AWS Interview Questions and Answers

AWS interviews test two things: whether you know what the main services do, and whether you can put them together into a safe, reliable and affordable design. This guide gives you 72 AWS interview questions and answers, arranged from basics to scenario questions, for freshers and for experienced cloud and DevOps candidates.

Every answer starts with a short, direct response you can say aloud, followed by a comparison table, a command or a policy where it helps. The page is written for current AWS. It drops retired features such as EC2 Classic and states limits only where they were checked against the AWS documentation, with a note to recheck before relying on them.

The guide has ten parts: 8 on AWS basics, 11 on compute, 8 on storage, 9 on networking, 10 on security and IAM, 5 on databases, 5 on serverless and integration, 6 on monitoring, cost and infrastructure as code, 3 on AI services and 7 scenario questions. Use the contents list to jump to your level, and practise the scenario questions aloud.

Key points

• 72 questions in ten parts, from AWS basics to scenario design.
• Every answer opens with a short answer you can say in an interview.
• Comparison tables for EC2 pricing, S3 classes, storage services, security controls and databases.
• Current as of 2026, with retired services removed.
• Scenario answers show what the interviewer is listening for.

In this guide

AWS Basics and Global Infrastructure (Freshers)

Every AWS interview starts with how the platform is organised, how you pay for it and who is responsible for what. Keep these answers short and precise.

Q1. What is AWS, and what is cloud computing?

Cloud computing means renting computing resources such as servers, storage and databases over the internet and paying for what you use, instead of buying and running your own hardware. Amazon Web Services, or AWS, is the largest provider of these services, offering compute, storage, networking, databases, analytics, security and AI tools.

The main benefits to mention are speed of setup, pay as you go pricing, the ability to scale up and down, and a global footprint.

Q2. What are Regions, Availability Zones and edge locations?

A Region is a separate geographic area, such as Mumbai or Frankfurt. Each Region has multiple Availability Zones, which are isolated groups of data centres within the Region, connected by fast private links. Edge locations are separate sites around the world where CloudFront caches content close to users. Edge locations are not Availability Zones.

Q3. What is the shared responsibility model?

AWS is responsible for the security of the cloud, which means the physical data centres, hardware and the core services. The customer is responsible for security in the cloud, which means data, identity and access management, operating system patching on EC2, network settings and encryption choices. The split moves toward AWS for managed services.

What the interviewer is listening for: You can name both sides and give one example of each, such as AWS securing the data centre and the customer configuring a bucket policy.

Q4. What is the difference between IaaS, PaaS and SaaS?

In Infrastructure as a Service, you rent basic building blocks such as virtual servers, and you manage the operating system and software, as with EC2. In Platform as a Service, the provider manages the servers and runtime and you manage the application, as with Elastic Beanstalk. In Software as a Service, you simply use the finished software.

Q5. How does AWS pricing work, and what are the main ways to lower cost?

AWS charges for what you use, usually by the hour or second for compute, by the gigabyte for storage, and by the gigabyte for data leaving AWS. The main ways to lower cost are right sizing instances, using Savings Plans or Reserved Instances for steady workloads, using Spot Instances for flexible work, and shutting down idle resources.

Data transfer into AWS is generally free, while transfer out to the internet and between Regions is charged. This surprises many beginners.

Q6. What are the pillars of the AWS Well Architected Framework?

The framework has six pillars: operational excellence, security, reliability, performance efficiency, cost optimisation and sustainability. Each pillar has design principles and questions that help you review a workload. Interviewers often ask you to apply them to a scenario, for example choosing multiple Availability Zones for reliability.

Q7. How can you interact with AWS: console, CLI and SDK?

The AWS Management Console is the web interface, the AWS Command Line Interface runs commands from a terminal and is good for scripts, and the SDKs let applications call AWS services from code in languages such as Python and Java. All three call the same service APIs, so anything you do in one is possible in the others.

# List buckets, then create one in the Mumbai Region
aws s3 ls
aws s3 mb s3://example-prwatech-demo-bucket --region ap-south-1

# Show the account and identity the CLI is using
aws sts get-caller-identity

Q8. What is the AWS Free Tier?

The Free Tier lets new customers try AWS services at no cost within set limits. It includes short free trials for some services, always free allowances for others, and, for newer accounts, a credit based plan. Terms change, so check the current Free Tier page. Always set a budget alert, because usage above the limits is charged.

Compute: EC2, Auto Scaling and Containers (Freshers and Intermediate)

Compute is the largest topic in most AWS interviews. Know the purchasing options and when each service fits.

Q9. What is Amazon EC2, and what are the main instance families?

Amazon EC2 provides resizable virtual servers called instances. Instance types are grouped into families by purpose: general purpose such as M and T, compute optimised such as C, memory optimised such as R and X, storage optimised such as I and D, and accelerated computing such as P and G for GPUs. Choose the family by what limits your workload.

Current instances run on the AWS Nitro System, and many families offer Graviton processors based on Arm, which often give better price performance for suitable workloads.

Q10. What are the EC2 purchasing options?

On Demand has no commitment and is billed per second. Savings Plans and Reserved Instances give a lower price for a one or three year commitment. Spot Instances use spare capacity at a large discount, up to 90 percent, but can be interrupted with two minutes notice. Dedicated Hosts give you a whole physical server.

Q11. What is an AMI?

An Amazon Machine Image is a template that contains the operating system, software and settings used to launch an EC2 instance. You can use AWS provided, marketplace or your own images. A custom AMI lets you launch many identical servers quickly, and AMIs are Region specific, so copy one to use it in another Region.

Q12. What is the difference between EBS and instance store?

Amazon EBS gives network attached block storage that persists independently of the instance, can be backed up with snapshots and lives in one Availability Zone. Instance store is physical disk attached to the host that is very fast but lost when the instance stops or fails, so use it only for temporary data such as caches.

Q13. What are security groups, and how are they used with EC2?

A security group is a virtual firewall attached to an instance or network interface. It contains allow rules only for inbound and outbound traffic. By default it blocks all inbound traffic and allows all outbound traffic. Security groups are stateful, so reply traffic for an allowed request is permitted automatically.

# Create a security group and allow HTTPS from anywhere

aws ec2 create-security-group --group-name web-sg --description "Web servers" --vpc-id vpc-0abc1234

aws ec2 authorize-security-group-ingress --group-id sg-0abc1234 \
  --protocol tcp --port 443 --cidr 0.0.0.0/0

Q14. What is Auto Scaling, and how does it work with a load balancer?

An Auto Scaling group keeps the number of EC2 instances between a minimum and a maximum, replacing unhealthy ones and adding or removing instances based on policies such as target CPU use. A load balancer in front spreads traffic across the instances, and the group registers new instances with it automatically.

A common design is an Auto Scaling group spread over at least two Availability Zones behind an Application Load Balancer.

Q15. What are the types of Elastic Load Balancer?

The Application Load Balancer works at layer 7 and routes HTTP and HTTPS traffic by path, host or header. The Network Load Balancer works at layer 4, handles TCP, UDP and TLS with very low latency and supports static IP addresses. The Gateway Load Balancer inserts third party network appliances. The Classic Load Balancer is the older type.

Q16. What is AWS Lambda, and what are its main limits?

AWS Lambda runs your code in response to events without you managing servers, and you pay only for the time the code runs. A function can have between 128 MB and 10,240 MB of memory and run for up to 15 minutes per invocation. Check the Lambda quotas page, because limits change.

Source: the AWS Lambda quotas page. Re check it before publishing, since AWS revises quotas.

Q17. What is a Lambda cold start, and how do you reduce it?

A cold start is the extra time Lambda needs to create a new execution environment and load your code when no warm one is available. It matters for latency sensitive requests. Reduce it with smaller packages, lighter initialisation, faster runtimes, provisioned concurrency to keep environments ready, and SnapStart on supported runtimes.

Q18. What is the difference between ECS, EKS and Fargate?

Amazon ECS is the AWS native service for running Docker containers. Amazon EKS runs Kubernetes and suits teams that want the Kubernetes ecosystem and portability. AWS Fargate is a serverless way to run containers on either one, so you do not manage the EC2 servers. Choose EKS for Kubernetes skills and ECS for simplicity.

Q19. What are placement groups?

A placement group controls how instances are placed on hardware. A cluster group packs instances close together for low latency and high network speed. A spread group places a small number of instances on separate hardware to reduce correlated failure. A partition group spreads groups of instances across partitions, which suits large distributed systems such as Hadoop or Kafka.

Storage: S3, EBS, EFS and Content Delivery (Freshers and Intermediate)

Storage questions focus on choosing the right service and controlling cost. Be ready to compare options.

Q20. What is Amazon S3?

Amazon S3 is object storage that holds any amount of data as objects inside buckets, accessed over HTTP through an API. It is designed for very high durability, 11 nines, and scales without capacity planning. A single object can be up to 5 TB. S3 is used for backups, data lakes, static websites and application files.

S3 has offered strong read after write consistency for all objects since December 2020, so a new object or an overwrite is visible immediately to later reads.

Q21. What are the S3 storage classes?

The classes trade storage price against retrieval cost and speed. S3 Standard is for frequent access. Intelligent Tiering moves objects between tiers automatically. Standard IA and One Zone IA suit infrequent access. The Glacier classes, Instant Retrieval, Flexible Retrieval and Deep Archive, are for archives. Express One Zone gives the lowest latency in one zone.

Glacier Instant RetrievalRare, but needs fast accessMillisecondsArchive pricing with instant reads

Glacier Flexible RetrievalArchivesMinutes to hoursLower storage costGlacier Deep ArchiveLong term archivesHoursLowest storage cost

Check the S3 pricing page for current minimum storage durations and retrieval fees.

Q22. How do S3 versioning and lifecycle rules work?

Versioning keeps every version of an object, so you can recover from accidental deletes and overwrites. Lifecycle rules automatically move objects to cheaper storage classes after a set number of days and delete them when they expire. Together they protect data and cut cost, and you can also expire old versions to stop their cost growing.

aws s3api put-bucket-versioning --bucket example-bucket \
  --versioning-configuration Status=Enabled

aws s3api put-bucket-lifecycle-configuration --bucket example-bucket \
  --lifecycle-configuration file://lifecycle.json

Q23. How do you secure an S3 bucket?

Keep Block Public Access on, give access through IAM policies and bucket policies using least privilege, and use pre signed URLs for temporary sharing. Encrypt data, since new objects are encrypted with SSE S3 by default and SSE KMS gives you key control. Turn on access logging or CloudTrail data events for audit.

• Block Public Access is on by default for new buckets, and access control lists are disabled by default.
• Use bucket policies that allow only the specific roles and conditions you need.
• Use SSE KMS when you need key rotation control and an audit trail of key use.
• Use versioning with MFA delete or Object Lock for data that must not be changed.

Q24. What is a pre signed URL?

A pre signed URL is a link that gives temporary access to a private S3 object, or lets someone upload to a specific key, without sharing credentials. It is signed with the permissions of the person who created it and stops working after the expiry time. Use it for downloads or uploads from a web application.

aws s3 presign s3://example-bucket/reports/q3.pdf --expires-in 900

Q25. What is the difference between EBS, EFS and S3?

EBS is block storage attached to one EC2 instance in one Availability Zone, like a hard disk. EFS is a shared network file system that many instances can mount at once across zones. S3 is object storage accessed through an API, not mounted as a disk. Choose by access pattern: disk, shared files or objects.

Q26. What is Amazon CloudFront?

CloudFront is a content delivery network that caches copies of your content at edge locations close to users, which reduces latency and load on the origin. The origin can be an S3 bucket, a load balancer or another web server. It also supports HTTPS, signed URLs and protection with AWS WAF.

Q27. How do you move large amounts of data into AWS?

For networks with enough bandwidth, use the AWS CLI or DataSync, with S3 multipart upload. For very large or slow connections, use the AWS Snow Family devices, which are shipped to you and returned. For ongoing transfer, use Direct Connect or a VPN. Choose by how much data there is and how fast it must arrive.

Networking and VPC (Intermediate)

Networking is where candidates are separated. Be able to draw a simple VPC and explain how traffic flows through it.

Q28. What is a VPC, and what are its components?

A Virtual Private Cloud is your own isolated network inside AWS, where you define the IP range and launch resources. Its main parts are subnets, route tables, an internet gateway, NAT gateways, security groups and network ACLs. Each subnet lives in one Availability Zone, so you use several subnets for high availability.

Q29. What is the difference between a public and a private subnet?

A public subnet has a route to an internet gateway, so resources with public addresses can be reached from the internet. A private subnet has no direct route to the internet gateway, so resources there are not reachable from outside. Private resources reach the internet through a NAT gateway placed in a public subnet.

Q30. What is the difference between a security group and a network ACL?

A security group works at the instance level, allows rules only and is stateful. A network ACL works at the subnet level, supports allow and deny rules, is stateless and evaluates rules in number order. Use security groups as the main control and network ACLs as an extra layer, for example to block a specific address range.

Q31. What is a NAT gateway, and why is it used?

A NAT gateway lets resources in a private subnet start outbound connections to the internet, for example to download updates, without allowing inbound connections from the internet. It sits in a public subnet and has an Elastic IP address. It belongs to one Availability Zone, so use one per zone for resilience.

Q32. What are VPC endpoints?

A VPC endpoint lets resources in your VPC reach AWS services privately without using the internet, a NAT gateway or a public address. Gateway endpoints, for S3 and DynamoDB, are added to route tables and are free. Interface endpoints use AWS PrivateLink with a private IP in your subnet and are charged per hour and per gigabyte.

Q33. What is the difference between VPC peering and Transit Gateway?

VPC peering is a one to one private connection between two VPCs, and it does not pass traffic through a third VPC. A Transit Gateway is a central hub that connects many VPCs and on premises networks, so you avoid building a mesh of peering links. Use peering for a few VPCs and Transit Gateway as the network grows.

Q34. What are Route 53 routing policies?

Route 53 is the AWS DNS service, and its routing policies decide how it answers queries. Simple returns one record. Weighted splits traffic by proportion. Latency sends users to the Region with the lowest latency. Failover uses health checks to move to a standby. Geolocation and geoproximity route by user location.

Q35. What is the difference between Direct Connect and a site to site VPN?

A site to site VPN creates an encrypted tunnel over the public internet, which is quick to set up and low cost but has variable performance. Direct Connect is a dedicated private network link from your site to AWS, with more consistent speed and latency but a longer set up. Many companies use a VPN as a backup for Direct Connect.

Q36. What happened to EC2 Classic and ClassicLink?

EC2 Classic was the original network model, where instances ran in a single shared network. AWS retired EC2 Classic on 15 August 2022, and ClassicLink was retired with it. All current instances run inside a VPC. If an interview question mentions EC2 Classic, answer that it is retired and explain the VPC approach instead.

Security, IAM and Governance (Intermediate)

Security is part of almost every scenario question. Always answer with least privilege, encryption and logging in mind.

Q37. What is IAM, and what are users, groups, roles and policies?

AWS Identity and Access Management controls who can access which resources. A user is an identity for a person or application, a group is a set of users, and a role is an identity that is assumed temporarily by a user, service or application. A policy is a JSON document that lists the allowed or denied actions on resources.

Q38. What is the principle of least privilege, and how do you apply it in IAM?

Least privilege means granting only the permissions needed for a task and nothing more. In IAM, start with no access, add specific actions on specific resources, use conditions where possible, review access regularly with IAM Access Analyzer and last used data, and remove unused permissions. Avoid policies that allow all actions on all resources.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject"],
      "Resource": "arn:aws:s3:::example-bucket/reports/*"
    }
  ]
}

This policy allows reading objects under one prefix of one bucket. It does not allow listing the bucket, writing or deleting.

Q39. How does IAM decide whether a request is allowed?

By default every request is denied. An explicit allow in an applicable policy permits it, but an explicit deny in any policy always overrides an allow. Other layers can also limit access, such as service control policies in AWS Organizations, permissions boundaries and session policies, and the final access is the overlap of all of them.

Q40. What is the difference between an IAM user and an IAM role?

An IAM user has long term credentials such as a password or access keys. A role has no permanent credentials. It gives temporary credentials, issued through AWS STS, to whoever assumes it, such as an EC2 instance, a Lambda function or a person from another account. Prefer roles and short lived credentials over access keys.

Q41. How should you protect the root user of an AWS account?

Use the root user only for the few tasks that require it. Protect it with a strong unique password and multi factor authentication, do not create access keys for it, and keep the sign in details secure and shared only as your policy allows. Do daily work with IAM Identity Center or IAM roles instead.

Q42. What is AWS IAM Identity Center?

IAM Identity Center is the service for giving people single sign on access to multiple AWS accounts and applications from one place. You connect it to your company directory or use its own, then assign permission sets to users and groups per account. It replaces long lived IAM users for staff and is the successor to AWS SSO.

Q43. What is the difference between CloudWatch, CloudTrail and AWS Config?

CloudWatch collects metrics, logs and alarms about performance and health. CloudTrail records API calls, answering who did what and when. AWS Config records resource configurations over time and checks them against rules, answering what changed and whether it is compliant. Together they cover monitoring, auditing and compliance.

Q44. What is AWS KMS, and how does it relate to encryption?

AWS Key Management Service creates and controls the encryption keys used by many AWS services and your own applications. Services such as S3, EBS and RDS can encrypt data with KMS keys, and every key use is logged in CloudTrail. Key policies and grants control who can use a key, and keys can rotate automatically.

Q45. What is the difference between Secrets Manager and Systems Manager Parameter Store?

Both store configuration values securely. Secrets Manager is built for secrets such as database passwords, with automatic rotation and a price per secret. Parameter Store is simpler, with free standard parameters for configuration and encrypted values, but without built in rotation for most secrets. Never put secrets in code or in plain text environment variables.

Q46. Which AWS services help detect threats and vulnerabilities?

Amazon GuardDuty watches logs and network activity for suspicious behaviour. Amazon Inspector scans instances, container images and Lambda functions for known vulnerabilities. AWS Security Hub collects and prioritises findings, and Amazon Macie finds sensitive data in S3. AWS WAF and Shield protect web applications from common attacks and DDoS.

Databases and Data Services (Intermediate)

Choosing the right database is a favourite scenario question. Start from the access pattern, not from the product name.

Q47. How do RDS, Aurora, DynamoDB and Redshift differ?

Amazon RDS runs managed relational databases such as MySQL and PostgreSQL. Aurora is a cloud built, MySQL and PostgreSQL compatible database with higher performance and faster failover. DynamoDB is a serverless key value and document NoSQL database. Redshift is a columnar data warehouse for analytics on large datasets.

Q48. What is the difference between RDS Multi AZ and read replicas?

Multi AZ keeps a synchronous standby copy in another Availability Zone and fails over to it automatically, which improves availability but does not serve reads in the standard setup. Read replicas are asynchronous copies used to scale read traffic and can be in another Region. One is for resilience, the other is for performance.

Q49. How do you design a DynamoDB table?

Start from the questions the application asks, then choose a partition key with many distinct values so that traffic spreads evenly, and a sort key if you need ordered or range queries. Use global secondary indexes for other access patterns. Choose on demand capacity for unpredictable traffic and provisioned capacity with auto scaling for steady traffic.

A single item can be up to 400 KB. A hot partition, where one key receives most of the traffic, is the most common design problem.

Q50. What is Amazon ElastiCache used for?

ElastiCache is a managed in memory cache, using Redis compatible or Memcached engines. It sits in front of a database to serve frequent reads in microseconds, which lowers database load and latency. Common uses are session storage, leaderboards and caching query results. Set an expiry time and plan how to handle stale data.

Q51. What is AWS DMS, and how do you migrate a database with little downtime?

AWS Database Migration Service copies data from a source database to a target, and can keep the target updated with ongoing change data capture. For minimal downtime, run a full load, let change capture catch up, test the target, and then switch the application over during a short window. The Schema Conversion Tool helps when engines differ.

Serverless and Application Integration (Intermediate)

Serverless and messaging services appear often in design questions. Know what each one is for and how they combine.

Q52. What is Amazon API Gateway?

API Gateway is a managed service for creating, publishing and securing HTTP, REST and WebSocket APIs. It handles routing, authorisation, throttling and request validation, and it commonly sits in front of Lambda functions. It lets you build a backend without managing servers. Add caching and usage plans to control load and cost.

Q53. What is the difference between SQS, SNS and EventBridge?

SQS is a queue where consumers pull messages, which decouples producers from consumers and absorbs spikes. SNS is a publish and subscribe service that pushes one message to many subscribers. EventBridge is an event bus that routes events from AWS services, your apps and partners to targets using rules. Use them together for fan out designs.

Q54. What is the difference between SQS Standard and FIFO queues?

Standard queues give nearly unlimited throughput and at least once delivery, so messages can occasionally arrive twice and out of order. FIFO queues keep messages in order within a message group and support exactly once processing through deduplication, with lower throughput limits. Choose FIFO when order and duplicates matter, for example payment steps.

Q55. What is AWS Step Functions?

Step Functions lets you coordinate several services into a workflow using a state machine. It manages the order of steps, retries, error handling, parallel branches and waiting, so you do not write that logic yourself. It suits long running business processes, data pipelines and approval flows built from Lambda functions and other services.

Q56. What is Amazon Kinesis, and when do you use it?

Kinesis is a family of services for streaming data. Kinesis Data Streams collects and stores real time records for custom processing, Data Firehose loads streaming data into destinations such as S3 and Redshift, and Managed Service for Apache Flink analyses streams. Use Kinesis when many producers send events that need processing within seconds.

Monitoring, Cost and Infrastructure as Code (Intermediate and Experienced)

Experienced candidates are expected to show how they keep a workload observable, repeatable and affordable.

Q57. What is infrastructure as code, and how does CloudFormation work?

Infrastructure as code means defining resources in text files that can be versioned, reviewed and reused. In CloudFormation you write a template in YAML or JSON that describes resources, then create a stack from it. CloudFormation creates, updates and deletes the resources in the correct order, and change sets show what will change before you apply it.

AWSTemplateFormatVersion: "2010-09-09"
Resources:
  ArtifactsBucket:
    Type: AWS::S3::Bucket
    Properties:
      VersioningConfiguration:
        Status: Enabled

Q58. How do CloudFormation, Terraform and the AWS CDK compare?

CloudFormation is the AWS native service with declarative templates. Terraform is a third party tool that works across many clouds, using its own language and state file. The AWS CDK lets you write infrastructure in programming languages such as Python or TypeScript, and generates CloudFormation templates. Choose by team skills and whether you need multiple clouds.

Q59. How do you monitor an application on AWS?

Use CloudWatch metrics for performance, CloudWatch Logs for application and system logs, alarms that notify through SNS or trigger actions, and dashboards for a combined view. Add X Ray for tracing requests across services, and CloudTrail for audit. Define the signals that matter first, such as latency, error rate and saturation, and alert on those.

Q60. How do you control and reduce AWS cost?

Tag every resource so cost can be assigned, use AWS Budgets for alerts and Cost Explorer for analysis, and right size using Compute Optimizer. Use Savings Plans for steady load and Spot for flexible jobs, move data to cheaper S3 classes, delete unattached volumes and idle load balancers, and schedule non production environments to shut down at night.

What the interviewer is listening for: You mention measurement before action, and name specific levers.

Q61. What is AWS Organizations, and what are service control policies?

AWS Organizations lets you manage many accounts centrally, group them into organisational units, and consolidate billing. Service control policies set the maximum permissions that accounts in a unit can ever use, for example blocking use of certain Regions. They do not grant permissions by themselves. They only limit what IAM policies can allow.

Q62. What is AWS Trusted Advisor?

Trusted Advisor inspects your account and gives recommendations on cost optimisation, performance, security, fault tolerance and service limits. For example, it flags idle resources, open security groups and unencrypted buckets. The number of checks you can see depends on your support plan.

AWS AI and Machine Learning Services (Intermediate)

Cloud interviews now include a few questions on AI services. Keep your answers practical and tied to use cases.

Q63. What is Amazon SageMaker?

Amazon SageMaker AI is a managed service for building, training and deploying machine learning models. It provides notebooks, managed training jobs, tuning, a model registry and endpoints for real time or batch predictions. It removes much of the infrastructure work, and you still choose the algorithm, data and evaluation.

Q64. What is Amazon Bedrock?

Amazon Bedrock is a managed service that gives access to foundation models from several providers through one API. You can use the models for text and image generation, add your own data with retrieval, build agents, and apply guardrails, without hosting the models yourself. Your data stays in your account and is not used to train the base models.

Check the current Bedrock documentation for the list of available models and Regions, since both change often.

Q65. Which pre built AWS AI services should you know?

Know a few by use case. Rekognition analyses images and video, Textract extracts text and tables from documents, Comprehend analyses text, Transcribe converts speech to text, Polly converts text to speech, and Translate translates languages. They need no machine learning expertise and are called through simple APIs.

Scenario Based AWS Interview Questions (Experienced)

Scenario questions test design thinking. State your assumptions, name the services, and explain the trade offs you are making.

Q66. How would you design a highly available web application on AWS?

Place the application in an Auto Scaling group across at least two Availability Zones behind an Application Load Balancer, keep servers stateless, store sessions in ElastiCache or DynamoDB, use RDS Multi AZ or Aurora for the database, serve static files from S3 through CloudFront, and use Route 53 health checks. Monitor with CloudWatch.

• Compute: Auto Scaling group in two or more zones behind an Application Load Balancer.
• Data: Multi AZ database, and S3 for files with versioning.
• Edge: CloudFront and Route 53 with health checks.
• Operations: CloudWatch alarms, automated deployments and tested backups.

What the interviewer is listening for: You remove single points of failure at each layer and keep the servers stateless.

Q67. How would you lock down a new AWS account?

Secure the root user with MFA and no access keys, enable IAM Identity Center and stop using long term keys, turn on CloudTrail in all Regions, enable GuardDuty and Security Hub, set a budget alert, use AWS Organizations with service control policies, keep S3 Block Public Access on, and encrypt data with KMS.

What the interviewer is listening for: You start with identity, logging and guardrails before any workload.

Q68. Your S3 bill is rising quickly. How do you find the cause and reduce it?

Open Cost Explorer and filter by service and usage type to see whether the cost is storage, requests or data transfer. Use S3 Storage Lens and Storage Class Analysis to find cold data. Then add lifecycle rules to move or expire objects, use Intelligent Tiering where access is unknown, delete incomplete multipart uploads and old versions, and use CloudFront to cut transfer.

What the interviewer is listening for: You measure first and then pick the lever that matches the cost type.

Q69. How do you choose a disaster recovery strategy?

Start from the recovery time objective, how fast you must be back, and the recovery point objective, how much data you can lose. Backup and restore is the cheapest and slowest. Pilot light keeps core pieces running. Warm standby runs a scaled down copy. Multi site active active is the fastest and most expensive.

Q70. How would you build a serverless pipeline to process images uploaded by users?

Users upload to an S3 bucket, ideally with a pre signed URL. An S3 event triggers a Lambda function that resizes the image and writes the result to another bucket, and it records metadata in DynamoDB. Add an SQS queue between the event and Lambda to absorb spikes, and a dead letter queue to capture failures.

What the interviewer is listening for: You use events, decoupling and failure handling, and avoid managing servers.

Q71. You must migrate a production database to AWS with almost no downtime. What is your plan?

Assess the source and choose the target engine, create the target in a Multi AZ setup, convert the schema if engines differ, run a full load with DMS and keep it in sync with change data capture, test the application against the target, then cut over in a short window and keep the source as a fallback until the new system is proven.

What the interviewer is listening for: You plan testing and a rollback, not just the data copy.

Q72. How would you give an application on EC2 secure access to an S3 bucket?

Create an IAM role with a policy that allows only the needed actions on that bucket, attach it to the instance through an instance profile, and let the application use the temporary credentials from the instance metadata service. Do not store access keys on the server. Add a bucket policy and a VPC endpoint to keep traffic private.

What the interviewer is listening for: You choose roles and temporary credentials over stored keys.

Common questions about AWS interviews

What topics should I prepare for an AWS interview?

Prepare the core services first: EC2, S3, IAM, VPC, RDS, Lambda and CloudWatch. Then learn how to design for high availability, security and cost. Experienced roles add infrastructure as code, networking depth, disaster recovery and migration. Practise explaining a design out loud, because many interviews are scenario based.

Which AWS certification should I start with?

Start with AWS Cloud Practitioner if you are new to cloud, or go straight to Solutions Architect Associate if you have some experience. Developer Associate and SysOps Administrator Associate suit those roles. Check the current exam guides on the AWS Training and Certification site, because exams and names change.

How can a fresher get hands on AWS practice without a large bill?

Use the Free Tier or credits, set a budget alert on day one, and delete resources when you finish. Build small projects such as a static website on S3 with CloudFront, a Lambda function behind API Gateway, and a three tier application. Document each project, because interviewers ask about them.

Do AWS interviews include coding?

For cloud engineer and DevOps roles, expect scripting in Python or Bash, writing a CloudFormation or Terraform template, and reading JSON policies. Developer roles may include coding with the SDK. Practise automating a task, such as stopping idle instances, using the CLI or boto3.

How are AWS interviews different for experienced candidates?

They focus on design decisions and trade offs, such as choosing between services, planning disaster recovery, controlling cost and securing multiple accounts. You will be asked about incidents you have handled. Prepare two or three real examples with the problem, the action you took and the measured result.

A four week plan to prepare

Use this plan if you have about a month before your interview.

Practise with a trainer

If you want to practise these questions with a trainer and work on hands on projects, you can book a free demo class for the Prwatech AWS course. It covers core AWS services, networking, security, serverless and hands on labs.

Contact the learning team for current batch dates and fees.

Written by Mithun Ray, data engineering trainer at Prwatech. Reviewed by Avishekh Verma. Last updated October,2026.