Question 1

What is AWS?

Accepted Answer

Amazon Web Services is the largest public cloud provider, offering more than two hundred services covering compute, storage, networking, databases, analytics, machine learning, security and developer tooling, delivered on demand and billed by consumption. It removes the need to buy and operate physical infrastructure. Interviewers listen for consumption billing and on-demand provisioning rather than a list of services. Adding that AWS launched in 2006 with S3 and EC2 and has the largest market share and service catalogue of the major providers gives useful context.

Question 2

What is the difference between a Region, an Availability Zone and an Edge Location?

Accepted Answer

A Region is a separate geographic area such as ap-south-1 in Mumbai, containing multiple Availability Zones. An Availability Zone is one or more discrete data centres with independent power, cooling and networking, connected to other AZs in the region by low-latency links. An Edge Location is a CloudFront point of presence used for caching and for services like Route 53 and Global Accelerator. The follow-up is always high availability: deploy across at least two AZs to survive a data-centre failure, and across regions for regional resilience and data residency. Noting that AZ identifiers like ap-south-1a map to different physical zones in different accounts — AWS shuffles them — is a strong detail.

Question 3

What is an AWS account and how does AWS Organizations relate to it?

Accepted Answer

An account is the fundamental container for resources, billing and identity — every resource belongs to exactly one account. AWS Organizations groups accounts into a hierarchy of organisational units under a management account, enabling consolidated billing, service control policies and centralised governance. The key architectural point is that the account is the primary isolation boundary on AWS, which is why a multi-account strategy — separate accounts per environment and per workload — is the standard enterprise pattern rather than separating with tags or VPCs inside one account.

Question 4

What is a Service Control Policy?

Accepted Answer

An SCP is an Organizations policy that sets the maximum permissions available to accounts in an organisational unit. It does not grant anything — it only restricts what IAM in those accounts can allow. Even an account root user cannot exceed an SCP. The framing that matters is that SCPs are guardrails and IAM is the grant: effective permission is the intersection of the two. That an SCP can stop even a root user is the fact interviewers use to check whether you understand the model, because IAM alone cannot.

Question 5

What is the AWS shared responsibility model?

Accepted Answer

AWS is responsible for security *of* the cloud — physical facilities, hardware, the hypervisor and the managed service internals. The customer is responsible for security *in* the cloud — IAM, security groups, encryption configuration, patching guest operating systems, and application code. The dividing line moves up the stack as the service becomes more managed. The best way to demonstrate understanding is with a contrast: on EC2 you patch the OS, on RDS AWS patches the database engine but you still control access and encryption, and on Lambda there is no OS for you to touch at all.

Question 6

What are IaaS, PaaS and SaaS with AWS examples?

Accepted Answer

IaaS gives raw infrastructure with you managing the OS upwards — EC2. PaaS gives a managed runtime where you supply code and configuration — Elastic Beanstalk or App Runner. SaaS is finished software consumed directly — Amazon WorkMail or Amazon Chime. Higher up the stack means less to operate and less control. Positioning Lambda as FaaS and ECS or EKS as CaaS shows nuance beyond the three-tier model. The trade-off to name is control versus operational burden rather than one model being better.

Question 7

What is the AWS Well-Architected Framework?

Accepted Answer

A set of six pillars for evaluating architectures: operational excellence, security, reliability, performance efficiency, cost optimisation and sustainability. It comes with a review process and questions per pillar, and the Well-Architected Tool in the console records reviews and improvement plans. The value in an interview is using the pillars as a structure for design answers and naming which pillar you are trading away in a given decision. A candidate who says "this improves reliability at the cost of cost optimisation, and here is why that is the right call" sounds like an architect.

Question 8

What is the difference between the AWS Management Console, the CLI, the SDKs and CloudFormation?

Accepted Answer

They are four interfaces to the same APIs. The console is the web UI, the CLI is the command-line tool, SDKs are language-specific libraries, and CloudFormation is declarative infrastructure as code. Anything possible in the console is possible through the API. The recommendation to state is that production changes should go through infrastructure as code so intent is reviewable and reproducible, with the console reserved for exploration and read-only investigation. Console-driven change management produces drift with no audit of intent.

Question 9

What is an AWS ARN?

Accepted Answer

An Amazon Resource Name uniquely identifies any AWS resource, in the form arn:partition:service:region:account-id:resource. Some resources are global and omit the region, such as S3 buckets and IAM entities. ARNs are what IAM policies reference to scope permissions. Being able to reason about ARN structure is what makes least-privilege IAM policies possible — wildcards in the resource segment are how policies become over-permissive. Knowing which services have region-less ARNs is a small but revealing detail.

Question 10

What is the AWS free tier?

Accepted Answer

It has three parts: 12-month free offers for new accounts such as 750 hours per month of a t2 or t3.micro EC2 instance and 5 GB of S3; always-free offers such as 1 million Lambda requests per month and 25 GB of DynamoDB storage; and short-term trials for specific services. The practical caution is that free-tier limits are per account and easy to exceed silently — a second instance, or a service not covered, generates charges. Setting a billing alarm immediately after opening an account is the advice that shows real experience.

Question 11

How does AWS billing work?

Accepted Answer

Charges accrue per service by usage — compute per second or hour, storage per GB-month, requests per million, and data transfer out per GB. Consolidated billing under an Organizations management account aggregates member accounts and shares volume discounts and Reserved Instance or Savings Plan benefits across them. Two facts worth naming: data transfer *in* is generally free while transfer *out* is charged, and cross-AZ traffic within a region is charged in both directions. That second one is a common and invisible cost in multi-AZ architectures.

Question 12

What is the difference between AWS Support plans?

Accepted Answer

Basic gives account and billing support only. Developer adds business-hours technical support with a single contact. Business adds 24/7 support, faster response times, full Trusted Advisor checks and API access. Enterprise On-Ramp and Enterprise add faster response, a technical account manager and architectural reviews. The detail interviewers check is that full Trusted Advisor checks require Business support or above — the Basic plan only gets a small subset. For a production workload, Business is generally the practical minimum because of the 24/7 response commitment.

Question 13

What is AWS Trusted Advisor?

Accepted Answer

Trusted Advisor inspects your account and reports recommendations across cost optimisation, performance, security, fault tolerance, service limits and operational excellence — idle instances, unrestricted security groups, missing multi-AZ, quotas nearing their limit. The service-limit checks are the most operationally useful because hitting a quota during a scaling event is a self-inflicted outage. Knowing that most checks require Business support or above stops you promising capabilities a Basic-plan customer will not see.

Question 14

What is the difference between horizontal and vertical scaling on AWS?

Accepted Answer

Vertical scaling changes the instance type to one with more CPU or memory, which requires a stop and start on EC2 and is bounded by the largest available type. Horizontal scaling adds more instances behind a load balancer through an Auto Scaling group, which gives elasticity and fault tolerance. The precondition for horizontal scaling is a stateless application or externalised state, which is why session data belongs in ElastiCache or DynamoDB rather than on the instance. Naming that requirement is what turns the definition into a design principle.

Question 15

What is the difference between a managed and an unmanaged service?

Accepted Answer

A managed service has AWS operating the infrastructure, patching, scaling and availability — RDS, Lambda, DynamoDB. An unmanaged service means you provision and operate it yourself, such as a database installed on EC2. Managed costs more per unit but removes operational work and a large class of human error. The mature answer names the constraints managed services impose — version restrictions, no superuser access, limited tuning — and says you would self-manage only when a specific requirement forces it. Reflexive preference in either direction is the weaker answer.

Question 16

What is AWS Control Tower?

Accepted Answer

Control Tower sets up and governs a multi-account AWS environment using best practices: it creates an organisation with a landing zone, log archive and audit accounts, applies guardrails as SCPs and config rules, and provides Account Factory for provisioning new accounts with standard configuration. It is the answer to "how would you set up AWS for a new enterprise" because it encodes the multi-account landing zone pattern rather than requiring you to build it. The consideration to name is that it is opinionated, so heavily customised environments sometimes outgrow it.

Question 17

What is a multi-account strategy and why use one?

Accepted Answer

Separate AWS accounts per environment, workload or team, grouped in Organizations under organisational units. It gives hard isolation of blast radius, clean cost attribution, independent service quotas, and simpler compliance boundaries — all of which tags or VPCs inside a single account cannot provide. Service quotas being per account is the underappreciated reason: a runaway workload in one account cannot exhaust another account's Lambda concurrency or EC2 limits. That isolation argument is what convinces people who think tagging is sufficient.

Question 18

What is the AWS Config service?

Accepted Answer

AWS Config records the configuration of resources over time, giving you a timeline of what changed and when, and evaluates resources against Config Rules — managed or custom — reporting compliance. It supports conformance packs for bundled rule sets and can trigger automatic remediation. The distinction from CloudTrail is what interviewers check: CloudTrail records the API call — who did it — while Config records the resulting resource state over time. You need both to answer "who made this bucket public and when did it change".

Question 19

What is the difference between CloudTrail and CloudWatch?

Accepted Answer

CloudTrail records API activity — who called what, from where, and whether it succeeded — for audit and security. CloudWatch collects operational telemetry — metrics, logs and events — for monitoring, dashboards and alarms. CloudTrail answers governance questions; CloudWatch answers "is it working". They intersect because CloudTrail can deliver to CloudWatch Logs, letting you alarm on specific API activity such as a root login or a security group change. Describing that integration shows you understand how they are used together rather than as separate silos.

Question 20

What is an AWS service quota and how does it differ from a hard limit?

Accepted Answer

A service quota is the maximum amount of a resource or rate of API calls per account and usually per region, and most can be increased by request. A few are hard limits that cannot be raised. Quotas exist to protect shared capacity and to limit the damage from runaway automation. The operational point is lead time: quota increases can take days, so they belong in launch planning rather than being discovered during a scaling event. Service Quotas supports CloudWatch alarms on utilisation, which is the preventive control worth naming.

Question 21

What is eventual consistency and where do you meet it on AWS?

Accepted Answer

Eventual consistency means a read may not immediately reflect the latest write, but replicas converge. On AWS you meet it in IAM policy propagation, in DynamoDB eventually-consistent reads, in Route 53 record propagation and in some cross-region replication. S3 has been strongly consistent for reads and list operations since 2020. The S3 point matters because a lot of older material still describes S3 as eventually consistent for overwrites and listings, which is no longer true. Knowing the current behaviour rather than repeating old folklore is a genuine differentiator.

Question 22

What is the difference between a public and a private subnet?

Accepted Answer

A public subnet has a route to an internet gateway, so resources with public IPs are reachable from and can reach the internet. A private subnet has no such route — outbound access goes through a NAT gateway in a public subnet, and there is no inbound path from the internet. The correction to make is that the subnet is not "public" because of a setting on it — it is public because of its route table. That routing-based definition is what interviewers are testing, and candidates who describe it as a checkbox usually cannot explain NAT placement.

Question 23

What is AWS CloudShell?

Accepted Answer

CloudShell is a browser-based shell pre-authenticated as your console identity, with the AWS CLI, Python, Node and common tools installed, and 1 GB of persistent home directory storage per region. It is the fastest way to run AWS commands without configuring credentials locally. The practical limits to note are that only the home directory persists, sessions time out after inactivity, and it inherits your console permissions — so it is for administration and exploration, not for running workloads.

Question 24

What is an AWS Local Zone, Wavelength Zone and Outpost?

Accepted Answer

A Local Zone extends a region into a metropolitan area for single-digit millisecond latency to nearby users. A Wavelength Zone places compute inside a telecom provider's 5G network for mobile edge applications. Outposts is AWS-managed physical hardware installed in your own data centre, running AWS services locally. Outposts is the answer to a data-residency or latency requirement that keeps workloads on premises while keeping the AWS operating model. Naming the constraint that would justify each — latency, mobile edge, residency — is more valuable than the definitions alone.

Question 25

What is the AWS Global Accelerator?

Accepted Answer

Global Accelerator provides static anycast IP addresses that route user traffic into the AWS global network at the nearest edge location and onward to the healthiest endpoint, with automatic failover. It works at layer 4 and supports both TCP and UDP. The contrast with CloudFront is what interviewers probe: CloudFront caches HTTP content at the edge, while Global Accelerator does not cache — it optimises the network path and gives fixed IPs, which matters for non-HTTP protocols and for clients that must allowlist an address.

Question 26

What does "elasticity" mean and how is it different from scalability?

Accepted Answer

Scalability is the ability to handle growth by adding capacity. Elasticity is the ability to add and *remove* capacity automatically as demand changes, so you pay only for what you need at any moment. Cloud economics depend on elasticity, not just scalability. The consequence to draw out is that a system that scales up but never scales down captures only half the benefit and often costs more than on-premises. Naming scale-in as the harder and more valuable half is what makes the distinction meaningful.

Question 27

What is an AWS availability SLA and what does it actually promise?

Accepted Answer

Each service publishes an SLA — for example EC2 offers 99.99% for a region when instances are deployed across at least two AZs. The promise is a service credit if the commitment is missed, not a guarantee of uptime. Many SLAs are conditional on architecting for multi-AZ. The conditionality is the point that catches people: a single-AZ deployment does not receive the multi-AZ SLA. Also, credits are small relative to business impact, so the SLA is a floor on AWS's obligation rather than a substitute for your own resilience design.

Question 28

What is the difference between a security group and a network ACL?

Accepted Answer

A security group is a stateful virtual firewall attached to an ENI, supporting only allow rules; return traffic is automatically permitted. A network ACL is stateless, operates at the subnet level, supports both allow and deny rules, and evaluates them in numbered order, so you must define both directions explicitly. This is one of the most-asked AWS questions. The practical guidance is to do most work with security groups and reserve NACLs for coarse subnet-level denies, such as blocking a known-bad IP range, because stateless rules are easy to get wrong.

Question 29

What is the AWS root user and how should you treat it?

Accepted Answer

The root user is the identity created with the account and has unrestricted access that cannot be limited by IAM. It should have hardware or virtual MFA enabled, no access keys, a strong unique password stored securely, and should be used only for the handful of tasks that require it, such as closing the account or changing support plans. Naming the specific root-only tasks and stating that access keys should be deleted entirely is what shows real practice. An alarm on root account usage through CloudTrail is the detective control that completes the answer.

Question 30

What is AWS CloudFormation?

Accepted Answer

CloudFormation is AWS's native infrastructure-as-code service. You describe resources in a YAML or JSON template and it creates, updates and deletes them as a stack, tracking state, handling dependencies and rolling back on failure. StackSets deploy the same template across many accounts and regions. Automatic rollback on failure is a genuine advantage over some alternatives, since a failed update returns the stack to its previous state. The trade-off versus Terraform — native integration and rollback versus multi-cloud support and a larger ecosystem — is the follow-up worth being ready for.

Question 31

What is the difference between AWS CDK and CloudFormation?

Accepted Answer

The CDK lets you define infrastructure in a general-purpose language such as TypeScript or Python, using constructs that encapsulate best practices, and synthesises a CloudFormation template which CloudFormation then deploys. So the CDK is an authoring layer on top of the same deployment engine. The benefit is abstraction and reuse — an L3 construct can create a dozen resources with sensible defaults from a few lines. The cost is that reviewing a pull request no longer tells you exactly what will be created, so reviewing the synthesised diff becomes important.

Question 32

What is the difference between a stateful and a stateless application, and why does it matter on AWS?

Accepted Answer

A stateless application keeps no client-specific data locally, so any instance can serve any request. A stateful one holds session or file data on the instance, so requests must return to the same instance. Stateless is required for effective horizontal scaling, instance replacement and immutable deployment. The practical migration path is to externalise state — sessions to ElastiCache or DynamoDB, uploaded files to S3, and shared filesystems to EFS. Naming those three destinations turns the principle into an actionable change.

Question 33

What is AWS Systems Manager?

Accepted Answer

Systems Manager is the operations hub for EC2 and hybrid servers: Session Manager for shell access without SSH keys or open ports, Patch Manager for OS patching, Run Command for fleet-wide commands, Parameter Store for configuration and secrets, State Manager for desired-state configuration, and Inventory for asset data. Session Manager is the piece to lead with because it removes the need for bastion hosts and open port 22 entirely, with access controlled by IAM and every session logged. That is a substantial security improvement over key-based SSH.

Question 34

What is the difference between Parameter Store and Secrets Manager?

Accepted Answer

Parameter Store holds configuration and, with SecureString, encrypted values, and is free for standard parameters. Secrets Manager is purpose-built for secrets, adding automatic rotation with Lambda, cross-region replication and fine-grained resource policies, and charges per secret per month. The deciding factor is automatic rotation: if a credential must rotate without a deployment, Secrets Manager does it natively while Parameter Store does not. For non-rotating configuration, Parameter Store is the cheaper choice.

Question 35

What is an AWS VPC endpoint?

Accepted Answer

A VPC endpoint provides private connectivity from your VPC to AWS services without traversing the internet. Gateway endpoints, for S3 and DynamoDB, add a route table entry at no charge. Interface endpoints, powered by PrivateLink, create an ENI with a private IP in your subnet and are charged hourly plus per GB. The cost angle is a strong practical detail: a gateway endpoint for S3 is free and removes NAT gateway data-processing charges for S3 traffic, which is often a significant saving as well as a security improvement.

Question 36

What is AWS PrivateLink?

Accepted Answer

PrivateLink exposes a service — an AWS service, your own service behind a Network Load Balancer, or a partner SaaS — through an interface endpoint with a private IP in the consumer's VPC. Traffic never leaves the AWS network, and there is no VPC peering, no route sharing and no CIDR overlap concern. The advantage over VPC peering is exactly that: peering connects whole networks and requires non-overlapping CIDRs, whereas PrivateLink exposes one service through one address. It is how SaaS vendors integrate into customer VPCs without network-level trust.

Question 37

How does AWS handle data encryption by default?

Accepted Answer

Many services encrypt at rest by default now — S3 objects, EBS volumes for new accounts, RDS snapshots when the instance is encrypted — using AWS-managed KMS keys. Data in transit between services uses TLS. You can supply a customer-managed KMS key for control over rotation, policy and revocation. The property that makes a customer-managed key valuable is revocability and auditability: you can see every use in CloudTrail and disable the key to render data unreadable. That is also the operational risk, which is why key deletion has a mandatory waiting period.

Question 38

What is the difference between AWS Backup and service-native snapshots?

Accepted Answer

Service-native snapshots are per-service point-in-time copies you manage individually. AWS Backup is a centralised service that applies backup plans across EBS, RDS, DynamoDB, EFS, FSx and more, with a single policy for schedule, retention, lifecycle to cold storage, cross-region and cross-account copy, and vault lock for immutability. Vault Lock is the feature to name for ransomware resilience, because it makes backups immutable so an attacker with account access cannot delete them. Cross-account copy is the other control, since backups in the same account as the workload share its blast radius.

Question 39

What is the difference between AWS Organizations SCPs and IAM permission boundaries?

Accepted Answer

An SCP limits the maximum permissions for an entire account or organisational unit. A permissions boundary limits the maximum permissions of an individual IAM user or role. Both are ceilings, not grants — effective permission is the intersection of the identity policy, any boundary, and any applicable SCP. Permissions boundaries are the mechanism for safe delegation: you let a developer create roles while guaranteeing those roles can never exceed a defined ceiling. That delegation use case is what the question is really about.

Question 40

How would you set up a new AWS environment for a company from scratch?

Accepted Answer

Start with Organizations and Control Tower to create a landing zone with log archive and audit accounts; define an OU structure by environment and function; apply SCP guardrails; federate identity with IAM Identity Center rather than creating IAM users; design the network — VPC CIDR plan, Transit Gateway or shared VPCs; enable CloudTrail organisation-wide to a locked S3 bucket, plus Config, GuardDuty and Security Hub; set up consolidated billing with budgets and Cost and Usage Report; and provision everything with infrastructure as code from day one. This is the classic senior opener and it tests sequence more than recall. Identity, account structure and network come before any workload, because retrofitting an account strategy or a CIDR plan onto a live estate is extremely painful. Naming Control Tower as the accelerator rather than building it by hand is the practical close.

AWS Fundamentals & Global Infrastructure Interview Questions and Answers

How to use this set