AWS interviews range from "what is EC2" to genuinely tricky architecture trade-offs — when to pick Fargate over EKS, how Security Groups differ from NACLs, why Aurora exists next to RDS. This covers the full spread, organized by service area, with diagrams for the parts that are easier to see than to read, and a mock test at the end.

AWS Fundamentals

Q1. What is Amazon Web Services (AWS) and what are its key features?

AWS is Amazon's cloud computing platform — on-demand compute, storage, databases, networking, and hundreds of higher-level services, billed by usage instead of upfront hardware purchase. Its defining features are elasticity (scale resources up/down on demand), a pay-as-you-go model, global reach across many physical regions, and a huge breadth of managed services that let teams avoid running (and patching) the underlying infrastructure themselves.

Q2. Explain the concept of Regions and Availability Zones in AWS.

A Region is a separate geographic area (us-east-1, eu-west-1…) with its own fully isolated set of data centers — chosen for latency to your users, cost, and data-residency requirements. Each Region contains multiple Availability Zones (AZs) — physically distinct data centers with independent power/networking/cooling, close enough for low-latency replication but far enough apart that one AZ failing shouldn't take down another.

Q3. What is an Amazon Machine Image (AMI) and how is it used?

An AMI is a template containing everything needed to launch an EC2 instance — the OS, any pre-installed software, and configuration. AWS provides base AMIs (Amazon Linux, Ubuntu, Windows), the AWS Marketplace has vendor-published ones, and you can create your own "golden image" from a configured instance so every new instance launches already set up, instead of provisioning from scratch every time.

Q4. Describe the difference between Elastic IP and Public IP in AWS.

Q5. What is the role of the AWS Management Console?

It's the web-based UI for creating, configuring, and monitoring AWS resources by clicking through forms rather than writing code — great for learning, one-off tasks, and visual debugging, but real infrastructure is better managed through the CLI, SDKs, or Infrastructure-as-Code (CloudFormation/Terraform) so changes are repeatable and reviewable.

Q6. Explain the concept of Elastic Computing in AWS.

Elastic computing means capacity grows and shrinks automatically to match actual demand — add instances during a traffic spike, remove them once it passes — instead of provisioning for peak load year-round and paying for idle capacity the rest of the time. Auto Scaling Groups are the concrete mechanism most compute services build this on.

Q7. What is AWS Identity and Access Management (IAM) and why is it important?

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject"],
      "Resource": "arn:aws:s3:::my-bucket/*"
    }
  ]
}

IAM controls who (users, roles, services) can do what (actions) to which resources — policies like the one above are attached to users, groups, or roles to grant exactly the permissions needed, nothing more. It's foundational to AWS security: nearly every real-world AWS incident traces back to overly broad IAM permissions somewhere in the chain.

Q8. Describe the AWS Shared Responsibility Model.

The split shifts depending on the service — for EC2 (IaaS) you manage the guest OS and everything above it; for a fully managed service like Lambda or RDS, AWS takes on more of the stack, and your responsibility narrows to configuration, code, and data.

Q9. What is the difference between Vertical Scaling and Horizontal Scaling in AWS?

Q10. Explain the concept of High Availability in AWS.

High availability means an application keeps running through individual component failures — spreading instances across multiple Availability Zones, load balancing across them, and using managed services (RDS Multi-AZ, S3's built-in cross-AZ redundancy) that already handle failover internally, so a single AZ outage doesn't take the whole application down.

Compute Services

Q11. What is Amazon Elastic Compute Cloud (EC2) and what are its key features?

EC2 is AWS's core virtual server service — resizable compute capacity billed by the second/hour, with full control over the OS and installed software. Key features: many instance types tuned for different workloads, Auto Scaling for elastic capacity, Elastic Load Balancing to spread traffic across instances, and multiple pricing models (On-Demand, Reserved, Spot) trading flexibility for cost.

Q12. Describe the different EC2 instance types and their use cases.

Q13. What is Amazon Elastic Container Service (ECS) and how does it work?

ECS is AWS's own container orchestrator — you define tasks (one or more containers) and services (how many task copies to keep running), and ECS schedules them onto compute, either EC2 instances you manage or Fargate's serverless compute. It's a simpler alternative to Kubernetes when you don't need Kubernetes's full feature set or portability across clouds.

Q14. Explain the difference between Amazon EC2 and AWS Lambda.

Q15. What is AWS Elastic Beanstalk and when would you use it?

Elastic Beanstalk is a Platform-as-a-Service layer over EC2/ELB/Auto Scaling — you upload application code and it provisions and wires up all the underlying infrastructure automatically. It's the right choice when you want a standard web app deployed quickly without hand-configuring every AWS service, and the wrong choice once you need fine-grained control Beanstalk's opinions get in the way of.

Q16. How does Auto Scaling work in AWS?

An Auto Scaling Group maintains a desired number of instances, launching more when a scaling policy's condition is met (CPU above a threshold, a queue backing up) and terminating instances when demand drops — all attached to a Load Balancer so traffic automatically redistributes across whatever instances currently exist.

Q17. What is Amazon Elastic Kubernetes Service (EKS) and its benefits?

EKS is AWS's managed Kubernetes control plane — AWS runs and patches the Kubernetes masters, you run your workloads on worker nodes (EC2 or Fargate). Its benefit over self-managed Kubernetes is exactly that: no cluster upgrades or control-plane operations to own, while keeping full Kubernetes API compatibility and portability of the same manifests to any other Kubernetes cluster.

Q18. Describe the concept of Spot Instances in AWS.

Spot Instances sell unused EC2 capacity at a steep discount, with the catch that AWS can reclaim it whenever that capacity is needed elsewhere — ideal for fault-tolerant, interruptible workloads (batch jobs, CI runners, stateless workers behind an Auto Scaling Group), a bad fit for anything that can't tolerate a sudden interruption.

Q19. What is AWS Fargate and how does it differ from Amazon ECS?

Fargate is a serverless compute engine for containers — you define a task, Fargate runs it without you provisioning or managing any EC2 instances at all. ECS is the orchestration layer (what to run, how many copies); Fargate is one of two ways to actually run it (the other being EC2 instances you manage yourself), so "ECS on Fargate" is the fully serverless combination.

Q20. Explain the purpose of Amazon EC2 Container Registry (ECR).

ECR is AWS's managed Docker container registry — push/pull images the same way you would with Docker Hub, but integrated with IAM for access control and with ECS/EKS/Fargate for pulling images directly during deployment, without managing a separate registry service.

Storage and Database Services

Q21. What is Amazon Simple Storage Service (S3) and its key features?

S3 is object storage — store any amount of data (files, backups, media, static websites) as objects in buckets, accessed over HTTP(S). Key features: 99.999999999% ("11 nines") durability, multiple storage classes trading cost for retrieval speed, fine-grained access control, and versioning/lifecycle policies to manage objects automatically over time.

Q22. Explain the difference between Amazon S3 and Amazon Elastic Block Store (EBS).

Q23. What is Amazon Relational Database Service (RDS) and what database engines does it support?

RDS is a managed relational database service — AWS handles patching, backups, and failover, you just connect and query. It supports MySQL, PostgreSQL, MariaDB, Oracle, SQL Server, and Amazon's own Aurora (MySQL/PostgreSQL-compatible).

Q24. Describe the concept of Amazon S3 buckets and objects.

aws s3 mb s3://my-app-assets
aws s3 cp ./logo.png s3://my-app-assets/images/logo.png
aws s3 ls s3://my-app-assets/images/

A bucket is a globally-uniquely-named top-level container; every file stored inside it is an object, addressed by a key (its path-like name). There's no real folder structure underneath — S3 just uses key prefixes and slashes to simulate one in the console/CLI.

Q25. What is Amazon DynamoDB and when would you use it?

DynamoDB is a fully managed, serverless NoSQL key-value/document database with single-digit-millisecond latency at virtually any scale. Reach for it over RDS when you need massive horizontal scale with predictable low latency and your access patterns are known upfront (DynamoDB's schema design is access-pattern-first, not entity-relationship-first) — less suited when you need ad-hoc joins/queries across many attributes.

Q26. Explain the difference between Amazon RDS and Amazon Aurora.

Q27. What is Amazon Elastic File System (EFS) and its use cases?

EFS is a managed, fully elastic NFS file system that multiple EC2 instances (or containers) can mount simultaneously — unlike EBS, which attaches to one instance at a time. It's the right fit for shared configuration, shared content directories, or any workload where several compute instances genuinely need to read/write the same files concurrently.

Q28. How does Amazon S3 ensure data durability and availability?

S3 automatically replicates every object across multiple devices in multiple Availability Zones within a region — that's what backs the 11-nines durability figure. Availability (whether the object is retrievable right now, a slightly different guarantee from durability) varies by storage class, with the Standard class targeting 99.99% availability.

Q29. What is Amazon Redshift and how does it differ from Amazon RDS?

Redshift is a managed data warehouse built for large-scale analytical (OLAP) queries — columnar storage and massively parallel processing across a cluster of nodes. RDS is built for transactional (OLTP) workloads — many small, fast reads/writes. Running heavy analytics against an RDS instance meant for live application traffic is exactly the anti-pattern Redshift exists to solve.

Q30. Describe the concept of Amazon S3 Glacier and its use cases.

Networking and Content Delivery

Q31. What is Amazon Virtual Private Cloud (VPC) and its key components?

A VPC is your own logically isolated slice of the AWS network — you define its IP address range (CIDR block), subnets within it, route tables, an internet gateway for public access, and security controls (Security Groups, NACLs). Every EC2 instance, RDS database, and most other resources live inside a VPC.

Q32. Explain the difference between Security Groups and Network Access Control Lists (NACLs) in AWS.

Q33. What is Amazon Route 53 and how does it work?

Route 53 is AWS's DNS service — it translates domain names into IP addresses, and adds routing policies beyond plain DNS resolution: latency-based routing to the nearest healthy region, weighted routing for gradual rollouts/A-B testing, and health checks that automatically stop routing to unhealthy endpoints.

Q34. Describe the concept of Subnets in AWS VPC.

A subnet is a segment of a VPC's IP range tied to one specific Availability Zone — public subnets route to an internet gateway (for resources that need direct internet access), private subnets don't (for databases and internal services, reachable only from inside the VPC or through a NAT gateway for outbound-only internet access).

Q35. What is Amazon CloudFront and its benefits?

CloudFront is AWS's CDN — it caches content (static assets, even dynamic API responses with the right cache headers) at edge locations physically close to end users worldwide, cutting latency and offloading traffic from the origin server. It also integrates with AWS Shield/WAF for DDoS/application-layer protection at the edge, before traffic ever reaches your origin.

Q36. Explain the purpose of Elastic Load Balancing (ELB) in AWS.

ELB distributes incoming traffic across multiple targets (EC2 instances, containers, Lambda functions) in one or more AZs, and performs health checks so traffic automatically stops going to an unhealthy target — the standard building block behind almost every scalable AWS architecture.

Q37. What is AWS Direct Connect and when would you use it?

Direct Connect is a dedicated, private network connection from your on-premises data center directly into AWS, bypassing the public internet entirely. Use it when you need consistent, high-bandwidth, low-latency connectivity (large data migrations, hybrid architectures with heavy cross-traffic) that a regular internet-based VPN can't reliably guarantee.

Q38. How does Amazon VPC peering work?

VPC peering creates a direct network route between two VPCs (in the same or different accounts/regions) so resources in each can communicate using private IPs, as if they were on the same network — with the caveat that peering isn't transitive: if A peers with B and B peers with C, A still can't reach C through B without its own separate peering connection.

Q39. What is Amazon API Gateway and its use cases?

API Gateway is a managed service for creating, publishing, and securing APIs at scale — handling request routing, throttling, authentication, and request/response transformation in front of backends like Lambda, EC2, or any HTTP endpoint. It's the standard front door for a serverless API built on Lambda.

Q40. Describe the concept of AWS Transit Gateway.

Transit Gateway is a central hub that connects many VPCs and on-premises networks through one managed gateway, instead of a tangle of individual peering connections between every pair — turning what would be an unmanageable mesh at scale into a simple hub-and-spoke topology.

Security and Compliance

Q41. What is AWS Key Management Service (KMS) and how does it work?

KMS creates and manages encryption keys used to encrypt data across AWS services (S3, EBS, RDS, and more) — you can use AWS-managed keys with zero setup, or customer-managed keys for finer control over rotation and access policy, all backed by hardware security modules AWS manages for you.

Q42. Explain the concept of AWS CloudTrail and its benefits.

CloudTrail logs every API call made against your AWS account — who did what, when, from where — which is the foundation of security auditing, compliance evidence, and incident forensics ("who deleted that S3 bucket, and when"). It's typically the first place you look after any security incident.

Q43. What is AWS Web Application Firewall (WAF) and its use cases?

WAF sits in front of CloudFront, an ALB, or API Gateway and filters HTTP requests against rules — blocking common exploits (SQL injection, XSS), rate-limiting abusive clients, or geo-blocking traffic from specific regions — before the request ever reaches your application.

Q44. Describe the purpose of AWS Shield and its features.

Q45. What is AWS Secrets Manager and how does it help secure sensitive information?

Secrets Manager stores credentials, API keys, and other secrets encrypted at rest, with fine-grained IAM access control, and can automatically rotate database credentials on a schedule — replacing the anti-pattern of secrets hardcoded in source code or config files with something both auditable and rotatable.

Q46. Explain the concept of AWS Compliance Programs.

AWS maintains third-party audited compliance certifications (SOC 1/2/3, PCI DSS, HIPAA eligibility, ISO 27001, FedRAMP, and many more) covering its own infrastructure — under the Shared Responsibility Model, this covers "security of the cloud," but you're still responsible for configuring your own workload to actually meet whichever compliance regime applies to it.

Q47. What is AWS Config and how does it help with compliance and governance?

Config continuously records the configuration state of your AWS resources and evaluates them against rules you define (e.g. "every S3 bucket must have encryption enabled") — flagging non-compliant resources and, for many rules, showing you exactly when and how a resource's configuration drifted.

Q48. Describe the role of AWS GuardDuty in security monitoring.

GuardDuty is a managed threat-detection service that continuously analyzes account activity, network logs, and DNS logs using machine learning and threat intelligence — surfacing things like compromised credentials making unusual API calls, or an EC2 instance communicating with a known malicious IP, without you managing any detection infrastructure yourself.

Q49. What is AWS Security Hub and its key features?

Security Hub aggregates findings from GuardDuty, Config, Inspector, and other security tools into one dashboard, scored against security standards (CIS AWS Foundations, PCI DSS) — the single-pane-of-glass view instead of checking half a dozen separate security services individually.

Q50. Explain the concept of AWS Artifact and its purpose.

Artifact is a self-service portal for downloading AWS's compliance reports and agreements (SOC reports, PCI attestations) — useful for your own compliance/audit team to prove AWS's side of the shared-responsibility bargain, without having to request documents through support.

Monitoring and Management

Q51. What is Amazon CloudWatch and its key components?

Q52. Explain the difference between Amazon CloudWatch and AWS CloudTrail.

Q53. What is AWS Systems Manager and its use cases?

Systems Manager is an operations hub for managing fleets of EC2 (and on-prem) instances — running commands across many instances at once, patching at scale, storing configuration in Parameter Store, and session-based shell access without opening SSH ports at all.

Q54. Describe the concept of Amazon EventBridge (formerly CloudWatch Events).

EventBridge is a serverless event bus — services (and your own applications) publish events, and rules route matching events to targets (Lambda, SQS, Step Functions) — the backbone of event-driven architectures where services react to what happened elsewhere in the system instead of polling for changes.

Q55. What is AWS OpsWorks and how does it help with infrastructure management?

OpsWorks provides managed Chef and Puppet configuration-management platforms on AWS — useful if your team already has Chef/Puppet cookbooks and wants that same automation model on AWS infrastructure, rather than rewriting configuration as CloudFormation/Terraform.

Q56. Explain the purpose of AWS Config Rules.

Config Rules are the actual compliance checks AWS Config evaluates against — either AWS-managed rules ("S3 buckets must not be public") or custom rules backed by a Lambda function, giving you continuous, automatic compliance checking instead of periodic manual audits.

Q57. What is AWS CloudFormation and its benefits?

Resources:
  MyBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: my-app-assets
  MyInstance:
    Type: AWS::EC2::Instance
    Properties:
      InstanceType: t3.micro
      ImageId: ami-0abcdef1234567890

CloudFormation is AWS's native Infrastructure-as-Code service — describe your entire stack in a JSON/YAML template, and it creates, updates, or tears down every resource in the right dependency order. The benefit over clicking through the console: repeatable, version-controlled, reviewable infrastructure changes.

Q58. Describe the concept of AWS Service Catalog.

Service Catalog lets a platform/central team publish a curated set of pre-approved CloudFormation templates ("products") that other teams can self-service deploy — giving developers autonomy to spin up their own infrastructure while still enforcing organizational standards (tagging, security baseline, allowed instance types) on what they're allowed to launch.

Q59. What is AWS Trusted Advisor and how does it help optimize AWS usage?

Trusted Advisor inspects your account and surfaces recommendations across cost optimization, performance, security, fault tolerance, and service limits — things like idle load balancers costing money for nothing, S3 buckets with public access, or an EC2 instance underutilized enough to downsize.

Q60. Explain the role of AWS Personal Health Dashboard.

It's a personalized view of AWS service health specifically scoped to the resources you actually use — unlike the public AWS Service Health Dashboard (which shows region-wide outages generally), this surfaces events that concretely affect your account, so you're not manually cross-referencing a general status page against your own infrastructure.

Application Integration and Serverless

Q61. What is Amazon Simple Queue Service (SQS) and its use cases?

SQS is a fully managed message queue — producers push messages, consumers pull and process them, decoupling the two so a slow or temporarily-down consumer doesn't block the producer. Classic uses: buffering work for background processing, smoothing out traffic spikes, and decoupling microservices from each other.

Q62. Explain the difference between Amazon SQS and Amazon Simple Notification Service (SNS).

Q63. What is AWS Lambda and its key features?

def handler(event, context):
    name = event.get("queryStringParameters", {}).get("name", "world")
    return {
        "statusCode": 200,
        "body": f"Hello, {name}!"
    }

Lambda runs your code in response to events (an HTTP request, a new S3 object, a queue message) without provisioning or managing any server — it scales automatically per-request and bills per invocation and execution time down to the millisecond, with nothing to pay when it's idle.

Q64. Describe the concept of Amazon API Gateway and its benefits.

Covered above under Networking — worth repeating here in the serverless context specifically: it's what turns a bare Lambda function into a real, authenticated, throttled, publicly-callable HTTP API, without writing that plumbing into the function itself.

Q65. What is Amazon DynamoDB Streams and how does it work?

DynamoDB Streams captures a time-ordered log of every item-level change (insert/update/delete) in a table, which a Lambda function (or other consumer) can subscribe to — enabling reactive patterns like updating a search index, sending a notification, or replicating data elsewhere the instant the source table changes.

Q66. Explain the purpose of AWS Step Functions.

Step Functions orchestrates multi-step workflows (often chains of Lambda functions, but also other AWS services directly) as a visual state machine — handling retries, error branches, parallel steps, and human-approval waits declaratively, instead of hand-rolling that orchestration logic and its failure handling inside application code.

Q67. What is Amazon Kinesis and its use cases?

Kinesis ingests and processes real-time streaming data at scale — clickstreams, IoT telemetry, application logs — for use cases like real-time analytics dashboards, anomaly detection, or feeding a data lake continuously rather than in periodic batches.

Q68. Describe the concept of AWS AppSync and its benefits.

AppSync is a managed GraphQL service — define a schema, wire resolvers to data sources (DynamoDB, Lambda, RDS), and get a GraphQL API with built-in real-time subscriptions and offline data sync for mobile clients, without running your own GraphQL server.

Q69. What is Amazon EventBridge (formerly CloudWatch Events) and its role in serverless architectures?

In a serverless context specifically, EventBridge is the connective tissue between independently deployed Lambda functions and services — one function publishes "OrderPlaced," and any number of other functions can subscribe to react to it, without the publisher needing to know who's listening.

Q70. Explain the concept of AWS Serverless Application Model (SAM).

SAM is a CloudFormation extension with a shorthand syntax purpose-built for serverless resources (functions, APIs, tables) — a few lines of SAM expand into the much more verbose raw CloudFormation underneath, plus a CLI (sam local) for testing Lambda functions locally before deploying.

Data Analytics and Machine Learning

Q71. What is Amazon Elastic MapReduce (EMR) and its key features?

EMR is a managed big-data platform running Hadoop, Spark, Hive, and other frameworks on a cluster of EC2 instances that scale up/down as needed — for large-scale data processing and transformation jobs too big for a single machine.

Q72. Explain the difference between Amazon Redshift and Amazon Athena.

Q73. What is Amazon Kinesis Data Streams and its use cases?

The core Kinesis service specifically for capturing and storing real-time data streams for a configurable retention window, letting multiple consumer applications process the same stream independently and at their own pace — the foundation the other Kinesis services (Firehose, Analytics) build on.

Q74. Describe the concept of Amazon Glue and its benefits.

Glue is a managed ETL service — it can crawl data sources to automatically infer schema, then run serverless Spark jobs to clean/transform/move data between S3, Redshift, RDS, and other stores, without provisioning or managing the underlying Spark cluster yourself.

Q75. What is Amazon SageMaker and how does it help with machine learning?

SageMaker is an end-to-end managed ML platform — notebook environments for experimentation, managed training on scalable compute (including spot instances for cost savings), and managed hosting for deployed model endpoints, covering the whole ML lifecycle without stitching together separate infrastructure for each stage.

Q76. Explain the purpose of Amazon QuickSight.

QuickSight is AWS's managed BI/dashboarding service — connect it to Redshift, RDS, S3, or other sources and build interactive visualizations and dashboards for business users, without standing up a self-hosted BI tool.

Q77. What is AWS Data Pipeline and its role in data processing?

Data Pipeline orchestrates scheduled data movement and transformation jobs between AWS services (and on-premises data sources) — an older service that's been largely superseded by Glue and Step Functions for new projects, but still found in existing pipelines built before those matured.

Q78. Describe the concept of Amazon Rekognition and its use cases.

Rekognition is a managed computer vision API — image/video analysis for object detection, facial analysis, text extraction (OCR), and content moderation, callable directly without training or hosting your own vision model.

Q79. What is Amazon Comprehend and how does it help with natural language processing?

Comprehend extracts insight from unstructured text — sentiment, key phrases, entities, language detection — as a managed API call, useful for analyzing customer feedback, support tickets, or documents at scale without building/training an NLP model in-house.

Q80. Explain the concept of Amazon Forecast and its benefits.

Forecast uses machine learning to generate time-series predictions (demand, inventory, resource needs) from historical data, using the same forecasting technology behind Amazon's own retail demand planning — without requiring in-house ML/forecasting expertise to get a reasonably accurate model.

Deployment and DevOps

Q81. What is AWS CodePipeline and its key features?

CodePipeline orchestrates the stages of a CI/CD workflow — source, build, test, deploy — triggering automatically on a code change and coordinating the other CodeSuite services (or third-party tools) that each stage delegates to.

Q82. Explain the difference between AWS CodeCommit and AWS CodeDeploy.

Q83. What is AWS CodeBuild and how does it work?

version: 0.2
phases:
  install:
    commands:
      - npm install
  build:
    commands:
      - npm test
      - npm run build
artifacts:
  files:
    - '**/*'
  base-directory: dist

CodeBuild is a fully managed build service — it spins up a container per build, runs the commands defined in a buildspec.yml (as above), and produces artifacts, scaling automatically so you're never queued behind someone else's build on shared CI infrastructure.

Q84. Describe the concept of AWS CodeStar and its benefits.

CodeStar bundled a project template, a pre-wired CI/CD pipeline, and an issue tracker into one quick-start experience — since deprecated (no longer available to new customers) in favor of directly using CodePipeline/CodeBuild/CodeCommit or a Well-Architected reference template, but worth knowing by name for older environments still using it.

Q85. What is AWS X-Ray and its role in application debugging?

X-Ray traces a request as it travels across multiple services (API Gateway → Lambda → DynamoDB → an external API call), visualizing the whole call graph with per-segment timing — exactly the tool for finding which specific hop in a distributed request is actually slow, when "the API is slow" could mean any of five different services.

Q86. Explain the purpose of AWS CloudFormation Nested Stacks.

Nested stacks let one CloudFormation template reference and compose other templates as reusable modules (a "networking" stack, a "database" stack) — the CloudFormation equivalent of breaking a monolithic script into importable functions, so common infrastructure patterns aren't copy-pasted across every project.

Q87. What is AWS OpsWorks for Chef Automate and its use cases?

It's the specific OpsWorks flavor providing a fully managed Chef Automate server — for teams already standardized on Chef for configuration management who want AWS to host and patch the Chef server itself rather than self-managing it.

Q88. Describe the concept of AWS Systems Manager Parameter Store.

Parameter Store holds configuration data and secrets as hierarchical key-value pairs, with optional KMS encryption for sensitive values — a lighter-weight alternative to Secrets Manager (no automatic rotation, but free for standard parameters) commonly used for app config and non-rotating secrets.

Q89. What is AWS CloudFormation Drift Detection and its benefits?

Drift detection compares a stack's actual current resource configuration against what the template says it should be — catching cases where someone manually changed a resource through the console after it was deployed, which is exactly the kind of undocumented change that makes infrastructure unpredictable over time.

Q90. Explain the concept of AWS CodePipeline Approval Actions.

An approval action pauses the pipeline at a defined stage until a designated person manually approves (or rejects) continuing — the standard way to insert a human gate before a production deployment, without giving up the rest of the pipeline's automation.

Advanced Topics and Best Practices

Q91. What is AWS Well-Architected Framework and its pillars?

It's AWS's own framework for evaluating architecture decisions across six pillars — used both as a design checklist and, formally, as a structured review process (the "Well-Architected Review") teams run against real workloads to find and prioritize architectural risk.

Q92. Explain the concept of AWS Serverless Application Repository.

It's a managed catalog of pre-built, shareable serverless applications (defined as SAM templates) — deploy a ready-made application or component into your own account with a few clicks instead of building common serverless patterns from scratch.

Q93. What is AWS Outposts and its use cases?

Outposts brings actual AWS hardware into your own data center, running the same APIs and services as the cloud — for workloads with low-latency on-premises requirements, local data processing needs, or regulatory data-residency constraints that rule out the public cloud but still want a consistent AWS operating model.

Q94. Describe the concept of AWS Wavelength and its benefits.

Wavelength embeds AWS compute/storage directly inside telecom providers' 5G networks, at the edge closest to mobile devices — for ultra-low-latency use cases (AR/VR, real-time gaming, connected vehicles) where even a normal AWS region's latency is too much.

Q95. What is AWS Local Zones and when would you use them?

Local Zones are smaller AWS infrastructure deployments in specific metro areas, closer to end users than a full Region — useful for latency-sensitive applications serving a concentrated population in a city that doesn't have its own full AWS Region.

Q96. Explain the purpose of AWS CloudFormation Custom Resources.

A custom resource lets a CloudFormation template manage something that isn't a native AWS resource type at all — backed by a Lambda function that CloudFormation calls on create/update/delete — for provisioning third-party services, running one-off setup logic, or wrapping a not-yet-supported AWS API into the same declarative stack.

Q97. What is AWS Elastic Beanstalk Blue/Green Deployments and its benefits?

Blue/green deployment stands up an entirely new environment ("green") alongside the live one ("blue"), tests it, then swaps traffic over via a DNS/URL swap — giving an instant, low-risk rollback (just swap back) compared to updating instances in place, at the cost of briefly running two full environments simultaneously.

Q98. Describe the concept of AWS Global Accelerator.

Global Accelerator gives your application static "anycast" IP addresses and routes user traffic onto AWS's private global network backbone as early as possible (at the nearest edge location), rather than over the public internet the whole way — reducing latency and jitter for global user bases, and providing fast regional failover.

Q99. What is AWS Control Tower and its role in multi-account management?

Control Tower automates setting up a secure, well-structured multi-account AWS environment (a "landing zone") — baseline guardrails, account provisioning through Account Factory, and centralized logging/auditing across every account — the standard starting point for organizations managing dozens of AWS accounts rather than one.

Q100. Explain the concept of AWS Savings Plans and its benefits.

Savings Plans give a discount (similar to Reserved Instances) in exchange for committing to a consistent amount of compute spend ($/hour) for 1 or 3 years — more flexible than Reserved Instances since the commitment applies across instance families, sizes, and even compute services (EC2, Fargate, Lambda), rather than being locked to one specific instance type.

Test yourself

A quick mock test covering the ground above — the rapid-fire round that often opens an AWS interview before the deeper architecture discussion.