Chapter 70: DevOps Interview Questions by Topic and Company
70.9 AWS Interview Questions for DevOps Engineers
AWS madhe VPC, IAM aani S3 che prashna sarvat jast. Diagram kadhun uttar dya.
What you will learn in this lesson
- 47 real AWS questions with short answers
- Which companies asked them, from public interview stories
- Fresher, experienced and senior levels
- A simple way to answer: why, what, how
Why: the problem
Most DevOps jobs in India use AWS. Interviewers ask about networks, access and storage, and how you fix common issues.
What: how to read this lesson
Each question has a short answer in three parts.
- Why: the reason the thing exists.
- What: the plain meaning.
- How: how you use it, often with a small command.
"Asked at" names a company only when a public interview story says the question was asked there. No tag means it is a common question that many companies ask.
Companies with the most questions in this lesson: LTIMindtree (16), Capgemini (12), Walmart Global Tech (8), HCLTech (7), Tech Mahindra (5), Accenture (4).
How: answer any question in 4 steps
- Start with the reason. One sentence.
- Give the plain meaning. No big words.
- Show one command or file.
- Add one example from your work. Then stop and wait.
Fresher questions
Q1. Which AWS services have you used?
Why: They want real usage, not a list.
What: Group them: compute (EC2, Lambda, EKS/ECS), storage (S3, EBS, EFS), network (VPC, ALB, Route 53, CloudFront), security (IAM, KMS, Secrets Manager), monitoring (CloudWatch).
How: For each, say one thing you did with it.
Q2. What is the difference between EBS, S3 and EFS?
Why: Choosing storage is a basic design skill.
What: EBS: block disk for one EC2 (one AZ). S3: object storage over HTTP, very durable. EFS: shared NFS file system for many servers.
How: EBS for OS/DB disks, S3 for files/backups, EFS for shared folders.
Q3. What is EBS?
Why: Every EC2 has a disk.
What: Elastic Block Store is a network disk attached to one EC2 in one AZ.
How: Types: gp3 (general), io2 (high IOPS), st1/sc1 (throughput/cold). Back up with snapshots.
aws ec2 create-snapshot --volume-id vol-0abc --description nightly
Q4. What is the difference between a snapshot, a backup and an AMI?
Why: Recovery planning needs these.
What: Snapshot: point-in-time copy of an EBS volume. AMI: image to launch EC2 (includes snapshots). Backup: a managed plan (AWS Backup) with schedules and retention.
How: Use AWS Backup for policies, AMIs for golden images.
Q5. What are EC2 instance types?
Why: Right size saves money.
What: Families: t (burstable), m (general), c (compute), r (memory), g/p (GPU), i (storage).
How: Pick by workload and check metrics before resizing.
Q6. What are S3 storage classes?
Why: Storage cost can be cut a lot.
What: Standard, Intelligent-Tiering, Standard-IA, One Zone-IA, Glacier Instant/Flexible/Deep Archive.
How: Use lifecycle rules to move old data to cheaper classes.
Q7. What is an S3 lifecycle policy?
Why: Old files cost money.
What: Rules that move objects to other classes or delete them after N days.
How: Example: move logs to Glacier after 30 days, delete after 365.
{"Rules":[{"ID":"logs","Status":"Enabled","Filter":{"Prefix":"logs/"},"Transitions":[{"Days":30,"StorageClass":"GLACIER"}],"Expiration":{"Days":365}}]}
Q8. Is there a limit to the number of objects in an S3 bucket?
Why: Trick question.
What: No, the number of objects is unlimited. A single object can be up to 5 TB.
How: Use multipart upload for large files.
Q9. What are the common uses of S3?
Why: Basic.
What: Backups, static website hosting, logs, data lake, build artifacts, Terraform state.
Q10. What is a VPC?
Why: Every AWS design starts here.
What: A Virtual Private Cloud is your own private network in AWS with subnets, route tables and gateways.
How: Plan the CIDR (e.g. 10.0.0.0/16) so it does not overlap with other networks.
Q11. What is the difference between a public and a private subnet?
Why: Security design basic.
What: A public subnet has a route to an Internet Gateway. A private subnet does not.
How: Put load balancers in public subnets and apps/DBs in private ones.
Q12. What is the difference between an Internet Gateway and a NAT Gateway?
Why: Outbound access for private servers.
What: IGW gives two-way internet for public subnets. NAT gateway lets private servers go out but blocks incoming connections.
How: Put NAT in a public subnet, route private subnets to it.
Q13. What is the difference between a Security Group and a NACL?
Why: Two firewalls in AWS.
What: Security group: on the instance, stateful, allow rules only. NACL: on the subnet, stateless, allow and deny rules, numbered order.
How: Use SGs for most control, NACLs for subnet-wide blocks.
Q14. Why is a security group called stateful?
Why: It explains return traffic.
What: If incoming traffic is allowed, the reply is allowed automatically.
How: NACLs are stateless, so you must allow return ports (ephemeral 1024-65535).
Q15. What is the difference between an IAM role and an IAM policy?
Why: Identity basics.
What: A policy is a JSON document of permissions. A role is an identity that services or users assume, with policies attached.
How: Give EC2/Lambda roles, not access keys.
{"Effect":"Allow","Action":"s3:GetObject","Resource":"arn:aws:s3:::ravi-data/*"}
Q16. What is Auto Scaling?
Why: Handle traffic changes automatically.
What: An Auto Scaling group keeps a number of EC2s and adds or removes them by policy.
How: Policies: target tracking, step, scheduled, predictive.
Q17. What is AWS Lambda?
Why: Serverless is common.
What: Lambda runs code on events without servers; you pay per request and run time.
How: Use for small event tasks: S3 triggers, APIs, schedules.
Q18. Which AWS service is used for monitoring?
Why: Basic.
What: CloudWatch: metrics, logs, alarms, dashboards. CloudTrail records API calls.
How: Set alarms to SNS for alerts.
aws cloudwatch describe-alarms --state-value ALARM
Q19. What is Route 53?
Why: AWS DNS.
What: A managed DNS service with domain registration and health checks.
Q20. What is CloudTrail?
Why: Audit trail.
What: It records who called which AWS API and when.
How: Use it to investigate changes and incidents.
Experienced questions (2-5 years)
Q21. How do you secure an S3 bucket?
Why: Public buckets cause data leaks.
What: Security is access control plus encryption.
How: Block Public Access, least-privilege bucket policy, encryption (SSE-S3 or SSE-KMS), versioning, access logs, and TLS-only policy.
aws s3api put-public-access-block --bucket ravi-data --public-access-block-configuration BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true
Q22. What S3 encryption options are there?
Why: Compliance needs encryption.
What: SSE-S3 (AWS keys), SSE-KMS (your KMS key, audited), DSSE-KMS, and client-side encryption.
How: Use SSE-KMS for sensitive data and enforce it in bucket policy.
Q23. How do you audit IAM permissions?
Why: Too many permissions are a big risk.
What: Find unused and over-broad access.
How: Use IAM Access Analyzer, last-accessed data, credential reports, CloudTrail, and remove unused users and keys.
aws iam generate-credential-report
Q24. How do you give cross-account access?
Why: Big companies have many AWS accounts.
What: Create a role in the target account trusted by the source account.
How: The source assumes the role with STS; for S3 you can also use a bucket policy.
aws sts assume-role --role-arn arn:aws:iam::222233334444:role/ReadS3 --role-session-name ravi
Q25. How can an EC2 in account A read an S3 bucket in account B?
Why: A real interview scenario.
What: Both sides must allow it.
How: Give the EC2 role s3 permissions, and add a bucket policy in account B allowing that role ARN (or assume a role in B).
Q26. How do you connect an EC2 instance to RDS?
Why: Common app setup.
What: Both in the same VPC (or peered).
How: Put RDS in private subnets; allow port 3306/5432 in the RDS security group from the EC2 security group; use the endpoint name.
mysql -h mydb.xxxx.ap-south-1.rds.amazonaws.com -u admin -p
Q27. How does RDS high availability work?
Why: Databases must survive failures.
What: Multi-AZ keeps a standby in another AZ with synchronous copy and automatic failover.
How: Read replicas are for read scaling, not HA (though they can be promoted).
Q28. What daily tasks do you do on RDS?
Why: Shows hands-on experience.
What: Monitoring, backups, patching and performance.
How: Check CloudWatch metrics and Performance Insights, snapshots, parameter groups, storage autoscaling, slow query logs.
Q29. How do you access an instance that has only a private IP?
Why: Private servers need admin access.
What: It cannot be reached from the internet directly.
How: Use SSM Session Manager (best), a bastion host, or a VPN.
aws ssm start-session --target i-0abc123
Q30. What is VPC peering and Transit Gateway?
Why: Many VPCs must talk.
What: Peering: one-to-one link between two VPCs, not transitive. Transit Gateway: a hub connecting many VPCs and on-prem.
How: Use TGW when you have more than a few VPCs.
Q31. How can a private EC2 download packages without a NAT gateway?
Why: Saves cost and keeps traffic private.
What: VPC endpoints give private access to AWS services.
How: Use an S3 gateway endpoint (yum/dnf repos on Amazon Linux are on S3) or a package proxy/mirror.
Q32. What are Route 53 routing policies?
Why: DNS can steer traffic.
What: Simple, weighted, latency, failover, geolocation, geoproximity, multivalue.
How: Use failover with health checks for DR, latency for global users.
Q33. How do you reduce latency for users around the world?
Why: Global performance.
What: Serve content close to users.
How: Use CloudFront (CDN), latency-based Route 53, multi-region deployments, and caching.
Q34. Which AWS services integrate with CloudFront?
Why: CDN design.
What: Origins can be S3, ALB, EC2, API Gateway, MediaStore; add WAF and Shield for protection; Lambda@Edge/CloudFront Functions for logic.
Q35. A load balancer shows high latency. How do you troubleshoot?
Why: Latency hurts users.
What: The delay may be in the LB, targets or backends.
How: Check ALB TargetResponseTime vs request count, unhealthy targets, target CPU, DB latency, and access logs.
Q36. What is the difference between scheduled and dynamic scaling?
Why: Picking the right policy.
What: Scheduled scaling changes capacity at fixed times. Dynamic scaling reacts to metrics.
How: Use both: schedule for known peaks, dynamic for surprises.
Q37. How do you make EC2 highly available across AZs?
Why: Single servers fail.
What: Spread instances across 2-3 AZs behind a load balancer.
How: Use an Auto Scaling group with multiple subnets and health checks.
Q38. How do you migrate an EC2 instance to another region?
Why: Region moves happen.
What: Copy the image to the new region.
How: Create an AMI, copy it to the target region, launch, then move DNS and data.
aws ec2 copy-image --source-region ap-south-1 --source-image-id ami-0abc --region us-east-1 --name web-copy
Q39. You cannot SSH into an EC2 instance. What do you check?
Why: Very common support issue.
What: Network, key, user and OS are possible causes.
How: 1) Security group/NACL allow 22 from your IP. 2) Public IP and route. 3) Right key and user. 4) Instance status checks. 5) Use EC2 Serial Console or SSM.
aws ec2 describe-instance-status --instance-ids i-0abc
Q40. How do you deploy Lambda across environments?
Why: Same code, different config.
What: Use aliases and versions, environment variables, and IaC (SAM, Terraform).
How: Promote the same package from dev to prod.
Q41. How do you connect on-prem to a VPC?
Why: Hybrid setups are common in MNCs.
What: Site-to-Site VPN (quick, over internet) or Direct Connect (private line).
How: Use non-overlapping CIDRs and route via TGW or VGW.
Q42. How do you control AWS cost?
Why: Cost is a daily concern.
What: Find waste and right-size.
How: Cost Explorer, budgets and alerts, tagging, rightsizing, Savings Plans, spot instances, S3 lifecycle, delete idle resources.
Q43. How do you attach S3 to an EC2 instance?
Why: S3 is not a disk.
What: EC2 accesses S3 over the API using an IAM role.
How: Attach an instance profile, then use the AWS CLI/SDK; mount tools exist but are not true file systems.
aws s3 cp s3://ravi-data/report.csv .
Q44. How do you check whether an S3 bucket exists with boto3?
Why: Script writing on AWS.
What: head_bucket returns success, 404 if missing, 403 if it exists but you lack access.
How: Catch ClientError and read the error code.
import boto3, botocore
s3 = boto3.client("s3")
try:
s3.head_bucket(Bucket="ravi-data")
except botocore.exceptions.ClientError as e:
print(e.response["Error"]["Code"])
Q45. How does boto3 find credentials?
Why: Wrong credentials cause odd errors.
What: It checks in order: code params, environment variables, ~/.aws files, then the IAM role (instance/task/pod).
How: Prefer roles over keys.
Senior questions
Q46. How do you design disaster recovery on AWS?
Why: Senior design question.
What: Choose by RTO/RPO: backup & restore, pilot light, warm standby, multi-site active-active.
How: Replicate data across regions, keep IaC ready, test failover regularly.
Q47. Design a 3-tier architecture for a banking app.
Why: Classic design question.
What: Web tier (ALB + CloudFront + WAF), app tier (ASG/EKS in private subnets), DB tier (RDS Multi-AZ, encrypted).
How: Add KMS, Secrets Manager, CloudTrail, GuardDuty, backups and multi-AZ everywhere.
Practice tasks
Easy What is EBS?
Why: Saying it once with your own words makes it stick.
What to do: Answer this question as if the interviewer just asked it.
- Open a lab VM or container, never production.
- Run or write the example from the answer.
- Read the output line by line.
- Say the answer aloud in under 60 seconds.
Check: Your answer has a reason, a plain meaning and one command.
Easy What is an S3 lifecycle policy?
Why: Saying it once with your own words makes it stick.
What to do: Answer this question as if the interviewer just asked it.
- Open a lab VM or container, never production.
- Run or write the example from the answer.
- Read the output line by line.
- Say the answer aloud in under 60 seconds.
Check: Your answer has a reason, a plain meaning and one command.
Medium How do you secure an S3 bucket?
Why: Saying it once with your own words makes it stick.
What to do: Answer this question as if the interviewer just asked it.
- Open a lab VM or container, never production.
- Run or write the example from the answer.
- Read the output line by line.
- Say the answer aloud in under 60 seconds.
Check: Your answer has a reason, a plain meaning and one command.
Easy What is the difference between an IAM role and an IAM policy?
Why: Saying it once with your own words makes it stick.
What to do: Answer this question as if the interviewer just asked it.
- Open a lab VM or container, never production.
- Run or write the example from the answer.
- Read the output line by line.
- Say the answer aloud in under 60 seconds.
Check: Your answer has a reason, a plain meaning and one command.
Medium How do you audit IAM permissions?
Why: Saying it once with your own words makes it stick.
What to do: Answer this question as if the interviewer just asked it.
- Open a lab VM or container, never production.
- Run or write the example from the answer.
- Read the output line by line.
- Say the answer aloud in under 60 seconds.
Check: Your answer has a reason, a plain meaning and one command.
Medium How do you give cross-account access?
Why: Saying it once with your own words makes it stick.
What to do: Answer this question as if the interviewer just asked it.
- Open a lab VM or container, never production.
- Run or write the example from the answer.
- Read the output line by line.
- Say the answer aloud in under 60 seconds.
Check: Your answer has a reason, a plain meaning and one command.
Medium How do you connect an EC2 instance to RDS?
Why: Saying it once with your own words makes it stick.
What to do: Answer this question as if the interviewer just asked it.
- Open a lab VM or container, never production.
- Run or write the example from the answer.
- Read the output line by line.
- Say the answer aloud in under 60 seconds.
Check: Your answer has a reason, a plain meaning and one command.
Medium How do you access an instance that has only a private IP?
Why: Saying it once with your own words makes it stick.
What to do: Answer this question as if the interviewer just asked it.
- Open a lab VM or container, never production.
- Run or write the example from the answer.
- Read the output line by line.
- Say the answer aloud in under 60 seconds.
Check: Your answer has a reason, a plain meaning and one command.
Homework: try at home
- Pick five questions you find hard.
- Write your own answer for each in three lines.
- Record yourself answering them. Listen once and improve.
Recap
In short
- Answer in order: why, what, how, then one example.
- Show one small command when you can.
- "Asked at" comes from public interview stories.
- Practise aloud; do not memorise word for word.
FAQ
Do I need to learn all 47 questions?
No. Start with the fresher ones. Then add the experienced ones for your level.
Should I memorise these answers?
No. Understand the why, then say it in your own words. Interviewers notice memorised lines.
What if I do not know an answer?
Say so honestly. Then explain how you would find out, step by step.
Are these questions only for one company?
No. "Asked at" shows where people said it was asked. Other companies ask the same things.
How long should an answer be?
About 30 to 60 seconds. Give a reason, a plain meaning and one example.
Is a lab really needed?
Yes. Running the command once makes your answer real and confident.
Interview questions
Practise these five first. Many companies asked them.
- How do you secure an S3 bucket? - Security is access control plus encryption.
- Which AWS services have you used? - Group them: compute (EC2, Lambda, EKS/ECS), storage (S3, EBS, EFS), network (VPC, ALB, Route 53, CloudFront), security (IAM, KMS, Secrets Manager), monitoring (CloudWatch).
- What is an S3 lifecycle policy? - Rules that move objects to other classes or delete them after N days.
- What is a VPC? - A Virtual Private Cloud is your own private network in AWS with subnets, route tables and gateways.
- What is the difference between an Internet Gateway and a NAT Gateway? - IGW gives two-way internet for public subnets.
Quick quiz
Q1. Which AWS services have you used?
Group them: compute (EC2, Lambda, EKS/ECS), storage (S3, EBS, EFS), network (VPC, ALB, Route 53, CloudFront), security (IAM, KMS, Secrets Manager), monitoring (CloudWatch).
Q2. What S3 encryption options are there?
SSE-S3 (AWS keys), SSE-KMS (your KMS key, audited), DSSE-KMS, and client-side encryption.
Q3. What is the difference between an IAM role and an IAM policy?
A policy is a JSON document of permissions.
Q4. What is VPC peering and Transit Gateway?
Peering: one-to-one link between two VPCs, not transitive.
Q5. How do you make EC2 highly available across AZs?
Spread instances across 2-3 AZs behind a load balancer.
Samajla ka?
Revision card
Interview card