Question 1

Explain the AWS shared responsibility model.

Accepted Answer

AWS is responsible for security “of” the cloud — hardware, the hypervisor, physical facilities and managed service infrastructure. You are responsible for security “in” the cloud — IAM permissions, OS patching on EC2, security groups, encryption settings, and your application code and data.

Question 2

What is IAM and what are the main identity types?

Accepted Answer

IAM controls who can call which AWS API on which resource. The main identities are users (long-lived, usually humans), groups (permission bundles), and roles (temporary credentials assumed by services, EC2 instances, Lambda functions or federated users). In production, prefer roles over access keys.

Question 3

IAM role vs IAM user — when do you use each?

Accepted Answer

A user has permanent credentials and suits a person or legacy script. A role has no permanent credentials; STS issues short-lived tokens when it's assumed. Any EC2, ECS, Lambda or CI job talking to AWS should use a role, so nothing secret has to be stored or rotated.

Question 4

What is an IAM policy, and what's the difference between identity-based and resource-based policies?

Accepted Answer

A policy is a JSON document of Effect, Action, Resource and optional Condition. Identity-based policies attach to a user, group or role. Resource-based policies attach to the resource itself (S3 bucket policy, SQS queue policy, KMS key policy) and can grant cross-account access without a role in the target account.

Question 5

How does AWS evaluate permissions when several policies apply?

Accepted Answer

An explicit Deny always wins. Otherwise the request must be explicitly Allowed by some policy, and it must also be permitted by every applicable boundary — SCPs from Organizations, permission boundaries and session policies. Anything not allowed is denied by default.

Question 6

What is a VPC, and what does a basic production VPC look like?

Accepted Answer

A VPC is your private, logically isolated network in AWS. A typical build: one VPC per environment, public subnets in two AZs holding the load balancer and NAT gateway, private subnets in the same AZs for app servers, and isolated subnets for RDS. Route tables send 0.0.0.0/0 to an internet gateway from public subnets and to a NAT gateway from private subnets.

Question 7

Security group vs NACL?

Accepted Answer

A security group is stateful, attaches to an ENI, and only supports allow rules — return traffic is automatic. A NACL is stateless, attaches to a subnet, supports allow and deny rules that are evaluated in number order, and needs explicit rules for both directions. Use security groups for day-to-day access control and NACLs for coarse subnet-level blocks.

Question 8

Difference between an Internet Gateway, a NAT Gateway and a VPC Endpoint?

Accepted Answer

An IGW gives a subnet two-way internet access. A NAT gateway lets private instances reach the internet outbound but blocks inbound. A VPC endpoint keeps traffic to AWS services on the AWS network — Gateway endpoints for S3 and DynamoDB, Interface endpoints (PrivateLink ENIs) for most other services — which cuts NAT cost and keeps data off the public internet.

Question 9

EC2 instance types and purchase options — how do you pick?

Accepted Answer

Pick the family by workload: t for burstable, m general purpose, c compute-heavy, r memory-heavy, and g/p for GPU. For pricing, use On-Demand for spiky or unknown load, Savings Plans or Reserved Instances for steady baseline, and Spot for stateless, fault-tolerant workers and CI runners.

Question 10

What are the S3 storage classes and when would you use each?

Accepted Answer

Standard for hot data, Intelligent-Tiering when access patterns are unknown, Standard-IA and One Zone-IA for infrequent access, Glacier Instant / Flexible Retrieval for archives, and Deep Archive for long-term compliance copies. Lifecycle rules move objects between them automatically.

Question 11

How do you secure an S3 bucket?

Accepted Answer

Turn on Block Public Access at the account and bucket level, use a bucket policy plus IAM roles instead of ACLs, enforce TLS with a policy condition on aws:SecureTransport, enable default encryption with SSE-S3 or SSE-KMS, and switch on versioning and access logging. Use presigned URLs when the browser needs temporary access.

Question 12

ALB vs NLB vs CLB?

Accepted Answer

The Application Load Balancer works at Layer 7 with host and path routing, and it's what you use with ECS/EKS. The Network Load Balancer is Layer 4, handles millions of connections with very low latency and gives static IPs. The Classic Load Balancer is legacy — don't design new systems with it.

Question 13

How does Auto Scaling work?

Accepted Answer

An Auto Scaling group keeps a desired count of instances built from a launch template, spread across AZs, and replaces any instance that fails a health check. Target-tracking policies (e.g. keep average CPU at 60%) handle most cases; step scaling and scheduled scaling cover known spikes. Warm-up and cooldown settings stop it flapping.

Question 14

What is the difference between RDS Multi-AZ and a read replica?

Accepted Answer

Multi-AZ is for availability — a synchronous standby in another AZ that AWS fails over to; you can't read from it in most engines. Read replicas are for scale — asynchronous copies you point read traffic at, and they can be promoted manually in a disaster.

Question 15

What is AWS Lambda and what are its main limits?

Accepted Answer

Lambda runs your code on demand without servers, billed per millisecond. Key limits to mention: 15-minute maximum execution, up to 10 GB memory, 512 MB to 10 GB of /tmp, 6 MB synchronous payload and cold starts — which you mitigate with provisioned concurrency or smaller packages.

Question 16

How do you manage secrets in AWS?

Accepted Answer

Use Secrets Manager for credentials that need automatic rotation (RDS passwords, API keys) and SSM Parameter Store SecureString for cheaper config values. Encrypt with KMS, grant read access via IAM roles, fetch at runtime instead of baking into AMIs or images, and never commit secrets to Git.

Question 17

What is DevOps in one sentence, and how do you measure it?

Accepted Answer

DevOps is the practice of shortening the path from a code commit to safe production value by sharing ownership between development and operations and automating everything repeatable. Measure it with the four DORA metrics: deployment frequency, lead time for changes, change failure rate and mean time to restore.

Question 18

Continuous Integration vs Continuous Delivery vs Continuous Deployment?

Accepted Answer

CI means every commit is automatically built and tested against the mainline. Continuous Delivery means every passing build is packaged and always releasable, with a human approving the push. Continuous Deployment removes that approval — every green build goes to production automatically.

Question 19

Walk me through a CI/CD pipeline you have built.

Accepted Answer

Describe your own: commit to a feature branch triggers lint, unit tests and a security scan; merge to main builds a Docker image tagged with the commit SHA, pushes to ECR, and deploys to staging via Terraform or a Helm chart; automated smoke tests run; a manual approval promotes the same immutable image to production with a rolling or blue-green release, and rollback is redeploying the previous tag.

Question 20

What goes inside a buildspec.yml?

Accepted Answer

Version, optional env variables and parameter-store references, and phases: install (runtimes), pre_build (login to ECR, pull dependencies), build (compile, run tests, docker build), and post_build (docker push, write imagedefinitions.json). Then artifacts and cache blocks to speed up subsequent builds.

Question 21

Blue-green vs canary vs rolling deployment?

Accepted Answer

Blue-green runs two identical environments and switches traffic at once — instant rollback but double the infrastructure. Canary sends a small percentage of traffic to the new version, watches metrics, then ramps up. Rolling replaces instances in batches — cheapest, but both versions serve traffic during the roll and rollback is slower.

Question 22

How do you roll back a bad deployment?

Accepted Answer

Prefer redeploying the previous immutable artefact rather than reverting code under pressure. With blue-green you shift the listener back; with ECS or Kubernetes you roll back to the previous task definition or revision; with CodeDeploy you enable automatic rollback on CloudWatch alarm. Database changes need backward-compatible migrations so the old version still runs.

Question 23

How do you handle database migrations in a CI/CD pipeline?

Accepted Answer

Use a migration tool (Flyway, Liquibase, Alembic) run as a pipeline step, and make every change expand-then-contract: add the new column, deploy code that writes both, backfill, then remove the old column in a later release. Never couple an irreversible migration to the same deploy as the code that needs it.

Question 24

How do you keep secrets out of a Jenkins or GitHub Actions pipeline?

Accepted Answer

Store them in Secrets Manager, Parameter Store, Vault or the CI provider's encrypted secrets, inject them as masked environment variables at run time, use OIDC federation to assume an AWS role instead of static keys, and scan the repository with git-secrets or trufflehog in CI.

Question 25

What is a Jenkins declarative pipeline and why use Jenkinsfile in the repo?

Accepted Answer

A declarative pipeline is a structured Jenkinsfile with pipeline, agent, stages and post blocks. Keeping it in the repo makes the build process versioned, reviewable and identical for every branch — pipeline as code rather than clicking through the Jenkins UI.

Question 26

How do you speed up a slow build?

Accepted Answer

Cache dependencies and Docker layers, run test suites in parallel, split unit tests from slower integration tests, use multi-stage Docker builds with a small final image, only build what changed in a monorepo, and scale build agents horizontally with Spot instances.

Question 27

Container vs virtual machine?

Accepted Answer

A VM virtualises hardware and runs a full guest OS, so it boots in minutes and takes gigabytes. A container shares the host kernel and isolates processes with namespaces and cgroups, so it starts in milliseconds and ships only the application plus its libraries. Containers give density and portability; VMs give stronger isolation.

Question 28

Explain a Dockerfile and the difference between CMD and ENTRYPOINT.

Accepted Answer

A Dockerfile is the recipe for an image — base image, dependency installs, copied source and the start command. ENTRYPOINT defines the executable that always runs; CMD supplies default arguments that a docker run argument can override. Using ENTRYPOINT with a CMD argument list is the usual pattern.

Question 29

How do you reduce Docker image size?

Accepted Answer

Use a multi-stage build so compilers stay out of the final layer, start from alpine or distroless, combine RUN commands and clean package caches in the same layer, add a .dockerignore, and copy dependency manifests before source so the dependency layer stays cached.

Question 30

What are the core Kubernetes objects?

Accepted Answer

A Pod is the smallest deployable unit (one or more containers sharing a network namespace). A Deployment manages ReplicaSets for stateless rollouts, a StatefulSet handles ordered, identity-bound workloads, a DaemonSet runs one pod per node, a Service gives stable networking, and Ingress exposes HTTP routes. ConfigMaps and Secrets supply configuration.

Question 31

ClusterIP vs NodePort vs LoadBalancer vs Ingress?

Accepted Answer

ClusterIP is internal only. NodePort opens a port on every node. LoadBalancer provisions a cloud load balancer per service, which gets expensive. Ingress puts one load balancer in front of an ingress controller that routes by host and path to many services — the normal production choice.

Question 32

How does a Kubernetes rolling update work, and how do you roll it back?

Accepted Answer

The Deployment creates a new ReplicaSet and shifts pods over, honouring maxSurge and maxUnavailable, and only counts a pod as ready when its readiness probe passes. Roll back with `kubectl rollout undo deployment/<name>`, which scales the previous ReplicaSet back up.

Question 33

Liveness vs readiness vs startup probes?

Accepted Answer

Liveness restarts a container that is alive but stuck. Readiness removes a pod from the Service endpoints while it can't serve, without killing it. Startup gives slow-booting apps time before liveness begins. Getting readiness right is what makes zero-downtime deploys actually zero-downtime.

Question 34

Requests vs limits, and what causes OOMKilled or CPU throttling?

Accepted Answer

Requests are what the scheduler reserves; limits are the hard ceiling. Exceeding a memory limit gets the container OOMKilled — the exit code is 137. Exceeding a CPU limit doesn't kill it, it throttles it, which shows up as latency. Set requests from observed usage and keep memory limits close to requests.

Question 35

How do you debug a pod stuck in CrashLoopBackOff?

Accepted Answer

`kubectl describe pod` for events and the last exit code, `kubectl logs --previous` for the crashed container's output, check the image tag and command, verify ConfigMap/Secret mounts and env vars exist, confirm probes aren't failing too early, and check resource limits. Then reproduce locally with the same image.

Question 36

What is EKS and how does it differ from ECS and Fargate?

Accepted Answer

EKS is managed Kubernetes — portable, powerful, more operational overhead. ECS is AWS's own simpler orchestrator with tight IAM and ALB integration. Fargate is a serverless compute mode for either one: no nodes to patch or scale, you pay per task's vCPU and memory. Pick ECS+Fargate for speed, EKS when you need the Kubernetes ecosystem.

Question 37

What is Infrastructure as Code and what does it buy you?

Accepted Answer

Defining infrastructure in version-controlled files that a tool applies. You get reviewable changes, identical environments, disaster recovery by re-applying code, and an audit trail — instead of undocumented clicks in the console that nobody can reproduce.

Question 38

Terraform vs CloudFormation?

Accepted Answer

Terraform is multi-cloud, uses HCL, has a large provider and module ecosystem, and keeps its own state file. CloudFormation is AWS-native, needs no state management, integrates with StackSets and drift detection, and supports service-managed rollbacks. Teams on AWS only sometimes prefer CloudFormation or CDK; mixed estates usually pick Terraform.

Question 39

What is Terraform state and how do you manage it in a team?

Accepted Answer

State maps your configuration to real resource IDs. Store it remotely in an S3 backend with encryption and versioning, plus DynamoDB (or S3 native) locking so two engineers can't apply at once, and use separate state files per environment. Never commit state to Git — it contains sensitive values.

Question 40

Explain terraform plan, apply, and how you handle drift.

Accepted Answer

`plan` produces a diff between state, config and reality; `apply` executes it. Drift is when someone changes a resource manually — `terraform plan` surfaces it, and you either revert by applying the code or bring the change in by updating the code (or `terraform import` for unmanaged resources).

Question 41

What does idempotent mean in Ansible, and why does it matter?

Accepted Answer

Running the same playbook repeatedly leaves the system in the same state and only makes changes when reality differs from the declaration. It matters because you can safely re-run a playbook to enforce configuration without duplicating users, appending the same line twice or restarting services unnecessarily.

Question 42

How do you troubleshoot a Linux server that's running out of disk?

Accepted Answer

`df -h` to find the full filesystem, `du -sh /*` narrowing down to the biggest directories, `lsof | grep deleted` for files still held open by a process after deletion, check /var/log and Docker's overlay directory, then fix the cause with logrotate, `docker system prune` or a bigger volume — not just by deleting files once.

Question 43

A service is unreachable on port 443 — how do you debug it?

Accepted Answer

Work up the stack: is the process listening (`ss -lntp`), does it respond locally (`curl localhost`), is the host firewall open, does the security group and NACL allow it, is the target group healthy, does DNS resolve to the right load balancer, and is the certificate valid. Say the order out loud — interviewers grade the method, not the answer.

Question 44

Which Git branching strategy do you use and why?

Accepted Answer

Trunk-based development with short-lived feature branches and feature flags suits continuous delivery: small merges, fewer conflicts, main always releasable. GitFlow suits versioned releases with long support windows. Whichever you name, be able to explain how a hotfix reaches production.

Question 45

CloudWatch vs CloudTrail vs Config?

Accepted Answer

CloudWatch handles metrics, logs, alarms and dashboards — how things are performing. CloudTrail records API calls — who did what, when, from where. AWS Config records resource configuration over time and evaluates compliance rules — what the setup looks like and whether it drifted.

Question 46

How do you set up meaningful alerting instead of alert noise?

Accepted Answer

Alert on symptoms users feel — error rate, latency percentiles, saturation and queue depth — rather than every CPU spike. Base thresholds on SLOs, use composite alarms and anomaly detection, route by severity so only real pages wake someone, and delete any alert nobody acts on.

Question 47

How do you build security into the pipeline (DevSecOps)?

Accepted Answer

Shift left: secret scanning and SAST on commit, dependency scanning (SCA) on build, image scanning with ECR scan or Trivy before push, IaC scanning with tfsec or Checkov, and runtime checks with GuardDuty, Security Hub and Inspector. Fail the build on high severity rather than emailing a report nobody reads.

Question 48

What is KMS and the difference between encryption at rest and in transit?

Accepted Answer

KMS manages encryption keys and integrates with most AWS services; customer-managed keys let you control rotation and key policy. At rest means stored data is encrypted (EBS, S3, RDS, snapshots). In transit means TLS between clients and services. Interviewers expect both, plus 'enforce TLS with a bucket policy condition'.

Question 49

How do you reduce AWS cost without hurting reliability?

Accepted Answer

Right-size using Compute Optimizer, buy Savings Plans for baseline load, run stateless workers and CI on Spot, apply S3 lifecycle rules, delete unattached EBS volumes and old snapshots, use VPC endpoints to cut NAT data charges, scale non-production down at night, and tag everything so Cost Explorer can show which team spends what.

Question 50

What is your disaster recovery strategy, and what are RTO and RPO?

Accepted Answer

RTO is how fast you must be back; RPO is how much data you can afford to lose. Choose the pattern to match: backup and restore (cheapest, hours), pilot light, warm standby, or active-active multi-region (most expensive, near zero). Whatever you choose, say that you test restores on a schedule — an untested backup is not a backup.

Top 50 AWS DevOps Interview Questions and Answers (2026)

AWS fundamentals

DevOps culture, CI/CD and pipelines

Docker and Kubernetes

Infrastructure as Code, configuration and Linux

Monitoring, security and cost

Answers are easy. Doing it in a live lab is what gets you hired.