved Elastic IP. Terminating deletes the instance, and the root volume is deleted with it by default. The differing default between root and additional volumes is the detail to know: additional volumes survive termination unless configured otherwise, which is why orphaned volumes accumulate cost.

Question 40

What is an AMI?

Accepted Answer

An Amazon Machine Image is a template used to launch EC2 instances, containing the operating system, installed software and configuration as one or more snapshots. You can use AWS-provided images, marketplace images, or build your own. The practice to name is building a golden AMI with your software pre-installed, so instances boot fast and identically. That is what makes autoscaling responsive, because a long startup script slows every scale-out.

Question 41

What is a snapshot?

Accepted Answer

A snapshot is a point-in-time backup of an EBS volume, stored in S3 within the region and taken incrementally so only changed blocks are saved after the first one. You can restore a volume from it or create new volumes. The incremental behaviour means subsequent snapshots are cheap, and deleting an older one does not break newer ones. Knowing that snapshots are regional, so they can restore into a different AZ, is the practical use.

Question 42

What is a NAT gateway and why is it needed?

Accepted Answer

A NAT gateway lets resources in private subnets make outbound connections to the internet — for package updates or third-party APIs — while accepting no unsolicited inbound connections. It is placed in a public subnet and referenced from the private subnet's route table. The detail worth knowing is that a NAT gateway lives in one Availability Zone, so a resilient design uses one per AZ. It also charges hourly plus per GB processed, which is a common surprise on the bill.

Question 43

What is Amazon ECS and what is Fargate?

Accepted Answer

ECS is AWS's container orchestration service, running containers defined in task definitions either as one-off tasks or as long-running services behind a load balancer. Fargate is the serverless capacity option — you specify CPU and memory and AWS provides the underlying compute with no instances to manage. The contrast worth naming is with EKS, which is managed Kubernetes: ECS is simpler and AWS-native, EKS gives the full Kubernetes ecosystem and portability at the cost of more concepts to learn.

Question 44

What is a container and how is it different from a virtual machine?

Accepted Answer

A container packages an application with its dependencies and shares the host operating system kernel, so it is lightweight and starts in seconds. A virtual machine includes a full guest operating system on a hypervisor, so it is heavier and slower to start but more isolated. The practical consequence is density and speed: you can run many more containers than VMs on the same hardware and start them far faster, which is what makes container-based autoscaling responsive.

Question 45

What is serverless computing?

Accepted Answer

Serverless means you deploy code or a container and the platform handles provisioning, scaling and capacity entirely — you never size or patch a server and you pay only while your code runs. Lambda, Fargate, S3, DynamoDB on-demand and API Gateway are AWS examples. The honest caveat is cold starts and reduced control over the environment. Naming a trade-off rather than presenting serverless as free of downsides is what makes the answer credible.

Question 46

How would you host a simple web application on AWS? Walk me through it.

Accepted Answer

Static frontend in S3 served through CloudFront with an ACM certificate and a Route 53 record. Backend as a Lambda function behind API Gateway, or a container on ECS Fargate behind an Application Load Balancer. Data in DynamoDB or RDS in private subnets, secrets in Secrets Manager, and CloudWatch for logs, metrics and alarms. This is the standard closing question for a fresher screen and it tests whether you can connect several services into a working system. Naming where the data, the secrets and the monitoring go — not just the compute — is what makes it a complete answer.

AWS Interview Questions for Freshers Interview Questions and Answers

How to use this set