Cloud
AWS interview questions on EC2, S3, RDS, Lambda, IAM, and core architectural patterns for cloud-native applications.
What is the difference between EC2, Lambda, and ECS/Fargate?
Tip: EC2 is a virtual server you manage (full control, always-on cost). Lambda is serverless functions — event-driven, auto-scaling, pay-per-invocation, with cold starts and time limits. ECS/Fargate run containers without managing servers. Choose Lambda for spiky/event work, EC2 for long-running/custom needs, containers for portability.
Explain S3 storage classes and when to use each.
Tip: S3 Standard for hot data, Standard-IA / One Zone-IA for infrequent access, Glacier / Glacier Deep Archive for cheap cold archival (retrieval latency). Intelligent-Tiering auto-moves objects by access pattern. Lifecycle policies transition objects to cheaper classes over time.
What is IAM and what is the principle of least privilege?
Tip: IAM controls who can do what via users, groups, roles, and JSON policies. Least privilege means granting only the permissions needed — prefer roles (temporary credentials) over long-lived access keys, scope policies to specific resources, and never use the root account for daily work.
What is the difference between a security group and a network ACL?
Tip: A security group is a stateful firewall at the instance level (return traffic auto-allowed, allow-rules only). A network ACL is stateless at the subnet level (you must allow both directions, supports deny rules). SGs are the primary control; NACLs add a coarse subnet-wide layer.
How do you make an application highly available on AWS?
Tip: Deploy across multiple Availability Zones behind an Elastic Load Balancer, use Auto Scaling groups, a Multi-AZ RDS (with read replicas), and store static assets in S3 + CloudFront. Use Route 53 health checks for failover. Avoid single points of failure and design stateless app tiers.
What is the difference between a VPC, subnet, and an Internet Gateway?
Tip: A VPC is your isolated virtual network. Subnets partition it — public subnets route to an Internet Gateway (internet-facing), private subnets do not (use a NAT Gateway for outbound-only). Route tables and gateways define connectivity.
When would you use SQS vs SNS?
Tip: SQS is a pull-based queue for decoupling and reliable async processing (one consumer group drains messages). SNS is push-based pub/sub fan-out to many subscribers (Lambda, SQS, email). The common "fan-out" pattern combines them: SNS topic → multiple SQS queues.
How do you optimise AWS cost?
Tip: Right-size instances, use Auto Scaling, buy Reserved Instances/Savings Plans for steady workloads and Spot for fault-tolerant batch, move cold data to cheaper S3 tiers, delete unattached EBS/idle resources, and monitor with Cost Explorer + budgets/alerts.
InterviewEra generates role-specific questions using your actual projects and skills. Get scored feedback on technical depth, clarity, and structure — free to start.