AWS EC2 Interview Questions and Answers (30, Freshers and Scenario Based)
These are the AWS EC2 interview questions asked most often for fresher and 2 to 5 year cloud roles, with short answers you can say in under a minute. They cover basics, storage, pricing, scaling, security and real troubleshooting scenarios. Practise each one on a free-tier instance in your own account (for example in the Mumbai region, ap-south-1), so your answers include what you actually saw on screen.
Five console checks every EC2 answer uses
- Details tab: AMI, instance type, key pair, IAM role.
- Security tab: security groups and their inbound rules.
- Networking tab: subnet, public IP, Elastic IP.
- Storage tab: root EBS volume and "Delete on termination".
- Monitoring tab: CPU and status checks.
The request path behind many answers
Many EC2 scenario questions are about one box on this path: IGW, route table, NACL, security group.
Basics
Q1. What is Amazon EC2?
Elastic Compute Cloud gives you virtual servers (instances) in AWS that you start in minutes and pay for by the second (Linux) or hour, depending on the OS and pricing model.
Q2. What is an AMI?
An Amazon Machine Image is the template for the root disk: OS, software and settings. You launch instances from it, and you can create your own AMI from a configured instance.
Q3. Instance families?
General purpose (t3, m7i), compute optimised (c7i), memory optimised (r7i), storage optimised (i4i) and accelerated (p5, g5). Graviton types end in "g", such as m7g.
Q4. What is a key pair?
A public key AWS places on the instance and a private key (.pem) you keep. SSH uses it instead of a password. AWS cannot give the private key back if you lose it.
Q5. Security group vs NACL?
A security group is a stateful firewall on the instance's network interface, with allow rules only. A NACL is a stateless firewall on the subnet, with allow and deny rules, checked in number order.
Q6. Public IP vs Elastic IP?
An auto-assigned public IP changes when you stop and start the instance. An Elastic IP stays the same until you release it. AWS now charges for every public IPv4 address.
Q7. What is user data?
A script that runs on the first boot, often used to install nginx or Docker automatically. It runs as root through cloud-init.
Storage and lifecycle
Q8. Stop vs terminate vs hibernate?
Stop shuts it down; EBS data stays and you pay only for storage. Terminate deletes the instance (and the root volume, by default). Hibernate saves RAM to EBS and resumes where it left off.
Q9. EBS vs instance store?
EBS is network storage that survives stops and can be snapshotted. Instance store is a local disk that is fast but loses data when the instance stops or terminates.
Q10. EBS volume types?
gp3 (general SSD, the usual default), io2 (high IOPS for databases), st1 and sc1 (HDD for throughput and cold data).
Q11. What is an EBS snapshot?
A point-in-time, incremental backup of a volume, stored in S3 by AWS. You can create a new volume from it, even in another AZ, or copy it to another region.
Q12. Can you launch an EC2 instance directly from a snapshot?
Not directly. Create an AMI from the snapshot (register image), then launch from the AMI.
Q13. How do you increase disk size without downtime?
Modify the EBS volume size, then run growpart and xfs_growfs (or resize2fs) inside Linux. No reboot is needed.
Pricing and scaling
Q14. On-Demand vs Reserved vs Savings Plans vs Spot?
On-Demand: pay as you go. Reserved Instances and Savings Plans: up to about 72% off for a 1 or 3 year commitment. Spot: up to about 90% off spare capacity, but AWS can take it back with a 2-minute notice.
Q15. When do you use Spot?
For work that can be interrupted: batch jobs, CI runners, image rendering, and stateless web nodes in an Auto Scaling group mixed with On-Demand.
Q16. What is an Auto Scaling group?
A group that keeps a minimum and maximum number of instances from a launch template, replaces unhealthy ones, and scales on metrics such as average CPU.
Q17. ALB vs NLB?
ALB works at layer 7 (HTTP/HTTPS) with path and host routing. NLB works at layer 4 (TCP/UDP) with very high performance and static IPs.
Q18. What are T-family CPU credits?
T3 and T4g instances earn credits when idle and spend them in bursts. In standard mode, CPU drops to the baseline when credits run out; unlimited mode charges extra instead.
Security and scenarios
Q19. How should an app on EC2 access S3?
With an IAM role attached through an instance profile. The SDK gets temporary credentials from the instance metadata service. Never store access keys on the server.
Q20. What is IMDSv2 and why use it?
The token-based version of the instance metadata service. It blocks many SSRF attacks that tried to steal role credentials, which is what happened in the Capital One breach in 2019.
Q21. SSH says Connection timed out. What do you check?
The security group allows port 22 from your current IP, the instance has a public IP, the subnet route table has an internet gateway, and the NACL allows the traffic and the return ports.
Q22. You lost the .pem file. How do you get in?
Use EC2 Instance Connect or Session Manager if available, add a new public key to ~/.ssh/authorized_keys. Otherwise stop the instance, attach its root volume to another instance, and add the key there.
Q23. How do you move an instance to another region?
Create an AMI, copy the AMI to the target region, and launch from it. Elastic IPs and security groups must be created again there.
Q24. A t3.micro web server becomes very slow every afternoon. Why might that be?
It probably ran out of CPU credits. Check CPUCreditBalance in CloudWatch, then move to unlimited mode or a bigger or non-burstable instance.
Q25. How do you patch 50 instances?
With AWS Systems Manager Patch Manager and maintenance windows, or by baking new AMIs and rolling them out through the Auto Scaling group.
A live example to tell in the interview
"I launched a t3.micro with Amazon Linux 2023 in ap-south-1, installed nginx with user data, and attached an IAM role so it could read one S3 bucket. When SSH timed out from home, I found my home IP had changed, so the security group rule for port 22 no longer matched. I fixed the rule, and later replaced SSH with Session Manager so port 22 could be closed completely."
That one story covers user data, IAM roles, security groups and a real fix.
Summary table
| Area | Must-know |
|---|---|
| Basics | AMI, instance types, key pairs, user data |
| Network | Security group vs NACL, public vs Elastic IP |
| Storage | EBS vs instance store, gp3, snapshots, resize |
| Lifecycle | Stop vs terminate vs hibernate |
| Pricing | On-Demand, Savings Plans, Reserved, Spot |
| Scaling | Auto Scaling groups, ALB vs NLB |
| Security | IAM roles, IMDSv2, Session Manager |
Quick quiz: check what you learned
Which firewall is stateful and attached to the instance?
- The security group
- The network ACL
- The route table
- The internet gateway
Show answer
A. Security groups track connections, so return traffic is allowed.
What happens to EBS data when you stop an instance?
- It stays on the volume
- It is deleted at once
- It moves to Glacier
- It is copied to S3
Show answer
A. Stop keeps the EBS volumes; only terminate deletes the root volume by default.
Best way for an EC2 app to reach S3?
- An IAM role on the instance
- Access keys in a .env file
- The root user password
- A public S3 bucket policy
Show answer
A. Roles give temporary credentials without stored keys.
Which pricing model can be taken back with 2 minutes notice?
- Spot Instances
- Savings Plans
- On-Demand
- Dedicated Hosts
Show answer
A. Spot uses spare capacity that AWS can reclaim.
Learn it properly
These pages go deeper, with labs:
Frequently asked questions
What EC2 questions are asked to freshers?
AMI, instance types, key pairs, security groups, public vs Elastic IP, EBS, stop vs terminate and user data.
What do experienced interviews add?
Auto Scaling, load balancers, pricing optimisation, IAM roles, IMDSv2, patching at scale and troubleshooting scenarios.
Do I need to memorise instance type names?
Know the families and what the letters mean (t burstable, c compute, r memory, g Graviton). Exact sizes are not needed.
Which AWS certification covers EC2 best?
AWS Certified Solutions Architect – Associate and SysOps Administrator – Associate cover it in depth.
How should I answer pricing questions?
Match the model to the workload: steady servers on Savings Plans, spiky ones On-Demand, interruptible jobs on Spot.
Is the security group stateful?
Yes. Return traffic for an allowed request is allowed automatically. NACLs are stateless and need rules both ways.