AWS DevOps Interview Questions and Answers

Shweta Patel

Published : 23 July 2026

36 Views

#aws

#interview

#interview-preparation

#technical-interview

#system-design-interview

#interview-questions

#cloud-architecture

Amazon Web Services (AWS) is the world's most widely adopted cloud platform. It offers hundreds of cloud services that help businesses build, deploy and scale applications without investing in physical infrastructure.

Today, startups as well as large enterprises use AWS to host websites, run applications, store data, build machine learning models and automate deployments. Because of its popularity, AWS has become one of the most common topics in cloud computing and software engineering interviews.

If you're preparing for an AWS interview, you should have a good understanding of core services like IAM, EC2, S3, VPC, Route 53, Load Balancers, Auto Scaling, Lambda, CloudWatch and networking concepts.

This guide covers some of the most frequently asked AWS interview questions, with answers explained in simple language.

1. What is IAM? Why is it important?

IAM (Identity and Access Management) is the AWS service used to control who can access your AWS resources and what actions they are allowed to perform.

Instead of sharing one AWS account with everyone, IAM lets you create separate identities and give each person or application only the permissions they actually need. This follows the Principle of Least Privilege, which is one of the most important security practices in AWS.

There are three main IAM components:

1. IAM User

An IAM User represents a person or an application that needs long-term access to AWS. Users can sign in using a username and password or access keys.

2. IAM Group

A Group is simply a collection of IAM users. Instead of assigning permissions to every user individually, you assign permissions to the group and every member inherits those permissions.

3. IAM Role

An IAM Role provides temporary credentials instead of permanent ones. Roles are commonly used by AWS services like EC2, Lambda or ECS to access other AWS resources securely without storing access keys.

2. What is the difference between an AWS Region and an Availability Zone (AZ)?

A Region is a physical geographic location where AWS operates data centers. Each Region contains multiple Availability Zones (AZs). An Availability Zone is one or more isolated data centers with independent power, networking and cooling.

For example:

Region: Asia Pacific (Mumbai) – ap-south-1
Availability Zones: ap-south-1a, ap-south-1b, ap-south-1c

The two work together to improve application availability.

For example, if you deploy your application across two Availability Zones and one AZ experiences an outage, the application can continue serving users from the other AZ.

3. What is the AWS Shared Responsibility Model?

The AWS Shared Responsibility Model explains which security responsibilities belong to AWS and which belong to the customer. AWS is responsible for security of the cloud, while customers are responsible for security in the cloud.

AWS is responsible for:

Physical data centers
Networking infrastructure
Hardware
Storage devices
Virtualization layer

Customers are responsible for:

IAM users and permissions
Application security
Operating system patches (for EC2)
Data encryption
Firewall rules
Database security

The exact responsibility depends on the AWS service you're using.

For example, with EC2, you manage the operating system yourself. With AWS Lambda, AWS manages the servers and you mainly focus on your application code and permissions.

4. What is the difference between Horizontal Scaling and Vertical Scaling?

Both scaling methods increase application capacity, but they do it differently.

Vertical Scaling

Vertical scaling means upgrading a single server by adding more CPU, RAM or storage. It's simple to implement, but there's a limit to how much one machine can be upgraded.

Horizontal Scaling

Horizontal scaling means adding more servers and distributing traffic among them using a load balancer. This approach provides better scalability, fault tolerance and high availability, which is why it's commonly used in cloud environments.

5. What is the AWS Well-Architected Framework?

The AWS Well-Architected Framework is a collection of best practices that helps you build secure, reliable, efficient and cost-effective applications on AWS. It is based on six pillars.

Operational Excellence – Improve operations through automation, monitoring and continuous improvement.
Security – Protect applications, infrastructure and data.
Reliability – Build systems that recover quickly from failures.
Performance Efficiency – Use the right resources to achieve good performance.
Cost Optimization – Avoid unnecessary spending while meeting business requirements.
Sustainability – Design workloads that reduce energy consumption and improve environmental efficiency.

Note: Sustainability became the sixth pillar in 2021, so make sure you mention all six pillars during interviews.

6. What is the difference between Security Groups and Network ACLs?

Both Security Groups and Network ACLs act as firewalls inside a VPC, but they work at different levels.

Feature	Security Group	Network ACL
Applied To	EC2 instance or resource	Entire subnet
State	Stateful	Stateless
Rules	Allow rules only	Allow and deny rules
Return Traffic	Automatically allowed	Must be explicitly allowed
Typical Use	Protect individual resources	Protect an entire subnet

In most applications, Security Groups are your primary firewall, while Network ACLs provide an extra layer of protection for the subnet.

7. What is AWS KMS? What is Envelope Encryption?

AWS Key Management Service (KMS) is a managed service for creating, storing and managing encryption keys. Many AWS services, such as S3, EBS, RDS and Secrets Manager, integrate directly with KMS to encrypt sensitive data.

A common encryption technique used by KMS is Envelope Encryption.

Instead of encrypting large files directly with the master key, AWS first generates a temporary data key.

The process works like this:

KMS generates a data key.
The plaintext data key encrypts the actual data.
The data key is then encrypted using the KMS key.
The plaintext data key is removed from memory.
The encrypted data and encrypted data key are stored together.

This approach is both secure and efficient, especially for encrypting large amounts of data.

8. What are S3 Object Lock and MFA Delete?

Both features protect data stored in Amazon S3, but they solve different problems.

S3 Object Lock

S3 Object Lock prevents an object from being modified or deleted for a specified period. It uses the Write Once, Read Many (WORM) model and is commonly used in industries that have strict compliance requirements, such as banking, healthcare and government.

MFA Delete

MFA Delete adds another layer of protection by requiring multi-factor authentication before someone can:

Permanently delete an object version
Disable bucket versioning

This helps prevent accidental or unauthorized deletions.

9. What is a VPC? What are its main components?

A Virtual Private Cloud (VPC) is your own private network inside AWS. It allows you to decide how resources communicate, which resources are accessible from the internet and how network traffic is controlled.

Some important VPC components are:

Subnets – Divide the VPC into public and private networks.
Route Tables – Decide where network traffic should go.
Internet Gateway (IGW) – Allows public internet access.
NAT Gateway – Lets private instances access the internet without exposing them publicly.
Security Groups – Instance-level firewall.
Network ACLs – Subnet-level firewall.

Together, these components help you build secure and scalable cloud networks.

10. What is the difference between a Public IP and an Elastic IP?

Both allow an EC2 instance to communicate over the internet, but they behave differently.

Feature	Public IP	Elastic IP
Type	Automatically assigned	Static public IPv4 address
Changes	May change after the instance is stopped and started	Remains the same until released
Assignment	Automatic	Manually allocated
Reusability	Cannot be moved easily	Can be reassigned to another instance
Best Use	Temporary internet access	Applications that require a fixed public IP

Elastic IPs are commonly used when an application must always be reachable using the same IP address.

11. What is Amazon Route 53? What routing policies does it support?

Amazon Route 53 is AWS's managed Domain Name System (DNS) service. It translates domain names like example.com into IP addresses so users can reach your application. Besides DNS resolution, Route 53 also supports domain registration, health checks and intelligent traffic routing.

Route 53 provides several routing policies:

Simple Routing – Routes traffic to a single resource.
Weighted Routing – Splits traffic based on assigned percentages.
Latency-Based Routing – Sends users to the AWS Region with the lowest network latency.
Failover Routing – Automatically redirects traffic to a backup resource if the primary one becomes unhealthy.
Geolocation Routing – Routes traffic based on the user's geographic location.
Geoproximity Routing – Routes traffic based on the location of AWS resources and optional traffic bias.
Multi-Value Answer Routing – Returns multiple healthy IP addresses to improve availability and basic load distribution.

Each routing policy is designed for a different use case, so choosing the right one depends on your application's requirements.

12. What is the difference between VPC Peering and AWS Transit Gateway?

Both VPC Peering and AWS Transit Gateway (TGW) allow communication between multiple VPCs, but they're designed for different use cases.

VPC Peering creates a direct connection between two VPCs. It's simple to set up and works well when you only need to connect a small number of VPCs.
AWS Transit Gateway acts as a central hub that connects multiple VPCs, VPNs and on-premises networks. Instead of creating separate connections between every VPC, each VPC connects to the Transit Gateway, making the network much easier to manage.

Feature	VPC Peering	AWS Transit Gateway
Connection	One-to-one	Hub-and-spoke
Routing	Non-transitive	Supports transitive routing
Management	Manual as the network grows	Centralized and easier to manage
Scalability	Best for a few VPCs	Best for large environments

When should you use each?

Use VPC Peering when you need to connect only a few VPCs.
Use Transit Gateway when managing many VPCs or building a hybrid cloud architecture.

13. What is an EC2 instance? How do you choose the right instance type?

An Amazon EC2 (Elastic Compute Cloud) instance is a virtual server that runs in AWS. You can use it to host websites, APIs, databases, applications or almost any workload that requires a server. Choosing the right instance type depends on your application's requirements.

Some factors to consider include:

CPU requirements
Memory (RAM)
Storage performance
Network throughput
Expected traffic
Budget

AWS provides different instance families for different workloads.

General Purpose (T, M) – Balanced compute, memory and networking.
Compute Optimized (C) – Best for CPU-intensive applications.
Memory Optimized (R, X) – Suitable for large databases and in-memory applications.
Storage Optimized (I, D) – Designed for workloads requiring high disk performance.

For pricing:

On-Demand – Pay only for what you use.
Reserved Instances / Savings Plans – Lower cost for long-term usage.
Spot Instances – Cheapest option for fault-tolerant workloads.

14. What is the difference between stopping and terminating an EC2 instance?

Although both actions stop your application from running, they have very different purposes.

Stopping an EC2 Instance	Terminating an EC2 Instance
Shuts down the instance temporarily	Permanently deletes the instance
Can be started again later	Cannot be recovered
Instance ID remains the same	Instance ID is permanently deleted
Root EBS volume is preserved (unless configured otherwise)	Root EBS volume is deleted by default*

*The root EBS volume is deleted only if the Delete on Termination option is enabled (which is the default setting).

Example

Stop a development server during weekends to reduce costs.
Terminate a temporary testing server after the project is completed.

15. What is an Amazon Machine Image (AMI)?

An Amazon Machine Image (AMI) is a template used to launch EC2 instances. Think of it as a blueprint for creating virtual servers.

An AMI usually contains:

Operating system (Linux or Windows)
Installed software
Application dependencies
Configuration settings
Block device mapping
Launch permissions

Instead of configuring every server manually, you can create an AMI once and launch multiple identical EC2 instances whenever needed.

16. What is an Auto Scaling Group (ASG)?

An Auto Scaling Group (ASG) automatically adds or removes EC2 instances based on application demand. When traffic increases, Auto Scaling launches more instances. When traffic decreases, it terminates unnecessary instances to reduce costs.

An Auto Scaling Group helps improve:

High availability
Scalability
Fault tolerance
Cost optimization

To configure an Auto Scaling Group, you need:

Launch Template (or Launch Configuration)
Auto Scaling Group
Scaling Policies
CloudWatch Alarms
VPC and Subnets

Auto Scaling is commonly used together with an Application Load Balancer (ALB) to distribute traffic across multiple EC2 instances.

17. What is an Elastic Load Balancer (ELB)? What are its different types?

An Elastic Load Balancer (ELB) automatically distributes incoming traffic across multiple targets, such as EC2 instances, containers, IP addresses or Lambda functions.

Instead of sending every request to a single server, ELB spreads the traffic across multiple healthy targets, improving both availability and performance.

AWS provides four types of load balancers.

1. Application Load Balancer (ALB)

Works at Layer 7 (HTTP/HTTPS).

Ideal for:

Web applications
REST APIs
Microservices
Path-based and host-based routing

2. Network Load Balancer (NLB)

Works at Layer 4 (TCP/UDP/TLS).

Best for:

Very high-performance applications
Low-latency workloads
Millions of requests per second

3. Gateway Load Balancer (GWLB)

Used to deploy and scale third-party virtual appliances such as:

Firewalls
Intrusion Detection Systems (IDS)
Intrusion Prevention Systems (IPS)

4. Classic Load Balancer (CLB)

An older generation load balancer that supports basic HTTP and TCP traffic.

AWS recommends using ALB or NLB for most new applications.

18. What are EC2 Placement Groups?

Placement Groups let you control how EC2 instances are physically placed inside AWS infrastructure. Depending on your workload, you may want instances to be close together for better performance or spread apart for higher availability.

AWS provides three types of Placement Groups.

1. Cluster Placement Group

Places instances close together inside the same Availability Zone.

Best for:

High Performance Computing (HPC)
Big data processing
Machine learning
Applications requiring very low latency

2. Partition Placement Group

Distributes instances across multiple logical partitions. If one partition fails, instances in other partitions continue running.

Commonly used for:

Hadoop
Kafka
Cassandra

3. Spread Placement Group

Places each instance on separate hardware. This minimizes the chance that a hardware failure affects multiple instances.

Ideal for:

Critical databases
Domain controllers
Small production workloads

19. What is AWS Lambda? How is it different from EC2?

AWS Lambda is a serverless compute service that lets you run code without managing servers. You simply upload your code and AWS automatically handles provisioning, scaling, patching and infrastructure management.

Lambda is commonly used for:

REST APIs
File processing
Event-driven applications
Scheduled jobs
Automation

Feature	EC2	Lambda
Server Management	You manage the server	AWS manages everything
Scaling	Manual or Auto Scaling	Automatic
Pricing	Pay while the instance is running	Pay only when the function executes
Best For	Long-running applications	Event-driven workloads

If you need full control over the operating system, choose EC2. If you only need to execute code in response to events, Lambda is usually the better choice.

20. What is an AWS Lambda Cold Start? How can you reduce it?

A Cold Start is the extra time AWS Lambda needs to prepare a new execution environment before running a function. This usually happens when:

A function is invoked for the first time.
The function hasn't been used for some time.
Lambda needs additional execution environments because of increased traffic.

Cold starts are generally more noticeable in Java and .NET than in Node.js or Python because their runtime initialization takes longer.

You can reduce cold starts by:

Using Provisioned Concurrency
Keeping deployment packages small
Removing unnecessary dependencies
Reducing initialization code outside the handler
Choosing lightweight runtimes when possible
Optimizing VPC networking if the function runs inside a VPC

21. What is Amazon S3? What durability and availability does it provide?

Amazon Simple Storage Service (S3) is AWS's object storage service.

It's commonly used to store:

Images
Videos
Documents
Backups
Application logs
Static website files
Data lakes

S3 stores data as objects inside buckets and automatically replicates it across multiple Availability Zones within a Region.

Amazon S3 provides:

99.999999999% (11 nines) durability, meaning your data is extremely unlikely to be lost.
99.99% availability for the S3 Standard storage class.

Durability refers to how safely AWS stores your data, while availability refers to how often you can successfully access it.

22. What is the difference between Amazon S3, EBS and EFS?

AWS offers different storage services for different workloads.

Feature	Amazon S3	Amazon EBS	Amazon EFS
Storage Type	Object Storage	Block Storage	File Storage
Access	API or URL	Attached to an EC2 instance	Shared file system
Scalability	Virtually unlimited	Increase volume size	Automatically grows and shrinks
Sharing	Easy to share over the internet	Usually attached to one EC2 instance at a time	Multiple EC2 instances can access simultaneously
Best For	Images, backups, logs	Databases and operating systems	Shared application files

Common use cases

Amazon S3 – Store website assets, backups, videos and logs.
Amazon EBS – Persistent storage for EC2 instances and databases.
Amazon EFS – Shared storage for multiple application servers.

23. What are S3 Storage Classes? What are Lifecycle Policies?

Not all data is accessed equally. Some files are used every day, while others are rarely accessed. To reduce storage costs, Amazon S3 provides multiple storage classes.

Some commonly used storage classes include:

S3 Standard – Frequently accessed data.
S3 Intelligent-Tiering – Automatically moves data between storage tiers based on usage.
S3 Standard-IA – Infrequently accessed data.
S3 One Zone-IA – Lower-cost storage in a single Availability Zone.
S3 Glacier Instant Retrieval – Archived data that still needs quick access.
S3 Glacier Flexible Retrieval – Long-term archival storage.
S3 Glacier Deep Archive – Lowest-cost storage for data rarely accessed.

What are Lifecycle Policies?

Lifecycle Policies automatically manage data as it ages. For example, you can configure S3 to:

Move files to cheaper storage after 30 days.
Archive files after 90 days.
Permanently delete logs after one year.

This helps reduce storage costs without manual intervention.

24. When would you choose Amazon RDS instead of DynamoDB?

The choice depends on the type of application you're building.

Choose Amazon RDS when:

You need a relational database.
Your application requires joins and complex SQL queries.
Transactions and ACID compliance are important.

Common examples include:

Banking applications
ERP systems
E-commerce platforms
CRM software

Choose Amazon DynamoDB when:

You need extremely low latency.
Your application must scale automatically.
Your data doesn't require complex relationships.

Common examples include:

Gaming applications
IoT platforms
Shopping carts
User sessions
Real-time analytics

25. What is Amazon Aurora? How is it different from Amazon RDS?

Amazon Aurora is a cloud-native relational database built by AWS.

It's compatible with MySQL and PostgreSQL, but offers better performance, availability and scalability than standard database engines running on Amazon RDS.

Feature	Amazon Aurora	Standard Amazon RDS
Performance	Higher	Standard
Storage	Automatically scales up to 128 TiB	Depends on the selected database engine and storage configuration
Replication	Six copies across three Availability Zones	Supports Multi-AZ deployments and read replicas (engine-dependent)
Failover	Faster	Generally slower
Cost	Higher	Lower

Aurora is a good choice for business-critical applications that require high availability and excellent performance.

26. What is Amazon CloudWatch?

Amazon CloudWatch is AWS's monitoring and observability service. It helps you monitor applications, infrastructure and AWS services from a single place.

With CloudWatch, you can:

Monitor CPU, memory (via CloudWatch Agent), disk and network usage
Collect application logs
Create dashboards
Set alarms
Trigger automated actions when thresholds are reached

For example, if an EC2 instance's CPU usage remains above 80% for several minutes, CloudWatch can automatically trigger an Auto Scaling policy to launch another instance.

CloudWatch plays a key role in monitoring application health, identifying issues early and automating operational tasks.

27. What is the difference between Amazon ECS and Amazon EKS? When should you use each?

Both Amazon ECS and Amazon EKS help you run and manage containers on AWS, but they're designed for different use cases.

Amazon ECS (Elastic Container Service)

Amazon ECS is AWS's own container orchestration service. It's simple to set up, tightly integrated with AWS services and requires very little operational effort.

Choose ECS if:

Your applications run entirely on AWS.
You want the easiest way to deploy Docker containers.
Your team doesn't have Kubernetes experience.

Amazon EKS (Elastic Kubernetes Service)

Amazon EKS is AWS's managed Kubernetes service. AWS manages the Kubernetes control plane while you manage your applications and worker nodes (or use Fargate).

Choose EKS if:

Your organization already uses Kubernetes.
You need portability across different cloud providers.
You want the complete Kubernetes ecosystem and its advanced features.

Comparison

Feature	Amazon ECS	Amazon EKS
Platform	AWS-native container service	Managed Kubernetes
Learning Curve	Easy	Moderate to High
Best For	AWS-focused applications	Kubernetes-based workloads
Portability	AWS only	Multi-cloud friendly

28. What is Infrastructure as Code (IaC)? What is the role of AWS CloudFormation?

Infrastructure as Code (IaC) is the practice of creating and managing infrastructure using code instead of manually configuring resources through the AWS Console.

Instead of clicking through multiple pages every time you need a server, database or VPC, you simply define everything in a template and let AWS create it automatically.

Benefits of IaC

Faster infrastructure provisioning
Consistent environments across Dev, QA and Production
Easy version control using Git
Reduced manual errors
Quick rollback if something goes wrong

What is AWS CloudFormation?

AWS CloudFormation is AWS's native Infrastructure as Code service.

You describe your infrastructure in YAML or JSON templates and CloudFormation automatically creates, updates and deletes AWS resources in the correct order.

It is widely used to automate infrastructure deployment and keep environments consistent.

29. Explain the difference between Amazon SNS and Amazon SQS. When would you use each?

Although both SNS and SQS are messaging services, they solve different problems.

Amazon SNS

Amazon SNS (Simple Notification Service) follows a publish-subscribe model. A single message can be delivered to multiple subscribers simultaneously.

Common use cases

Email notifications
SMS alerts
Triggering Lambda functions
Broadcasting application events

Amazon SQS

Amazon SQS (Simple Queue Service) is a message queue that stores messages until they're processed. Instead of broadcasting messages, SQS helps different applications communicate reliably without depending on each other.

Common use cases

Background jobs
Order processing
Payment processing
Asynchronous task execution

Comparison

Amazon SNS	Amazon SQS
Publish-subscribe messaging	Message queue
One message → Many subscribers	One message → One consumer
Real-time notifications	Reliable background processing
Event broadcasting	Application decoupling

Rule of Thumb

Use SNS when multiple services need to receive the same event.
Use SQS when work should be processed asynchronously and reliably.

30. Explain the difference between Monolithic and Microservices architecture.

These are two common ways of building applications.

Monolithic Architecture

In a monolithic application, all features are built into a single application. Everything is deployed together, scaled together and usually shares the same codebase.

This approach is simple for small applications but becomes difficult to maintain as the project grows.

Microservices Architecture

In a microservices architecture, the application is divided into small, independent services. Each service focuses on a single business capability and can be developed, deployed and scaled independently.

This architecture is commonly used for large cloud-native applications.

Comparison

Feature	Monolithic	Microservices
Codebase	Single	Multiple Services
Deployment	Entire Application	Individual Services
Scaling	Whole Application	Service-wise
Maintenance	Harder as project grows	Easier for large systems
Best For	Small projects	Large distributed systems

31. Explain Blue-Green Deployment and Rolling Deployment in AWS.

Both deployment strategies help release new versions of an application without causing significant downtime.

Blue-Green Deployment

Blue-Green deployment uses two identical environments.

Blue runs the current production version.
Green contains the new release.

Once the new version has been tested, traffic is switched from Blue to Green.

If something goes wrong, switching back to the previous version takes only a few seconds.

Best for

Applications where downtime isn't acceptable.

Rolling Deployment

Rolling deployment updates servers gradually instead of all at once.

For example, if you have 10 servers, AWS might update two at a time until every server is running the new version.

This approach requires fewer resources than Blue-Green deployments but takes longer to complete and rollbacks are usually slower.

When to use

Blue-Green → Fast rollback and zero downtime
Rolling → Simpler and more cost-effective deployments

32. An EC2 instance in a private subnet needs internet access to download updates. How would you configure it?

The recommended approach is to use a NAT Gateway.

Steps

Create a NAT Gateway in a public subnet.
Assign it an Elastic IP.
Update the route table of the private subnet so outbound traffic goes through the NAT Gateway.
Keep the EC2 instance in the private subnet without a public IP.

This setup allows the server to download updates while preventing inbound internet access, making it much more secure.

Note: A NAT Instance can also be used, but AWS generally recommends using a NAT Gateway because it's fully managed and scales automatically.

33. How would you design a serverless API backend on AWS?

A typical serverless architecture includes:

Amazon API Gateway receives incoming HTTP requests.
Amazon Cognito authenticates users.
AWS Lambda runs the application logic.
Amazon DynamoDB stores application data.
Amazon CloudWatch collects logs and metrics.
AWS CloudFormation or AWS SAM manages the infrastructure.

Benefits

Fully managed
Automatically scales with traffic
No server administration required

34. How would you design a highly available web application on AWS?

A production-ready highly available architecture removes every possible single point of failure.

Typical Architecture

Amazon Route 53 for DNS
Application Load Balancer (ALB)
Auto Scaling Group across multiple Availability Zones
EC2 instances running the application
Amazon RDS Multi-AZ database
Amazon CloudWatch for monitoring

If one Availability Zone goes down, traffic is automatically routed to healthy instances in another zone.

35. How would you build a CI/CD pipeline for a containerized application on AWS?

A typical AWS CI/CD pipeline:

Developers push code to GitHub or AWS CodeCommit.
AWS CodePipeline detects the change.
AWS CodeBuild compiles the application, runs tests and builds a Docker image.
Push the Docker image to Amazon ECR.
Deploy to Amazon ECS or Amazon EKS.
Monitor deployments using Amazon CloudWatch.

This automates the entire deployment process from code commit to production.

36. How would you troubleshoot intermittent 502 Bad Gateway errors behind an ALB?

A 502 Bad Gateway error usually means the load balancer couldn't get a valid response from the backend application.

Troubleshooting Steps

Check ALB access logs and CloudWatch metrics.
Verify application logs for crashes or exceptions.
Ensure health checks are passing.
Check CPU, memory and network utilization.
Verify Security Groups and Network ACLs.
Confirm Auto Scaling isn't routing traffic to unhealthy instances.

Working through these steps usually helps identify the root cause quickly.

37. AWS costs suddenly increased. How would you investigate?

A structured investigation should include:

Check the AWS Billing Dashboard.
Use Cost Explorer to identify which service caused the increase.
Review recent infrastructure changes using CloudTrail.
Look for:
- Idle EC2 instances
- Unused EBS volumes
- Unnecessary S3 storage
Verify data transfer costs.
Recommend:
- Reserved Instances
- Savings Plans
- Spot Instances
- S3 Lifecycle Policies

The goal is to identify what changed, determine why and reduce ongoing costs.

38. Design a scalable photo-sharing application on AWS.

Architecture

Amazon S3 for storing photos
Amazon CloudFront for global image delivery
Amazon API Gateway for REST APIs
AWS Lambda for backend logic
Amazon Cognito for authentication
Amazon DynamoDB for user profiles and metadata
Amazon OpenSearch Service for search
Amazon Route 53 for DNS
Amazon CloudWatch for monitoring

Benefits

Highly scalable
Global performance
Minimal infrastructure management

39. IAM access keys were accidentally pushed to a public GitHub repository. What would you do?

Treat this as a security incident.

Immediate Actions

Deactivate or delete the exposed keys immediately.
Generate new credentials if needed.
Review CloudTrail logs for suspicious activity.
Remove any unauthorized resources.
Rotate related secrets such as:
- Database passwords
- API keys
Store secrets in AWS Secrets Manager.
Enable GitHub Secret Scanning.
Update security practices to prevent future incidents.

Priority: Secure the account first, investigate afterward.

40. How would you migrate a 10 TB Oracle database to AWS with minimal downtime?

For large production databases, AWS Database Migration Service (AWS DMS) is typically the preferred solution.

Migration Strategy

Assess the existing database.
Use AWS Schema Conversion Tool (SCT) if migrating to another database engine.
Perform the initial data load using AWS DMS.
Enable Change Data Capture (CDC).
Schedule a short maintenance window.
Perform the final synchronization.
Point the application to the new Amazon RDS database.

Using CDC minimizes downtime because data replication continues while the source database remains online.

41. How would you design a scalable AWS network architecture for a large enterprise?

For large organizations, a Hub-and-Spoke architecture is commonly used.

Typical Architecture

AWS Organizations for multi-account management
AWS Transit Gateway for connecting multiple VPCs
AWS Direct Connect for private on-premises connectivity
AWS Resource Access Manager (RAM) for resource sharing
Security Groups
Network ACLs
IAM
AWS KMS
Amazon Route 53 for DNS and failover
Amazon CloudWatch for monitoring
AWS CloudTrail for auditing

Benefits

Simplified networking
Better security
Easier scalability
Avoids complex VPC peering meshes

42. Your Lambda function is timing out while connecting to an RDS database inside a VPC. How would you troubleshoot it?

Lambda timeouts when accessing RDS are usually caused by networking issues, database connection limits or slow queries. I would troubleshoot the problem step by step instead of guessing.

Troubleshooting Steps

Check Amazon CloudWatch Logs to identify where the function is spending most of its time.
Use AWS X-Ray to determine whether the delay is in Lambda initialization, database connection or query execution.
If the function experiences cold starts, consider enabling Provisioned Concurrency, especially for Java or .NET applications.
Check whether the database has reached its maximum connection limit. If many Lambda functions connect simultaneously, use Amazon RDS Proxy to reduce connection overhead.
Review Amazon RDS metrics:
- CPU Utilization
- Memory Usage
- Active Connections
- Slow Queries
Verify the VPC configuration:
- Security Groups
- Private Subnets
- Route Tables
- Network ACLs
Perform load testing after making changes and continue monitoring to ensure the issue is resolved.

43. Which AWS services would you use to ingest, process and analyze real-time IoT sensor data?

A common architecture for real-time IoT workloads looks like this:

Architecture

Amazon Kinesis Data Streams collects sensor data from thousands or millions of devices.
AWS Lambda processes incoming events, filters invalid data and triggers notifications.
Amazon Kinesis Data Analytics performs real-time SQL-based analytics, aggregations and anomaly detection.
Amazon S3 stores both raw and processed data for long-term storage.
Amazon Athena queries data stored in S3 using SQL.
Amazon Redshift provides advanced analytics and reporting.

Security & Operations

IAM for access control
AWS KMS for encryption
Amazon CloudWatch and AWS X-Ray for monitoring
AWS Glue for metadata management and ETL jobs (if required)

Benefits

Fully managed
Highly scalable
Low operational overhead
Near real-time analytics

44. How would you design a Zero Trust network for microservices running on Amazon EKS?

In a Zero Trust architecture, no service is trusted by default. Every request must be authenticated and authorized.

Design

Assign each microservice its own IAM Role using IAM Roles for Service Accounts (IRSA).
Apply Kubernetes Network Policies with a default deny-all rule.
Allow communication only between explicitly authorized services.
Use a service mesh such as:
- Istio
- Linkerd
- AWS App Mesh

to enable Mutual TLS (mTLS) for encrypted and authenticated service-to-service communication.

Secure inbound traffic using:
- Application Load Balancer (ALB)
- TLS Certificates
- AWS WAF
Restrict outbound traffic using:
- VPC Endpoints
- NAT Gateway
- Strict Egress Policies

Benefits

Strong identity-based security
Encrypted service communication
Reduced attack surface
Least privilege access

45. Your application requires an RTO of 15 minutes and an RPO of 1 minute. Which disaster recovery strategy would you recommend?

For these requirements, Warm Standby is usually the best choice.

Architecture

A smaller but fully functional copy of the application runs continuously in a secondary AWS Region.
Data is continuously replicated using:
- Amazon Aurora Global Database
- DynamoDB Global Tables
- Amazon S3 Cross-Region Replication
Amazon Route 53 Health Checks monitor the primary region.
During a disaster:
- Route 53 redirects traffic.
- Auto Scaling increases capacity in the standby region.

Why Warm Standby?

Fast recovery
Meets low RTO/RPO requirements
Lower cost than Active-Active deployments

46. An EC2 instance cannot access files stored in Amazon S3. How would you troubleshoot it?

I'd begin with IAM permissions before checking networking.

Troubleshooting Steps

Verify the EC2 instance has the correct IAM Role attached.
Ensure the role includes permissions such as:
- s3:GetObject
- s3:ListBucket
Review the S3 Bucket Policy for explicit Deny statements.
If the bucket uses AWS KMS encryption, verify the IAM role has access to the KMS key.
Verify connectivity using:
- Internet Gateway
- NAT Gateway
- S3 VPC Endpoint
Test using AWS CLI:
```
aws s3 ls
aws s3 cp
```
Review CloudTrail and CloudWatch Logs for permission or networking errors.

47. Design a highly available and scalable e-commerce platform on AWS.

A production-ready e-commerce application should be secure, scalable and capable of handling sudden traffic spikes.

Architecture

Amazon Route 53 for DNS and failover
Application Load Balancer (ALB)
EC2 Auto Scaling Groups across multiple Availability Zones
Amazon Aurora or Amazon RDS Multi-AZ
Amazon ElastiCache (Redis)
Amazon S3 + CloudFront for images and static content
AWS WAF + AWS Shield for security
Amazon CloudWatch for monitoring

Benefits

High availability
Automatic scaling
Low latency
Protection against DDoS attacks

48. CPU usage is above the scaling threshold, but your Auto Scaling Group isn't launching new instances. How would you troubleshoot it?

When Auto Scaling doesn't respond, I verify every component involved in the scaling process.

Checklist

Confirm the CloudWatch Alarm has entered the ALARM state.
Verify the scaling policy is attached to the Auto Scaling Group.
Check whether the ASG has already reached its Maximum Capacity.
Review the Launch Template:
- AMI
- Instance Type
- IAM Role
- Security Groups
- Subnets
Review the Auto Scaling Activity History for failed launch attempts.
Check EC2 service quotas and subnet IP availability.

Most Auto Scaling issues are caused by configuration problems rather than the scaling policy itself.

49. An entire AWS Region becomes unavailable. How would you keep the application running?

To survive a regional outage, the application should already be deployed across multiple AWS Regions.

Architecture

Deploy the application in a secondary AWS Region.
Replicate databases using:
- Aurora Global Database
- DynamoDB Global Tables
Replicate S3 objects using Cross-Region Replication (CRR).
Configure Amazon Route 53 Failover Routing with Health Checks.
Use CloudFormation or Terraform to keep both regions identical.
Continuously monitor both regions.
Perform regular Disaster Recovery (DR) drills.

Benefits

Minimal downtime
Automatic failover
Improved business continuity

50. How would you securely manage API keys and database passwords in AWS?

Sensitive credentials should never be stored directly in application code or configuration files.

Best Practices

Store secrets in AWS Secrets Manager.
Use IAM Roles instead of hardcoded credentials.
Enable automatic secret rotation whenever supported.
Encrypt secrets using AWS KMS.
Retrieve secrets dynamically at runtime.
Monitor secret access using:
- AWS CloudTrail
- Amazon CloudWatch

Benefits

Improved security
Automated credential rotation
Easier compliance
Reduced operational overhead

51. Your application stores millions of files every day. How would you design the storage architecture?

For this type of workload, Amazon S3 is the ideal solution because it offers virtually unlimited storage and extremely high durability.

Architecture

Amazon S3 as the primary storage layer.
S3 Intelligent-Tiering for automatic cost optimization.
Lifecycle Policies to move old files to Glacier storage classes.
CloudFront for fast global content delivery.
S3 Versioning to protect against accidental deletion.
Cross-Region Replication (optional) for disaster recovery.
CloudWatch and Cost Explorer to monitor storage usage and costs.

Benefits

Virtually unlimited scalability
Cost optimization
High durability (11 9's)
Global content delivery

52. Microservices running on Amazon EKS cannot communicate with each other. How would you troubleshoot the issue?

When services can't communicate, I verify the Kubernetes networking components one by one.

Troubleshooting Steps

Check that all Pods are running:
```
kubectl get pods
```
Verify Kubernetes Services:
```
kubectl get svc
```
Verify Endpoints:
```
kubectl get endpoints
```
Test DNS resolution to ensure CoreDNS is functioning correctly.
Review Kubernetes Network Policies to confirm communication is allowed.
Verify AWS Security Groups and VPC networking configuration.
Review container logs and application logs for connection failures.
If using a Service Mesh (Istio, Linkerd, AWS App Mesh), inspect:
- Request traces
- Metrics
- mTLS configuration
Use CloudWatch or the service mesh observability tools to identify networking bottlenecks.

Common Root Causes

Incorrect Service selectors
Missing Endpoints
Network Policy restrictions
DNS failures
Security Group misconfigurations
mTLS or Service Mesh configuration issues