←

# cloud & infrastructure

// [58] real interview questions. Answers and sources live in the practice app.

practice this topic
  1. Explain the difference between an IAM user, an IAM role, and an IAM policy. When would you use each?(mid)
  2. A user reports they cannot access an S3 bucket. How do you debug it?(mid)
  3. What are the IAM best practices you would enforce on a new AWS account?(junior)
  4. Which IAM tooling would you use to identify and trim permissions a user or role never actually uses?(mid)
  5. Your code running on a fresh EC2 instance fails AWS API calls with missing credentials. A teammate suggests copying your access keys onto the instance. What do you do instead?(mid)
  6. You expose a Lambda function that uploads images to S3 and writes metadata to DynamoDB. A colleague suggests embedding AWS credentials in the function so it can reach those services. What's your take?(mid)
  7. Explain Regions and Availability Zones in AWS. Why does the distinction matter when you design a deployment?(junior)
  8. Describe the AWS Shared Responsibility Model. Give a concrete example of something AWS handles and something you must handle.(junior)
  9. What is the difference between Security Groups and Network ACLs in a VPC?(mid)
  10. Users get connection timeouts reaching an application on an EC2 instance. Walk through how you diagnose it.(mid)
  11. A colleague picks a /27 subnet because he needs 29 IP addresses for EC2 instances. Is that enough?(mid)
  12. After you stop and start an EC2 instance, its public IP changes and breaks a client that had it hardcoded. How do you fix this properly?(junior)
  13. Match the EC2 pricing model to the workload: (a) a service that must run continuously for 2 years, (b) a batch job that can be interrupted and retried, (c) a short-term workload that must not be interrupted.(mid)
  14. What happens to EBS volumes and their data when an EC2 instance is stopped versus terminated?(junior)
  15. What is EC2 Instance Store, and when would you choose it over EBS despite its downsides?(mid)
  16. When would you run a workload on AWS Lambda instead of EC2, and what are Lambda's real limitations?(mid)
  17. Is a new S3 bucket public by default? What security measures do you apply to buckets holding sensitive data?(mid)
  18. What is an S3 presigned URL and when would you use one?(mid)
  19. A customer wants to move rarely accessed data to the cheapest S3 storage available. Which storage class do you recommend, and what do you warn them about?(mid)
  20. In disaster recovery planning, what are RTO and RPO, and how do they drive which DR strategy you pick?(senior)
  21. Your web application runs in a single AWS region. How do you keep it operating if that region becomes unavailable, and when is multi-AZ alone not enough?(senior)
  22. What is the difference between RDS Multi-AZ and RDS read replicas? When do you need each?(mid)
  23. Application Load Balancer vs Network Load Balancer: how do you choose, and which has lower latency?(mid)
  24. An Auto Scaling Group runs two instances and you change desired capacity to 2 → 1. What exactly happens, and how does ASG decide which instance to kill?(mid)
  25. What is the difference between horizontal and vertical scaling, and why does cloud architecture favor horizontal?(junior)
  26. CloudWatch vs CloudTrail: which do you use to investigate 'why was this EC2 instance terminated' vs 'why is this instance slow'?(mid)
  27. This month's AWS bill is unexpectedly huge. How do you find the cause and stop the bleeding?(senior)
  28. When is the public cloud the wrong choice? Give concrete cases where on-premise or hybrid wins.(senior)
  29. Describe the typical Terraform workflow from writing code to applied infrastructure. What does each core command do?(junior)
  30. Why does Terraform keep a state file at all, and why is committing it to Git a bad idea?(mid)
  31. Two engineers run terraform apply at the same time against shared state. What can go wrong, and how do you set the project up so it can't happen?(senior)
  32. How do you structure Terraform state for dev, staging, and production, and why are workspaces usually not the answer?(senior)
  33. You inherit AWS infrastructure that was created by hand in the console. How do you bring it under Terraform management without recreating it?(mid)
  34. Why are Terraform provisioners considered a last resort, and what should you use instead?(mid)
  35. You need to connect 15 VPCs across several accounts so they can all reach shared services. Why is full-mesh VPC peering the wrong answer, and what do you use instead?(senior)
  36. Instances in a private subnet need to download OS updates from the internet but must not be reachable from it. What do you configure, and how does a NAT Gateway differ from an Internet Gateway?(mid)
  37. Your NAT Gateway bill for S3 traffic from private-subnet instances is surprisingly high. What's the fix, and what's the difference between the two VPC endpoint types?(senior)
  38. You want traffic split 90/10 between a stable and a new stack, but also automatic failover to a healthy region. Which Route 53 routing policies do this, and can you combine them?(mid)
  39. Global users complain your S3-hosted app and API are slow far from the origin region. How does CloudFront help, and what's the cache-invalidation gotcha?(mid)
  40. You're decoupling a web tier from slow background work, and separately you need one event to trigger several independent consumers. Which of SQS and SNS fits each, and how do you combine them?(senior)
  41. A DynamoDB table that worked in testing throttles under real traffic, and one partition is far hotter than others. What's the root cause, and how do you design the keys to avoid it?(senior)
  42. What consistency does S3 actually guarantee now, and what stale-read surprises still exist despite 'strong consistency'?(mid)
  43. Storage costs on a bucket full of logs are growing forever. How do you use S3 lifecycle rules, and what edge cases bite people?(mid)
  44. Secrets Manager vs SSM Parameter Store: both store config/secrets, so how do you choose between them?(mid)
  45. Your company is growing from one AWS account to many teams. Why go multi-account, and how do Organizations, SCPs, and cross-account roles fit together?(senior)
  46. Service A in account 111 needs to read an S3 bucket in account 222. Walk through the least-privilege cross-account setup and why you don't just share access keys.(senior)
  47. You run fault-tolerant batch processing on Spot Instances to save ~90%. How do you handle interruptions gracefully, and what turns Spot into a false economy?(senior)
  48. A traffic spike hits a Lambda behind API Gateway and users get 429/throttling errors while a downstream database is overwhelmed. What Lambda concurrency behavior explains this, and how do you control it?(senior)
  49. Several EC2 instances across AZs need to read and write the same set of files simultaneously. Would you use EBS, EFS, or S3, and why not the other two?(mid)
  50. A read-heavy app hammers RDS with the same queries and latency is climbing. Would you add read replicas or ElastiCache, and what's the tradeoff?(mid)
  51. How does AWS KMS envelope encryption actually protect S3/EBS data, and why does giving an app kms:Decrypt matter as much as the bucket policy?(senior)
  52. You're ingesting a continuous high-volume clickstream that several teams need to process independently and replay. Do you use SQS or Kinesis Data Streams, and what's the ordering/replay difference?(senior)
  53. Traffic is unpredictable and mostly idle with occasional bursts, and you're paying for a provisioned Aurora cluster that sits nearly empty. What do you switch to, and when is it the wrong call?(mid)
  54. Your public app is being hit by SQL-injection attempts and credential-stuffing bots, and separately you want to know if an instance is doing something malicious. Which of WAF and GuardDuty addresses each, and how do they differ?(mid)
  55. On-prem systems need private, high-bandwidth, consistent-latency connectivity to your VPC. Do you use a Site-to-Site VPN or Direct Connect, and how do you make the resilient choice?(senior)
  56. Security groups are stateful and NACLs are stateless — give a concrete case where that difference causes a bug someone spends an hour on.(mid)
  57. You need to expose an HTTP API to the public with auth, rate limiting, and per-route control in front of Lambda. What does API Gateway give you over exposing the function directly, and what's the cost/latency tradeoff?(senior)
  58. A large batch of writes hits DynamoDB and some return ProvisionedThroughputExceeded / throttling errors even though average consumed capacity looks below the limit. Why, and how should the client behave?(senior)