1. What is the difference between an AWS Availability Zone and a Region, and why would you deploy across multiple AZs?

An Availability Zone is a physically isolated data center within a Region, while a Region is a geographic area containing multiple AZs; deploying across multiple AZs provides high availability and fault tolerance, such as running an RDS Multi-AZ database that automatically fails over if one AZ goes down.

2. Explain the difference between vertical and horizontal scaling, and provide an example of each in AWS.

Vertical scaling means increasing the power of an existing instance (like upgrading from t3.medium to t3.large), while horizontal scaling means adding more instances; an example of horizontal scaling is using an Auto Scaling Group to add more EC2 instances behind a load balancer during traffic spikes.

3. What is CloudWatch and what are some key metrics you would monitor for an EC2 instance?

CloudWatch is AWS's monitoring and logging service that collects and visualizes metrics; for an EC2 instance, you would monitor CPU utilization, network input/output, disk read/write operations, and status checks to detect performance degradation or failures.

4. You notice your application's latency has increased in the past hour. Walk me through how you would troubleshoot this using AWS tools.

I would start by checking CloudWatch dashboards to see if CPU, memory, or network metrics have spiked on my EC2 instances or RDS database, then review Application Load Balancer access logs to identify slow requests, and finally check CloudTrail for recent infrastructure changes; for example, if RDS CPU is high, I might query the Performance Insights dashboard to find the slow query.

5. What is an Auto Scaling Group, and how would you configure it to scale based on CPU utilization?

An Auto Scaling Group automatically adjusts the number of EC2 instances based on demand to maintain performance and cost efficiency; you configure it with a target tracking scaling policy that maintains CPU utilization at a desired level, such as 70%, by adding instances when CPU exceeds the threshold and removing them when it drops.

6. Describe the difference between Security Groups and Network ACLs. When would you use each one?

Security Groups act as instance-level stateful firewalls that allow inbound and outbound traffic, while Network ACLs are subnet-level stateless firewalls that process rules in order; use Security Groups for most cases to control traffic to individual instances, and use Network ACLs when you need subnet-wide restrictions or explicit deny rules.

7. What is an AWS Systems Manager Session Manager, and how might you use it instead of SSH?

Session Manager is an AWS service that lets you start interactive shell sessions on EC2 instances without managing SSH keys or bastion hosts, using IAM permissions for access control; this is more secure because there are no open SSH ports and all session activity is logged in CloudTrail.

8. Your team uses AWS Lambda for a critical microservice. A sudden traffic spike causes Lambda invocations to fail. What could be the issue and how would you diagnose it?

The issue could be hitting Lambda concurrency limits, timeout issues, or insufficient memory; you would check CloudWatch Logs for timeout or out-of-memory errors, review the Lambda throttling metric in CloudWatch, and confirm the concurrent execution limit in Lambda settings, then increase the reserved concurrency if needed.

9. You need to store sensitive database passwords for your applications running on EC2. Which AWS service would you use and why?

You should use AWS Secrets Manager to securely store and rotate database credentials, as it integrates with IAM for access control, automatically rotates secrets with Lambda functions, and encrypts secrets at rest using KMS; this is better than storing passwords in environment variables or configuration files.

10. Design a highly available web application on AWS for a junior SRE. What components would you use and why?

I would use an Application Load Balancer across multiple AZs to distribute traffic, Auto Scaling Groups with EC2 instances for compute, RDS Multi-AZ for the database, CloudFront for caching static content, and Route 53 for DNS with health checks; this design ensures no single point of failure and handles traffic spikes automatically.

11. Explain Infrastructure as Code and how you would use CloudFormation or Terraform to manage your AWS infrastructure.

Infrastructure as Code means defining infrastructure in code rather than manual console clicks, enabling version control, reproducibility, and automation; with CloudFormation you write YAML or JSON templates to define all resources, while Terraform is provider-agnostic and uses HCL syntax, allowing you to commit changes to git, review them, and apply them consistently across environments.

12. Your team wants to implement CI/CD on AWS. What services would you recommend and how would they work together?

I would use AWS CodePipeline to orchestrate the workflow, CodeBuild to compile and test code, CodeDeploy to deploy to EC2 instances or on-premises servers, and store code in CodeCommit; for example, a developer commits code to CodeCommit, CodePipeline automatically triggers CodeBuild to run tests, and if tests pass, CodeDeploy deploys the application to production servers.