AWS Interview Questions for Freshers: 22 Questions With Answers

Last updated: 13 October 2026 · By the Asuraa Team

Quick answer: Fresher AWS interviews focus on EC2, S3, VPC, IAM, a database and monitoring. Key facts from the official AWS documentation: S3 standard classes are designed for 99.999999999% durability, Lambda functions can run for up to 900 seconds with 128 MB to 10,240 MB of memory, and security groups are stateful with allow-only rules while network ACLs are stateless and support deny rules.

Key takeaways

• AWS documentation lists a designed durability of 99.999999999% for S3 storage classes such as S3 Standard, Standard-IA and the Glacier classes.
• AWS Lambda functions can run for up to 900 seconds and can be given 128 MB to 10,240 MB of memory, with CPU scaling in proportion to memory.
• Security groups work at the instance level, allow rules only and are stateful, while network ACLs work at the subnet level, support deny rules and are stateless.
• Under the shared responsibility model, AWS secures the cloud infrastructure and the customer secures what runs in it, including guest OS patches on EC2 and IAM permissions.
• AWS recommends IAM roles with temporary credentials for workloads, so an EC2 instance should read S3 through an attached role rather than stored access keys.

AWS interviews for freshers in India check whether you understand the core services well enough to deploy and secure a simple application: EC2, S3, VPC, IAM, a database and monitoring. Below are 22 questions with model answers, a weighting table and a 7-day plan. Facts about limits and options come from the official AWS documentation. For other subjects, see the interview questions by subject guide.

Which AWS topics carry the most weight in fresher interviews?

Compute, storage, networking and IAM make up most fresher AWS rounds; databases, monitoring and cost come up as follow-ups.

What cloud basics questions come first?

Interviewers open with fundamentals to check your vocabulary before moving to services.

1. What is cloud computing, and what are IaaS, PaaS and SaaS?

Cloud computing is renting computing resources such as servers, storage and databases over the internet and paying for what you use, instead of buying hardware. IaaS gives you raw infrastructure you manage yourself, such as Amazon EC2. PaaS manages the platform so you only deploy code, such as AWS Elastic Beanstalk. SaaS is a finished application you simply use, such as Gmail or Salesforce.

2. What is the difference between a Region and an Availability Zone?

The AWS global infrastructure overview defines a Region as a physical location in the world with multiple Availability Zones, and an Availability Zone as one or more discrete data centres with redundant power, networking and connectivity in separate facilities. You spread an application across AZs for high availability and choose a Region for latency, data residency and price. For Indian users, the Mumbai and Hyderabad Regions keep data in the country.

3. What is the AWS shared responsibility model?

AWS's shared responsibility model splits security into security "of" the cloud, which AWS handles (hardware, networking, facilities), and security "in" the cloud, which the customer handles. On EC2 you patch the guest operating system, manage your applications and configure security groups. On managed services such as S3 or DynamoDB, AWS runs the platform and you manage your data, encryption choices and IAM permissions.

What compute questions should you prepare?

EC2 and Lambda dominate compute questions, with Auto Scaling as a common follow-up.

4. What is EC2 and what is an AMI?

Amazon EC2 provides virtual servers, called instances, that you launch in minutes and pay for while they run. An AMI (Amazon Machine Image) is the template an instance starts from: the operating system, configuration and any pre-installed software. Instance types such as t3, m5 or c5 differ in CPU, memory and network capacity, so you pick one to match the workload.

5. What are the EC2 purchasing options?

The EC2 purchasing options page lists On-Demand (pay by the second), Savings Plans (commit to a USD-per-hour spend for one or three years), Reserved Instances (commit to an instance configuration for one or three years), Spot Instances (unused capacity at a lower price that can be reclaimed), Dedicated Hosts, Dedicated Instances and Capacity Reservations. Use On-Demand for short or unpredictable work, Savings Plans or Reserved Instances for steady workloads, and Spot for fault-tolerant batch jobs.

6. What do Elastic Load Balancing and Auto Scaling do?

A load balancer spreads incoming traffic across healthy instances, often in several Availability Zones, and stops sending traffic to an instance that fails health checks. An Auto Scaling group keeps a minimum number of instances running and adds or removes instances based on rules such as average CPU usage. Together they give availability and let you pay only for the capacity you need.

7. What is AWS Lambda, and what are its key limits?

Lambda is a serverless service that runs your function in response to events, such as an API call or a file landing in S3, and bills only for execution time. You do not manage servers or patching. According to the Lambda quotas page, a function can run for up to 900 seconds (15 minutes) and use 128 MB to 10,240 MB of memory, and CPU scales with memory.

8. When would you choose EC2 over Lambda?

Choose Lambda for short, event-driven tasks with spiky traffic, such as resizing images on upload or a lightweight API. Choose EC2, or containers, for long-running processes, jobs longer than 15 minutes, workloads needing a specific OS setup, or steady high traffic where always-on servers cost less. A good answer names a real trade-off: Lambda removes server management but adds cold starts and execution limits.

What S3 and storage questions are common?

S3 is the most asked AWS service in fresher interviews, so know its classes and security settings well.

9. What is Amazon S3?

S3 is object storage: you store files as objects inside buckets, each identified by a key, and access them over HTTPS or the SDK. It is used for backups, static website assets, data lakes and log storage. The S3 storage classes documentation lists a designed durability of 99.999999999% (eleven nines) for the standard classes.

10. What S3 storage classes are there?

The S3 documentation lists S3 Standard for frequently accessed data, S3 Intelligent-Tiering for unknown or changing access patterns, S3 Standard-IA and One Zone-IA for data accessed about once a month (30-day minimum storage), Glacier Instant Retrieval for quarterly-access archives with millisecond retrieval (90 days), Glacier Flexible Retrieval for yearly access with minutes-to-hours retrieval (90 days), and Glacier Deep Archive for data accessed less than once a year (180 days). Lifecycle rules move objects between classes automatically.

11. What is the difference between S3, EBS and EFS?

S3 is object storage accessed over an API, ideal for files, backups and static content at any scale. EBS is block storage attached to a single EC2 instance like a hard disk, used for the operating system and databases. EFS is a managed network file system that many Linux instances can mount at once, used for shared content. The interview test is whether you match the storage type to the access pattern.

12. How do you secure an S3 bucket?

Keep S3 Block Public Access turned on unless the bucket truly serves public content. Grant access through IAM policies and bucket policies following least privilege, enable default encryption, and turn on versioning so deleted or overwritten objects can be recovered. For sharing a private file temporarily, generate a pre-signed URL instead of making the object public.

What networking questions do freshers face?

Expect at least one question on VPC design and one on security groups.

13. What is a VPC, and what makes a subnet public or private?

A VPC is your own logically isolated network in AWS with an IP range you choose, divided into subnets in different Availability Zones. A subnet is public when its route table sends internet traffic to an Internet Gateway; a private subnet has no such route. Instances in a private subnet reach the internet for updates through a NAT gateway, while databases stay unreachable from outside.

14. What is the difference between a security group and a network ACL?

The AWS VPC security comparison explains that a security group works at the instance level, supports allow rules only, evaluates all rules together and is stateful, so return traffic is allowed automatically. A network ACL works at the subnet level, supports allow and deny rules, evaluates numbered rules in ascending order until one matches and is stateless, so return traffic must be allowed explicitly. AWS recommends security groups as the primary control and NACLs as an extra layer.

15. What are Route 53 and CloudFront?

Route 53 is AWS's DNS service: it maps domain names to resources and can route users based on health checks, latency or location. CloudFront is a content delivery network that caches content at edge locations close to users, cutting latency for static assets and videos. A typical setup puts CloudFront in front of an S3 bucket or load balancer, with Route 53 pointing the domain at CloudFront.

What IAM and security questions are asked?

IAM questions test whether you can be trusted with access to a company account.

16. What is the difference between an IAM user, a group, a role and a policy?

A policy is a JSON document that allows or denies actions on resources. A user is a long-term identity with a password or access keys, and a group lets you attach policies to many users at once. The IAM roles documentation describes a role as an identity with no long-term credentials that a trusted principal assumes to receive temporary credentials, and AWS recommends roles for workloads and federation for people.

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": ["s3:GetObject"],
    "Resource": "arn:aws:s3:::my-app-reports/*"
  }]
}

17. How would you give an EC2 instance access to S3?

Create an IAM role with a policy allowing only the needed S3 actions on the specific bucket, attach it to the instance through an instance profile, and let the SDK pick up temporary credentials automatically. Never put access keys in code or on the server. This answer covers least privilege and roles together, which is why interviewers like it.

18. What are the basic security best practices for an AWS account?

Enable MFA on the root user and stop using root for daily work. Give people least-privilege access, prefer roles and temporary credentials over access keys, and rotate or delete unused keys. Turn on CloudTrail for auditing, keep S3 Block Public Access on, and never commit keys to a public GitHub repository.

What database, monitoring and design questions come up?

These questions check whether you can run what you deploy.

19. What is the difference between RDS and DynamoDB?

Amazon RDS is a managed relational database service for engines such as MySQL and PostgreSQL, suited to structured data, joins and transactions. DynamoDB is a managed NoSQL key-value and document database that scales automatically and gives consistent low latency for access by key. Pick RDS when the data model is relational and queries vary; pick DynamoDB when access patterns are known and scale is large.

20. What is the difference between CloudWatch and CloudTrail?

CloudWatch monitors performance: it collects metrics such as CPU usage, stores application logs, and triggers alarms, for example notifying you when CPU stays above 80% for five minutes. CloudTrail records API activity, meaning who did what in the account and when, such as which user deleted a bucket. Remember it as CloudWatch for health, CloudTrail for audit.

21. What is infrastructure as code, and which AWS tool supports it?

Infrastructure as code means defining servers, networks and permissions in version-controlled files instead of clicking through the console. AWS CloudFormation reads YAML or JSON templates and creates the resources as a stack; Terraform is a popular multi-cloud alternative. IaC makes environments repeatable, reviewable and easy to tear down.

22. How would you design a highly available web application on AWS?

Put a load balancer in front of an Auto Scaling group of EC2 instances spread across at least two Availability Zones in private subnets. Use a managed database such as RDS with a Multi-AZ standby, store static assets in S3 behind CloudFront, and route the domain with Route 53. Add CloudWatch alarms and keep the setup in CloudFormation or Terraform. Walk through what happens when one AZ fails; that is the point of the question.

What do most guides on AWS interview questions for freshers get wrong?

Most guides treat AWS as a memory test of service names and quote limits and counts that change often. Interviewers care more about judgement: why a role is safer than an access key, why a database belongs in a private subnet, why Spot suits batch jobs but not a payment API. Guides also blur security groups and NACLs; the AWS documentation is precise that security groups are stateful with allow-only rules, while NACLs are stateless and process rules in number order. Finally, avoid quoting Free Tier or pricing figures from old blogs. Check the current AWS page and say you did.

How should you revise AWS in 7 days?

Use a personal AWS account with a budget alert set on day one, and build as you read.

1. Day 1: Cloud models, Regions and AZs, shared responsibility. Create a billing alert and enable root MFA.
2. Day 2: EC2: launch an instance, connect over SSH, compare purchasing options. Stop it afterwards.
3. Day 3: S3: create a bucket, upload files, test a lifecycle rule and a pre-signed URL.
4. Day 4: VPC: public and private subnets, route tables, security groups vs NACLs.
5. Day 5: IAM: write a least-privilege policy and attach a role to EC2 to read S3.
6. Day 6: Lambda triggered by an S3 upload, CloudWatch logs and an alarm, RDS vs DynamoDB notes.
7. Day 7: Draw the highly available architecture from memory and answer all 22 questions aloud.

New to cloud? Start with how to learn AWS for jobs, and decide whether a certificate helps you with is AWS Cloud Practitioner worth it in India. For round structure, read how to prepare for technical interview questions, and for role-specific depth, the cloud engineer interview questions.

Related guides

• Interview Questions by Subject: Java, Python, SQL, DSA, Cloud, AI
• Statistics Interview Questions for Data Analysts: 23 With Answers
• Node.js and Express Interview Questions: 23 With Answers (Route Order)
• Power BI Interview Questions (2026): 22 Questions With Answers

FAQ

Which AWS services should a fresher learn first?

Start with IAM, EC2, S3 and VPC, because almost every interview and project uses them. Then add one database (RDS or DynamoDB), Lambda, CloudWatch and a load balancer with Auto Scaling. Deploying one small web application end to end with these services teaches more than reading about fifty services, and gives you a project to discuss.

What is the difference between a security group and a NACL in AWS?

A security group is attached to instances, allows traffic with allow rules only, evaluates all its rules together and is stateful, so replies are allowed automatically. A network ACL is attached to a subnet, supports both allow and deny rules, checks numbered rules in order and is stateless, so return traffic needs its own rule. AWS treats security groups as the main control.

What is the maximum timeout for AWS Lambda?

The official Lambda quotas page lists a maximum function timeout of 900 seconds, which is 15 minutes, for standard functions. Memory can be set from 128 MB to 10,240 MB. If your job needs longer, use AWS Step Functions to split it into steps, or run it on EC2, ECS or AWS Batch instead.

Is AWS certification needed to get a cloud job as a fresher?

It is not mandatory, but an entry certificate such as AWS Cloud Practitioner or Solutions Architect Associate can help a fresher get past resume screening when combined with a hands-on project. Recruiters still test practical understanding in the interview, so a deployed application with IAM, VPC and S3 configured properly often counts for more than the certificate alone.

What is the difference between S3 and EBS?

S3 is object storage accessed over an API, where you store files in buckets at practically any scale and read them from anywhere with permission. EBS is block storage attached to one EC2 instance in one Availability Zone, behaving like a disk for the operating system or a database. Use S3 for files and backups, EBS for instance disks.

How do freshers avoid a large AWS bill while practising?

Set an AWS Budgets alert on day one, use the smallest instance sizes, and stop or terminate instances, NAT gateways and databases as soon as you finish practising. Delete unused Elastic IPs and snapshots, and check the Billing dashboard daily during your first week. Never post access keys in public GitHub repositories.

Final thoughts

AWS interviewers hire freshers who can explain why they chose a service, not those who can list two hundred of them. Deploy one small application with IAM roles, a private database and S3, practise the 22 answers aloud, and then search cloud and DevOps fresher roles on Asuraa jobs.