Click here for DevSecOps and Cloud DevOps Course
DevOps Shack
AWS DevOps Interview Mastery
✅ EC2 (Elastic Compute Cloud)
Q1. What is Amazon EC2?
Answer:
Amazon EC2 (Elastic Compute Cloud) is a web service that provides virtual servers (called
instances) in the AWS cloud. Instead of buying physical servers, EC2 allows you to launch,
manage, scale, and terminate compute resources on demand. You can choose OS (Linux/Windows),
CPU, RAM, storage type, networking type, and security. EC2 billing is based on factors such as
type of instance, OS, storage, region, and time used. It provides complete control like a
physical server, including SSH/RDP access.
Q2. What are EC2 instance types?
Answer:
EC2 instance types are categories designed for different workloads. The major families include:
• General Purpose (t2/t3/m5) – balanced CPU and memory for web servers, dev environments.
• Compute Optimized (c5/c6g) – high performance CPU for gaming, analytics, CI/CD runners.
• Memory Optimized (r5/x1e) – RAM-heavy workloads like databases, analytics.
• Storage Optimized (i3/d2/h1) – high disk throughput for OLTP systems, warehouses.
• Accelerated Computing (p3/g4/f1) – GPU-based workloads like ML, AI, big data.
Choosing the right type depends on workload characteristics.
Q3. What are EC2 purchase options?
Answer:
EC2 supports multiple pricing models:
• On-Demand – Pay per hour/second, best for temporary or unpredictable workloads.
• Reserved Instances – 1 or 3-year commitment with up to 75% discount. Ideal for long-
running workloads.
• Spot Instances – Up to 90% discount but can be terminated anytime; used for CI/CD, big
data, ML training.
• Savings Plans – Flexible pricing based on CPU usage commitment rather than instance type.
• Dedicated Hosts – Physical servers for compliance and software licensing requirements.
Q4. What are EC2 Security Groups?
Answer:
Security Groups are virtual firewalls attached to EC2 instances that control inbound and
outbound traffic. They operate at the instance level (not subnet level). Rules allow traffic
only; they never deny. For example, inbound rule allowing port 22 for SSH enables secure access.
A security group is stateful: when inbound traffic is allowed, the response automatically flows
out without explicit outbound rule.
Q5. What is a Key Pair in EC2?
Answer:
EC2 uses key pairs (public + private key) for secure authentication.
• Linux instances use private key (.pem) for SSH login.
• Windows instances use private key to decrypt Administrator password.
The public key stays in AWS, private key stays with the user. If lost, the instance cannot
be accessed unless a recovery method (mount root volume to another instance and modify SSH
config) is performed.
Q6. What is EBS in EC2?
Answer:
Elastic Block Store (EBS) provides persistent storage for EC2 instances. It’s like attaching a
hard disk. Types include:
• gp3/gp2 – general purpose SSD
• io2/io1 – high IOPS SSD for enterprise databases
• st1/sc1 – HDD for big throughput workloads
EBS volumes can be resized, snapshotted, backed up, and attached/detached across instances
(within the same AZ).
Q7. What is AMI?
Answer:
AMI (Amazon Machine Image) is a preconfigured image containing OS + software configuration +
application dependencies. It is used to launch identical instances quickly, especially useful
for auto scaling, disaster recovery, and golden image deployments.
Q8. What is Auto Scaling?
Answer:
Auto Scaling automatically increases or decreases the number of EC2 instances based on business
demand. It helps maintain performance while reducing cost. Scaling policies depend on metrics
like CPU usage, network I/O, or custom CloudWatch metrics. Integrated with Load Balancers to
distribute traffic automatically.
Q9. What is Elastic Load Balancing?
Answer:
ELB distributes incoming traffic across multiple EC2 instances to increase availability and
fault tolerance. Types include:
• Application Load Balancer (ALB) – HTTP/HTTPS, Layer 7 routing, path-based routing
• Network Load Balancer (NLB) – TCP/UDP, extremely high performance, low latency
• Classic Load Balancer – legacy, L4 + L7 support
Q10. How does EC2 integrate with DevOps pipelines?
Answer:
EC2 is commonly used to run CI/CD agents (Jenkins, GitLab runners), deploy containerized and
non-container apps, host microservices, run test automation, serve production workloads, and
trigger auto scaling for rolling or blue-green deployments.
💠 IAM (Identity and Access Management)
Q11. What is IAM?
Answer:
IAM manages access to AWS services and resources securely. It controls who (user/role) can
access what (service/resource) and how (permission policy). IAM manages Users, Groups, Roles,
and Policies. It supports MFA, cross-account access, least-privilege principle, and audit
logging.
Q12. What are IAM Users, Groups, and Roles?
Answer:
• Users – Individuals requiring access (human users).
• Groups – Collections of users with shared permissions.
• Roles – Temporary access identities assumed by applications, EC2, Lambda, SSO users, or
external accounts.
Roles are preferred over IAM users for workloads because they use temporary credentials
and are more secure.
Q13. What are IAM Policies?
Answer:
Policies are JSON documents defining permissions using Effect, Action, Resource, and Condition.
Example:
• "Effect": "Allow"
• "Action": "s3:*"
• "Resource": "arn:aws:s3:::my-bucket/*"
Policies determine what operations are permitted or denied. AWS provides managed policies,
customer-managed policies, and inline policies.
Q14. What is MFA?
Answer:
Multi-Factor Authentication adds a second authentication layer (TOTP app, U2F key) in addition
to password/access key. It prevents unauthorized access even if credentials are leaked.
Q15. Why is root user considered risky?
Answer:
Root user has unrestricted permissions across AWS. It must be used only once—to set up the
account—and secured using MFA. Day-to-day operations must be performed using individual IAM
users/roles with least privilege.
Q16. What is Access Key in IAM?
Answer:
An Access Key (Access Key ID + Secret Access Key) is used for CLI/SDK authentication without
console login. It must never be shared, embedded in code, or uploaded to GitHub. Rotate keys
frequently using IAM best practices.
Q17. What is IAM Role for EC2?
Answer:
IAM roles allow EC2 instances to communicate securely with other AWS services without storing
sensitive credentials in code. Example: an EC2 role with S3-read permissions allows an app on
EC2 to fetch objects without access keys.
Q18. What is permission boundary?
Answer:
A permission boundary restricts the maximum permissions an IAM user or role can have. Even if a
user is granted additional permissions, they cannot exceed the boundary limits. Used in large
organizations to prevent privilege escalation.
Q19. What is STS?
Answer:
Security Token Service generates temporary security credentials used for cross-account access,
single sign-on, and federated access. It ensures sessions expire automatically for better
security.
Q20. What is least privilege principle?
Answer:
Users should receive only the minimum access needed to perform their tasks. Example: a developer
accessing only their project’s S3 bucket rather than full S3 admin rights.
📌 S3
Q21. What is Amazon S3?
Answer:
Amazon S3 (Simple Storage Service) is an object storage system designed for storing and
retrieving any amount of data from anywhere. It supports 99.999999999% durability (11 nines)
using multi-AZ replication. Ideal for files, backups, logs, media, static websites, big data
storage, ML datasets.
Q22. What are Buckets and Objects in S3?
Answer:
A bucket is a container for storing objects.
An object is stored data + metadata + unique key. Each object can be up to 5TB in size. Bucket
names are globally unique and mapped to AWS regions.
Q23. What is S3 Storage Class?
Answer:
Storage classes optimize cost based on access frequency:
• S3 Standard – frequent access
• S3 Intelligent-Tiering – auto-moves between tiers based on access
• S3 Standard-IA & One-Zone-IA – infrequent access
• S3 Glacier – archival storage
• S3 Glacier Deep Archive – lowest cost, retrieval in hours
Choosing correct class reduces storage cost significantly.
Q24. What is S3 Versioning?
Answer:
Versioning stores multiple copies of an object whenever it is modified or deleted. It protects
against accidental deletion/overwrites. Once enabled, versioning cannot be disabled—only
suspended.
Q25. What is S3 Lifecycle Policy?
Answer:
Lifecycle rules automate object transitions between storage classes and manage expiration.
Example:
• After 30 days → move to Standard-IA
• After 90 days → move to Glacier
• After 365 days → delete object
Q26. What is S3 Encryption?
Answer:
S3 supports encryption in-transit (HTTPS/TLS) and at-rest (AES). Methods include:
• SSE-S3 – managed by AWS
• SSE-KMS – uses KMS CMK keys
• SSE-C – customer provided keys
• Client-side encryption – encrypted before upload
Q27. What is S3 Access Control?
Answer:
You can control access using:
• IAM Policies
• Bucket Policies
• ACLs (legacy)
• Block Public Access
Best practice is to block public access unless you're hosting a public website.
Q28. Can S3 host static websites?
Answer:
Yes. S3 supports hosting static websites (HTML, CSS, JS) with Route 53 DNS and CloudFront CDN.
It does not support backend code like PHP or [Link].
Q29. What is S3 Transfer Acceleration?
Answer:
It speeds up file upload/download by routing traffic via AWS Edge Locations instead of public
internet. Ideal for global uploads.
Q30. How does S3 integrate in DevOps pipelines?
Answer:
S3 is widely used for storing:
• Terraform state files
• CI/CD artifacts (JAR/ZIP/Images)
• Logs and monitoring data
• Software build storage
•
🌐 VPC
Q31. What is VPC?
Answer:
Virtual Private Cloud is a private isolated network in AWS where resources like EC2, RDS, and
Load Balancers run securely. Users control IP ranges, routing, subnets, NAT, firewalls, and
traffic flow.
Q32. What are Subnets?
Answer:
Subnets divide a VPC network.
• Public Subnet – has internet access via Internet Gateway; used for ALB, Bastion host.
• Private Subnet – no direct internet access; used for databases, backend services.
Q33. What is Internet Gateway?
Answer:
An IGW enables inbound/outbound Internet communication for public subnets. Without it, instances
cannot connect to the internet.
Q34. What is NAT Gateway?
Answer:
NAT Gateway allows instances in private subnets to access the internet (for package updates)
without exposing them publicly.
Q35. What are Route Tables?
Answer:
Route tables control how network traffic is forwarded. Example:
• [Link]/0 → IGW (public)
• [Link]/0 → NAT (private)
Q36. What are NACLs and Security Groups?
Answer:
• NACL (stateless firewall) – operates at subnet level; requires inbound and outbound rules
both.
• Security Group (stateful firewall) – operates at instance level; response traffic allowed
automatically.
Q37. What is VPC Peering?
Answer:
Peering connects two VPCs to communicate internally without public internet. Good for multi-
region microservices.
Q38. What is VPC Endpoint?
Answer:
VPC Endpoint allows private communication to AWS services (like S3, DynamoDB) via AWS network
instead of internet. Useful for security and cost.
Q39. What is Transit Gateway?
Answer:
Transit Gateway connects multiple VPCs and on-prem networks via a central hub. Essential for
large organizations with many VPCs.
Q40. How does VPC benefit DevOps?
Answer:
VPC isolates environments like Dev, QA, Stage, Prod, enforces network security, supports private
deployments, and enables zero-trust architecture.
📡 CloudWatch
Q41. What is CloudWatch?
Answer:
CloudWatch monitors AWS resources and applications in real time. It collects metrics, logs,
events, and provides alarms and dashboards for proactive alerting.
Q42. What are CloudWatch Metrics?
Answer:
Metrics are numeric measurements like CPUUtilization, NetworkIn/Out, DiskReadOps. EC2 and other
services send metrics automatically; custom metrics can also be pushed via API.
Q43. What are CloudWatch Logs?
Answer:
CloudWatch Logs collect raw log files from EC2, Lambda, applications, containers, and on-prem
systems. Logs can be queried using Logs Insights, exported to S3, or forwarded to
Elasticsearch/OpenSearch.
Q44. What are CloudWatch Alarms?
Answer:
Alarms trigger automated actions based on thresholds. Example:
• CPU > 80% for 5 minutes → Scale out ASG
• Disk space low → Send SNS alert
• Payment service errors > 10 → Notify Slack
Q45. What is CloudWatch Dashboard?
Answer:
Dashboards visualize metrics in a single console. They help track system health and SLA
compliance. Dashboards can show graphs, heatmaps, and alarms.
Q46. What is CloudWatch Events / EventBridge?
Answer:
EventBridge triggers automation when AWS resources generate events. Example:
• EC2 stopped → Trigger Lambda to send email
• GitHub push → Trigger AWS pipeline
• S3 upload → Trigger Lambda
Q47. What is Log Retention Policy?
Answer:
Retention settings delete old logs automatically to control cost. Options include 1 day, 3
months, 1 year, or never expire.
Q48. Difference between CloudWatch and CloudTrail?
Answer:
• CloudWatch monitors performance metrics and logs.
• CloudTrail tracks API-level activity (who did what and when).
Together, they provide full observability and audit capabilities.
Q49. How does CloudWatch help DevOps?
Answer:
CloudWatch provides continuous monitoring, automated scaling, incident alerts, log insights,
system debugging, and cost optimization. It is integrated into CI/CD pipelines to detect
deployment failures.
Q50. What is Custom Metric in CloudWatch?
Answer:
Custom Metrics are user-defined data points pushed from apps or on-prem systems—for example:
• Number of logins per minute
• Payment API failures
• Jenkins job duration