AWS INTERVIEW QUESTIONS

Section 1: Basic AWS Interview Questions

1. What is Cloud Computing? Can you talk about and compare any two popular
Cloud Service Providers?

For a detailed discussion on this topic, please refer our Cloud Computing blog. Following
is the comparison between two of the most popular Cloud Service Providers:

Amazon Web Services Vs Microsoft Azure

Parameters AWS Azure

Initiation 2006 2010
Market Share 4x x
Implementation Less Options More Experimentation Possible
Features Widest Range Of Options Good Range Of Options
App Hosting AWS not as good as Azure Azure Is Better
Development Varied & Great Features Varied & Great Features
IaaS Offerings Good Market Hold Better Offerings than AWS
Related Learning: AWS vs Azure and Google Cloud vs AWS or Detailed AWS vs Azure
vs Google Cloud Comparison here!

2.. Try this AWS scenario based interview question. I have some private servers on
my premises, also I have distributed some of my workload on the public cloud, what
is this architecture called?

A. Virtual Private Network

B. Private Cloud
C. Virtual Private Cloud
D. Hybrid Cloud

Answer D.

Explanation: This type of architecture would be a hybrid cloud. Why? Because we are
using both, the public cloud, and your on premises servers i.e the private cloud. To make
this hybrid architecture easy to use, wouldn’t it be better if your private and public cloud
were all on the same network(virtually). This is established by including your public cloud

1
servers in a virtual private cloud, and connecting this virtual cloud with your on premise
servers using a VPN(Virtual Private Network).

Learn to design, develop, and manage a robust, secure, and highly available cloud-
based solution for your organization’s needs with the Google Cloud Platform Course.

3. What is Auto-scaling?

Auto-scaling is a feature that allows you to provision and launch new instances based
on demand. It enables you to automatically raise or reduce resource capacity in
response to demand.

4. What is geo-targeting in CloudFront?

Geo-targeting is a concept in which businesses may deliver customized information to

their audience depending on their geographic location without altering the URL. This
allows you to produce personalized content for a specific geographical audience while
keeping their demands in mind.

5. Define and explain the three initial orders of all services and the AWS products
erected on them.

There are three primary types of cloud services: computing, storage, and networking.

Then there are AWS products built based on the three orders of all services. Computing
services such as EC2, Elastic Beanstalk, Lambda, Auto-Scaling, and Lightsail are
exemplifications. S3, Glacier, Elastic Block Storage, and the Elastic File System exemplify
the storage. VPC, Amazon CloudFront, and Route53 are exemplifications of networking
services.

6. What are the steps involved in a CloudFormation Solution?

2
 • Create a new CloudFormation template or utilize an existing one in JSON or
YAML format.
• Save the code in an S3 bucket, which will act as a repository for it.
• To call the bucket and construct a stack on your template, use AWS
CloudFormation.
• CloudFormation scans the file and understands the services that are called, their
sequence, and the relationships between the services before provisioning them
one by one.

7. What are the main features of Cloud Computing?

Cloud computing has the following key characteristics:

1. Massive amounts of computing resources can be provisioned quickly.

2. Resources can be accessed from any location with an internet connection due to
its location independence.
3. Unlike physical devices, cloud storage has no capacity constraints which makes it
very efficient for storage.
4. Multi-Tenancy allows a large number of users to share resources.
5. Data backup and disaster recovery are becoming easier and less expensive with
cloud computing.
6. Its Scalability enables businesses to scale up and scale down as needed with
cloud computing.i
7.

8. Explain AWS.

AWS is an abbreviation for Amazon Web Services, which is a collection of remote

computing services also known as Cloud Computing. This technology is also known as
IaaS, or Infrastructure as a Service.

9. Name some of the non-regional AWS services.

Some of the non-regional AWS services.

1. CloudFront
2. IAM
3. Route 53
4. Web Application Firewall

10. What are the different layers that define cloud architecture?

3
The following are the various layers operated by cloud architecture:

• CLC or Cloud Controller.

• Cluster Controller
• SC or Storage Controller
• NC, or Node Controller
• Walrus

11. What are the tools and techniques that you can use in AWS to identify if you
are paying more than you should be, and how to correct it?

You may ensure that you are paying the proper amount for the resources you use by
utilizing the following resources:

• Check out the Top Services Table- It is a dashboard in the expense management
interface that displays the top five most used services. This will show you how
much money you are spending on the resources in question.
• Cost Finder- There are cost explorer programs accessible that will allow you to
see and evaluate your consumption expenditures over the previous 13 months.
You may also receive a cost prediction for the next three months.
• AWS Budgets- This helps you create a budget for the services. It will also allow
you to see if the current plan suits your budget and the specifics of how you
utilize the services.
• Cost Allocation Labels- This aids in determining the resource that has cost the
most in a given month. It allows you to categorize your resources and cost
allocation tags in order to keep track of your AWS charges.

12. What are the various layers of cloud computing? Explain their work.

Cloud computing categories have various layers that include

1. Infrastructure as a Service (IaaS) is the on-demand provision of services such as

servers, storage, networks, and operating systems.
2. Platform as a Service (PaaS) combines IaaS with an abstracted collection of
middleware services, software development, and deployment tools.
3. PaaS also enables developers to create web or mobile apps in the cloud quickly.
4. Software as a Service (SaaS) is a software application that has been delivered on-
demand, in a multi-tenant model
5. Function as a Service (FaaS) enables end users to build and execute app
functionalities on a serverless architecture.

4
13. What are the various Cloud versions?

There are several models for deploying cloud services:

1. The public cloud is a collection of computer resources such as hardware,

software, servers, storage, and so on that are owned and operated by third-party
cloud providers for use by businesses or individuals.
2. A private cloud is a collection of resources owned and managed by an
organization for use by its employees, partners, or customers.
3. A hybrid cloud combines public and private cloud services.

14. Is there any other alternative tool to log into the cloud environment other than
the console?

The following will help you in logging into AWS resources:

• Putty
• AWS CLI for Linux
• AWS CLI for Windows
• AWS CLI for Windows CMD
• AWS SDK
• Eclipse

15. What are the native AWS Security logging capabilities?

Most AWS services provide logging capabilities. AWS CloudTrail, AWS Config, and
others, for example, have account level logging. Let’s look at two specific services:

AWS CloudTrail
This is a service that gives a history of AWS API calls for each account. It also allows you
to undertake security analysis, resource change tracking, and compliance audits on your
AWS environment. The nice aspect about this service is that you can set it to send
notifications via AWS SNS when fresh logs are provided.

AWS Setup
This helps you comprehend the configuration changes that occur in your environment.
This service offers an AWS inventory that contains configuration history, configuration
change notification, and links between AWS resources. It may also be set to send
notifications via AWS SNS when fresh logs are received.

16. What is a DDoS attack, and what services can minimize them?

5
DDoS is a cyber-attack in which the culprit visits a website and creates several sessions,
preventing genuine users from accessing the service. The following native tools will help
you in preventing DDoS attacks on your AWS services:

• AWS Shield
• AWS WAF
• AAmazon CloudFront
• Amazon Route53
• ELB
• VPC

16. List the pros and cons of serverless computing.

Advantages:

1. Cost-effective
2. Operations have been simplified.
3. Improves Productivity
4. Scalable

Disadvantages:

1. This can result in response latency

2. Due to resource constraints, it is not suitable for high-computing operations.
3. Not very safe.
4. Debugging can be difficult.

17. What characteristics distinguish cloud architecture from traditional cloud

architecture?

The characteristics are as follows:

• In the cloud, hardware requirements are met based on the demand generated by
cloud architecture.
• When there is a demand for resources, cloud architecture can scale them up.
• Cloud architecture can manage and handle dynamic workloads without a single
point of failure.

Earn Cloud Architect Certification and become certified.

18. What are the featured services of AWS?

6
AWS’s key components are as follows:

• Elastic compute cloud (EC2): It is a computing resource that is available on

demand for hosting applications. In times of uncertain workloads, EC2 comes in
handy.
• Route 53: It is a web-based DNS service.
• Simple Storage Device S3: This is a storage device service that is widely used in
AWS Identity and Access Management.
• Elastic Block Store: It allows you to store constant volumes of data and is
integrated with EC2. It also allows you to persist data.
• Cloud watch: It allows you to monitor the critical areas of AWS and even set a
reminder for troubleshooting.
• Simple Email Service: It allows you to send emails using regular SMTP or a
restful API call.

Section 2: AWS Interview Questions and Answers for Amazon EC2

For a detailed discussion on this topic, please refer to our EC2 AWS blog.

19. What does the following command do with respect to the Amazon EC2 security
groups?

ec2-create-group CreateSecurityGroup

A. Groups the user created security groups into a new group for easy access.
B. Creates a new security group for use with your account.
C. Creates a new group inside the security group.
D. Creates a new rule inside the security group.

Answer B.

Explanation: A Security group is just like a firewall, it controls the traffic in and out of
your instance. In AWS terms, the inbound and outbound traffic. The command mentioned
is pretty straight forward, it says create security group, and does the same. Moving along,
once your security group is created, you can add different rules in it. For example, you
have an RDS instance, to access it, you have to add the public IP address of the machine
from which you want to access the instance in its security group.

20. Here is aws scenario based interview question. You have a video trans-coding
application. The videos are processed according to a queue. If the processing of a
video is interrupted in one instance, it is resumed in another instance. Currently

7
there is a huge back-log of videos which needs to be processed, for this you need
to add more instances, but you need these instances only until your backlog is
reduced. Which of these would be an efficient way to do it?

You should be using an On Demand instance for the same. Why? First of all, the workload
has to be processed now, meaning it is urgent, secondly you don’t need them once your
backlog is cleared, therefore Reserved Instance is out of the picture, and since the work is
urgent, you cannot stop the work on your instance just because the spot price spiked,
therefore Spot Instances shall also not be used. Hence On-Demand instances shall be the
right choice in this case.

21. You have a distributed application that periodically processes large volumes of
data across multiple Amazon EC2 Instances. The application is designed to recover
gracefully from Amazon EC2 instance failures. You are required to accomplish this
task in the most cost effective way.

Which of the following will meet your requirements?

A. Spot Instances
B. Reserved instances
C. Dedicated instances
D. On-Demand instances

Answer: A

Explanation: Since the work we are addressing here is not continuous, a reserved
instance shall be idle at times, same goes with On Demand instances. Also it does not
make sense to launch an On Demand instance whenever work comes up, since it is
expensive. Hence Spot Instances will be the right fit because of their low rates and no
long term commitments.

22. How is stopping and terminating an instance different from each other?

Starting, stopping and terminating are the three states in an EC2 instance, let’s discuss
them in detail:

• Stopping and Starting an instance: When an instance is stopped, the instance

performs a normal shutdown and then transitions to a stopped state. All of its
Amazon EBS volumes remain attached, and you can start the instance again at a

8
 later time. You are not charged for additional instance hours while the instance is
in a stopped state.
• Terminating an instance: When an instance is terminated, the instance performs a
normal shutdown, then the attached Amazon EBS volumes are deleted unless the
volume’s deleteOnTermination attribute is set to false. The instance itself is also
deleted, and you can’t start the instance again at a later time.

23. If I want my instance to run on a single-tenant hardware, which value do I have

to set the instance’s tenancy attribute to?

A. Dedicated
B. Isolated
C. One
D. Reserved

Answer A.

Explanation: The Instance tenancy attribute should be set to Dedicated Instance. The rest
of the values are invalid.

24. When will you incur costs with an Elastic IP address (EIP)?

A. When an EIP is allocated.

B. When it is allocated and associated with a running instance.
C. When it is allocated and associated with a stopped instance.
D. Costs are incurred regardless of whether the EIP is associated with a running
instance.

Answer C.

Explanation: You are not charged, if only one Elastic IP address is attached with your
running instance. But you do get charged in the following conditions:

• When you use more than one Elastic IPs with your instance.
• When your Elastic IP is attached to a stopped instance.
• When your Elastic IP is not attached to any instance.

25. How is a Spot instance different from an On-Demand instance or Reserved

Instance?

9
First of all, let’s understand that Spot Instance, On-Demand instance and Reserved
Instances are all models for pricing. Moving along, spot instances provide the ability for
customers to purchase compute capacity with no upfront commitment, at hourly rates
usually lower than the On-Demand rate in each region. Spot instances are just like
bidding, the bidding price is called Spot Price. The Spot Price fluctuates based on supply
and demand for instances, but customers will never pay more than the maximum price
they have specified. If the Spot Price moves higher than a customer’s maximum price, the
customer’s EC2 instance will be shut down automatically. But the reverse is not true, if the
Spot prices come down again, your EC2 instance will not be launched automatically, one
has to do that manually. In Spot and On demand instance, there is no commitment for
the duration from the user side, however in reserved instances one has to stick to the time
period that he has chosen.

26. Are the Reserved Instances available for Multi-AZ Deployments?

A. Multi-AZ Deployments are only available for Cluster Compute instances types
B. Available for all instance types
C. Only available for M3 instance types
D. D. Not Available for Reserved Instances

Answer B.

Explanation: Reserved Instances is a pricing model, which is available for all instance
types in EC2.

27. How to use the processor state control feature available on the c4.8xlarge
instance?

The processor state control consists of 2 states:

• The C state – Sleep state varying from c0 to c6. C6 being the deepest sleep state
for a processor
• The P state – Performance state p0 being the highest and p15 being the lowest
possible frequency.

Now, why the C state and P state. Processors have cores, these cores need thermal
headroom to boost their performance. Now since all the cores are on the processor the
temperature should be kept at an optimal state so that all the cores can perform at the
highest performance.

10
Now how will these states help in that? If a core is put into sleep state it will reduce the
overall temperature of the processor and hence other cores can perform better. Now the
same can be synchronized with other cores, so that the processor can boost as many
cores it can by timely putting other cores to sleep, and thus get an overall performance
boost.

Concluding, the C and P state can be customized in some EC2 instances like the c4.8xlarge
instance and thus you can customize the processor according to your workload.

28. What kind of network performance parameters can you expect when you launch
instances in cluster placement group?

The network performance depends on the instance type and network performance
specification, if launched in a placement group you can expect up to

• 10 Gbps in a single-flow,
• 20 Gbps in multiflow i.e full duplex
• Network traffic outside the placement group will be limited to 5 Gbps(full duplex).

29. To deploy a 4 node cluster of Hadoop in AWS which instance type can be used?

First let’s understand what actually happens in a Hadoop cluster, the Hadoop cluster
follows a master slave concept. The master machine processes all the data, slave machines
store the data and act as data nodes. Since all the storage happens at the slave, a higher
capacity hard disk would be recommended and since master does all the processing, a
higher RAM and a much better CPU is required. Therefore, you can select the
configuration of your machine depending on your workload. For e.g. – In this case
c4.8xlarge will be preferred for master machine whereas for slave machine we can select
i2.large instance. If you don’t want to deal with configuring your instance and installing
hadoop cluster manually, you can straight away launch an Amazon EMR (Elastic Map
Reduce) instance which automatically configures the servers for you. You dump your data
to be processed in S3, EMR picks it from there, processes it, and dumps it back into S3.

30. Where do you think an AMI fits, when you are designing an architecture for a
solution?

AMIs(Amazon Machine Images) are like templates of virtual machines and an instance is
derived from an AMI. AWS offers pre-baked AMIs which you can choose while you are
launching an instance, some AMIs are not free, therefore can be bought from the AWS
Marketplace. You can also choose to create your own custom AMI which would help you
save space on AWS. For example if you don’t need a set of software on your installation,

11
you can customize your AMI to do that. This makes it cost efficient, since you are removing
the unwanted things.

31. How do you choose an Availability Zone?

Let’s understand this through an example, consider there’s a company which has user
base in India as well as in the US.

Let us see how we will choose the region for this use case :

So, with reference to the above figure the regions to choose between are, Mumbai and
North Virginia. Now let us first compare the pricing, you have hourly prices, which can be
converted to your per month figure. Here North Virginia emerges as a winner. But, pricing
cannot be the only parameter to consider. Performance should also be kept in mind
hence, let’s look at latency as well. Latency basically is the time that a server takes to
respond to your requests i.e the response time. North Virginia wins again!

So concluding, North Virginia should be chosen for this use case.

32. Is one Elastic IP address enough for every instance that I have running?

Depends! Every instance comes with its own private and public address. The private
address is associated exclusively with the instance and is returned to Amazon EC2 only
when it is stopped or terminated. Similarly, the public address is associated exclusively
with the instance until it is stopped or terminated. However, this can be replaced by the
Elastic IP address, which stays with the instance as long as the user doesn’t manually
detach it. But what if you are hosting multiple websites on your EC2 server, in that case
you may require more than one Elastic IP address.

33. What are the best practices for Security in Amazon EC2?

There are several best practices to secure Amazon EC2. A few of them are given below:

12
 • Use AWS Identity and Access Management (IAM) to control access to your AWS
resources.
• Restrict access by only allowing trusted hosts or networks to access ports on your
instance.
• Review the rules in your security groups regularly, and ensure that you apply the
principle of least
• Privilege – only open up permissions that you require.
• Disable password-based logins for instances launched from your AMI. Passwords
can be found or cracked, and are a security risk.

34. How can you upgrade or downgrade a system with little to no downtime?

The following steps can be used to update or downgrade a system with near-zero
downtime:

AWS Certification Training Course for Solutions Architects

Explore Curriculum

First, you will have to Launch the EC2 console, then secondly, select the AMI Operating
System. The next step is creating an instance using the new instance type; you need to
install the updates and go to set up apps. Then check to determine if the instances are
operational or not, and if everything is well, you will deploy the new instance and
replace all the old ones. Now once everything is ready for installation, you can upgrade
or downgrade the system with very little to no downtime

35. What’s the Amazon EC2 root device volume?

The image used to boot an EC2 instance is saved on the root device slice, which
happens when an Amazon AMI launches a new EC2 case. This root device volume is
supported by EBS or an instance store. In general, the lifetime of an EC2 instance does
not affect the root device data stored on Amazon EBS.

13
36. Mention and explain the many types of Amazon EC2 instances.

The various instances available on Amazon EC2 General-purpose Instances:

1. They are used to compute a wide range of tasks and aid in allocating processor,
memory, and networking resources.
2. Instances optimized for computing: These are suitable for compute-intensive
workloads. They can handle batch processing workloads, high-performance web
servers, machine learning inference, and a wide range of other tasks.
3. Memory-optimized: They process and provide tasks that manage massive
datasets in memory.
4. Computing speed: It accelerates the execution of floating-point number
calculations, data pattern matching, and graphics processing.
5. Optimized Storage: They conduct operations on local storage that need
sequential read and write access to big data sets.

37. What exactly do you mean by ‘changing’ in Amazon EC2?

Amazon EC2 now provides the option for customers to move from the current ‘instance
count-based constraints’ to the new ‘vCPU Based restrictions.’ As a result, when
launching a demand-driven mix of instance types, usage is assessed in terms of the
number of vCPUs.

38. Your application is running on an EC2 instance. When your instance’s CPU
consumption reaches 80%, you must lower the load on it. What method do you
employ to finish the task?

Setting up an autoscaling group to deploy new instances when an EC2 instance’s CPU
consumption exceeds 80% and distributing traffic among instances via the deployment
of an application load balancer and the designation of EC2 instances as target instances
can do this.

39. How does one set up CloudWatch to recover an EC2 instance?

Here’s how you can set them up:

1. Using Amazon CloudWatch, create an alarm.

2. Navigate to the Define Alarm -> Actions tab of the Alarm.
3. Choose the Option to Recover This Instance

14
40. How do you recover/log in to an EC2 instance for which you have lost the key?

If you have lost your key, follow the procedures below to recover an EC2 instance:

Step 1. Verify that the EC2Config service is operating.

Step 2. Detach the instance’s root volume.

Step 3. Connect the volume to a temporary instance

Step 4. Change the configuration file

Step 5. Restart the original instance.

Section 3: AWS interview questions for Amazon Storage

41. What exactly is Amazon S3?

Explanation S3 stands for Simple Storage Service, and Amazon S3 is the most
extensively used storehouse platform. S3 is an object storehouse service that can store
and recoup any volume of data from any position. Despite its rigidity, it’s basically
measureless as well as cost-effective because it’s on- a demand storehouse. Away from
these advantages, it provides new situations of continuity and vacuity. Amazon S3 aids
in data operation for cost reduction, access control, and compliance.

42. What Storage Classes are available in Amazon S3?

15
Explanation: The following Storage Classes are accessible using Amazon S3:

1. Storage class Amazon S3 Glacier Instant Retrieval

2. Amazon S3 Glacier Flexible Retrieval Storage Class (Formerly S3 Glacier)
3. Glacier Deep Archive on Amazon S3 (S3 Glacier Deep Archive)
4. Storage class S3 Outposts
5. Amazon S3 Standard-Occasional Access (S3 Standard-IA)
6. Amazon S3 One Zone-Only Occasional Access (S3 One Zone-IA)
7. Amazon S3 Basic (S3 Standard)
8. Amazon S3 Storage with Reduced Redundancy
9. Intelligent-Tiering on Amazon S3 (S3 Intelligent-Tiering)

43. How do you auto-delete old snapshots?

Explanation: Here’s how to delete outdated photos automatically:

1. Take snapshots of the EBS volumes on Amazon S3 in accordance with process

and best practices.
2. To manage all of the snapshots automatically, use AWS Ops Automator.
3. You may use this to generate, copy, and remove Amazon EBS snapshots.

44. Another aws interview questions and answers for experienced scenario
based. You need to configure an Amazon S3 bucket to serve static assets for your
public-facing web application. Which method will ensure that all objects uploaded
to the bucket are set to public read?

A. Set permissions on the object to public read during upload.

B. Configure the bucket policy to set all objects to public read.
C. Use AWS Identity and Access Management roles to set the bucket to public read.
D. Amazon S3 objects default to public read, so no action is needed.

Answer B.

Explanation: Rather than making changes to every object, its better to set the policy for
the whole bucket. IAM is used to give more granular permissions, since this is a website,
all objects would be public by default.

45. A customer wants to leverage Amazon Simple Storage Service (S3) and Amazon
Glacier as part of their backup and archive infrastructure. The customer plans to use
third-party software to support this integration. Which approach will limit the

16
access of the third party software to only the Amazon S3 bucket named “company-
backup”?

A. A custom bucket policy limited to the Amazon S3 API in three Amazon Glacier
archive “company-backup”
B. A custom bucket policy limited to the Amazon S3 API in “company-backup”
C. A custom IAM user policy limited to the Amazon S3 API for the Amazon Glacier
archive “company-backup”.
D. A custom IAM user policy limited to the Amazon S3 API in “company-backup”.

Answer D.

Explanation: Taking queue from the previous questions, this use case involves more
granular permissions, hence IAM would be used here.

45. Can S3 be used with EC2 instances, if yes, how?

Yes, it can be used for instances with root devices backed by local instance storage. By
using Amazon S3, developers have access to the same highly scalable, reliable, fast,
inexpensive data storage infrastructure that Amazon uses to run its own global network
of web sites. In order to execute systems in the Amazon EC2 environment, developers use
the tools provided to load their Amazon Machine Images (AMIs) into Amazon S3 and to
move them between Amazon S3 and Amazon EC2.

Another use case could be for websites hosted on EC2 to load their static content from
S3.

For a detailed discussion on S3, please refer our S3 AWS blog.

46. A customer implemented AWS Storage Gateway with a gateway-cached volume

at their main office. An event takes the link between the main and branch office
offline. Which methods will enable the branch office to access their data?

A. Restore by implementing a lifecycle policy on the Amazon S3 bucket.

B. Make an Amazon Glacier Restore API call to load the files into another Amazon S3
bucket within four to six hours.
C. Launch a new AWS Storage Gateway instance AMI in Amazon EC2, and restore
from a gateway snapshot.
D. Create an Amazon EBS volume from a gateway snapshot, and mount it to
an Amazon EC2 instance.

17
Answer C.

Explanation: The fastest way to do it would be launching a new storage gateway instance.
Why? Since time is the key factor which drives every business, troubleshooting this
problem will take more time. Rather than we can just restore the previous working state
of the storage gateway on a new instance.

47. When you need to move data over long distances using the internet, for instance
across countries or continents to your Amazon S3 bucket, which method or service
will you use?

A. Amazon Glacier
B. Amazon CloudFront
C. Amazon Transfer Acceleration
D. Amazon Snowball

Answer C.

Explanation: You would not use Snowball, because for now, the snowball service does
not support cross region data transfer, and since, we are transferring across countries,
Snowball cannot be used. Transfer Acceleration shall be the right choice here as it throttles
your data transfer with the use of optimized network paths and Amazon’s content delivery
network upto 300% compared to normal data transfer speed.

48. How can you speed up data transfer in Snowball?

The data transfer can be increased in the following way:

• By performing multiple copy operations at one time i.e. if the workstation is

powerful enough, you can initiate multiple cp commands each from different
terminals, on the same Snowball device.
• Copying from multiple workstations to the same snowball.
• Transferring large files or by creating a batch of small file, this will reduce the
encryption overhead.
• Eliminating unnecessary hops i.e. make a setup where the source machine(s) and
the snowball are the only machines active on the switch being used, this can hugely
improve performance.

49. What’s the distinction between EBS and Instance Store?

18
EBS is a type of persistent storage that allows data to be recovered at a later time. When
you save data to the EBS, it remains long after the EC2 instance has been terminated.
Instance Store, on the other hand, is temporary storage that is physically tied to a host
system. You cannot remove one instance and attach it to another using an Instance
Store. Data in an Instance Store, unlike EBS, is lost if any instance is stopped or
terminated.

50. How can you use EBS to automate EC2 backup?

To automate EC2 backups using EBS, perform the following steps:

Step 1. Get a list of instances and connect to AWS through API to get a list of Amazon
EBS volumes that are associated to the instance locally.

Step 2. List each volume’s snapshots and give a retention time to each snapshot. Create
a snapshot of each volume afterwards.

Step 3. Remove any snapshots that are older than the retention term.

Section 4: AWS Interview Questions for AWS VPC

51. What Is Amazon Virtual Private Cloud (VPC) and How Does It Work?

A VPC is the most efficient way to connect to your cloud services from within your own
data centre. When you link your datacenter to the VPC that contains your instances,
each instance is allocated a private IP address that can be accessed from your
datacenter. As a result, you may use public cloud services as if they were on your own
private network.

52. If you want to launch Amazon Elastic Compute Cloud (EC2) instances and assign
each instance a predetermined private IP address you should:

A. Launch the instance from a private Amazon Machine Image (AMI).

B. Assign a group of sequential Elastic IP address to the instances.
C. Launch the instances in the Amazon Virtual Private Cloud (VPC).
D. Launch the instances in a Placement Group.

Answer C.

Explanation: The best way of connecting to your cloud resources (for ex- ec2 instances)
from your own data center (for eg- private cloud) is a VPC. Once you connect your
datacenter to the VPC in which your instances are present, each instance is assigned a
19
private IP address which can be accessed from your datacenter. Hence, you can access
your public cloud resources, as if they were on your own network.

Master the Cloud with Confidence – Enroll in AWS SysOps Training Today!

53. How do you connect multiple sites to a VPC?

If you have numerous VPN connections, you may use the AWS VPN CloudHub to
encrypt communication across locations. Here’s an illustration of how to link different
sites to a VPC:

54. What are some of the security products and features offered in VPC?

Here are some security products and features:

20
Security groups – serve as a firewall for EC2 instances, allowing you to regulate inbound
and outgoing traffic at the instance level.

Network access control lists – It operates as a subnet-level firewall, managing inbound

and outgoing traffic.

Flow logs – capture inbound and outgoing traffic from your VPC’s network interfaces.

55. How many Subnets are allowed in a VPC?

Each Amazon Virtual Private Cloud may support up to 200 Subnets (VPC).

56. Can I connect my corporate datacenter to the Amazon Cloud?

Yes, you can do this by establishing a VPN(Virtual Private Network) connection between
your company’s network and your VPC (Virtual Private Cloud), this will allow you to
interact with your EC2 instances as if they were within your existing network.

57. Is it possible to change the private IP addresses of an EC2 while it is

running/stopped in a VPC?

Primary private IP address is attached with the instance throughout its lifetime and cannot
be changed, however secondary private addresses can be unassigned, assigned or moved
between interfaces or instances at any point.

58. Why do you make subnets?

A. Because there is a shortage of networks

B. To efficiently utilize networks that have a large no. of hosts.
C. Because there is a shortage of hosts.
D. To efficiently utilize networks that have a small no. of hosts.

Answer B.

Explanation: If there is a network which has a large no. of hosts, managing all these hosts
can be a tedious job. Therefore we divide this network into subnets (sub-networks) so
that managing these hosts becomes simpler.

59. Which of the following is true?

A. You can attach multiple route tables to a subnet

B. You can attach multiple subnets to a route table

21
 C. Both A and B
D. None of these.

Answer B.

Explanation: Route Tables are used to route network packets, therefore in a subnet
having multiple route tables will lead to confusion as to where the packet has to go.
Therefore, there is only one route table in a subnet, and since a route table can have any
no. of records or information, hence attaching multiple subnets to a route table is
possible.

60. In CloudFront what happens when content is NOT present at an Edge location
and a request is made to it?

A. An Error “404 not found” is returned

B. CloudFront delivers the content directly from the origin server and stores it in the
cache of the edge location
C. The request is kept on hold till content is delivered to the edge location
D. The request is routed to the next closest edge location

Answer B.

Explanation: CloudFront is a content delivery system, which caches data to the nearest
edge location from the user, to reduce latency. If data is not present at an edge location,
the first time the data may get transferred from the original server, but from the next time,
it will be served from the cached edge.

61. If I’m using Amazon CloudFront, can I use Direct Connect to transfer objects
from my own data center?

Yes. Amazon CloudFront supports custom origins including origins from outside of AWS.
With AWS Direct Connect, you will be charged with the respective data transfer rates.

62. If my AWS Direct Connect fails, will I lose my connectivity?

If a backup AWS Direct connect has been configured, in the event of a failure it will switch
over to the second one. It is recommended to enable Bidirectional Forwarding Detection
(BFD) when configuring your connections to ensure faster detection and failover. On the
other hand, if you have configured a backup IPsec VPN connection instead, all VPC traffic
will failover to the backup VPN connection automatically. Traffic to/from public resources
such as Amazon S3 will be routed over the Internet. If you do not have a backup AWS

22
Direct Connect link or a IPsec VPN link, then Amazon VPC traffic will be dropped in the
event of a failure.

Section 5: AWS Interview Questions and Answers for Amazon Database

63. If I launch a standby RDS instance, will it be in the same Availability Zone as my
primary?

A. Only for Oracle RDS types

B. Yes
C. Only if it is configured at launch
D. No

Answer D.

Explanation: No, since the purpose of having a standby instance is to avoid an

infrastructure failure (if it happens), therefore the standby instance is stored in a different
availability zone, which is a physically different independent infrastructure.

64. When would I prefer Provisioned IOPS over Standard RDS storage?

A. If you have batch-oriented workloads

B. If you use production online transaction processing (OLTP) workloads.
C. If you have workloads that are not sensitive to consistent performance
D. All of the above

Answer A.

Explanation: Provisioned IOPS deliver high IO rates but on the other hand it is expensive
as well. Batch processing workloads do not require manual intervention they enable full
utilization of systems, therefore a provisioned IOPS will be preferred for batch oriented
workload.

65. Given that the RDS instance replica is not promoted as the master instance,
how would you handle a situation in which the relational database engine
routinely collapses as traffic to your RDS instances increases?

For managing high amounts of traffic, as well as creating manual or automatic

snapshots to restore data if the RDS instance fails, a bigger RDS instance type is
necessary.

66. Which scaling method would you recommend for RDS, and why?
23
Vertical scaling and horizontal scaling are the two forms of scaling. Vertical scaling
allows you to scale up your master database vertically with the click of a button. A
database can only be scaled vertically, and the RDS may be resized in 18 different ways.
Horizontal scaling, on the other hand, is beneficial for copies. These are read-only
replicas that can only be performed with Amazon Aurora.

66. How is Amazon RDS, DynamoDB and Redshift different?

• Amazon RDS is a database management service for relational databases, it

manages patching, upgrading, backing up of data etc. of databases for you without
your intervention. RDS is a Db management service for structured data only.
• DynamoDB, on the other hand, is a NoSQL database service, NoSQL deals with
unstructured data.
• Redshift, is an entirely different service, it is a data warehouse product and is used
in data analysis.

67. If I am running my DB Instance as a Multi-AZ deployment, can I use the standby

DB Instance for read or write operations along with primary DB instance?

A. Yes
B. Only with MySQL based RDS
C. Only for Oracle RDS instances
D. No

Answer D.

Explanation: No, Standby DB instance cannot be used with primary DB instance in

parallel, as the former is solely used for standby purposes, it cannot be used unless the
primary instance goes down.

68. Your company’s branch offices are all over the world, they use a software with a
multi-regional deployment on AWS, they use MySQL 5.6 for data persistence.

The task is to run an hourly batch process and read data from every region to
compute cross-regional reports which will be distributed to all the branches. This
should be done in the shortest time possible. How will you build the DB architecture
in order to meet the requirements?

A. For each regional deployment, use RDS MySQL with a master in the region and a
read replica in the HQ region

24
 B. For each regional deployment, use MySQL on EC2 with a master in the region and
send hourly EBS snapshots to the HQ region
C. For each regional deployment, use RDS MySQL with a master in the region and
send hourly RDS snapshots to the HQ region
D. For each regional deployment, use MySQL on EC2 with a master in the region and
use S3 to copy data files hourly to the HQ region

Answer A.

Explanation: For this we will take an RDS instance as a master, because it will manage
our database for us and since we have to read from every region, we’ll put a read replica
of this instance in every region where the data has to be read from. Option C is not correct
since putting a read replica would be more efficient than putting a snapshot, a read replica
can be promoted if needed to an independent DB instance, but with a Db snapshot it
becomes mandatory to launch a separate DB Instance.

69. Can I run more than one DB instance for Amazon RDS for free?

Yes. You can run more than one Single-AZ Micro database instance, that too for free!
However, any use exceeding 750 instance hours, across all Amazon RDS Single-AZ Micro
DB instances, across all eligible database engines and regions, will be billed at standard
Amazon RDS prices. For example: if you run two Single-AZ Micro DB instances for 400
hours each in a single month, you will accumulate 800 instance hours of usage, of which
750 hours will be free. You will be billed for the remaining 50 hours at the standard
Amazon RDS price.

For a detailed discussion on this topic, please refer our RDS AWS blog.

70. Which AWS services will you use to collect and process e-commerce data for
near real-time analysis?

A. Amazon ElastiCache
B. Amazon DynamoDB
C. Amazon Redshift
D. Amazon Elastic MapReduce

Answer B,C.

71. Can I retrieve only a specific element of the data, if I have a nested JSON data in
DynamoDB?

25
Yes. When using the GetItem, BatchGetItem, Query or Scan APIs, you can define a
Projection Expression to determine which attributes should be retrieved from the table.
Those attributes can include scalars, sets, or elements of a JSON document.

72. A company is deploying a new two-tier web application in AWS. The company
has limited staff and requires high availability, and the application requires complex
queries and table joins. Which configuration provides the solution for the
company’s requirements?

A. MySQL Installed on two Amazon EC2 Instances in a single Availability Zone

B. Amazon RDS for MySQL with Multi-AZ
C. Amazon ElastiCache
D. Amazon DynamoDB

Answer D.

Explanation: DynamoDB has the ability to scale more than RDS or any other relational
database service, therefore DynamoDB would be the apt choice.

73. What happens to my backups and DB Snapshots if I delete my DB Instance?

When you delete a DB instance, you have an option of creating a final DB snapshot, if you
do that you can restore your database from that snapshot. RDS retains this user-created
DB snapshot along with all other manually created DB snapshots after the instance is
deleted, also automated backups are deleted and only manually created DB Snapshots
are retained.

74. Which of the following use cases are suitable for Amazon DynamoDB? Choose 2
answers

A. Managing web sessions.

B. Storing JSON documents.
C. Storing metadata for Amazon S3 objects.
D. Running relational joins and complex updates.

Answer C,D.

Explanation: If all your JSON data have the same fields eg [id,name,age] then it would be
better to store it in a relational database, the metadata on the other hand is unstructured,
also running relational joins or complex updates would work on DynamoDB as well.

26
75. How can I load my data to Amazon Redshift from different data sources like
Amazon RDS, Amazon DynamoDB and Amazon EC2?

You can load the data in the following two ways:

• You can use the COPY command to load data in parallel directly to Amazon
Redshift from Amazon EMR, Amazon DynamoDB, or any SSH-enabled host.
• AWS Data Pipeline provides a high performance, reliable, fault tolerant solution to
load data from a variety of AWS data sources. You can use AWS Data Pipeline to
specify the data source, desired data transformations, and then execute a pre-
written import script to load your data into Amazon Redshift.

76. What is an Amazon RDS maintenance window? Will your database instance be
available during maintenance?

You may plan DB instance updates, database engine version upgrades, and software
patching using the RDS maintenance window. Only upgrades for security and durability
are scheduled automatically. The maintenance window is set to 30 minutes by default,
and the DB instance will remain active throughout these events, but with somewhat
reduced performance.

77. Your application has to retrieve data from your user’s mobile every 5 minutes
and the data is stored in DynamoDB, later every day at a particular time the data is
extracted into S3 on a per user basis and then your application is later used to
visualize the data to the user. You are asked to optimize the architecture of the
backend system to lower cost, what would you recommend?

A. Create a new Amazon DynamoDB (able each day and drop the one for the previous
day after its data is on Amazon S3.
B. Introduce an Amazon SQS queue to buffer writes to the Amazon DynamoDB table
and reduce provisioned write throughput.
C. Introduce Amazon Elasticache to cache reads from the Amazon DynamoDB table
and reduce provisioned read throughput.
D. Write data directly into an Amazon Redshift cluster replacing both Amazon
DynamoDB and Amazon S3.

Answer C.

Explanation: Since our work requires the data to be extracted and analyzed, to optimize
this process a person would use provisioned IO, but since it is expensive, using a

27
ElastiCache memoryinsread to cache the results in the memory can reduce the
provisioned read throughput and hence reduce cost without affecting the performance.

78. You are running a website on EC2 instances deployed across multiple Availability
Zones with a Multi-AZ RDS MySQL Extra Large DB Instance. The site performs a high
number of small reads and writes per second and relies on an eventual consistency
model. After comprehensive tests you discover that there is read contention on RDS
MySQL. Which are the best approaches to meet these requirements? (Choose 2
answers)

A. Deploy ElastiCache in-memory cache running in each availability zone

B. Implement sharding to distribute load to multiple RDS MySQL instances
C. Increase the RDS MySQL Instance size and Implement provisioned IOPS
D. Add an RDS MySQL read replica in each availability zone

Answer A,C.

Explanation: Since it does a lot of read writes, provisioned IO may become expensive.
But we need high performance as well, therefore the data can be cached using ElastiCache
which can be used for frequently reading the data. As for RDS since read contention is
happening, the instance size should be increased and provisioned IO should be
introduced to increase the performance.

A better way to learn more about the EC2 instances is from the AWS Solution Architect
Certification.

79. A startup is running a pilot deployment of around 100 sensors to measure street
noise and air quality in urban areas for 3 months. It was noted that every month
around 4GB of sensor data is generated. The company uses a load balanced auto
scaled layer of EC2 instances and a RDS database with 500 GB standard storage. The
pilot was a success and now they want to deploy at least 100K sensors which need
to be supported by the backend. You need to store the data for at least 2 years to
analyze it. Which setup of the following would you prefer?

A. Add an SQS queue to the ingestion layer to buffer writes to the RDS instance
B. Ingest data into a DynamoDB table and move old data to a Redshift cluster
C. Replace the RDS instance with a 6 node Redshift cluster with 96TB of storage
D. Keep the current architecture but upgrade RDS storage to 3TB and 10K provisioned
IOPS

28
Answer C.
Explanation: A Redshift cluster would be preferred because it easy to scale, also the work
would be done in parallel through the nodes, therefore is perfect for a bigger workload
like our use case. Since each month 4 GB of data is generated, therefore in 2 year, it should
be around 96 GB. And since the servers will be increased to 100K in number, 96 GB will
approximately become 96TB. Hence option C is the right answer.

Section 6: AWS Interview Questions and Answers for AWS Auto Scaling, AWS Load
Balancer

80. Suppose you have an application where you have to render images and also do
some general computing. From the following services which service will best fit
your need?

A. Classic Load Balancer

B. Application Load Balancer
C. Both of them
D. None of these

Answer B.

Explanation: You will choose an application load balancer, since it supports path based
routing, which means it can take decisions based on the URL, therefore if your task needs
image rendering it will route it to a different instance, and for general computing it will
route it to a different instance.

81. What is the difference between Scalability and Elasticity?

Scalability is the ability of a system to increase its hardware resources to handle the
increase in demand. It can be done by increasing the hardware specifications or increasing
the processing nodes.

Elasticity is the ability of a system to handle increase in the workload by adding additional
hardware resources when the demand increases(same as scaling) but also rolling back the
scaled resources, when the resources are no longer needed. This is particularly helpful in
Cloud environments, where a pay per use model is followed.

82. How can an existing instance be added to a new Auto Scaling group?

To add an existing instance to a new Auto Scaling group, follow these steps:

29
Step1. Launch the EC2 console.

Step2. Select your instance from the list of Instances.

Step3. Navigate to Actions -> Instance Settings -> Join the Auto Scaling Group

Step4. Choose a new Auto Scaling group.

Step5. Join this group to the Instance.

Step6. If necessary, modify the instance.

Step7. Once completed, the instance may be successfully added to a new Auto Scaling
group.

83. How will you change the instance type for instances which are running in your
application tier and are using Auto Scaling. Where will you change it from the
following areas?

A. Auto Scaling policy configuration

B. Auto Scaling group
C. Auto Scaling tags configuration
D. Auto Scaling launch configuration

Answer D.

Explanation: Auto scaling tags configuration, is used to attach metadata to your

instances, to change the instance type you have to use auto scaling launch configuration.

84. You have a content management system running on an Amazon EC2 instance
that is approaching 100% CPU utilization. Which option will reduce load on the
Amazon EC2 instance?

A. Create a load balancer, and register the Amazon EC2 instance with it
B. Create a CloudFront distribution, and configure the Amazon EC2 instance as the
origin
C. Create an Auto Scaling group from the instance using the
CreateAutoScalingGroup action
D. Create a launch configuration from the instance using the
CreateLaunchConfigurationAction

Answer A.

30
Explanation:Creating alone an autoscaling group will not solve the issue, until you attach
a load balancer to it. Once you attach a load balancer to an autoscaling group, it will
efficiently distribute the load among all the instances. Option B – CloudFront is a CDN, it
is a data transfer tool therefore will not help reduce load on the EC2 instance. Similarly
the other option – Launch configuration is a template for configuration which has no
connection with reducing loads.

85. When should I use a Classic Load Balancer and when should I use an Application
load balancer?

A Classic Load Balancer is ideal for simple load balancing of traffic across multiple EC2
instances, while an Application Load Balancer is ideal for microservices or container-based
architectures where there is a need to route traffic to multiple services or load balance
across multiple ports on the same EC2 instance.

For a detailed discussion on Auto Scaling and Load Balancer, please refer our EC2
AWS blog.

86. What does Connection draining do?

A. Terminates instances which are not in use.

B. Re-routes traffic from instances which are to be updated or failed a health
check.
C. Re-routes traffic from instances which have more workload to instances which
have less workload.
D. Drains all the connections from an instance, with one click.

Answer B.

Explanation: Connection draining is a service under ELB which constantly monitors the
health of the instances. If any instance fails a health check or if any instance has to be
patched with a software update, it pulls all the traffic from that instance and re routes
them to other instances.

87. When an instance is unhealthy, it is terminated and replaced with a new one,
which of the following services does that?

A. Sticky Sessions
B. Fault Tolerance
C. Connection Draining
D. Monitoring

31
Answer B.

Explanation: When ELB detects that an instance is unhealthy, it starts routing incoming
traffic to other healthy instances in the region. If all the instances in a region becomes
unhealthy, and if you have instances in some other availability zone/region, your traffic is
directed to them. Once your instances become healthy again, they are re routed back to
the original instances.

88. What are lifecycle hooks used for in AutoScaling?

A. They are used to do health checks on instances

B. They are used to put an additional wait time to a scale in or scale out event.
C. They are used to shorten the wait time to a scale in or scale out event
D. None of these

Answer B.

Explanation: Lifecycle hooks are used for putting wait time before any lifecycle action i.e
launching or terminating an instance happens. The purpose of this wait time, can be
anything from extracting log files before terminating an instance or installing the
necessary softwares in an instance before launching it.

89. A user has setup an Auto Scaling group. Due to some issue the group has failed
to launch a single instance for more than 24 hours. What will happen to Auto Scaling
in this condition?

A. Auto Scaling will keep trying to launch the instance for 72 hours
B. Auto Scaling will suspend the scaling process
C. Auto Scaling will start an instance in a separate region
D. The Auto Scaling group will be terminated automatically

Answer B.

Explanation: Auto Scaling allows you to suspend and then resume one or more of the
Auto Scaling processes in your Auto Scaling group. This can be very useful when you want
to investigate a configuration problem or other issue with your web application, and then
make changes to your application, without triggering the Auto Scaling process.

Section 7: AWS Interview Questions for CloudTrail, Route 53

32
90. What is Cloudtrail, and how does it interact with Route 53?

CloudTrail is a service that logs every request made to the Amazon Route 53 API by an
AWS account, including those made by IAM users. CloudTrail stores these requests’ log
files to an Amazon S3 bucket. CloudTrail collects data on all requests. CloudTrail log files
contain information that may be used to discover which requests were submitted to
Amazon Route 53, the IP address from which the request was sent, who issued the
request, when it was sent, and more.

91. How does AWS configuration interact with AWS CloudTrail?

AWS CloudTrail logs user API activity on your account and provides you with access to
the data. CloudTrail provides detailed information on API activities such as the caller’s
identity, the time of the call, request arguments, and response elements. AWS Config,
on the other hand, saves point-in-time configuration parameters for your AWS
resources as Configuration Items (CIs).

A CI may be used to determine what your AWS resource looks like at any given time.
Using CloudTrail, on the other hand, you can instantly determine who made an API
request to alter the resource. Cloud Trail may also be used to determine if a security
group was wrongly setup.

92. You have an EC2 Security Group with several running EC2 instances. You
changed the Security Group rules to allow inbound traffic on a new port and
protocol, and then launched several new instances in the same Security Group. The
new rules apply:

A. Immediately to all instances in the security group.

B. Immediately to the new instances only.
C. Immediately to the new instances, but old instances must be stopped and restarted
before the new rules apply.
D. To all instances, but it may take several minutes for old instances to see the
changes.

Answer A.

Explanation: Any rule specified in an EC2 Security Group applies immediately to all the
instances, irrespective of when they are launched before or after adding a rule.

33
93. To create a mirror image of your environment in another region for disaster
recovery, which of the following AWS resources do not need to be recreated in the
second region? ( Choose 2 answers )

A. Route 53 Record Sets

B. Elastic IP Addresses (EIP)
C. EC2 Key Pairs
D. Launch configurations
E. Security Groups

Answer A.

Explanation: Route 53 record sets are common assets therefore there is no need to
replicate them, since Route 53 is valid across regions

94. A customer wants to capture all client connection information from his load
balancer at an interval of 5 minutes, which of the following options should he
choose for his application?

A. Enable AWS CloudTrail for the loadbalancer.

B. Enable access logs on the load balancer.
C. Install the Amazon CloudWatch Logs agent on the load balancer.
D. Enable Amazon CloudWatch metrics on the load balancer.

Answer A.

Explanation: AWS CloudTrail provides inexpensive logging information for load balancer
and other AWS resources This logging information can be used for analyses and other
administrative work, therefore is perfect for this use case.

95. A customer wants to track access to their Amazon Simple Storage Service (S3)
buckets and also use this information for their internal security and access audits.
Which of the following will meet the Customer requirement?

A. Enable AWS CloudTrail to audit all Amazon S3 bucket access.

B. Enable server access logging for all required Amazon S3 buckets.
C. Enable the Requester Pays option to track access via AWS Billing
D. Enable Amazon S3 event notifications for Put and Post.

Answer A.

34
Explanation: AWS CloudTrail has been designed for logging and tracking API calls. Also
this service is available for storage, therefore should be used in this use case.

96. Which of the following are true regarding AWS CloudTrail? (Choose 2 answers)

A. CloudTrail is enabled globally

B. CloudTrail is enabled on a per-region and service basis
C. Logs can be delivered to a single Amazon S3 bucket for aggregation.
D. CloudTrail is enabled for all available services within a region.

Answer B,C.

Explanation: Cloudtrail is not enabled for all the services and is also not available for all
the regions. Therefore option B is correct, also the logs can be delivered to your S3 bucket,
hence C is also correct.

97. What happens if CloudTrail is turned on for my account but my Amazon S3

bucket is not configured with the correct policy?

CloudTrail files are delivered according to S3 bucket policies. If the bucket is not
configured or is misconfigured, CloudTrail might not be able to deliver the log files.

98. How do I transfer my existing domain name registration to Amazon Route 53

without disrupting my existing web traffic?

You will need to get a list of the DNS record data for your domain name first, it is generally
available in the form of a “zone file” that you can get from your existing DNS provider.
Once you receive the DNS record data, you can use Route 53’s Management Console or
simple web-services interface to create a hosted zone that will store your DNS records for
your domain name and follow its transfer process. It also includes steps such as updating
the nameservers for your domain name to the ones associated with your hosted zone. For
completing the process you have to contact the registrar with whom you registered your
domain name and follow the transfer process. As soon as your registrar propagates the
new name server delegations, your DNS queries will start to get answered.

99. What services are available for implementing a centralised logging solution?

The most important services you may utilise are Amazon CloudWatch Logs, which you
can store in Amazon S3 and then display using Amazon Elastic Search. To transfer data
from Amazon S3 to Amazon ElasticSearch, you can utilise Amazon Kinesis Firehose.

35
Section 8: AWS Interview Questions for AWS SQS, AWS SNS, AWS SES, AWS
ElasticBeanstalk

100. WHAT EXACTLY ARE SNS AND SQS?

Ans: Amazon Simple Notification Service (SNS) is a web service that manages user
notifications sent from any cloud platform. From any cloud platform, manage and
distribute messages or notifications to users and consumers.

Amazon Simple Queue Service (SQS) administers the queue service, which allows users
to move data whether it is running or active.

36
 101.
Which of the following services you would not use to deploy an app?

A. Elastic Beanstalk
B. Lambda
C. Opsworks
D. CloudFormation

Answer B.

Explanation: Lambda is used for running server-less applications. It can be used to

deploy functions triggered by events. When we say serverless, we mean without you
worrying about the computing resources running in the background. It is not designed
for creating applications which are publicly accessed.

102. What distinguishes AWS CludFormation from AWS Elastic Beanstalk?

The following are some distinctions between AWS CloudFormation and AWS Elastic
Beanstalk:

AWS CloudFormation assists you in provisioning and describing all infrastructure

resources in your cloud environment. AWS Elastic Beanstalk, on the other hand, provides
an environment that makes it simple to install and execute cloud applications.

AWS CloudFormation meets the infrastructure requirements of a wide range of

applications, including legacy applications and existing corporate applications. AWS

37
Elastic Beanstalk, on the other hand, is integrated with developer tools to assist you in
managing the lifespan of your applications.

103. How does Elastic Beanstalk apply updates?

A. By having a duplicate ready with updates before swapping.

B. By updating on the instance while it is running
C. By taking the instance down in the maintenance window
D. Updates should be installed manually

Answer A.

Explanation: Elastic Beanstalk prepares a duplicate copy of the instance, before updating
the original instance, and routes your traffic to the duplicate instance, so that, incase your
updated application fails, it will switch back to the original instance, and there will be no
downtime experienced by the users who are using your application.

104. What happens if my application in Beanstalk stops responding to requests?

AWS Beanstalk apps provide a built-in method for preventing infrastructure problems. If
an Amazon EC2 instance dies for whatever reason, Beanstalk will instantly start a new
instance using Auto Scaling. Beanstalk can detect if your application is not responding
to the custom link.

AWS Certification Training Course for Solutions Architects

Weekday / Weekend BatchesSee Batch Details

105. How is AWS Elastic Beanstalk different than AWS OpsWorks?

AWS Elastic Beanstalk is an application management platform while OpsWorks is a

configuration management platform. BeanStalk is an easy to use service which is used for
deploying and scaling web applications developed with Java, .Net, PHP, Node.js, Python,
Ruby, Go and Docker. Customers upload their code and Elastic Beanstalk automatically

38
handles the deployment. The application will be ready to use without any infrastructure
or resource configuration.

In contrast, AWS Opsworks is an integrated configuration management platform for IT

administrators or DevOps engineers who want a high degree of customization and control
over operations.

106. What happens if my application stops responding to requests in beanstalk?

AWS Beanstalk applications have a system in place for avoiding failures in the underlying
infrastructure. If an Amazon EC2 instance fails for any reason, Beanstalk will use Auto
Scaling to automatically launch a new instance. Beanstalk can also detect if your
application is not responding on the custom link, even though the infrastructure appears
healthy, it will be logged as an environmental event( e.g a bad version was deployed) so
you can take an appropriate action.

For a detailed discussion on this topic, please refer Lambda AWS blog.

Section 9: AWS Interview Questions and Answers for AWS OpsWorks, AWS KMS

107. How is AWS OpsWorks different than AWS CloudFormation?

OpsWorks and CloudFormation both support application modelling, deployment,

configuration, management and related activities. Both support a wide variety of
architectural patterns, from simple web applications to highly complex applications. AWS
OpsWorks and AWS CloudFormation differ in abstraction level and areas of focus.

AWS CloudFormation is a building block service which enables customer to manage

almost any AWS resource via JSON-based domain specific language. It provides
foundational capabilities for the full breadth of AWS, without prescribing a particular
model for development and operations. Customers define templates and use them to
provision and manage AWS resources, operating systems and application code.

In contrast, AWS OpsWorks is a higher level service that focuses on providing highly
productive and reliable DevOps experiences for IT administrators and ops-minded
developers. To do this, AWS OpsWorks employs a configuration management model
based on concepts such as stacks and layers, and provides integrated experiences for key
activities like deployment, monitoring, auto-scaling, and automation. Compared to AWS
CloudFormation, AWS OpsWorks supports a narrower range of application-oriented AWS
resource types including Amazon EC2 instances, Amazon EBS volumes, Elastic IPs, and
Amazon CloudWatch metrics.

39
108. A firm seeking to migrate to the AWS Cloud wants to use its existing Chef
recipes for infrastructure configuration management. Which AWS service would
be best for this need?

1. AWS Elastic Load Balancer

2. AWS Elastic Beanstalk
3. AWS OpsWorks
4. AWS Inspector

Answer C.

Explanation: AWS OpsWorks is a configuration management solution that allows you

to use Puppet or Chef to setup and run applications in a cloud organisation. AWS
OpsWorks Stacks and AWS OpsWorks for Chef Automate allow you to leverage
Chefcookbooks and solutions for configuration management, whereas AWS OpsWorks
for Puppet Enterprise allows you to set up an AWS Puppet Enterprise master server.
Puppet provides a suite of tools for enforcing desirable infrastructure states and
automating on-demand operations.

Learn more about AWS Migration here!

109. I created a key in Oregon region to encrypt my data in North Virginia region
for security purposes. I added two users to the key and an external AWS account. I
wanted to encrypt an object in S3, so when I tried, the key that I just created was
not listed. What could be the reason?

A. External aws accounts are not supported.

B. AWS S3 cannot be integrated KMS.
C. The Key should be in the same region.
D. New keys take some time to reflect in the list.

Answer C.

Explanation: The key created and the data to be encrypted should be in the same region.
Hence the approach taken here to secure the data is incorrect.

110. A company’s demand in AWS is for a mound- grounded paradigm for

its coffers. Different heaps are needed for the Development and
product surroundings. Which of the following styles may be utilised to meet
this demand?

40
 A. A. EC2 markers to define different mound layers for your coffers.
B. In DynamoD, define the metadata for the various levels.
C. Define the various tiers for your operation using AWS OpsWorks.
D. Define the different levels for your business using AWS Config.

Answer C.

Explanation: The OpsWorks service can meet the need. This need is supported by the
AWS attestation listed below AWS OpsWorks Stacks allows you to manage AWS and
on- demesne apps and waiters. You may represent your operation as a mound with
several layers similar as cargo balancing, database, and operation garçon using
OpsWorks Stacks. In each league, you may emplace and configure Amazon EC2 cases
or link fresh coffers similar as Amazon RDS databases.

111. A company needs to monitor the read and write IOPS for their AWS MySQL
RDS instance and send real-time alerts to their operations team. Which AWS services
can accomplish this?

A. Amazon Simple Email Service

B. Amazon CloudWatch
C. Amazon Simple Queue Service
D. Amazon Route 53

Answer B.

Explanation: Amazon CloudWatch is a cloud monitoring tool and hence this is the right
service for the mentioned use case. The other options listed here are used for other
purposes for example route 53 is used for DNS services, therefore CloudWatch will be the
apt choice.

112. What happens when one of the resources in a stack cannot be created
successfully in AWS OpsWorks?

When an event like this occurs, the “automatic rollback on error” feature is enabled, which
causes all the AWS resources which were created successfully till the point where the error
occurred to be deleted. This is helpful since it does not leave behind any erroneous data,
it ensures the fact that stacks are either created fully or not created at all. It is useful in
events where you may accidentally exceed your limit of the no. of Elastic IP addresses or
maybe you may not have access to an EC2 AMI that you are trying to run etc.

113. What automation tools can you use to spinup servers?

41
Any of the following tools can be used:

• Roll-your-own scripts, and use the AWS API tools. Such scripts could be written in
bash, perl or other language of your choice.
• Use a configuration management and provisioning tool like puppet or its successor
Opscode Chef. You can also use a tool like Scalr.
• Use a managed solution such as Rightscale.

We at Edureka are here to help you with every step on your journey, to becoming an AWS
Solution Architect; therefore besides the AWS Interview Questions and answers, we have
come up with a curriculum that covers exactly what you would need to crack the Solution
Architect Exam!

I hope you benefitted from these AWS Interview Questions. The topics you learned in this
blog are the most sought-after skill sets recruiters look for in an AWS Solution Architect
Professional. I have tried touching up on AWS interview questions and answers for
freshers and for people with 3-5 years of experience. However, for a more detailed study
on AWS, you can refer our AWS Tutorial. Unlock your potential as an AWS Developer by
earning your AWS Developer Certification. Take the next step in your cloud computing
journey and showcase your expertise in designing,

Basic AWS Interview Questions

1. Define and explain the three basic types of cloud services and the AWS products that
are built based on them?

The three basic types of cloud services are:

• Computing

• Storage

• Networking

42
Here are some of the AWS products that are built based on the three cloud service
types:

Computing - These include EC2, Elastic Beanstalk, Lambda, Auto-Scaling, and Lightsat.

Storage - These include S3, Glacier, Elastic Block Storage, Elastic File System.

Networking - These include VPC, Amazon CloudFront, Route53

2. What is the relation between the Availability Zone and Region?

AWS regions are separate geographical areas, like the US-West 1 (North California) and
Asia South (Mumbai). On the other hand, availability zones are the areas that are
present inside the regions. These are generally isolated zones that can replicate
themselves whenever required.

3. What is auto-scaling?

43
Auto-scaling is a function that allows you to provision and launch new instances
whenever there is a demand. It allows you to automatically increase or decrease
resource capacity in relation to the demand.

4. What is geo-targeting in CloudFront?

Geo-Targeting is a concept where businesses can show personalized content to their

audience based on their geographic location without changing the URL. This helps you
create customized content for the audience of a specific geographical area, keeping
their needs in the forefront.

5. What are the steps involved in a CloudFormation Solution?

Here are the steps involved in a CloudFormation solution:

1. Create or use an existing CloudFormation template using JSON or YAML

format.

2. Save the code in an S3 bucket, which serves as a repository for the code.

44
 3. Use AWS CloudFormation to call the bucket and create a stack on your
template.

4. CloudFormation reads the file and understands the services that are called,
their order, the relationship between the services, and provisions the services
one after the other.

6. How do you upgrade or downgrade a system with near-zero downtime?

You can upgrade or downgrade a system with near-zero downtime using the following
steps of migration:

• Open EC2 console

• Choose Operating System AMI

• Launch an instance with the new instance type

• Install all the updates

• Install applications

• Test the instance to see if it’s working

• If working, deploy the new instance and replace the older instance

• Once it’s deployed, you can upgrade or downgrade the system with near-zero
downtime.

Take home these interview Q&As and get much more. Download the complete AWS
Interview Guide here:

7. What are the tools and techniques that you can use in AWS to identify if you are
paying more than you should be, and how to correct it?

You can know that you are paying the correct amount for the resources that you are
using by employing the following resources:

45
 • Check the Top Services Table

It is a dashboard in the cost management console that shows you the top five
most used services. This will let you know how much money you are spending
on the resources in question.
• Cost Explorer

There are cost explorer services available that will help you to view and analyze
your usage costs for the last 13 months. You can also get a cost forecast for
the upcoming three months.
• AWS Budgets

This allows you to plan a budget for the services. Also, it will enable you to
check if the current plan meets your budget and the details of how you use
the services.
• Cost Allocation Tags

This helps in identifying the resource that has cost more in a particular month.
It lets you organize your resources and cost allocation tags to keep track of
your AWS costs.

8. Is there any other alternative tool to log into the cloud environment other than
console?

The that can help you log into the AWS resources are:

• Putty

• AWS CLI for Linux

• AWS CLI for Windows

• AWS CLI for Windows CMD

• AWS SDK

• Eclipse

46
9. What services can be used to create a centralized logging solution?

The essential services that you can use are Amazon CloudWatch Logs, store them
in Amazon S3, and then use Amazon Elastic Search to visualize them. You can use
Amazon Kinesis Firehose to move the data from Amazon S3 to Amazon ElasticSearch.

10. What are the native AWS Security logging capabilities?

Most of the AWS services have their logging options. Also, some of them have an
account level logging, like in AWS CloudTrail, AWS Config, and others. Let’s take a look
at two services in specific:

AWS CloudTrail

This is a service that provides a history of the AWS API calls for every account. It lets you
perform security analysis, resource change tracking, and compliance auditing of your
AWS environment as well. The best part about this service is that it enables you to
configure it to send notifications via AWS SNS when new logs are delivered.

AWS Config

47
This helps you understand the configuration changes that happen in your environment.
This service provides an AWS inventory that includes configuration history, configuration
change notification, and relationships between AWS resources. It can also be configured
to send information via AWS SNS when new logs are delivered.

11. What is a DDoS attack, and what services can minimize them?

DDoS is a cyber-attack in which the perpetrator accesses a website and creates multiple
sessions so that the other legitimate users cannot access the service. The native tools
that can help you deny the DDoS attacks on your AWS services are:

• AWS Shield

• AWS WAF

• Amazon Route53

• Amazon CloudFront

• ELB

• VPC

48
12. You are trying to provide a service in a particular region, but you do not see the
service in that region. Why is this happening, and how do you fix it?

Not all Amazon AWS services are available in all regions. When Amazon initially
launches a new service, it doesn’t get immediately published in all the regions. They
start small and then slowly expand to other regions. So, if you don’t see a specific
service in your region, chances are the service hasn’t been published in your region yet.
However, if you want to get the service that is not available, you can switch to the
nearest region that provides the services.

13. How do you set up a system to monitor website metrics in real-time in AWS?

Amazon CloudWatch helps you to monitor the application status of various AWS
services and custom events. It helps you to monitor:

• State changes in Amazon EC2

• Auto-scaling lifecycle events

• Scheduled events

• AWS API calls

• Console sign-in events

49
14. What are the different types of virtualization in AWS, and what are the differences
between them?

The three major types of virtualization in AWS are:

• Hardware Virtual Machine (HVM)

It is a fully virtualized hardware, where all the virtual machines act separate
from each other. These virtual machines boot by executing a master boot
record in the root block device of your image.
• Paravirtualization (PV)

Paravirtualization-GRUB is the bootloader that boots the PV AMIs. The PV-

GRUB chain loads the kernel specified in the menu.
• Paravirtualization on HVM

PV on HVM helps operating systems take advantage of storage and network

I/O available through the host.

50
15. Name some of the AWS services that are not region-specific

AWS services that are not region-specific are:

• IAM

• Route 53

• Web Application Firewall

• CloudFront

Want a Job at AWS? Find Out What It Takes

Cloud Architect Master's ProgramEXPLORE PROGRAM

16. What are the differences between NAT Gateways and NAT Instances?

While both NAT Gateways and NAT Instances serve the same function, they still have
some key differences.

17. What is CloudWatch?

51
The Amazon CloudWatch has the following features:

• Depending on multiple metrics, it participates in triggering alarms.

• Helps in monitoring the AWS environments like CPU utilization, EC2, Amazon
RDS instances, Amazon SQS, S3, Load Balancer, SNS, etc.

18. What is an Elastic Transcoder?

To support multiple devices with various resolutions like laptops, tablets, and
smartphones, we need to change the resolution and format of the video. This can be
done easily by an AWS Service tool called the Elastic Transcoder, which is a media
transcoding in the cloud that exactly lets us do the needful. It is easy to use, cost-
effective, and highly scalable for businesses and developers.

AWS Interview Questions for Intermediate and Experienced

19. With specified private IP addresses, can an Amazon Elastic Compute Cloud (EC2)
instance be launched? If so, which Amazon service makes it possible?

Yes. Utilizing VPC makes it possible (Virtual Private Cloud).

20. Define Amazon EC2 regions and availability zones?

Availability zones are geographically separate locations. As a result, failure in one zone
has no effect on EC2 instances in other zones. When it comes to regions, they may have
one or more availability zones. This configuration also helps to reduce latency and costs.

21. Explain Amazon EC2 root device volume?

52
The image that will be used to boot an EC2 instance is stored on the root device drive.
This occurs when an Amazon AMI runs a new EC2 instance. And this root device volume
is supported by EBS or an instance store. In general, the root device data on Amazon
EBS is not affected by the lifespan of an EC2 instance.

22. Mention the different types of instances in Amazon EC2 and explain its features.

1. General Purpose Instances: They are used to compute a range of workloads

and aid in the allocation of processing, memory, and networking resources.

2. Compute Optimized Instances: These are ideal for compute-intensive

applications. They can handle batch processing workloads, high-performance
web servers, machine learning inference, and various other tasks.

3. Memory Optimized: They process workloads that handle massive datasets in

memory and deliver them quickly.

4. Accelerated Computing: It aids in the execution of floating-point number

calculations, data pattern matching, and graphics processing. These functions
are carried out using hardware accelerators.

5. Storage Optimised: They handle tasks that require sequential read and write
access to big data sets on local storage.

23. Will your standby RDS be launched in the same availability zone as your primary?

No, standby instances are launched in different availability zones than the primary,
resulting in physically separate infrastructures. This is because the entire purpose of
standby instances is to prevent infrastructure failure. As a result, if the primary instance
fails, the backup instance will assist in recovering all of the data.

Advanced AWS Interview Questions and Answers

24. What is the difference between a Spot Instance, an On-demand Instance, and a
Reserved Instance?

53
Spot instances are unused EC2 instances that users can use at a reduced cost.

When you use on-demand instances, you must pay for computing resources without
making long-term obligations.

Reserved instances, on the other hand, allow you to specify attributes such as instance
type, platform, tenancy, region, and availability zone. Reserved instances offer significant
reductions and capacity reservations when instances in certain availability zones are
used.

25. How would you address a situation in which the relational database engine
frequently collapses when traffic to your RDS instances increases, given that the RDS
instance replica is not promoted as the master instance?

A larger RDS instance type is required for handling significant quantities of traffic, as
well as producing manual or automated snapshots to recover data if the RDS instance
fails.

26. What do you understand by 'changing' in Amazon EC2?

To make limit administration easier for customers, Amazon EC2 now offers the option to
switch from the current 'instance count-based limitations' to the new 'vCPU Based
restrictions.' As a result, when launching a combination of instance types based on
demand, utilization is measured in terms of the number of vCPUs.

27. Define Snapshots in Amazon Lightsail?

The point-in-time backups of EC2 instances, block storage drives, and databases are
known as snapshots. They can be produced manually or automatically at any moment.
Your resources can always be restored using snapshots, even after they have been
created. These resources will also perform the same tasks as the original ones from
which the snapshots were made.

54
AWS Scenario-based Questions

28. On an EC2 instance, an application of yours is active. Once the CPU usage on your
instance hits 80%, you must reduce the load on it. What strategy do you use to
complete the task?

It can be accomplished by setting up an autoscaling group to deploy additional

instances, when an EC2 instance's CPU use surpasses 80% and by allocating traffic
across instances via the creation of an application load balancer and the designation of
EC2 instances as target instances.

29. Multiple Linux Amazon EC2 instances running a web application for a firm are being
used, and data is being stored on Amazon EBS volumes. The business is searching for a
way to provide storage that complies with atomicity, consistency, isolation, and
durability while also increasing the application's resilience in the event of a breakdown
(ACID). What steps should a solutions architect take to fulfill these demands?

AWS Auto Scaling groups can create an application load balancer that spans many
availability zones. Mount a target on each instance and save data on Amazon EFS.

30. Your business prefers to use its email address and domain to send and receive
compliance emails. What service do you recommend to implement it easily and budget-
friendly?

This can be accomplished by using Amazon Simple Email Service (Amazon SES), a cloud-
based email-sending service.

Technical and Non-Technical AWS Interview Questions

31. Describe SES.

55
Amazon offers the Simple Email Service (SES) service, which allows you to send bulk
emails to customers swiftly at a minimal cost.

32. Describe PaaS.

PaaS supports the operation of multiple cloud platforms, primarily for the development,
testing, and oversight of the operation of the program.

33. How many S3 buckets can be created?

Up to 100 buckets can be created by default.

34. What is the maximum limit of elastic IPs anyone can produce?

A maximum of five elastic IP addresses can be generated per location and AWS account.

AWS Questions for Amazon EC2

35. What is Amazon EC2?

EC2 is short for Elastic Compute Cloud, and it provides scalable computing capacity.
Using Amazon EC2 eliminates the need to invest in hardware, leading to faster
development and deployment of applications. You can use Amazon EC2 to launch as
many or as few virtual servers as needed, configure security and networking, and
manage storage. It can scale up or down to handle changes in requirements, reducing
the need to forecast traffic. EC2 provides virtual computing environments called
“instances.”

36. What Are Some of the Security Best Practices for Amazon EC2?

56
Security best practices for Amazon EC2 include using Identity and Access Management
(IAM) to control access to AWS resources; restricting access by only allowing trusted
hosts or networks to access ports on an instance; only opening up those permissions
you require, and disabling password-based logins for instances launched from your AMI.

37. Can S3 Be Used with EC2 Instances, and If Yes, How?

Amazon S3 can be used for instances with root devices backed by local instance storage.
That way, developers have access to the same highly scalable, reliable, fast, inexpensive
data storage infrastructure that Amazon uses to run its own global network of websites.
To execute systems in the Amazon EC2 environment, developers load Amazon Machine
Images (AMIs) into Amazon S3 and then move them between Amazon S3 and Amazon
EC2.

Amazon EC2 and Amazon S3 are two of the best-known web services that make up
AWS.

38. What is the difference between stopping and terminating an EC2 instance?

While you may think that both stopping and terminating are the same, there is a
difference. When you stop an EC2 instance, it performs a normal shutdown on the
instance and moves to a stopped state. However, when you terminate the instance, it is
transferred to a stopped state, and the EBS volumes attached to it are deleted and can
never be recovered.

39. What are the different types of EC2 instances based on their costs?

The three types of EC2 instances are:

• On-demand Instance

It is cheap for a short time but not when taken for the long term
• Spot Instance

57
 It is less expensive than the on-demand instance and can be bought through
bidding.
• Reserved Instance

If you are planning to use an instance for a year or more, then this is the right
one for you.

40. How do you set up SSH agent forwarding so that you do not have to copy the key
every time you log in?

Here’s how you accomplish this:

1. Go to your PuTTY Configuration

2. Go to the category SSH -> Auth

3. Enable SSH agent forwarding to your instance

41. What are Solaris and AIX operating systems? Are they available with AWS?

Solaris is an operating system that uses SPARC processor architecture, which is not
supported by the public cloud currently.

58
AIX is an operating system that runs only on Power CPU and not on Intel, which means
that you cannot create AIX instances in EC2.

Since both the operating systems have their limitations, they are not currently available
with AWS.

42. How do you configure CloudWatch to recover an EC2 instance?

Here’s how you can configure them:

• Create an Alarm using Amazon CloudWatch

• In the Alarm, go to Define Alarm -> Actions tab

• Choose Recover this instance option

43. What are the common types of AMI designs?

There are many types of AMIs, but some of the common AMIs are:

• Fully Baked AMI

• Just Enough Baked AMI (JeOS AMI)

59
 • Hybrid AMI

44. What are Key-Pairs in AWS?

The Key-Pairs are password-protected login credentials for the Virtual Machines that are
used to prove our identity while connecting the Amazon EC2 instances. The Key-Pairs
are made up of a Private Key and a Public Key which lets us connect to the instances.

AWS Interview Questions for S3

45. What is Amazon S3?

S3 is short for Simple Storage Service, and Amazon S3 is the most supported storage
platform available. S3 is object storage that can store and retrieve any amount of data
from anywhere. Despite that versatility, it is practically unlimited as well as cost-effective
because it is storage available on demand. In addition to these benefits, it offers
unprecedented levels of durability and availability. Amazon S3 helps to manage data for
cost optimization, access control, and compliance.

46. How can you recover/login to an EC2 instance for which you have lost the key?

Follow the steps provided below to recover an EC2 instance if you have lost the key:

1. Verify that the EC2Config service is running

2. Detach the root volume for the instance

3. Attach the volume to a temporary instance

4. Modify the configuration file

60
 5. Restart the original instance

47. What are some critical differences between AWS S3 and EBS?

Here are some differences between AWS S3 and EBS

48. How do you allow a user to gain access to a specific bucket?

You need to follow the four steps provided below to allow access. They are:

1. Categorize your instances

2. Define how authorized users can manage specific servers.

3. Lockdown your tags

4. Attach your policies to IAM users

49. How can you monitor S3 cross-region replication to ensure consistency without
actually checking the bucket?

Follow the flow diagram provided below to monitor S3 cross-region replication:

61
50. What is SnowBall?

To transfer terabytes of data outside and inside of the AWS environment, a small
application called SnowBall is used.

Data transferring using SnowBall is done in the following ways:

1. A job is created.

2. The SnowBall application is connected.

3. The data is copied into the SnowBall application.

4. Data is then moved to the AWS S3.

51. What are the Storage Classes available in Amazon S3?

The Storage Classes that are available in the Amazon S3 are the following:

• Amazon S3 Glacier Instant Retrieval storage class

• Amazon S3 Glacier Flexible Retrieval (Formerly S3 Glacier) storage class

62
 • Amazon S3 Glacier Deep Archive (S3 Glacier Deep Archive)

• S3 Outposts storage class

• Amazon S3 Standard-Infrequent Access (S3 Standard-IA)

• Amazon S3 One Zone-Infrequent Access (S3 One Zone-IA)

• Amazon S3 Standard (S3 Standard)

• Amazon S3 Reduced Redundancy Storage

• Amazon S3 Intelligent-Tiering (S3 Intelligent-Tiering)

AWS Interview Questions for VPC

52. What Is Amazon Virtual Private Cloud (VPC) and Why Is It Used?

A VPC is the best way of connecting to your cloud resources from your own data center.
Once you connect your datacenter to the VPC in which your instances are present, each
instance is assigned a private IP address that can be accessed from your data center.
That way, you can access your public cloud resources as if they were on your own
private network.

53. VPC is not resolving the server through DNS. What might be the issue, and how can
you fix it?

To fix this problem, you need to enable the DNS hostname resolution, so that the
problem resolves itself.

54. How do you connect multiple sites to a VPC?

63
If you have multiple VPN connections, you can provide secure communication between
sites using the AWS VPN CloudHub. Here’s a diagram that will show you how to connect
various sites to a VPC:

55. Name and explain some security products and features available in VPC?

Here is a selection of security products and features:

• Security groups - This acts as a firewall for the EC2 instances, controlling
inbound and outbound traffic at the instance level.

• Network access control lists - It acts as a firewall for the subnets, controlling
inbound and outbound traffic at the subnet level.

• Flow logs - These capture the inbound and outbound traffic from the network
interfaces in your VPC.

56. How do you monitor Amazon VPC?

64
You can monitor VPC by using:

• CloudWatch and CloudWatch logs

• VPC Flow Logs

57. How many Subnets can you have per VPC?

We can have up to 200 Subnets per Amazon Virtual Private Cloud (VPC).

General AWS Interview Questions

58. When Would You Prefer Provisioned IOPS over Standard Rds Storage?

You would use Provisioned IOPS when you have batch-oriented workloads. Provisioned
IOPS delivers high IO rates, but it is also expensive. However, batch processing
workloads do not require manual intervention.

59. How Do Amazon Rds, Dynamodb, and Redshift Differ from Each Other?

Amazon RDS is a database management service for relational databases. It manages

patching, upgrading, and data backups automatically. It’s a database management
service for structured data only. On the other hand, DynamoDB is a NoSQL database
service for dealing with unstructured data. Redshift is a data warehouse product used
in data analysis.

60. What Are the Benefits of AWS’s Disaster Recovery?

Businesses use cloud computing in part to enable faster disaster recovery of critical IT
systems without the cost of a second physical site. The AWS cloud supports many
popular disaster recovery architectures ranging from small customer workload data

65
center failures to environments that enable rapid failover at scale. With data centers all
over the world, AWS provides a set of cloud-based disaster recovery services that enable
rapid recovery of your IT infrastructure and data.

61. How can you add an existing instance to a new Auto Scaling group?

Here’s how you can add an existing instance to a new Auto Scaling group:

• Open EC2 console

• Select your instance under Instances

• Choose Actions -> Instance Settings -> Attach to Auto Scaling Group

• Select a new Auto Scaling group

• Attach this group to the Instance

• Edit the Instance if needed

• Once done, you can successfully add the instance to a new Auto Scaling group

62. What are the factors to consider while migrating to Amazon Web Services?

Here are the factors to consider during AWS migration:

• Operational Costs - These include the cost of infrastructure, ability to match

demand and supply, transparency, and others.

• Workforce Productivity

• Cost avoidance

• Operational resilience

• Business agility

63. What is RTO and RPO in AWS?

66
RTO or Recovery Time Objective is the maximum time your business or organization is
willing to wait for a recovery to complete in the wake of an outage. On the other hand,
RPO or Recovery Point Objective is the maximum amount of data loss your company is
willing to accept as measured in time.

64. If you would like to transfer vast amounts of data, which is the best option among
Snowball, Snowball Edge, and Snowmobile?

AWS Snowball is basically a data transport solution for moving high volumes of data
into and out of a specified AWS region. On the other hand, AWS Snowball Edge adds
additional computing functions apart from providing a data transport solution. The
snowmobile is an exabyte-scale migration service that allows you to transfer data up to
100 PB.

65. Explain what T2 instances are?

The T2 Instances are intended to give the ability to burst to a higher performance
whenever the workload demands it and also provide a moderate baseline performance
to the CPU.

The T2 instances are General Purpose instance types and are low in cost as well. They
are usually used wherever workloads do not consistently or often use the CPU.

66. What are the advantages of AWS IAM?

AWS IAM allows an administrator to provide multiple users and groups with granular
access. Various user groups and users may require varying levels of access to the various
resources that have been developed. We may assign roles to users and create roles with
defined access levels using IAM.

It further gives us Federated Access, which allows us to grant applications and users
access to resources without having to create IAM Roles.

67
67. Explain Connection Draining

Connection Draining is an AWS service that allows us to serve current requests on the
servers that are either being decommissioned or updated.

By enabling this Connection Draining, we let the Load Balancer make an outgoing
instance finish its existing requests for a set length of time before sending it any new
requests. A departing instance will immediately go off if Connection Draining is not
enabled, and all pending requests will fail.

68. What is Power User Access in AWS?

The AWS Resources owner is identical to an Administrator User. The Administrator User
can build, change, delete, and inspect resources, as well as grant permissions to other
AWS users.

Administrator Access without the ability to control users and permissions is provided to
a Power User. A Power User Access user cannot provide permissions to other users but
has the ability to modify, remove, view, and create resources.

AWS Questions for CloudFormation

69. How is AWS CloudFormation different from AWS Elastic Beanstalk?

Here are some differences between AWS CloudFormation and AWS Elastic Beanstalk:

• AWS CloudFormation helps you provision and describe all of the infrastructure
resources that are present in your cloud environment. On the other hand, AWS
Elastic Beanstalk provides an environment that makes it easy to deploy and
run applications in the cloud.

68
 • AWS CloudFormation supports the infrastructure needs of various types of
applications, like legacy applications and existing enterprise applications. On
the other hand, AWS Elastic Beanstalk is combined with the developer tools to
help you manage the lifecycle of your applications.

70. What are the elements of an AWS CloudFormation template?

AWS CloudFormation templates are YAML or JSON formatted text files that are
comprised of five essential elements, they are:

• Template parameters

• Output values

• Data tables

• Resources

• File format version

71. What happens when one of the resources in a stack cannot be created successfully?

If the resource in the stack cannot be created, then the CloudFormation automatically
rolls back and terminates all the resources that were created in the CloudFormation
template. This is a handy feature when you accidentally exceed your limit of Elastic IP
addresses or don’t have access to an EC2 AMI.

69
AWS Questions for Elastic Block Storage

72. How can you automate EC2 backup using EBS?

Use the following steps in order to automate EC2 backup using EBS:

1. Get the list of instances and connect to AWS through API to list the Amazon
EBS volumes that are attached locally to the instance.

2. List the snapshots of each volume, and assign a retention period of the
snapshot. Later on, create a snapshot of each volume.

3. Make sure to remove the snapshot if it is older than the retention period.

73. What is the difference between EBS and Instance Store?

EBS is a kind of permanent storage in which the data can be restored at a later point.
When you save data in the EBS, it stays even after the lifetime of the EC2 instance. On
the other hand, Instance Store is temporary storage that is physically attached to a host
machine. With an Instance Store, you cannot detach one instance and attach it to
another. Unlike in EBS, data in an Instance Store is lost if any instance is stopped or
terminated.

70
74. Can you take a backup of EFS like EBS, and if yes, how?

Yes, you can use the EFS-to-EFS backup solution to recover from unintended changes or
deletion in Amazon EFS. Follow these steps:

1. Sign in to the AWS Management Console

2. Click the launch EFS-to-EFS-restore button

3. Use the region selector in the console navigation bar to select region

4. Verify if you have chosen the right template on the Select Template page

5. Assign a name to your solution stack

6. Review the parameters for the template and modify them if necessary

75. How do you auto-delete old snapshots?

Here’s the procedure for auto-deleting old snapshots:

• As per procedure and best practices, take snapshots of the EBS volumes on
Amazon S3.

• Use AWS Ops Automator to handle all the snapshots automatically.

• This allows you to create, copy, and delete Amazon EBS snapshots.

71
AWS Interview Questions for Elastic Load Balancing

76. What are the different types of load balancers in AWS?

There are three types of load balancers that are supported by Elastic Load Balancing:

1. Application Load Balancer

2. Network Load Balancer

3. Classic Load Balancer

77. What are the different uses of the various load balancers in AWS Elastic Load
Balancing?

Application Load Balancer

Used if you need flexible application management and TLS termination.

Network Load Balancer

72
Used if you require extreme performance and static IPs for your applications.

Classic Load Balancer

Used if your application is built within the EC2 Classic network

AWS Interview Questions for Security

78. What Is Identity and Access Management (IAM) and How Is It Used?

Identity and Access Management (IAM) is a web service for securely controlling access
to AWS services. IAM lets you manage users, security credentials such as access keys,
and permissions that control which AWS resources users and applications can access.

79. How can you use AWS WAF in monitoring your AWS applications?

AWS WAF or AWS Web Application Firewall protects your web applications from web
exploitations. It helps you control the traffic flow to your applications. With WAF, you
can also create custom rules that block common attack patterns. It can be used for three
cases: allow all requests, prevent all requests, and count all requests for a new policy.

80. What are the different AWS IAM categories that you can control?

Using AWS IAM, you can do the following:

• Create and manage IAM users

• Create and manage IAM groups

• Manage the security credentials of the users

• Create and manage policies to grant access to AWS services and resources

73
81. What are the policies that you can set for your users’ passwords?

Here are some of the policies that you can set:

• You can set a minimum length of the password, or you can ask the users to
add at least one number or special characters in it.

• You can assign requirements of particular character types, including uppercase

letters, lowercase letters, numbers, and non-alphanumeric characters.

• You can enforce automatic password expiration, prevent reuse of old

passwords, and request for a password reset upon their next AWS sign in.

• You can have the AWS users contact an account administrator when the user
has allowed the password to expire.

82. What is the difference between an IAM role and an IAM user?

The two key differences between the IAM role and IAM user are:

• An IAM role is an IAM entity that defines a set of permissions for making AWS
service requests, while an IAM user has permanent long-term credentials and
is used to interact with the AWS services directly.

• In the IAM role, trusted entities, like IAM users, applications, or an AWS
service, assume roles whereas the IAM user has full access to all the AWS IAM
functionalities.

83. What are the managed policies in AWS IAM?

There are two types of managed policies; one that is managed by you and one that is
managed by AWS. They are IAM resources that express permissions using IAM policy
language. You can create, edit, and manage them separately from the IAM users,
groups, and roles to which they are attached.

74
84. Can you give an example of an IAM policy and a policy summary?

Here’s an example of an IAM policy to grant access to add, update, and delete objects
from a specific folder.

Here’s an example of a policy summary:

85. How does AWS IAM help your business?

IAM enables to:

• Manage IAM users and their access - AWS IAM provides secure resource
access to multiple users

• Manage access for federated users – AWS allows you to provide secure access
to resources in your AWS account to your employees and applications without
creating IAM roles

75
AWS Interview Questions for Route 53

86. What Is Amazon Route 53?

Amazon Route 53 is a scalable and highly available Domain Name System (DNS). The
name refers to TCP or UDP port 53, where DNS server requests are addressed.

87. What Is Cloudtrail and How Do Cloudtrail and Route 53 Work Together?

CloudTrail is a service that captures information about every request sent to the Amazon
Route 53 API by an AWS account, including requests that are sent by IAM users.
CloudTrail saves log files of these requests to an Amazon S3 bucket. CloudTrail captures
information about all requests. You can use information in the CloudTrail log files to
determine which requests were sent to Amazon Route 53, the IP address that the
request was sent from, who sent the request, when it was sent, and more.

88. What is the difference between Latency Based Routing and Geo DNS?

The Geo Based DNS routing takes decisions based on the geographic location of the
request. Whereas, the Latency Based Routing utilizes latency measurements between
networks and AWS data centers. Latency Based Routing is used when you want to give
your customers the lowest latency possible. On the other hand, Geo Based routing is
used when you want to direct the customer to different websites based on the country
or region they are browsing from.

89. What is the difference between a Domain and a Hosted Zone?

Domain

A domain is a collection of data describing a self-contained administrative and technical

unit. For example, www.simplilearn.com is a domain and a general DNS concept.

76
Hosted zone

A hosted zone is a container that holds information about how you want to route traffic
on the internet for a specific domain. For example, lms.simplilearn.com is a hosted zone.

90. How does Amazon Route 53 provide high availability and low latency?

Here’s how Amazon Route 53 provides the resources in question:

Globally Distributed Servers

Amazon is a global service and consequently has DNS services globally. Any customer
creating a query from any part of the world gets to reach a DNS server local to them
that provides low latency.

Dependency

Route 53 provides a high level of dependability required by critical applications

Optimal Locations

Route 53 uses a global anycast network to answer queries from the optimal position
automatically.

AWS Interview Questions for Config

91. How does AWS config work with AWS CloudTrail?

AWS CloudTrail records user API activity on your account and allows you to access
information about the activity. Using CloudTrail, you can get full details about API
actions such as the identity of the caller, time of the call, request parameters, and

77
response elements. On the other hand, AWS Config records point-in-time configuration
details for your AWS resources as Configuration Items (CIs).

You can use a CI to ascertain what your AWS resource looks like at any given point in
time. Whereas, by using CloudTrail, you can quickly answer who made an API call to
modify the resource. You can also use Cloud Trail to detect if a security group was
incorrectly configured.

92. Can AWS Config aggregate data across different AWS accounts?

Yes, you can set up AWS Config to deliver configuration updates from different
accounts to one S3 bucket, once the appropriate IAM policies are applied to the S3
bucket.

AWS Interview Questions for Database

93. How are reserved instances different from on-demand DB instances?

Reserved instances and on-demand instances are the same when it comes to function.
They only differ in how they are billed.

Reserved instances are purchased as one-year or three-year reservations, and in return,

you get very low hourly based pricing when compared to the on-demand cases that are
billed on an hourly basis.

94. Which type of scaling would you recommend for RDS and why?

There are two types of scaling - vertical scaling and horizontal scaling. Vertical scaling
lets you vertically scale up your master database with the press of a button. A database
can only be scaled vertically, and there are 18 different instances in which you can resize

78
the RDS. On the other hand, horizontal scaling is good for replicas. These are read-only
replicas that can only be done through Amazon Aurora.

95. What is a maintenance window in Amazon RDS? Will your DB instance be available
during maintenance events?

RDS maintenance window lets you decide when DB instance modifications, database
engine version upgrades, and software patching have to occur. The automatic
scheduling is done only for patches that are related to security and durability. By default,
there is a 30-minute value assigned as the maintenance window and the DB instance will
still be available during these events though you might observe a minimal effect on
performance.

96. What are the consistency models in DynamoDB?

There are two consistency models In DynamoDB. First, there is the Eventual Consistency
Model, which maximizes your read throughput. However, it might not reflect the results
of a recently completed write. Fortunately, all the copies of data usually reach
consistency within a second. The second model is called the Strong Consistency Model.
This model has a delay in writing the data, but it guarantees that you will always see the
updated data every time you read it.

97. What type of query functionality does DynamoDB support?

DynamoDB supports GET/PUT operations by using a user-defined primary key. It

provides flexible querying by letting you query on non-primary vital attributes using
global secondary indexes and local secondary indexes.

AWS Interview Questions - Short Answer Questions

79
1. Suppose you are a game designer and want to develop a game with single-digit
millisecond latency, which of the following database services would you use?

Amazon DynamoDB

2. If you need to perform real-time monitoring of AWS services and get actionable
insights, which services would you use?

Amazon CloudWatch

3. As a web developer, you are developing an app, targeted primarily for the mobile
platform. Which of the following lets you add user sign-up, sign-in, and access control
to your web and mobile apps quickly and easily?

Amazon Cognito

4. You are a Machine Learning Engineer who is on the lookout for a solution that will
discover sensitive information that your enterprise stores in AWS and then use NLP to
classify the data and provide business-related insights. Which among the services would
you choose?

AWS Macie

5. You are the system administrator in your company, which is running most of its
infrastructure on AWS. You are required to track your users and keep tabs on how they
are being authenticated. You wish to create and manage AWS users and use
permissions to allow and deny their access to AWS resources. Which of the following
services suits you best?

AWS IAM

80
6. Which service do you use if you want to allocate various private and public IP
addresses to make them communicate with the internet and other instances?

Amazon VPC

7. This service provides you with cost-efficient and resizable capacity while automating
time-consuming administration tasks

Amazon Relational Database Service

8. Which of the following is a means for accessing human researchers or consultants to

help solve problems on a contractual or temporary basis?

Amazon Mechanical Turk

9. This service is used to make it easy to deploy, manage, and scale containerized
applications using Kubernetes on AWS. Which of the following is this AWS service?

Amazon Elastic Container Service

10. This service lets you run code without provisioning or managing servers. Select the
correct service from the below options

AWS Lambda

11. As an AWS Developer, using this pay-per-use service, you can send, store, and
receive messages between software components. Which of the following is it?

Amazon Simple Queue Service

81
12. Which service do you use if you would like to host a real-time audio and video
conferencing application on AWS, this service provides you with a secure and easy-to-
use application?

Amazon Chime

13. As your company's AWS Solutions Architect, you are in charge of designing
thousands of similar individual jobs. Which of the following services best meets your
requirements?

AWS Batch

AWS Interview Questions - Multiple-Choice

1. Suppose you are a game designer and want to develop a game with single-digit
millisecond latency, which of the following database services would you use?

1. Amazon RDS

2. Amazon Neptune

3. Amazon Snowball

4. Amazon DynamoDB

2. If you need to perform real-time monitoring of AWS services and get actionable
insights, which services would you use?

1. Amazon Firewall Manager

2. Amazon GuardDuty

3. Amazon CloudWatch

82
 4. Amazon EBS

3. As a web developer, you are developing an app, targeted especially for the mobile
platform. Which of the following lets you add user sign-up, sign-in, and access control
to your web and mobile apps quickly and easily?

1. AWS Shield

2. AWS Macie

3. AWS Inspector

4. Amazon Cognito

4. You are a Machine Learning Engineer who is on the lookout for a solution that will
discover sensitive information that your enterprise stores in AWS and then use NLP to
classify the data and provide business-related insights. Which among the services would
you choose?

1. AWS Firewall Manager

2. AWS IAM

3. AWS Macie

4. AWS CloudHSM

5. You are the system administrator in your company, which is running most of its
infrastructure on AWS. You are required to track your users and keep tabs on how they
are being authenticated. You wish to create and manage AWS users and use
permissions to allow and deny their access to AWS resources. Which of the following
services suits you best?

1. AWS Firewall Manager

2. AWS Shield

83
 3. Amazon API Gateway

4. AWS IAM

6. Which service do you use if you want to allocate various private and public IP
addresses in order to make them communicate with the internet and other instances?

1. Amazon Route 53

2. Amazon VPC

3. Amazon API Gateway

4. Amazon CloudFront

7. This service provides you with cost-efficient and resizable capacity while automating
time-consuming administration tasks

1. Amazon Relational Database Service

2. Amazon Elasticache

3. Amazon VPC

4. Amazon Glacier

8. Which of the following is a means for accessing human researchers or consultants to

help solve problems on a contractual or temporary basis?

1. Amazon Mechanical Turk

2. Amazon Elastic Mapreduce

3. Amazon DevPay

4. Multi-Factor Authentication

84
9. This service is used to make it easy to deploy, manage, and scale containerized
applications using Kubernetes on AWS. Which of the following is this AWS service?

1. Amazon Elastic Container Service

2. AWS Batch

3. AWS Elastic Beanstalk

4. Amazon Lightsail

10. This service lets you run code without provisioning or managing servers. Select the
correct service from the below options

1. Amazon EC2 Auto Scaling

2. AWS Lambda

3. AWS Batch

4. Amazon Inspector

11. As an AWS Developer, using this pay-per-use service, you can send, store and
receive messages between software components. Which of the following is it?

1. AWS Step Functions

2. Amazon MQ

3. Amazon Simple Queue Service

4. Amazon Simple Notification Service

12. Which service do you use if you would like to host real-time audio and video
conferencing application on AWS, this service provides you with a secure and easy-to-
use application?

1. Amazon Chime
85
 2. Amazon WorkSpaces

3. Amazon MQ

4. Amazon AppStream

13. As your company's AWS Solutions Architect, you are in charge of designing
thousands of similar individual jobs. Which of the following services best meets your
requirements?

1. AWS EC2 Auto Scaling

2. AWS Snowball

3. AWS Fargate

4. AWS Batch

14. You are a Machine Learning engineer and you are looking for a service that helps
you build and train Machine Learning models in AWS. Which among the following are
we referring to?

1. Amazon SageMaker

2. AWS DeepLens

3. Amazon Comprehend

4. Device Farm

15. Imagine that you are working for your company's IT team. You are assigned to
adjusting the capacity of AWS resources based on the incoming application and
network traffic. How would you do it?

1. Amazon VPC

2. AWS IAM

86
 3. Amazon Inspector

4. Amazon Elastic Load Balancing

16. This cross-platform video game development engine that supports PC, Xbox,
Playstation, iOS, and Android platforms allows developers to build and host their games
on Amazon's servers.

1. Amazon GameLift

2. AWS Greengrass

3. Amazon Lumberyard

4. Amazon Sumerian

17. You are the Project Manager of your company's Cloud Architects team. You are
required to visualize, understand and manage your AWS costs and usage over time.
Which of the following services works best?

1. AWS Budgets

2. AWS Cost Explorer

3. Amazon WorkMail

4. Amazon Connect

18. You are the chief Cloud Architect at your company. How can you automatically
monitor and adjust computer resources to ensure maximum performance and efficiency
of all scalable resources?

1. AWS CloudFormation

2. AWS Aurora

3. AWS Auto Scaling

87
 4. Amazon API Gateway

19. As a database administrator. you will employ a service that is used to set up and
manage databases such as MySQL, MariaDB, and PostgreSQL. Which service are we
referring to?

1. Amazon Aurora

2. AWS RDS

3. Amazon Elasticache

4. AWS Database Migration Service

20. A part of your marketing work requires you to push messages onto Google,
Facebook, Windows, and Apple through APIs or AWS Management Console. Which of
the following services do you use?

1. AWS CloudTrail

2. AWS Config

3. Amazon Chime

4. AWS Simple Notification Service

FAQs

1. Does Amazon support all services with region-based services?

No, not all of its services offer usage that is specific to a particular place. But the
majority of the services are region-specific.

2. In AWS, what is EBS?

88
A storage system used to store persistent data is called elastic block storage (EBS).
Block-level storage volumes and EC2 instances can be used with EBS for throughput-
and transaction-intensive workloads of any scale.

3. What is Amazon EC2?

Amazon Elastic Compute Cloud (Amazon EC2) is a computing capability that is scalable
on the Amazon Web Services (AWS) Cloud.

4. What is the benefit of Amazon EC2?

Using Amazon EC2 eliminates the need to invest in hardware upfront, allowing you to
develop and deploy apps more quickly.

Find our AWS Solutions

AWS Solutions Architect Interview Questions and Answers

1. What is Amazon EC2?

EC2 is short for Elastic Compute Cloud, and it provides scalable computing capacity.
Using Amazon EC2 eliminates the need to invest in hardware, leading to faster
development and deployment of applications. You can use Amazon EC2 to launch as
many or as few virtual servers as needed, configure security and networking, and
manage storage. It can scale up or down to handle changes in requirements, reducing
the need to forecast traffic. EC2 provides virtual computing environments called
“instances.”

2. What Are Some of the Security Best Practices for Amazon EC2?

89
Security best practices for Amazon EC2 include using Identity and Access Management
(IAM) to control access to AWS resources; restricting access by only allowing trusted
hosts or networks to access ports on an instance; only opening up those permissions
you require, and disabling password-based logins for instances launched from your AMI.

3. What is Amazon S3?

S3 is short for Simple Storage Service, and Amazon S3 is the most supported storage
platform available. S3 is object storage that can store and retrieve any amount of data
from anywhere. Despite that versatility, it is practically unlimited as well as cost-effective
because it is storage available on demand. In addition to these benefits, it offers
unprecedented levels of durability and availability. Amazon S3 helps to manage data for
cost optimization, access control, and compliance.

4. Can S3 Be Used with EC2 Instances, and If Yes, How?

Amazon S3 can be used for instances with root devices backed by local instance storage.
That way, developers have access to the same highly scalable, reliable, fast, inexpensive
data storage infrastructure that Amazon uses to run its own global network of websites.
To execute systems in the Amazon EC2 environment, developers load Amazon Machine
Images (AMIs) into Amazon S3 and then move them between Amazon S3 and Amazon
EC2.

Amazon EC2 and Amazon S3 are two of the best-known web services that make up
AWS.

5. What Is Identity and Access Management (IAM) and How Is It Used?

Identity and Access Management (IAM) is a web service for securely controlling access
to AWS services. IAM lets you manage users, security credentials such as access keys,
and permissions that control which AWS resources users and applications can access.

90
6. What Is Amazon Virtual Private Cloud (VPC) and Why Is It Used?

A VPC is the best way of connecting to your cloud resources from your own data center.
Once you connect your datacenter to the VPC in which your instances are present, each
instance is assigned a private IP address that can be accessed from your data center.
That way, you can access your public cloud resources as if they were on your own
private network.

7. What Is Amazon Route 53?

Amazon Route 53 is a scalable and highly available Domain Name System (DNS). The
name refers to TCP or UDP port 53, where DNS server requests are addressed.

8. What Is Cloudtrail and How Do Cloudtrail and Route 53 Work Together?

CloudTrail is a service that captures information about every request sent to the Amazon
Route 53 API by an AWS account, including requests that are sent by IAM users.
CloudTrail saves log files of these requests to an Amazon S3 bucket. CloudTrail captures
information about all requests. You can use information in the CloudTrail log files to
determine which requests were sent to Amazon Route 53, the IP address that the
request was sent from, who sent the request, when it was sent, and more.

9. When Would You Prefer Provisioned IOPS over Standard Rds Storage?

You would use Provisioned IOPS when you have batch-oriented workloads. Provisioned
IOPS delivers high IO rates, but it is also expensive. However, batch processing
workloads do not require manual intervention.

10. How Do Amazon Rds, Dynamodb, and Redshift Differ from Each Other?

Amazon RDS is a database management service for relational databases. It manages

patching, upgrading, and data backups automatically. It’s a database management

91
service for structured data only. On the other hand, DynamoDB is a NoSQL database
service for dealing with unstructured data. Redshift is a data warehouse product used in
data analysis.

11. What Are the Benefits of AWS’s Disaster Recovery?

Businesses use cloud computing in part to enable faster disaster recovery of critical IT
systems without the cost of a second physical site. The AWS cloud supports many
popular disaster recovery architectures ranging from small customer workload data
center failures to environments that enable rapid failover at scale. With data centers all
over the world, AWS provides a set of cloud-based disaster recovery services that enable
rapid recovery of your IT infrastructure and data.

12. How do you create an AMI?

To create an AMI, you need to have a running instance of the Amazon Linux OS and
then use the operating system's tools for packaging up your example into an AMI. You
can also use third-party tools like Packer or Terraform to automate this process.

13. What is AWS VPC?

Amazon Virtual Private Cloud (VPC) allows users to create a private, isolated section of
the AWS cloud. A VPC is logically isolated from other virtual networks in the AWS cloud.
The user controls the virtual networking environment, including selecting the IP address
range, creating subnets, and configuring route tables and network gateways. VPCs are
hosted in a specific region and are logically isolated from other VPCs in the same area.

14. What is AWS Auto Scaling and Load Balancer?

AWS Auto Scaling and Load Balancer services are two tools that can be used together to
help manage server traffic. These services can help ensure that your website or
application can handle sudden increases or decreases in traffic.

92
15. What is AWS SQS?

Amazon Simple Queue Service (SQS) is a fast, reliable, scalable, fully managed message
queuing service. Amazon Simple Notification Service (SNS) is a quick, flexible, fully
managed push notification service that lets you send individual messages or fan-out
messages to large numbers of recipients. Amazon Simple Email Service (SES) is a cost-
effective, flexible, and scalable email service that enables developers to send mail from
within any application. Elastic Beanstalk is an easy-to-use service for deploying and
scaling web applications and services developed with Java, .NET, PHP, Node.js, Python,
Ruby, Go, and Docker on familiar servers such as Apache, Nginx, Passenger, and IIS.

16. What is AWS OpsWorks?

AWS OpsWorks is a cloud orchestration technology. It enables developers and system

administrators to manage server deployments and applications using the DevOps
methodology. OpsWorks automates operational tasks such as software updates,
instance scaling, and monitoring. It also provides a flexible architecture that enables you
to use Chef and Puppet for configuration management.

17. What is AWS SNS?

Amazon Simple Notification Service (SNS) is a fast, fully managed push notification
service that makes sending messages to mobile devices and other distributed systems
easy.

18. What is CloudFront?

Ans. Amazon CloudFront has become one of the world's most popular delivery networks
(content delivery network, CDN) thanks to its ability to accelerate the transmission of
static and dynamic web content, like .html, .css, and .js files.

19. What are the main differences between 'horizontal' and 'vertical' scales?

93
SNS can scale horizontally to support large numbers of subscribers and deliver high
throughput by automatically adding new Capacity Units as needed. SNS can also scale
vertically to support large messages with multiple retries.

20. Explain the advantages of AWS's Disaster Recovery (DR) solution.

This is also among the most popular AWS interview questions asked in an AWS
interview.

The following are the advantages of AWS's Disaster Recovery (DR) solution:

• AWS offers a cost-effective backup, storage, and DR solution, helping

companies to reduce their capital expenses

• Fast setup time and more significant productivity gains

• AWS allows companies to scale up even during seasonal fluctuations

• It seamlessly replicates on-premises data to the cloud.

• Ensures quick retrieval of files

21. What are the different types of load balancers in EC2?

There are three types of load balancers in EC2 –

• Application Load Balancer – These balancers are designed to make routing

decisions at the application layer.

• Network Load Balancer: Network load balancer handles millions of requests

per second and helps make routing decisions at the transport layer.

• Classic Load Balancer: Classic Load Balancer is mainly used for applications
built within the EC2-Classic network. It offers essential load balancing at
varying Amazon EC2 instances.

94
22. What is DynamoDB?

DynamoDB is a NoSQL database. It is very flexible, performs quite reliably, and can be
integrated with AWS! It offers fast and predictable performance with seamless
scalability. With the help of DynamoDB, you do not need to worry about hardware
provisioning, setup, configuration, replication, software patching, or cluster scaling.

23. What is AWS CloudFormation?

AWS CloudFormation is an Amazon service dedicated to solving the need to standardize

and replicate the architectures to facilitate their execution and optimize resources and
costs in the delivery of applications or compliance with the requirements of the
organization. CloudFormation allows the creation of a proprietary library of instance
templates or architectures capable of being delivered at any time and in an organized
manner through programming.

24. What are the advantages of using AWS CloudFormation?

It is one of the most popular AWS interview questions. There are many advantages of
AWS CloudFormation, including the following.

1. Reduces infrastructure deployment time

2. Increases confidence in deployments

3. Replicates complex environments, for example, have complex environments

for development, pre-production, and production that are the same, or almost
the same, simply by scaling up resources.

4. Reuses the definitions between different products

5. Reduces environment repair time

25. What is Elastic Beanstalk?

95
Flexible Beanstalk is an arrangement administration by AWS, utilized in different AWS
applications, for example, EC2, S3, and Straightforward Warning Help.

26. What is Geo Restriction in CloudFront?

Geo restriction, also known as geoblocking, prevents users in specific geographic

locations from accessing content you're distributing through a CloudFront web
distribution.

27. What is a T2 instance?

T2 instances are designed to provide moderate baseline performance and the capability
to burst to higher performance as required by workload.

28. What is AWS Lambda?

AWS Lambda is a computing service that lets you run code in the AWS Cloud without
provisioning or managing servers.

29. What is a Serverless application in AWS?

The AWS Serverless Application Model (AWS SAM) extends AWS CloudFormation to
provide a simplified way of defining the Amazon API Gateway APIs, AWS Lambda
functions, and Amazon DynamoDB tables needed by your serverless application.

30. What is the use of Amazon ElastiCache?

Amazon ElastiCache is a web service that makes it easy to deploy, operate, and scale an
in-memory data store or cache in the cloud.

31. Explain how the buffer is used in Amazon web services.

96
The buffer makes the system more robust in managing traffic or load by synchronizing
different components.

32. Differentiate between stopping and terminating an instance.

When an instance is stopped, the model performs a normal shutdown and then
transitions to a stopped state.

33. Can the private IP addresses of an EC2 while it is running/stopped in a VPC?

The primary private IP address cannot be changed. Secondary personal addresses can
be unassigned, assigned, or moved between interfaces or instances at any point.

34. Give one instance where you would prefer Provisioned IOPS over Standard RDS
storage.

Provisioned IOPS can be preferred over Standard RDS storage when we have batch-
oriented workloads.

35. What are the different types of cloud services?

Various kinds of cloud administrations are:

• Programming as a Help (SaaS)

• Information as a Help (DaaS)

• Stage as a Help (PaaS)

36. What is the boot time for an instance store-backed instance?

The boot time for an Amazon Instance Store -Backed AMI is less than 5 minutes.

97
37. Will you use encryption for S3?

Yes, I will, as it is a proprietary technology. It's always a good idea to consider

encryption for sensitive data on S3.

38. What is Identity Access Management, and how is it used?

It is a web service used to control access to AWS services securely. Identity Access
Management allows you to manage users, security credentials, and resource
permissions.

39. What is Sharding?

Sharding or horizontal partitioning is a scale-out technique for relational databases.

40. How do you send requests to Amazon S3?

We can achieve this using the REST API or the AWS SDK wrapper libraries, and these
elements wrap up the underlying Amazon S3 REST API.

41. What is DynamoDB?

DynamoDB is a wholly overseen restrictive NoSQL data set, supporting key-worth and
report information structures.

42. What is Redshift?

Redshift is a petabyte-size data warehouse service by Amazon. It is easy, cost-effective,

and scalable and can be fully configured to analyze your data using the existing
business intelligence tools.

43. Which data centers are deployed for cloud P@ssw0rd7computing?

98
In order to provide an overview of which data centers are deployed for cloud
P@ssw0rd7computing, it is essential first to understand the definition of cloud
computing.

44. Which AWS services will you use to collect and process e-commerce data for near
real-time analysis?

Following are the AWS administrations that will be utilized to gather and handle web-
based business information for close to ongoing investigation:

Amazon DynamoDB

Amazon ElastiCache

45. What is SQS?

Simple Queue Service (SQS) is a distributed message queuing service that acts as a
mediator for two controllers. It is a pay-per-use web service.

46. What are the popular DevOps tools?

DevOps is a term for a set of practices that emphasize the collaboration and
communication of software developers and information technology (IT) professionals
while automating the process of software delivery and infrastructure changes.

47. What is Hybrid cloud architecture?

It is a sort of design where the responsibility is partitioned into equal parts, among
which one is on the open burden, and the other is on the nearby stockpiling. It is a
blend of on-premises, confidential cloud, outsider, and public cloud administrations
between the two stages.

99
48. What Is Configuration Management?

Design the board is utilized to deal with the arrangement of frameworks and the
administrations they give through code.

49. What are the features of Amazon cloud search?

Amazon cloud search highlights:

• AutoComplete guidance

• Boolean Ventures

• Whole text search

• Faceting term helping

• Prefix Searches

50. How do you access the data on EBS in AWS?

Data cannot be accessible on EBS directly by a graphical interface in AWS.

AWS Solution Architect Interview Questions

1) What is the difference between stopping and terminating an instance?

100
 •When an Ec2 instance is stopped, a normal shutdown is performed on the
instance.
• When an EC2 instance is terminated, it gets transferred to a stopped state,
and then the attached EBS volumes are permanently deleted.
2) When there is a need to acquire costs with an EIP?

When EIP is associated and allocated with a stopped instance, there is a need to acquire
costs. You will not be charged if only one Elastic IP is present with the instance you are
running. But, if the IP doesn’t attach to any instance or is attached to a stopped instance,
you need to pay for it.

3) Differentiate between an On-demand instance and a Spot Instance.

101
 •Spot Instances are unused computing capacity blocks released by AWS
when EC2 instances are created.
• On-Demand Instances are virtual servers in the AWS EC2 used while testing
and developing applications on EC2.
4) Name the Instances types for which the Multi AZ-deployments are available?

The Multi-AZ deployments are available for all the instances irrespective of their types
and use.

5) Which instance can we use for deploying a 4-node cluster of Hadoop in AWS?
We can use i2.large or c4.8x large instance for deploying a 4-node cluster of Hadoop in
AWS. However, c4.8x large instances are preferred for master machines, i2.large

102
instances are preferred for slave machines and c.4bx needs a better configuration on the
PC.

6) What do you know about an AMI?

AMI is a template that provides information required to launch an instance or virtual

machine. It is possible to select pre-built AMI’s that AMI commonly have in them while
creating an instance. Also, a user can have customized AMI for the most common
reason of saving space on AWS.

7) Can we run multiple websites on the EC2 server with one Elastic IP address?
We need more than one elastic IP to run multiple websites on the EC2 server, so it’s not
possible.

8) Mention the states available in Processor State Control?

It contains two states:
• P-state: It has different levels starting from P0 to P15.
• C-State: Its levels are from C0 to C6, where C6 is the strongest state for the
processor.
9) What is the use of making the subnets?
To efficiently utilize networks that have given a large number of hosts. You can assume
that many networks come with a large number of hosts. For easy access, the network is
divided into subnets. This will help in managing the hosts and getting them into a more
straightforward form.

10) Can you use the Amazon cloud front in directing the transfer objects?

103
Yes, the Amazon CloudFront helps you in supporting through the origins of the custom.
It may also include the origin that comes from outside of AWS.
11) Can we speed up data transfer in Snowball? How?
Yes, some specific methods for speeding up Snowball are:
• By simply copying from different hosts to the same Snowball.
• By creating a group of smaller files. This is helpful as it cuts down the
encryption issues.
12) How to establish a connection between the Amazon cloud and a corporate
data centre?
A VPN (Virtual Private Network) needs to be established between the Virtual private
cloud and the organization’s network. Then, the connection can be created, and data
can be accessed reliably.

13) Is it possible to change or modify the private IP address of an EC2 instance

while running?
No, the private IP address of an EC2 instance can not be changed while running, as the
private IP will remain with the instance permanently or through the life cycle.

14) Is it possible to run multiple databases on Amazon RDS free of cost?

104
Yes, as per RDS prices, there is an upper limit of 750 hours that on exceeding will be
charged. The charge is made only on the extra hours beyond 750.

Also Read: Our blog post on AWS CloudHSM.

15) If you hold half of the workload on the public cloud whereas the other half is
on local storage, what type of architecture is used in such a case?
The hybrid cloud architecture is used in such a case.

16) What is a Hypervisor?

A Hypervisor is a type of software used to create and run virtual machines. It integrates
physical hardware resources into a platform which are distributed virtually to each user.

17) I have some private servers on-premises. Also, I have distributed my workloads
on the public cloud. What is this architecture called in this case?

105
It is a hybrid cloud architecture as we are using both the public cloud and on-premises
servers, i.e. the private cloud.

18) What does the following command do for the Amazon EC2 security groups?
‘ec2-create-group CreateSecurityGroup’
A. Creates a new group inside the security group.

B. Creates a new security group for use with your account.

C. Creates a new rule inside the security group.

D. Groups the user-created security groups into a new group for easy access.

Answer: B – A Security group acts as a firewall and controls the traffic in and out of your
instance. The above command will create a security group, and on creation, the user can
add different rules to it. Suppose, if you want to access an RDS instance, you have to
add the public IP address of the machine by which you want to access the instance in its
security group.
19) Which value do we need to set the instance’s tenancy attribute to if we want
the instance to run on single-tenant hardware?
A. Isolated

B. Dedicated

C. One

106
D. Reserved

Answer: B – The Instance tenancy attribute should be set to Dedicated Instance. The
rest of the values are invalid.
20) In case AWS Direct Connect fails, will it result in connectivity loss?

If a backup of AWS Direct Connect has been configured, it will switch over to the second
one in the event of a failure. It is recommended to enable Bidirectional Forwarding
Detection (BFD) when configuring your connections to ensure faster detection and
failover. On the other hand, if you have configured a backup IPsec VPN connection
instead, all VPC traffic will automatically failover to the backup VPN connection. Traffic
to/from public resources such as Amazon S3 will be routed over the Internet.

21). Can you explain the difference between Amazon S3 and EBS?
Amazon S3 is a simple storage service that offers industry-leading scalability, data
availability, security, and performance. It can be used to store and retrieve any amount
of data, at any time, from anywhere on the web. Amazon EBS, on the other hand, is a
block storage service that provides persistent storage for Amazon EC2 instances. EBS
allows you to create storage volumes and attach them to EC2 instances, and supports
both magnetic and solid-state drive (SSD) volumes.
22). How do you handle data archiving in AWS?
One way to handle data archiving in AWS is to use Amazon S3 Glacier, which is a secure,
durable, and extremely low-cost Amazon S3 storage class for data archiving and long-
term backup. With S3 Glacier, you can store data at a cost that is as little as 1/10th of
one cent per gigabyte per month.

107
23). What is the purpose of Amazon CloudFront?
Amazon CloudFront is a content delivery network (CDN) that securely delivers data,
videos, applications, and APIs to customers globally. It integrates with other Amazon
Web Services products to give developers and businesses an easy way to distribute
content to end users with low latency, high data transfer speeds, and no minimum
usage commitments.
24). Can you explain how Amazon Elastic Block Store (EBS) works?
Amazon EBS provides raw block-level storage of data that can be attached to a running
Amazon EC2 instance. Each EBS volume is automatically replicated within its Availability
Zone to protect data from the failure of a single drive. EBS volumes can be used as the
primary storage for data that requires frequent and granular updates, such as file
systems or databases.

25). How do you secure an Amazon S3 bucket?

• To secure an Amazon S3 bucket, you can use a combination of the
following measures:
• Access control
• Encryption
• Versioning
• Access logging
26). Can you explain the difference between Amazon EC2 and Amazon Elastic
Beanstalk?
Amazon EC2 is a web service that provides resizable compute capacity in the cloud,
while Amazon Elastic Beanstalk is an easy-to-use service for deploying, running, and
scaling web applications and services developed with Java, .NET, PHP, Node.js, Python,
Ruby, and Docker.
27). Can you explain the purpose of Amazon Elastic Container Service (ECS)?
Amazon Elastic Container Service (ECS) is a fully managed container orchestration
service that makes it easy to run, scale, and secure containerized applications on AWS. It
allows you to easily run and scale containerized applications using Docker and Amazon
Elastic Container Registry (ECR) images.

28). How do you automate the scaling of Amazon EC2 instances?

To automate the scaling of Amazon EC2 instances, you can use Amazon Auto Scaling.
This service allows you to automatically increase or decrease the number of instances in
your Auto Scaling group based on predefined policies and metrics.

29). Can you explain the purpose of the Amazon Elastic File System (EFS)?

108
Amazon Elastic File System (EFS) is a fully managed, scalable, and elastic file storage
service for use with Amazon EC2 instances. EFS is designed to provide a simple and
highly available file storage service, with a high degree of scalability and performance.
30). How do you handle disaster recovery in AWS?
To handle disaster recovery in AWS, you can use a combination of services such as
Amazon S3, Amazon RDS, Amazon DynamoDB, and Amazon Elastic Block Store (EBS)
snapshots. You can use these services to create backups and replicas of your data and
resources.

31). Can you explain the difference between Amazon RDS and DynamoDB?
Amazon RDS is a fully managed relational database service that makes it easy to set up,
operate, and scale a relational database in the cloud. It supports a variety of database
engines, including MySQL, PostgreSQL, Oracle, and SQL Server.
On the other hand, Amazon DynamoDB is a fully managed NoSQL database service that
provides fast and predictable performance with seamless scalability.
32). How do you handle backups in AWS?
To handle backups in AWS, you can use a combination of services such as Amazon
S3, Amazon RDS, Amazon DynamoDB, and Amazon Elastic Block Store (EBS) snapshots.
These services allow you to create backups and replicas of your data and resources, and
then use these backups to recover your applications and data in the event of a failure.
33). Can you explain the purpose of Amazon Elastic MapReduce (EMR)?
Amazon Elastic MapReduce (EMR) is a fully managed service that makes it easy to
process large amounts of data using the popular Apache Hadoop and Apache Spark
frameworks.
34). How do you monitor resources and applications in AWS?
To monitor resources and applications in AWS, you can use a combination of services
such as Amazon CloudWatch, AWS CloudTrail, and Amazon CloudWatch Logs. These
services allow you to collect and monitor various metrics and logs related to your
resources and applications.

35). Can you explain the purpose of Amazon Simple Queue Service (SQS)?
Amazon Simple Queue Service (SQS) is a fully managed message queuing service that
makes it easy to decouple and scale microservices, distributed systems, and serverless
applications. SQS allows you to send,
36). How do you handle security in AWS?
To handle security in AWS, you can use a combination of services such as Amazon
Identity and Access Management (IAM), Amazon Virtual Private Cloud (VPC), and AWS
Key Management Service (KMS).

109
37). Can you explain the purpose of Amazon Simple Notification Service (SNS)?
Amazon Simple Notification Service (SNS) is a fully managed messaging service that
makes it easy to send and receive messages between applications and services. SNS
allows you to send messages to multiple subscribers at once, including via email, SMS,
and other protocols.
38). How do you handle compliance in AWS?
To handle compliance in AWS, you can use a combination of services such as AWS
Config and AWS Control Tower. These services allow you to monitor and evaluate your
resources against a set of predefined policies and guidelines and provide you with the
tools and resources you need to meet compliance requirements such as HIPAA, SOC 2,
and PCI DSS.

39). Can you explain the purpose of Amazon Simple Email Service (SES)?
Amazon Simple Email Service (SES) is a fully managed email service that allows you to
send and receive emails at scale. With SES, you can send emails to your customers,
subscribers, and other contacts using a simple and reliable API, or through the AWS
Management Console.

40). How do you handle data migration in AWS?

To handle data migration in AWS, you can use a combination of services such as AWS
DataSync, AWS Database Migration Service (DMS), and AWS Snowball. These services
allow you to easily transfer data between on-premises and cloud environments, and to
migrate data between different databases and storage services. Additionally, you can
use services such as AWS Direct Connect and Amazon S3 Transfer Acceleration to
optimize the transfer of large amounts of data.

41). Can you explain the purpose of Amazon Elasticsearch Service?

Amazon Elasticsearch Service is a fully managed service that makes it easy to deploy,
operate, and scale Elasticsearch clusters in the AWS cloud. It allows you to index, search,
and analyze large volumes of data quickly and in near real time.

42). How do you handle network traffic in AWS?

To handle network traffic in AWS, you can use a combination of services such as
Amazon Virtual Private Cloud (VPC), Amazon Elastic Load Balancing (ELB), and Amazon
Route 53. These services allow you to securely and efficiently route and manage network
traffic within your AWS environment.

43). Can you explain the purpose of the Amazon Elastic Transcoder?

110
Amazon Elastic Transcoder is a fully managed service that makes it easy to create and
convert video files into multiple formats. It allows you to convert existing video files into
different resolutions and bit rates, so that they can be played on a variety of devices,
such as smartphones, tablets, and smart TVs.

44). How do you handle cost optimization in AWS?

To handle cost optimization in AWS, you can use a combination of services such as AWS
Cost Explorer, AWS Trusted Advisor, and AWS Budgets. These services allow you to
monitor and control your costs, identify opportunities for cost savings, and set budgets
for your resources.

45). Can you explain the purpose of Amazon Kinesis?

Amazon Kinesis is a fully managed service that makes it easy to collect, process, and
analyze real-time streaming data. It allows you to easily ingest and process data
streams, such as log files, sensor data, and social media feeds, and then analyze and
visualize the data using services such as Amazon Redshift, Amazon Elasticsearch Service,
and Amazon QuickSight.
46). How do you handle multi-region deployments in AWS?
To handle multi-region deployments in AWS, you can use a combination of services
such as Amazon Route 53, Amazon CloudFront, and Amazon Elastic Block Store (EBS).
These services allow you to route traffic to the optimal region, distribute content
globally, and replicate data across multiple regions for high availability and disaster
recovery.

47). Can you explain the purpose of Amazon AppStream?

Amazon AppStream is a fully managed service that allows you to stream desktop
applications from the cloud to any device. It allows you to easily run your existing
applications on a variety of devices, such as laptops, tablets, and smartphones, without
the need to re-architect your applications or make changes to the underlying
infrastructure.

48). How do you handle integration with on-premises infrastructure in AWS?

To handle integration with on-premises infrastructure in AWS, you can use a
combination of services such as AWS Direct Connect, AWS VPN, and AWS Storage
Gateway. These services allow you to create dedicated connections between your on-
premises infrastructure and your AWS environment, and to easily transfer data and
resources between the two environments.

49). Can you explain the purpose of Amazon WorkSpaces?

111
Amazon WorkSpaces is a fully managed, secure desktop computing service that runs on
the AWS cloud. It allows you to easily provision cloud-based virtual desktops to your
users and provides them with access to their applications and data from any device.

50). How do you handle data encryption in AWS?

To handle data encryption in AWS, you can use a combination of services such as AWS
Key Management Service (KMS), Amazon Elastic Block Store (EBS) encryption, and
Amazon S3 encryption. These services allow you to encrypt your data at rest and in
transit, and to manage and control access to your encryption keys.

Read More: Top 100 AWS Interview Questions

Frequently Asked Questions
1) What does AWS Solution Architect do?
AWS Solution Architect designs and implements cloud solutions over the cloud that are
beneficial for the complete cloud performance.

2) How do I prepare for the AWS Solution Architect Interview?

First of all, gain the required knowledge for AWS Solution Architect. It would be
beneficial for you to opt for a specialized AWS Solution Architect course and get
certified, as it will add a plus point to your resume. Then start looking for the sample
questions, prepare yourself well and be confident while attending the interview.

3) Is it easy to get a job as AWS Solution Architect?

Getting a job is much easier for a skilled and experienced person when compared to a
beginner. With the increase in demand for the cloud, more job openings are available,
and you can also get the job if you have prepared well.

4) What is the salary of AWS Solution Architect?

AWS Solution Architect average salary in:

•US regions (in USD): 100,000 and can range between 80,000 to 200,000.
• India (in INR): 7,00,000 and can range between 3,00,00 to 18,00,000.
1. How would you design a fault-tolerant architecture on AWS?

Answer: Designing a fault-tolerant architecture in AWS involves utilizing multiple

Availability Zones for redundancy, implementing Elastic Load Balancing to distribute
incoming traffic across instances, auto-scaling to match demand, and using AWS services
like Amazon S3 and Amazon RDS for data durability. Regularly backing up data and having
112
a disaster recovery plan in place, along with monitoring system health using Amazon
CloudWatch, are also critical practices.

2. What are the benefits of using Amazon EC2 instances within an Auto Scaling
group?

Answer: Auto Scaling ensures that Amazon EC2 instances adjust according to the defined
conditions, maintaining application availability and balancing capacity. It helps in cost
reduction by adjusting the number of instances in use based on demand, thereby avoiding
the need to pay for idle computing resources. Auto Scaling in various instances across
multiple Availability Zones can also increase the fault tolerance of your applications.

3. Explain the significance of a Virtual Private Cloud (VPC) in AWS.

Answer: A VPC enables you to launch AWS resources into a virtual network that you’ve
defined. This virtual network closely resembles a traditional network that you’d operate in
your own data center, with the benefits of using the scalable infrastructure of AWS. It
provides control over your virtual networking environment, including selection of your own
IP address range, the creation of subnets, and configuration of route tables and network
gateways.

4. What strategies would you use to optimize the costs of AWS services for a project?

Answer: Cost optimization in AWS can involve several strategies: choosing the right pricing
models (e.g., Reserved Instances, Spot Instances), correctly estimating traffic and choosing
the appropriate instance types, using Auto Scaling to adjust resources, monitoring and
analyzing with AWS Cost Explorer, utilizing cheaper storage options for infrequently
accessed data, and employing AWS Budgets and AWS Trusted Advisor for cost monitoring
and recommendations.

5. How can AWS Direct Connect be beneficial for an organization?

Answer: AWS Direct Connect allows an organization to establish a dedicated network

connection between one’s network and AWS data centers. This provides a more stable and
reliable connection and can reduce network costs, increase bandwidth throughput, and
provide a more consistent network experience than internet-based connections. It’s
particularly beneficial for high throughput workloads or transferring large amounts of data.

113
Click the image above to watch this video from our

6. In a hybrid cloud architecture, how can you securely integrate on-premises

datacenters with AWS?

Answer: Secure integration in a hybrid cloud model can be achieved through several
means: AWS VPN allows you to establish a secure and private encrypted tunnel from your
network or device to the AWS global network. AWS Direct Connect bypasses the public
Internet and establishes a secure, dedicated connection from your premises to AWS.
Additionally, using AWS Transit Gateway, you can connect your on-premises datacenters to
AWS with a single gateway, simplifying your network and putting in place more stringent
security measures.

7. What is Amazon S3’s consistency model?

Answer: Amazon S3 provides strong read-after-write consistency for PUTS of new objects
and eventual consistency for overwrite PUTS and DELETES. This means that if a new object
is written to S3, any subsequent retrieval requests will return the latest version of the object.
However, for updates and deletes, it might take some time for the changes to propagate,
and requests made in the interim might return old data.

8. How do you ensure high availability and disaster recovery in AWS?

Answer: High availability and disaster recovery involve multiple AWS services and features:

• Utilize multiple Availability Zones and Regions to ensure that applications can handle
the loss of entire data centers.
• Implement Amazon RDS or Amazon Aurora Multi-AZ deployments to automate
database setup, patching, and backups.
• Use Amazon S3 for durable, scalable, and secure object storage with built-in lifecycle
policies for automated backup and storage management.
• Employ AWS CloudFormation for infrastructure as code and quick re-provisioning of
resources in a disaster recovery scenario.
• Implement AWS Shield and AWS WAF for resilience against DDoS attacks.

9. How does AWS assist in the deployment of hybrid applications?

114
Answer: AWS offers various services to facilitate hybrid deployments. AWS Outposts
extends AWS’s infrastructure, services, APIs, and tools to virtually any datacenter or on-
premises facility for a truly consistent hybrid experience. AWS Storage Gateway connects
on-premises software applications with cloud-based storage. Amazon RDS on VMware lets
you deploy managed databases in on-premises VMware environments, and AWS Direct
Connect establishes a dedicated network connection from an on-premises network to AWS.

10. What are the key aspects to consider while planning a migration to AWS cloud?

Answer: Key considerations include:

• Assessing the existing on-premises infrastructure and understanding the technical

requirements.
• Deciding on a suitable migration strategy (like re-hosting, re-platforming, re-
factoring, re-purchasing, retiring, or retaining).
• Calculating the total cost of ownership and potential cost savings.
• Planning for security and compliance.

11: How do Amazon S3 transfer acceleration and Amazon CloudFront differ in terms
of content delivery?

Answer: Amazon S3 Transfer Acceleration is specifically designed to speed up transferring

files to and from Amazon S3 by utilizing Amazon CloudFront’s globally distributed edge
locations. When users upload or download files, the data will travel through the optimized
network path to reach the S3 bucket faster. On the other hand, Amazon CloudFront is a
content delivery network (CDN) that caches content in edge locations around the world,
bringing the content closer to the end-users and reducing latency. While both involve
CloudFront’s edge locations, S3 Transfer Acceleration is for faster transfers to S3, and
CloudFront is for general content distribution to end-users.

12. What are placement groups in EC2, and can you describe the different types?

Answer: Placement groups are a way of controlling how EC2 instances are physically
located relative to one another. There are three types:

Cluster Placement Groups: Used for applications needing low network latency and high
network throughput, ensuring instances are placed in a single availability zone.

115
Spread Placement Groups: Ensures that instances are placed on distinct underlying
hardware, reducing correlated failures and suitable for a small number of critical instances.

Partition Placement Groups: Spread instances across different partitions, ensuring that
instances in one partition do not share the underlying hardware with instances in other
partitions.

13. Describe AWS Organizations and its primary use cases. How does it help in
managing multiple AWS accounts?

Answer: AWS Organizations lets you consolidate multiple AWS accounts into an
organization that you create and centrally manage. Primary use cases include centralized
billing, setting up and managing accounts, applying and managing service control policies
across accounts, and creating a hierarchical, multi-account structure. AWS Organizations
simplifies billing for multiple accounts by enabling the setup of a single payment method
for all the accounts in your organization through consolidated billing.

14. How would you design a multi-region architecture for high availability on AWS?

Answer: Designing a multi-region architecture involves replicating data and applications in

more than one geographic region. This is achieved by setting up application stacks in
multiple AWS regions, utilizing Amazon Route 53 for geo-based routing, replicating data
using services like Amazon RDS cross-region replication or S3 Cross-Region Replication,
and ensuring stateless applications to quickly scale and replicate.

15. What is the difference between an Application Load Balancer (ALB) and a
Network Load Balancer (NLB)? When would you choose one over the other?

Answer: ALB is layer 7 (application layer) load balancer, suitable for routing user traffic
based on content type, path, or host in the request. It’s ideal for HTTP/HTTPS traffic. NLB
operates at layer 4 (transport layer) and is designed for TCP/UDP traffic where extreme
performance is required. NLB is chosen for ultra-high levels of traffic or when low-level
routing is necessary.

16. Explain the process of automating infrastructure deployment using AWS

CloudFormation. What are CloudFormation templates?

Answer: AWS CloudFormation automates and simplifies the task of repeatedly and
predictably creating groups of related resources that power your applications. The process
116
involves writing a CloudFormation template in JSON or YAML format. This template defines
the AWS resources you want to deploy. Once the template is created, you can use
CloudFormation to create a stack based on the template, which will provision the defined
resources.

17. Describe the benefits of using Amazon Aurora over traditional RDS databases.
How does Aurora ensure fault tolerance and scalability?

Answer: Amazon Aurora is a MySQL and PostgreSQL-compatible relational database that

combines the speed and availability of high-end commercial databases with the simplicity
and cost-effectiveness of open-source databases. Benefits include up to 5 times the
performance of MySQL and 3 times the performance of PostgreSQL. Aurora automatically
divides your database volume into 10GB segments spread across many disks. Each 10GB
chunk of your database volume is replicated six ways, across three Availability Zones.
Aurora continuously backs up your data to Amazon S3, and transparently recovers from
physical storage failures; instance failover typically takes less than 30 seconds.

18. How can AWS WAF be integrated with AWS services to enhance web application
security?

Answer: AWS WAF (Web Application Firewall) protects web applications from common
web exploits. It can be integrated with Amazon CloudFront (the CDN service) and
Application Load Balancer, allowing you to create custom rules that block malicious traffic
patterns. This means that you can use AWS WAF to protect both your applications accessed
via CloudFront distributions and those accessed directly via an Application Load Balancer.

19. What’s the difference between AWS Systems Manager and AWS OpsWorks? How
do they help in configuration management?

Answer: AWS Systems Manager provides a unified interface for viewing operational data
from multiple AWS services and allows you to automate operational tasks across AWS
resources. It aids in patch management, automation, config management, and instance
management. On the other hand, AWS OpsWorks is a configuration management service
that uses Chef and provides instances of Chef and Puppet. OpsWorks lets you model and
set up your Amazon EC2 instances and other AWS resources with Chef cookbooks or
Puppet manifests. Both tools assist in automating infrastructure and application
management tasks but differ in their approaches and integration points.

117
20. Explain the purpose and use cases of Amazon Kinesis. How does it compare to
traditional messaging systems like SQS or SNS?

Answer: Amazon Kinesis is a platform to stream data on AWS, offering powerful services to
make it easier to load and analyze streaming data. Use cases include real-time analytics,
dashboards, and telemetry. While SQS (Simple Queue Service) is a distributed message
queuing service and SNS (Simple Notification Service) is for pub/sub messaging, Kinesis
provides real-time data streaming. SQS and SNS are ideal for decoupling components and
sending notifications, while Kinesis focuses on real-time data processing.

We hope these AWS Solutions Architect Associate interview questions equip you with the
insights and clarity needed for your AWS interview. Remember, while knowledge is key,
your ability to apply this knowledge in real-world scenarios will truly set you apart.

Stay updated with the latest AWS advancements, and always approach architectural
challenges with a solutions-oriented mindset. Best of luck in your journey towards
becoming a renowned AWS Solutions Architect!

Let us begin by looking into the basic AWS interview questions and answers.
1)WHAT IS A WELL ARCHITected FRAMEWORK?EXPLAIN EACH PILLAR OF AN
ARCHITECTED FRAMEWORK?

Search Results
Featured snippet from the web

����

In English

Think of the Well-Architected Framework as a guidebook for building sturdy cloud

systems. It contains six key principles, or “pillars,” that focus on the critical elements of
successful cloud architecture: security, operational efficiency, reliability, performance,
cost management, and sustainability.

118
2)WHAT ARE APIs,and API gateway,name different types of API gateway,and what is the
use for?

Search Results
Featured snippet from the web

����

In English
An API gateway is a data-plane entry point for API calls that represent client requests to
target applications and services. It typically performs request processing based on
defined policies, including authentication, authorization, access control, SSL/TLS
offloading, routing, and load balancing.

3) What are the different types of storage in AWS?

There are three main cloud storage types: object storage, file storage, and block storage.
Each offers its own advantages and has its own use cases.

Which AWS storage system is meant to store large amounts of data and can be used as
backup?

Amazon S3 Glacier is a secure, durable, and low-cost storage class of S3 for data
archiving and long-term backup. Customers can store large or small amounts of data for
as little as $0.004 per gigabyte per month.

4) what is disaster recovery,and what different types of disaster recovery methods and
tools can be used in aws?

Disaster recovery options in the cloud

PDFRSS

Disaster recovery strategies available to you within AWS can be broadly categorized into
four approaches, ranging from the low cost and low complexity of making backups to

119
more complex strategies using multiple active Regions. Active/passive strategies use an
active site (such as an AWS Region) to host the workload and serve traffic. The passive
site (such as a different AWS Region) is used for recovery. The passive site does not
actively serve traffic until a failover event is triggered.

It is critical to regularly assess and test your disaster recovery strategy so that you have
confidence in invoking it, should it become necessary. Use AWS Resilience Hub to
continuously validate and track the resilience of your AWS workloads, including whether
you are likely to meet your RTO and RPO targets.

Figure 6 - Disaster recovery strategies

5) what is IAM ,DIFFERENT IAM policies(6types of policies),IAM roles,use case of iam

roles for?

What is IAM?

AWS Identity and Access Management (IAM) is a web service for securely controlling
access to AWS resources. It enables you to create and control services for user
authentication or limit access to a certain set of people who use your AWS resources

How Does IAM Work?

The IAM workflow includes the following six elements:

120
 1. A principal is an entity that can perform actions on an AWS resource. A user, a
role or an application can be a principal.

2. Authentication is the process of confirming the identity of the principal trying

to access an AWS product. The principal must provide its credentials or
required keys for authentication.

3. Request: A principal sends a request to AWS specifying the action and which
resource should perform it.

4. Authorization: By default, all resources are denied. IAM authorizes a request

only if all parts of the request are allowed by a matching policy. After
authenticating and authorizing the request, AWS approves the action.

5. Actions are used to view, create, edit or delete a resource.

6. Resources: A set of actions can be performed on a resource related to your

AWS account.

Let us explore the components of IAM in the next section of the AWS IAM tutorial.

Components of IAM

121
There are other basic components of IAM. First, we have the user; many users together
form a group. Policies are the engines that allow or deny a connection based on policy.
Roles are temporary credentials that can be assumed to an instance as needed.

• Users

An IAM user is an identity with an associated credential and permissions attached to it.
This could be an actual person who is a user, or it could be an application that is a user.
With IAM, you can securely manage access to AWS services by creating an IAM user
name for each employee in your organization. Each IAM user is associated with only one
AWS account. By default, a newly created user is not authorized to perform any action in
AWS. The advantage of having one-to-one user specification is that you can individually
assign permissions to each user.

• Groups

A collection of IAM users is an IAM group. You can use IAM groups to specify
permissions for multiple users so that any permissions applied to the group are applied

122
to the individual users in that group as well. Managing groups is quite easy. You set
permissions for the group, and those permissions are automatically applied to all the
users in the group. If you add another user to the group, the new user will automatically
inherit all the policies and the permissions already assigned to that group. This lessens
the administrative burden.

• Policies

An IAM policy sets permission and controls access to AWS resources. Policies are stored
in AWS as JSON documents. Permissions specify who has access to the resources and
what actions they can perform. For example, a policy could allow an IAM user to access
one of the buckets in Amazon S3. The policy would contain the following information:

1. Who can access it

2. What actions that user can take

3. Which AWS resources that user can access

4. When they can be accessed

In JSON format that would look like this:

There are two types of policies: managed policies and inline policies.

123
 1. A managed policy is a default policy that you attach to multiple entities (users,
groups, and roles) in your AWS account. Managed policies, whether they are
AWS-managed or customer-managed, are stand-alone identity-based policies
attached to multiple users and/or groups.

2. Inline policies are policies that you create that are embedded directly into a
single entity (user, group or role).

• Roles

An IAM role is a set of permissions that define what actions are allowed and denied by
an entity in the AWS console. It is similar to a user in that it can be accessed by any type
of entity (an individual or AWS service). Role permissions are temporary credentials.

For example, you might want to allow a mobile app to use AWS resources, but you do
not want it to save the key, credential or password. Or you might want to give access to
resources to a user who already has an identity defined outside of AWS, such as a user
who already has Google or Facebook authentication. If you want to provide someone
with a service or let someone access resources in your account, you can use roles for
that purpose too. You also might want to grant temporary access to your account to a
third party, such as a consultant or an auditor. They’re not permanent users, just users
with temporary access to your environment.

Let us explore the features of IAM in the following section of the AWS IAM tutorial.

Features of IAM

To review, here are some of the main features of IAM:

• Shared access to the AWS account. The main feature of IAM is that it allows
you to create separate usernames and passwords for individual users or
resources and delegate access.

124
 • Granular permissions. Restrictions can be applied to requests. For example,
you can allow the user to download information, but deny the user the ability
to update information through the policies.

• Multifactor authentication (MFA). IAM supports MFA, in which users provide

their username and password plus a one-time password from their phone—a
randomly generated number used as an additional authentication factor.

• Identity Federation. If the user is already authenticated, such as through a

Facebook or Google account, IAM can be made to trust that authentication
method and then allow access based on it. This can also be used to allow users
to maintain just one password for both on-premises and cloud environment
work.

• Free to use. There is no additional charge for IAM security. There is no

additional charge for creating additional users, groups or policies.

• PCI DSS compliance. The Payment Card Industry Data Security Standard is an
information security standard for organizations that handle branded credit
cards from the major card schemes. IAM complies with this standard.

• Password policy. The IAM password policy allows you to reset a password or
rotate passwords remotely. You can also set rules, such as how a user should
pick a password or how many attempts a user may make to provide a
password before being denied access.

In the last section of the AWS IAM tutorial, let us go through a demo on how to create
an S3 bucket using the multifactor authentication (MFA) feature.

Demo: Create an S3 Bucket Using the MFA Feature

The final segment of this article puts together all of the information presented and uses
it to solve a basic problem.

125
Problem statement: To create an S3 bucket for a company in which each user can read
and write data with multifactor authentication.

Task: To create policies and assign permissions for a user and a group.

• Provide access (read and write) to the developer group.

• Provide a policy in which a user is allowed to read or denied permission to

write an object in an S3 bucket.

This is a very good use case if you have sensitive data in an S3 bucket and you want only
privileged or MFA-authenticated users to make changes to those buckets. For those
privileged users, you would enable multifactor authentication.

6) my ppk file is lost,how can i log into my ec2 instance?

1. Verify that the EC2Config service is running.

2. Detach the root volume for the instance.
3. Attach the volume to a temporary instance.
4. Modify the configuration file.
5. Restart the original instance.
7) how can you ensure high availability and fault tolerance for an aws application?

1. Design the system to have no single point of failure. ...

2. Correctly instrument and test system availability.
3. Prepare operating procedures for manual mechanisms to respond to, mitigate,
and recover from the failure.
To implement fault tolerance, workloads use spare (or redundant) subsystems. When
one of the subsystems in a redundant set fails, another picks up its work, typically
almost seamlessly. In this case, spares are truly spare capacity; they are available to
assume 100% of the work from the failed subsystem.

8) as part of your project ,explain a scenario where/how you had to implement a

disaster recovery plan for an aws application?

Disaster Recovery: 5 Key Features and Building Your DR Plan

1. Risk Assessment.
2. Evaluate Critical Needs.
126
 3. Set Disaster Recovery Plan Objectives.
4. Collect Data and Create the Written Document.
5. Test and Revise.
9) as part of your project,explain a scenario wher/how you had to optimize an
aws application database performance?

Amazon ElastiCache is a web service that makes it easy to deploy, operate, and
scale an in-memory cache in the cloud. The service improves the performance of
web applications by allowing you to retrieve information from fast, managed, in-
memory caches, instead of relying entirely on slower disk-based databases.
10) how can i secure my vpc? explain all aspects?in aws

Security best practices for your VPC

1. When you add subnets to your VPC to host your application, create them in
multiple Availability Zones. ...
2. Use security groups to control traffic to EC2 instances in your subnets. ...
3. Use network ACLs to control inbound and outbound traffic at the subnet level.

127