AWS interviews for entry-level cloud roles focus on core services (EC2, S3, VPC, IAM, RDS), how they fit together, and how you keep a setup secure and affordable. Below are 25 questions that come up again and again, with answers short enough to say out loud in an interview.
Each answer gives the idea first and the detail second. If you are still deciding which cloud to learn, read AWS vs Azure vs Google Cloud first.
Cloud and AWS basics
1. What is cloud computing?
Renting computing resources such as servers, storage and databases over the internet, paying only for what you use, instead of buying and running your own hardware.
2. What are IaaS, PaaS and SaaS?
| Model | You manage | AWS example |
|---|---|---|
| IaaS | OS, runtime, app, data | EC2 |
| PaaS | App and data | Elastic Beanstalk, RDS |
| SaaS | Only your usage and data | Amazon WorkMail, Chime |
3. What is the difference between a Region and an Availability Zone?
A Region is a geographic area such as Mumbai (ap-south-1). Each Region has several Availability Zones, which are separate data centres with their own power and networking. Spreading servers across zones protects you when one zone fails.
4. What is the shared responsibility model?
AWS secures the cloud itself: hardware, data centres and the managed service software. You secure what you put in the cloud: your data, IAM users, security groups, operating system patches on EC2 and encryption settings.
Compute questions
5. What is EC2 and what are instance types?
EC2 gives you virtual servers. Instance families are tuned for different work: t for burstable general use, m for balanced, c for compute-heavy, r for memory-heavy and g or p for GPUs.
6. Explain EC2 pricing options.
- On-Demand: pay per second, no commitment. Good for testing.
- Reserved Instances and Savings Plans: commit for one or three years for up to about 70% off.
- Spot: spare capacity at large discounts that AWS can reclaim with two minutes notice. Good for batch jobs.
7. What is an Auto Scaling group?
A group of EC2 instances that grows or shrinks based on rules, such as adding servers when average CPU stays above 70%. It also replaces unhealthy instances automatically.
8. What is AWS Lambda?
A serverless service that runs your function when an event happens, such as a file upload to S3 or an API call. You pay only for execution time and never manage servers. A single run can last up to 15 minutes.
9. ALB vs NLB?
An Application Load Balancer works at layer 7 and routes HTTP traffic by path or host name. A Network Load Balancer works at layer 4, handles TCP and UDP at very high speed and gives a static IP.
Storage and database questions
10. What are the S3 storage classes?
Standard for frequent access, Intelligent-Tiering when access is unpredictable, Standard-IA and One Zone-IA for infrequent access, and Glacier classes for archives. Lifecycle rules can move objects between classes automatically to save money.
11. How do you secure an S3 bucket?
- Keep Block Public Access turned on.
- Grant access with IAM policies and bucket policies, following least privilege.
- Enable default encryption and versioning.
- Use pre-signed URLs to share single files temporarily.
12. EBS vs EFS vs S3?
| Service | Type | Typical use |
|---|---|---|
| EBS | Block disk for one EC2 instance | Boot volumes, databases |
| EFS | Shared file system for many instances | Shared web content, home folders |
| S3 | Object storage over HTTP | Backups, media, data lakes, static websites |
13. RDS vs DynamoDB?
RDS is managed relational databases (MySQL, PostgreSQL, SQL Server and others) for structured data and joins. DynamoDB is a serverless NoSQL key-value store that scales to huge traffic with single-digit millisecond reads, but needs you to design access patterns up front.
14. What is Multi-AZ vs a read replica in RDS?
Multi-AZ keeps a standby copy in another zone for automatic failover, which is about availability. Read replicas are extra copies that serve read queries, which is about performance.
Networking and security questions
15. What is a VPC?
Your own private network inside AWS. You choose the IP range, split it into subnets, and control traffic with route tables, security groups and network ACLs.
16. Public subnet vs private subnet?
A public subnet has a route to an Internet Gateway, so resources with public IPs can be reached from the internet. A private subnet has no such route; its servers reach the internet for updates through a NAT Gateway placed in a public subnet.
17. Security group vs NACL?
| Security group | Network ACL |
|---|---|
| Attached to instances | Attached to subnets |
| Stateful: return traffic is allowed automatically | Stateless: return traffic needs its own rule |
| Allow rules only | Allow and deny rules |
18. What is IAM and what is an IAM role?
IAM controls who can do what in your account. Users and groups are for people. A role is a set of permissions that a service or user assumes temporarily, such as an EC2 instance reading from S3 without storing access keys on the server.
19. Show a least-privilege policy.
This policy lets an application read objects from one bucket only:
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Action": ["s3:GetObject"],
"Resource": "arn:aws:s3:::my-app-bucket/*"
}]
}20. How do you protect the root account?
Enable MFA, delete any root access keys, use it only for the few tasks that require it, and do daily work through IAM users or AWS IAM Identity Center.
Operations and scenario questions
21. What do CloudWatch and CloudTrail do?
CloudWatch collects metrics, logs and alarms, so you know how your resources are performing. CloudTrail records API calls, so you know who changed what and when.
22. How would you host a highly available web app?
Put EC2 instances in an Auto Scaling group across at least two Availability Zones behind an Application Load Balancer, use RDS Multi-AZ for the database, store static files in S3 with CloudFront in front, and use Route 53 for DNS.
23. Your AWS bill doubled this month. What do you check?
Open Cost Explorer and group by service, then look for idle EC2 instances, unattached EBS volumes, old snapshots, NAT Gateway data transfer and forgotten test environments. Set AWS Budgets alerts so it does not happen again.
24. How do you take backups in AWS?
Use AWS Backup or automated snapshots for EBS and RDS, enable S3 versioning, and copy critical backups to another Region. Test a restore regularly; an untested backup is only a hope.
25. What is Infrastructure as Code on AWS?
Defining resources in code so they can be reviewed and recreated. AWS offers CloudFormation and the CDK; many teams use Terraform instead because it also works with other clouds.
How to prepare
- Create a free-tier account and set a budget alert on day one.
- Build a two-tier app: EC2 behind a load balancer plus RDS in a private subnet.
- Host a static site on S3 with CloudFront.
- Write one Lambda function triggered by an S3 upload.
- Draw your architecture and practise explaining it in two minutes.
Frequently asked questions
Is AWS Cloud Practitioner enough to get a job?
It shows you know the basics, but most employers expect the Solutions Architect Associate level plus hands-on projects for cloud engineer roles.
Do AWS interviews ask coding questions?
Cloud and DevOps roles usually ask for scripting in Python or Bash and some Infrastructure as Code, not algorithm puzzles.
How long does it take to prepare for an AWS interview?
With basic Linux and networking knowledge, six to eight weeks of daily practice is enough for an entry-level role.
Explore more cloud computing tutorials, or see how cloud fits into the DevOps roadmap.
