9 Amazon Cloud Engineer Interview Questions & Answers

At a high level, OSPF helps routers choose the best IP path inside one autonomous system. The main challenge is keeping routers aware of link costs and topology changes. I would explain it in three parts: routers exchange Link-State Advertisements, build a Link-State Database, and run Dijkstra’s SPF algorithm. SPF chooses the lowest-cost path and installs it in the routing table. OSPF converges quickly, while larger networks can use hierarchical areas to limit routing work.

OSPF helps routers decide how to reach IP networks inside one autonomous system. The difficult part is that several paths may reach the same destination, and every path can have a different cost. Links can also change or fail. Routers therefore need a shared view of the relevant network topology before choosing routes. The diagram explains the process in three main steps. Routers exchange link-state information, build a topology map, and then calculate the lowest-cost paths that are placed into their routing tables.

1. Are we discussing OSPF only inside one autonomous system?
2. Should I explain how OSPF chooses paths using link costs?
3. Should I also explain how OSPF areas help larger networks scale?

I would start by saying that routers need a reliable way to choose the best IP paths inside one autonomous system. More than one route may reach the same network. A link can also fail or change.

OSPF solves this by discovering neighbors, learning the topology, calculating lowest-cost paths, and reacting when the topology changes. The diagram uses four routers named R1, R2, R3, and R4. Their links have different OSPF costs, and lower total cost is preferred.

Next, I would explain that OSPF is a link-state routing protocol. Routers flood Link-State Advertisements, called LSAs, so other routers can learn about the topology.

The diagram shows LSAs describing router IDs, links, connected networks, neighbors, prefixes, and costs. It also shows sequence, age, and checksum information. Sequence numbers help identify newer information. Age helps remove stale information, while the checksum helps detect corrupted LSA contents.

Each router stores the LSAs in a Link-State Database, called the LSDB. In the single-area example shown, routers build the same topology view from those LSAs. In a larger multi-area OSPF design, the detailed LSDB is maintained per area.

The LSDB gives each router the information needed to calculate paths locally. It is the input to the SPF calculation shown in the diagram.

Each router runs Dijkstra’s Shortest Path First algorithm, usually called SPF. SPF builds a shortest-path tree from that router’s point of view. It adds the OSPF costs along each possible route and chooses the path with the lowest total cost.

From R1, the network behind R4 is reached through R1–R2–R4 with total cost 20. The alternative R1–R3–R4 costs 25. For the network behind R3, the direct R1–R3 path costs 20, while R1–R2–R3 costs 40.

After SPF finishes, OSPF places the selected next hop and total cost into the routing table. IP packets can then be forwarded using that route.

The diagram also shows that OSPF converges quickly, supports VLSM and CIDR, and can scale with hierarchical areas. SPF produces loop-free shortest paths from the topology view. OSPF is an intra-domain protocol, meaning it operates inside an autonomous system. The diagram shows BGP for routing between autonomous systems.

The benefit is that routers can calculate good paths from shared link-state information. OSPF also reacts quickly when the topology changes and supports VLSM and CIDR. The downside is that routers must store LSAs and run SPF calculations after important topology changes. As a network grows, that work can also grow. Hierarchical areas help by limiting how much detailed routing information must be handled together. This makes OSPF easier to scale. SPF gives routers loop-free shortest paths from their topology view. OSPF is designed for routing inside one autonomous system, while the diagram uses BGP for routing between autonomous systems.

At a high level, I would trace the SSH connection from the customer to the EC2 instance, then trace the response back. The main challenge is finding where TCP port 22 stops. I would check the public DNS or Elastic IP, the Internet Gateway and subnet route table, then the Security Group and Network ACL. After that, I would verify the ENI, instance health, SSH service, host firewall, and return path. The downside is that several independent settings can cause the same timeout.

The goal is to find why a customer cannot open an SSH session to an EC2 instance that should be reachable from the internet. The difficult part is that several different settings can stop the same connection. A wrong public address, missing route, blocked security rule, stopped instance, or stopped SSH service can all look similar to the customer. I would troubleshoot in the same order shown in the diagram. Then I would check the response path back to the customer.

1. Is the customer using the instance public DNS name, public IPv4 address, or Elastic IP?
2. Does the SSH attempt time out, or does it reach the server and reject the login?
3. Did SSH work before, or has this instance never been reachable?

I would start by confirming that the customer is connecting to the correct public endpoint. I would verify the public DNS name, public IPv4 address, or Elastic IP shown for the instance. If DNS is used, it should resolve to the expected public IP. Commands such as nslookup or dig can confirm this. A wrong or old address means the connection is going to the wrong place.

Next, I would verify the path from the internet into the VPC. The public subnet's route table needs a default route such as 0.0.0.0/0 pointing to the Internet Gateway. The Internet Gateway must also be attached to the VPC. If either part is missing, the instance cannot use the direct internet path shown in the diagram.

Then I would check the two network security layers separately. The Security Group must allow inbound TCP port 22 from the customer's public IP or CIDR range. A Security Group is stateful. This means a response to an allowed SSH connection does not need a separate Security Group return rule.

The Network ACL is stateless, so both directions matter. Its inbound rules must allow TCP port 22 from the client source. Its outbound rules must allow the SSH response to the client's ephemeral TCP port. I would also check the Network ACL rule order because an earlier matching deny can block the traffic.

After the network settings look correct, I would verify the EC2 Network Interface, or ENI. The instance should have the expected public IPv4 or Elastic IP association, and the ENI should belong to the expected instance and public subnet.

The EC2 instance must be running and passing its status checks. Inside the instance, sshd must be installed, running, and listening on TCP port 22. The local host firewall must also allow port 22. If the network connection succeeds but login fails, I would check the SSH username, private key, and key-file permissions.

Finally, I would trace the SSH response back toward the client. The subnet still needs its route to the Internet Gateway. The Network ACL outbound rules must allow traffic to the client's ephemeral destination port. The Security Group does not need a separate response rule because it is stateful.

From the client, I can use nc -vz <public-ip> 22 to test TCP port 22 and ssh -vvv to see more detail about where SSH fails. If the cause is still unclear, I would review VPC Flow Logs for traffic to the ENI and check operating-system SSH logs such as /var/log/auth.log, /var/log/secure, or the relevant journal entries. If AWS Systems Manager Session Manager is already configured, it can provide an alternative way to access the instance.

The benefit is that this method follows the connection step by step, so each check removes one possible cause. It also separates network problems from SSH or key problems. The downside is that several independent settings must agree. A correct Security Group cannot help if the Internet Gateway route is missing. A correct route cannot help if the Network ACL blocks the traffic. Network ACLs also need more care because they are stateless and must allow the required traffic in both directions. This ordered approach reduces guessing and makes the failure easier to isolate.

Swap is disk space Linux can use for memory pages moved out of physical RAM. Some swap use can be normal. I would check available memory and vmstat si/so: falling memory with active swapping shows pressure, while sustained high swap I/O with slow applications can show performance degradation.

A computer has a limited amount of fast working space for programs that are running. When that space becomes tight, the system can place less-used information in a slower storage area and bring it back when needed. This can help the computer keep working, but using the slower area too often can make programs respond slowly. The important point is that seeing some information there is not automatically bad. You look at how much fast space is still available, whether information is moving frequently, and whether users notice slower performance.

1. Do you want only the Linux swap concept, or should I also explain how I would diagnose memory pressure on a cloud server?
2. Should I focus on host-level Linux observations such as free and vmstat?

Swap is disk space that Linux can use to hold memory pages moved out of physical RAM. RAM is fast but limited. Swap is slower because it uses storage. Under memory pressure, Linux may move less-active pages from RAM to swap, and pages can be brought back into RAM when needed.

The key troubleshooting point is that swap occupancy alone does not prove a problem. Some pages may remain in swap while the server still has healthy available memory and almost no active swapping. A normal state therefore looks like healthy available memory, a responsive system, and vmstat si/so values staying near zero. Here, si means pages being read from swap into memory, and so means pages being written from memory to swap.

Memory pressure becomes more likely when available RAM falls, swap used may increase, and vmstat si and/or so become active. These signals should be considered together. A single value by itself is not enough to prove the cause.

Performance degradation is more concerning when swap activity is sustained. Frequent swap I/O makes the system wait on slower storage. Evidence can include sustained high vmstat si/so, high disk I/O or I/O wait, and slow or unresponsive applications. Load average can provide supporting context, but it does not by itself prove that swap caused the slowdown.

Useful commands include free -h to inspect physical memory and swap usage, vmstat 1 5 to observe swap-in and swap-out activity, swapon --show to list active swap devices, and cat /proc/sys/vm/swappiness when examining swap tuning. Swap size depends on the workload, so I would monitor available memory, swap use, and si/so rather than assume one fixed swap size is correct.

The main tradeoff is resilience versus speed. Swap can reduce or delay out-of-memory pressure, but it is much slower than RAM and does not replace adequate physical memory. If sustained swapping is hurting application performance, I would confirm the evidence first and then investigate memory demand, workload behavior, or whether the server needs more RAM.

1. Check physical memory and swap with free -h, paying attention to available memory rather than only the free column.
2. Check vmstat 1 5 and inspect si and so for active swap-in and swap-out activity.
3. If available memory is healthy and si/so stay near zero, treat stable swap occupancy as potentially normal.
4. If available memory is falling and si/so become active, identify memory pressure.
5. If si/so remain high, correlate them with disk I/O or I/O wait and application latency or responsiveness.
6. Check active swap devices with swapon --show and review swappiness only when tuning behavior is relevant.
7. Correct the underlying memory or workload problem rather than assuming that clearing swap alone is the fix.

Swap has an operational cost rather than an algorithmic time complexity. RAM access is much faster than storage access, so frequent swapping adds storage I/O and can increase application latency. Monitoring with free and vmstat is lightweight. The maintenance cost comes from watching memory trends, correlating swap activity with storage and application behavior, choosing workload-appropriate swap capacity, and deciding when more RAM or workload changes are needed.

Common mistakes are saying that Linux swaps only after RAM is completely full, assuming any nonzero swap use means the server has a problem, treating nearly full swap as proof of performance degradation, or using load average alone to blame swap. Another mistake is recommending one universal swap size. The better approach is to correlate available memory, swap occupancy, vmstat si/so, disk I/O or I/O wait, and application responsiveness.

Explain three states clearly: normal use, memory pressure, and performance degradation. Emphasize that active swap I/O matters more than swap occupancy alone. Mention free -h and vmstat 1 5, define si/so, and finish by explaining that sustained swapping should be correlated with disk and application performance before deciding on a fix.

I would isolate the affected invocation cohort, correlate CloudWatch metrics, logs, traces, cold starts, concurrency, throttling, retries, and event attributes, and compare slow requests with healthy ones. Then I would locate the slow boundary, test hypotheses, fix only the confirmed bottleneck, and verify before increasing the Lambda timeout.

Some runs finish normally, while a smaller group takes too long and gets stopped. I would not immediately give every run more time, because that could hide the real problem. First, I would find the affected runs and look for what they share, such as when they happened, what started them, and which version handled them. Then I would compare them with successful runs from the same period, find where the extra waiting happens, test each possible reason, correct only the proven problem, and repeat the same checks afterward.

1. Which event sources invoke the Lambda, and is the problem associated with one source or event type?
2. Is the Lambda attached to a VPC?
3. Are traces available for enough affected and healthy invocations to compare their paths?
4. Does the function call databases, APIs, queues, or other downstream services?
5. Did the timeout pattern begin after a deployment, configuration change, or traffic change?
6. What is the configured Lambda timeout, and how close are normal and slow invocation durations to it?

The symptom is an intermittent timeout, so I would first define the affected cohort instead of treating every invocation as identical. I would slice the affected requests by time, event source, request ID, deployed version or alias, and safe event attributes. Then I would compare that cohort with healthy requests from the same period.

This matches the first step in the diagram: understand which requests fail before changing anything. Sensitive payloads, credentials, tokens, and personal information must be redacted rather than copied into diagnostic telemetry.

I would align the same time range across CloudWatch invocation and duration metrics, request logs, and traces. Metrics show when the problem happens and how widespread it is. Logs provide invocation context. Traces show where time is spent across the request path.

I would correlate duration, especially high-percentile or tail duration such as p95 or p99, with invocation volume, ConcurrentExecutions, Throttles, cold-start evidence, retries, and the same affected event cohort. Timeout-marked invocation logs are useful evidence, but a timeout message alone does not prove the root cause.

Telemetry should be correlated with consistent timestamps and request identifiers. Missing telemetry, different clocks between systems, or incomplete trace sampling can make unrelated events appear connected or hide rare failures, so I would account for those limitations before drawing conclusions.

Next I would determine where the extra time is spent. The main boundaries are function work, downstream waits, network calls, retries, concurrency pressure, and infrastructure limits.

If traces show that most of the time is inside the function, I would inspect that code path. If a downstream call dominates the request, I would investigate that dependency's latency and retry behavior. If ConcurrentExecutions or Throttles correlate with the affected cohort, I would investigate concurrency pressure and event-source behavior instead of assuming the function itself is slow.

I would compare slow and healthy requests for cold-start behavior. A cold start can add initialization time, but its presence does not prove that it caused the timeout. The evidence should show that affected invocations consistently have extra initialization delay compared with comparable healthy invocations.

Likewise, I would check whether throttling or concurrency pressure is actually correlated with the failures. I would not automatically increase reserved concurrency or other limits without evidence that the existing limit is part of the problem.

If the Lambda is attached to a VPC, I would test networking as an additional hypothesis. I would check DNS resolution, routing, NAT or VPC endpoint paths where applicable, security controls, connection setup, and downstream reachability.

The existence of a VPC is not proof of a networking problem. I would correlate networking evidence with the affected requests and traces to determine whether the VPC path is actually where time is being lost.

I would compare slow and healthy requests and ask: Is the delay associated with a cold start? Does it happen when throttling occurs? Is it limited to a VPC path? Is one downstream dependency slower? Are retries extending execution time?

Each hypothesis must be supported by evidence. If the comparison disproves one, I would reject it instead of continuing to treat it as the cause.

Once the evidence identifies the bottleneck, I would correct only that boundary. Depending on the confirmed cause, that could mean optimizing function code, adjusting a downstream timeout or retry policy, reusing connections, correcting concurrency configuration, or fixing a VPC path.

I would change the Lambda timeout only if the evidence shows that the workload legitimately needs more execution time after the underlying bottleneck is understood. Increasing the timeout too early can simply make a slow failure take longer.

After the correction, I would rerun representative requests or observe equivalent production traffic using the same cohort dimensions. I would confirm that high-percentile or tail latency is lower and that correlated timeouts or throttles no longer appear at the previous level.

I would also confirm that errors, retries, concurrency behavior, and downstream latency remain healthy. Metrics, logs, and traces should agree; improvement in one signal alone is not enough to prove the complete request path is healthy.

A useful service-level indicator, or SLI, is the percentage of invocations that complete successfully within the expected latency. A service-level objective, or SLO, is the target for that indicator. I would define the service objective before choosing alert thresholds.

Dashboards should show invocation volume, high-percentile duration, failures, ConcurrentExecutions, Throttles, and workload-specific downstream signals that help operators recognize the same symptom. Alerts should be symptom-based and actionable, with ownership, severity, runbook context, and noise controls rather than firing on every isolated spike.

Lambda and application instrumentation create the relevant metrics, logs, and traces. Correlation identifiers and safe resource attributes enrich them. The platform or configured instrumentation transports them to their monitoring and tracing backends, where operators query and retain them for investigation.

Trace sampling reduces ingestion cost but can miss rare slow requests. High-cardinality fields such as request IDs are valuable for per-request correlation but should not be used carelessly as metric dimensions because they can increase cardinality and cost. Retaining more data helps investigate intermittent failures but increases storage expense. Missing data, clock skew, sampling bias, and short retention windows can all weaken an investigation.

The interview takeaway is the same as the diagram: correlate before changing the timeout. Metrics show when the problem happens, logs show invocation context, and traces show where time is spent. I would use those signals to isolate the boundary, test hypotheses, make the smallest safe correction, and verify the affected cohort.

1. Define the intermittent timeout symptom and identify the affected invocation cohort by time, event source, request ID, version, and safe event attributes.
2. Compare the affected cohort with healthy invocations from the same period.
3. Align CloudWatch invocation and duration metrics, request logs, and traces for the same time range and cohort.
4. Correlate cold starts, ConcurrentExecutions, Throttles, retries, and downstream latency with the slow requests.
5. Isolate whether time is spent in function work, downstream waits, network calls, retries, concurrency pressure, or infrastructure limits.
6. If the Lambda uses a VPC, test DNS, routing, NAT or endpoint paths, security controls, connection setup, and downstream reachability.
7. Compare slow and healthy requests to test each hypothesis and reject unsupported explanations.
8. Apply only the smallest correction that addresses the confirmed bottleneck.
9. Re-run or observe the affected cohort and verify lower high-percentile latency with no correlated timeout or throttling regression.
10. Keep cohort-aware dashboards, actionable alerts, and runbook context, and change the Lambda timeout only when evidence shows that it is appropriate.

Common mistakes are increasing the Lambda timeout before finding where the time is spent; looking only at average duration instead of the slow tail; examining metrics, logs, and traces independently rather than correlating the same cohort; assuming a cold start automatically caused the timeout; blaming VPC networking merely because a VPC exists; ignoring retries, concurrency, and throttling; failing to compare slow requests with healthy requests; treating one telemetry signal as proof of the root cause; using request IDs as uncontrolled high-cardinality metric dimensions; logging sensitive data; ignoring missing telemetry, sampling bias, clock skew, or short retention; and declaring success without verifying the same affected cohort.

Present the answer as one evidence-first flow: scope the affected cohort, correlate CloudWatch metrics, logs, and traces, isolate where time is spent, test each hypothesis against healthy requests, apply the smallest confirmed correction, and verify the same cohort. Explicitly say that you would not increase the Lambda timeout until the root cause is understood.

Instance Store is fast, host-local, temporary block storage tied to an EC2 host. EBS is persistent network block storage with an independent volume lifecycle. Use Instance Store for disposable or replicated data and EBS for state that must survive instance stops, replacement, or termination.

Instance Store and EBS both give an EC2 server space to keep data, but they are designed for different kinds of information. One is closely tied to the physical machine running the server, so its contents must be treated as temporary. The other is separate storage that can remain available even when the server using it changes. The practical decision is simple: if losing the only copy of the data would cause a problem, use persistent storage. If the data can be rebuilt or recovered elsewhere and very fast local access is useful, temporary storage can be appropriate.

1. Does the data need to survive an instance stop, replacement, or termination?
2. Can the workload recreate or recover the data automatically if the underlying EC2 host is lost?
3. Is very low-latency local storage more important than independent persistence?
4. Does the storage need snapshots, resizing, backup integration, or later attachment to another supported EC2 instance?

Start with the lifecycle difference. Instance Store is ephemeral block storage provided by disks physically attached to the EC2 host. Its lifecycle is tied to that instance placement and underlying host. EBS, or Elastic Block Store, is persistent network-attached block storage whose volume lifecycle is separate from the EC2 compute instance.

For attachment, Instance Store is available only on EC2 instance types that provide instance-store devices. You cannot detach an Instance Store volume from one EC2 instance and later attach that same storage to another instance. EBS volumes are separate AWS resources. Subject to AWS attachment rules, an EBS volume can be detached from one supported instance and attached to another supported instance in the same Availability Zone. Some EBS volume types and configurations also support specialized attachment patterns such as Multi-Attach, but that is not the normal single-instance case.

For lifecycle and persistence, Instance Store data must be considered temporary. If an instance with Instance Store volumes is stopped, hibernated, or terminated, the data on those instance-store volumes is lost. Data can also be lost if the underlying host fails. Rebooting an instance does not by itself erase Instance Store data, but applications must never depend on Instance Store as the only durable copy because host replacement or other lifecycle events can remove it.

EBS is designed for persistent block storage. Stopping and starting an EC2 instance does not normally delete its EBS volumes. When an instance is terminated, whether a particular EBS volume is automatically deleted depends on that volume attachment's DeleteOnTermination setting. EBS volumes can also be snapshotted to Amazon EBS Snapshots for backup, restore, migration, and recovery workflows.

For durability, do not describe Instance Store as durable persistent storage. Its main advantage is local storage performance, while the application must tolerate losing that local copy. EBS is designed to provide persistent storage independently of a single EC2 host and has durability characteristics appropriate for persistent block storage. However, storage durability is not the same as backup. Important EBS data should still have an appropriate recovery strategy such as EBS snapshots, application-aware backups, replication, or another independent copy.

For performance, Instance Store can provide very high IOPS, high throughput, and low latency because the devices are physically local to the EC2 host. Exact performance depends on the selected EC2 instance type and its local NVMe or other instance-store devices. EBS performance uses the EC2 instance's EBS network path. Different EBS volume types offer different combinations of IOPS, throughput, latency, capacity, and cost, and achievable performance is also limited by the EC2 instance's EBS bandwidth and IOPS capabilities.

The safest workload rule is the most important part. Put only disposable, reproducible, or independently protected state on Instance Store. Good examples include caches, temporary processing files, shuffle data, scratch space, intermediate results, or replicated application data whose authoritative copy exists elsewhere. Do not keep the only copy of important business data on Instance Store.

Use EBS for state that should persist independently of an EC2 instance. Typical examples include EC2 boot volumes, persistent application file systems, self-managed database files when EBS is suitable for that database, and application state that needs snapshots or recovery after an instance is stopped, replaced, or terminated.

A practical summary is: Instance Store gives high-performance local storage but requires the application to tolerate complete loss of that local data. EBS gives persistent network block storage with an independent lifecycle and management features, but it still requires an appropriate backup and recovery plan for important data.

1. Decide whether the data must survive an instance stop, termination, replacement, or host failure.
2. If the only copy must survive, use EBS or another appropriate durable AWS storage service rather than Instance Store.
3. If the data is temporary, reproducible, or safely replicated elsewhere, consider Instance Store.
4. Compare required latency, IOPS, and throughput with the capabilities of the selected EC2 instance and EBS volume type.
5. Determine whether snapshots, backup, resizing, or later volume reattachment are required.
6. Keep authoritative persistent state on durable storage and reserve Instance Store for data the application can safely lose.

There is no algorithmic time or memory complexity to calculate for this storage-selection question. The important costs are operational, performance, recovery, and financial. Instance Store can provide very fast local access, but the application must rebuild or recover lost data when the instance or host disappears. Its capacity is included with EC2 instance types that provide it, although selecting a larger instance mainly for local storage can raise compute cost. EBS is billed separately based on its volume type, capacity, and applicable provisioned performance or snapshot usage. It is easier to manage for persistent state, but performance depends on both the EBS configuration and the EC2 instance's EBS limits.

A common mistake is saying Instance Store data survives an EC2 stop. It does not; stopping or hibernating the instance loses the instance-store data. Another mistake is saying a reboot always deletes Instance Store data; a reboot normally preserves it, although the storage must still be treated as ephemeral because host loss or other lifecycle events can destroy it. Candidates also sometimes say EBS data is always deleted when an instance terminates. The actual behavior depends on the volume attachment's DeleteOnTermination setting. Another mistake is treating EBS durability as a substitute for backups. Persistent storage, replication, and backups solve different failure scenarios. Finally, do not claim Instance Store is always faster for every workload; actual results depend on the EC2 instance type, EBS volume configuration, I/O pattern, and instance bandwidth limits.

Lead with the lifecycle rule: Instance Store is temporary host-local storage, while EBS is persistent network block storage with an independent volume lifecycle. Then compare stop and termination behavior, attachment, durability, and performance. Finish with one decision rule: disposable or reproducible data can use Instance Store; important persistent state belongs on EBS or another durable storage service.