AWS Cloud for DevOps Interview Questions for DevOps
25 AWS Cloud for DevOps questions with answers for devops roles — 7 easy, 13 medium, 5 hard.
About AWS Cloud for DevOps
Most DevOps jobs in India expect hands-on cloud skills, and AWS is the most common platform. This topic covers regions and AZs, IAM, VPC networking, security groups, EC2 with Auto Scaling and load balancers, S3, ECS, EKS and Lambda, high availability, disaster recovery and cost control.
Sheet progressStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
What are AWS Regions, Availability Zones and edge locations?
A Region is a geographic area such as ap-south-1 in Mumbai or ap-south-2 in Hyderabad, fully independent from others. Each Region has multiple Availability Zones, which are separate data centres with independent power and networking, linked by low-latency connections. Edge locations are smaller sites used by CloudFront and Route 53 to cache content and answer DNS close to users.
An IAM user is an identity for a person or app with long-term credentials. Groups collect users so permissions are managed together. Policies are JSON documents that allow or deny actions on resources. Roles are identities with temporary credentials that are assumed by services, such as EC2 or Lambda, or by users from other accounts. Prefer roles over access keys wherever possible.
03
What are the S3 storage classes and lifecycle policies?
S3 Standard is for frequently accessed data. Standard-IA and One Zone-IA are cheaper for infrequent access but charge retrieval fees. Intelligent-Tiering moves objects automatically based on access. Glacier Instant, Flexible Retrieval and Deep Archive are for archives with slower, cheaper access. Lifecycle rules move objects between classes after a set age and delete old versions or logs automatically.
AWS is responsible for security of the cloud: physical data centres, hardware, the network and the hypervisor. The customer is responsible for security in the cloud: IAM, data encryption, OS patching on EC2, security groups and application code. The split shifts with the service; for managed services like RDS or Lambda, AWS handles more of the underlying patching.
#!/bin/bash
set -e
dnf update -y
dnf install -y nginx
systemctl enable --now nginx
TOKEN=$(curl -s -X PUT http://169.254.169.254/latest/api/token \
-H 'X-aws-ec2-metadata-token-ttl-seconds: 60')
ID=$(curl -s -H "X-aws-ec2-metadata-token: $TOKEN" \
http://169.254.169.254/latest/meta-data/instance-id)
echo "<h1>Served by $ID</h1>" > /usr/share/nginx/html/index.html
User data runs once as root on first boot; logs are in /var/log/cloud-init-output.log. This uses IMDSv2.
07
Tell me about a time you had to learn a new cloud service quickly.
Situation: in my internship, the team needed a scheduled job and asked me to use AWS Lambda, which I had never used. Task: deliver it in a week. Action: I went through the official docs and a hands-on tutorial, built a small proof of concept on day two, and asked a senior to review the IAM role. Result: the job went live on time and I documented the setup.
A VPC is your private network with a CIDR range like 10.0.0.0/16. It is split into subnets in each Availability Zone. Public subnets have a route to an Internet Gateway; private subnets reach the internet only through a NAT Gateway in a public subnet. Route tables control traffic, security groups and NACLs filter it, and VPC endpoints give private access to services like S3.
09
What is the difference between a security group and a network ACL?
A security group acts as a firewall for instances or network interfaces. It is stateful, so return traffic is allowed automatically, and it supports only allow rules. A network ACL works at the subnet level, is stateless, so inbound and outbound rules must both allow traffic, supports allow and deny rules, and evaluates rules in number order. Security groups are the main control.
10
How do an Application Load Balancer and an Auto Scaling group work together?
The Auto Scaling group launches EC2 instances from a launch template across several Availability Zones and keeps the count between min and max, scaling on policies such as target 60 percent CPU. It registers instances with the ALB's target group. The ALB spreads HTTP traffic across healthy targets, routes by path or host, and health checks let the group replace failed instances.
Lambda runs functions without servers, billed per request and duration, ideal for event-driven tasks with short runtimes up to 15 minutes. ECS is AWS's simpler container orchestrator, good when you want containers without Kubernetes complexity, often with Fargate. EKS is managed Kubernetes, chosen for portability, a rich ecosystem and existing Kubernetes skills, but it needs more operational knowledge.
12
An EC2 instance in a private subnet cannot download packages from the internet. Why?
A private subnet has no direct route to the Internet Gateway. Check that its route table sends 0.0.0.0/0 to a NAT Gateway placed in a public subnet, that the NAT Gateway has an Elastic IP, and that the security group and NACL allow outbound traffic and return ports. For AWS services like S3, a VPC endpoint avoids NAT data charges.
13
An application on EC2 needs to read files from S3. How do you give it access securely?
Create an IAM role with a policy allowing only the needed actions, such as s3:GetObject on that bucket, attach it to the instance through an instance profile, and let the AWS SDK pick up temporary credentials automatically. Never put access keys in code or config files. Optionally add a bucket policy and a VPC endpoint so traffic stays inside AWS.
14
Someone made an S3 bucket with customer files public. What do you do?
Immediately block public access on the bucket and remove the public policy or ACLs. Check S3 server access logs or CloudTrail data events to see whether objects were downloaded, and involve security if customer data was exposed. Then enable Block Public Access at the account level, use AWS Config rules to detect public buckets, and require bucket changes through reviewed IaC.
15
The application cannot connect to an RDS database. What do you check?
Confirm the endpoint, port, username and password. Check that the RDS security group allows inbound traffic on the database port from the application's security group, and that both are in reachable subnets of the same VPC or peered networks. Test with nc -zv endpoint 5432 from the app host. Also check the instance status, max connections and SSL requirements.
16
Write an IAM policy that gives read-only access to one S3 bucket.
# ~/.aws/config
[profile prod-admin]
role_arn = arn:aws:iam::123456789012:role/DevOpsAdmin
source_profile = default
region = ap-south-1
aws s3 ls --profile prod-admin
# manual way
aws sts assume-role \
--role-arn arn:aws:iam::123456789012:role/DevOpsAdmin \
--role-session-name ravi-session
The role's trust policy must allow your account. Temporary credentials expire, usually after an hour.
18
How do you create an EKS cluster with eksctl and connect kubectl to it?
Situation: our dev and test AWS accounts cost almost as much as production. Task: my manager asked me to cut waste without slowing teams. Action: I tagged resources by owner, found idle instances and old snapshots, scheduled non-production instances to stop at night with a Lambda, and moved CI agents to Spot. Result: non-production spend fell about 40 percent within two months.
20
How do you prioritise when several teams ask you for infrastructure work at the same time?
I list the requests with their business impact and deadline, and check which are blocking production or a release. Production issues and security fixes come first. For the rest I agree priority with my lead and the requesting teams openly, give realistic timelines and share progress. Where requests repeat, I build self-service templates so teams are not waiting on me.
21
How do you design a highly available web application on AWS?
Spread every tier across at least two Availability Zones. Put an ALB in front of an Auto Scaling group of stateless instances or containers. Use RDS Multi-AZ or Aurora for the database and ElastiCache for sessions. Serve static content from S3 through CloudFront and use Route 53 health checks. Remove single points of failure and test failover regularly.
22
The monthly AWS bill suddenly doubled. How do you investigate and fix it?
Open Cost Explorer and group by service, account and tag to find the spike, then drill into usage type. Common causes are forgotten instances, unattached EBS volumes, NAT Gateway data transfer, oversized RDS, or logs retained forever. Fix the source, then set AWS Budgets alerts, enforce tagging, right-size using Compute Optimizer, and use Savings Plans or Spot for steady or batch workloads.
23
An e-commerce site expects 10 times normal traffic during a festive sale. How do you prepare?
Load test beforehand to find bottlenecks. Pre-scale Auto Scaling groups or Kubernetes nodes with scheduled scaling, since reactive scaling may be too slow. Cache aggressively with CloudFront and Redis, add read replicas, and check service quotas. Use queues to absorb spikes in order processing, set up dashboards and alerts, freeze risky deployments, and keep an on-call war room ready.
24
How would you plan disaster recovery for a complete AWS region failure?
Start from business RTO and RPO. Options range from backup and restore, which is cheapest and slowest, to pilot light, warm standby and multi-region active-active. Replicate data with S3 cross-region replication, Aurora Global Database or DynamoDB global tables, keep infrastructure in Terraform so it can be rebuilt, use Route 53 failover routing and rehearse failover drills.
25
How do you work with developers who resist new DevOps processes?
Situation: a team saw our new pipeline checks as slowing them down. Task: get adoption without forcing it. Action: I sat with them to understand the pain, found that the scans added twelve minutes, moved slow scans to run in parallel and made results clearer. Result: pipeline time went below the old one, the team adopted it and later suggested further improvements.
Frequently asked questions
How important is AWS Cloud for DevOps in DevOps interviews?
Most DevOps jobs in India expect hands-on cloud skills, and AWS is the most common platform. This topic covers regions and AZs, IAM, VPC networking, security groups, EC2 with Auto Scaling and load balancers, S3, ECS, EKS and Lambda, high availability, disaster recovery and cost control.
How should I use the AWS Cloud for DevOps sheet?
Go top to bottom — easy to hard. Answer before opening each answer, tick what you solved and save misses to Last-Minute Revision.