Question 1

What is the difference between a Region and an Availability Zone?

Accepted Answer

A Region is a geographic area, like Mumbai or Singapore, and each Region has several Availability Zones. An AZ is one or more separate data centres with their own power and network, connected to the other AZs with low-latency links. To survive a data centre failure I spread my app across at least two AZs. I pick a Region based on how close it is to users, data rules, the services available and price.

Question 2

What is IAM and what is the principle of least privilege?

Accepted Answer

IAM controls who can do what in AWS. Users and roles get permissions through policies, JSON documents that allow or deny actions on resources. Least privilege means giving only the permissions that are really needed, nothing more. For apps and servers I use IAM roles instead of access keys, because roles give temporary credentials automatically. I also protect the root account with MFA and do not use it day to day.

Question 3

What is the difference between a security group and a network ACL?

Accepted Answer

A security group is a firewall on an instance or network interface. It is stateful, so if inbound traffic is allowed the reply is allowed automatically, and it only has allow rules. A network ACL works at the subnet level, is stateless, so return traffic needs its own rule, and supports both allow and deny rules, checked in number order. Most access control is done with security groups. NACLs are an extra layer, for example to block an IP range.

Question 4

Explain a VPC with public and private subnets.

Accepted Answer

A VPC is my own private network in AWS. A public subnet has a route to an Internet Gateway, so resources like load balancers can be reached from the internet. A private subnet has no direct internet route. App servers and databases go there for safety. To let private resources download updates, they go out through a NAT Gateway in a public subnet. I create subnets in at least two AZs for high availability.

Question 5

What are the main S3 storage classes and when do you use them?

Accepted Answer

S3 Standard is for data used often. Standard-IA and One Zone-IA are cheaper for data used less often, but you pay to read it. Glacier Instant Retrieval, Flexible Retrieval and Deep Archive are for archives and backups, from milliseconds up to hours to get the data back. Intelligent-Tiering moves objects between tiers automatically when the access pattern is unknown. Lifecycle rules can move old data to cheaper classes automatically.

AWS interview questions