These 64 AWS and DevOps questions answer common beginner questions about AWS, Linux, Containers and Delivery. Use the topic links to find a short explanation, then try the practice exercise to apply it.
Explore the ScholarLogic AWS and DevOps course in Bengaluru, based in BTM Layout, or try the beginner practice exercise.
AWS services and access
What is an AWS account boundary useful for?
It separates resources, billing visibility and access administration. Use explicit cross-account permissions when workloads need to interact.
Why enable multifactor authentication for privileged AWS access?
It adds a second check against credential theft. Prefer centrally managed and temporary access for daily work.
What are temporary AWS credentials?
They expire and include a session token. Roles can issue them without distributing long-lived keys to workloads.
What is an IAM policy statement?
It specifies effects, actions, resources and optional conditions. Check all applicable policies when access differs from expectations.
What does explicit deny mean in IAM?
An applicable explicit deny overrides an allow. Find the denying policy before adding permissions.
What is an IAM role trust policy?
It specifies which principals can assume the role and under which conditions.
How does an EC2 instance get role credentials?
An attached instance profile makes temporary role credentials available to the instance. SDKs can retrieve them through the supported chain.
What is AWS CloudTrail useful for?
It records supported account and API activity for auditing. Configure the event types, destinations and retention you need.
What is an S3 object key?
It is the object’s name within a bucket. Slash-separated prefixes look like folders but are part of the key.
When is S3 versioning useful?
It retains versions to recover from overwrites and some deletions. Plan lifecycle rules and storage costs.
How does an S3 presigned URL work?
It grants time-limited access for a specific signed action using the signer’s permissions. Treat it as sensitive while valid.
What does S3 Block Public Access control?
It blocks applicable public access configurations at supported scopes. Keep it on unless a reviewed design needs public access.
What is an AWS KMS key used for?
It controls cryptographic operations such as protecting data keys. Policies determine who can use and administer it.
What is an RDS snapshot?
It is a backup of a database instance or cluster, depending on the service. Restore to a separate database to validate recovery.
What is AWS Lambda useful for?
It runs code in response to supported events or requests without managing servers. Design for retries and time limits.
How can AWS learners track lab spending?
Set a budget alert and inspect costs and resources after the lab. Alerts do not automatically stop all charges.
Networking and Linux
What is a network ACL in an AWS VPC?
It filters subnet traffic with ordered rules and is stateless. Configure return traffic explicitly.
What does stateful filtering mean for an AWS security group?
Response traffic for allowed connections is automatically permitted by the security group, subject to the rest of the network path.
What does a NAT gateway do for a private subnet?
It can provide outbound internet connectivity when correctly routed. It does not accept unsolicited inbound internet connections.
When is a VPC endpoint useful?
It gives supported services a private access path without requiring public internet routing. Check policy and endpoint charges.
What does DNS do in a deployment?
It resolves names to records such as IP addresses. Check both the record and the resolver when troubleshooting.
What is DNS TTL?
It is how long a resolver may cache a DNS answer. Existing caches may retain the previous value until it expires.
How do I tell a timeout from connection refused?
A timeout often means no answer arrived. A refusal means a reachable endpoint actively rejected the connection, often because nothing is listening.
What is a port in networking?
It identifies a transport endpoint, such as TCP port 443 for HTTPS. Check protocol as well as port number.
Why bind a local development server to loopback?
It limits direct access to the same machine. Expose it only when a deliberate test requires remote access.
How can I check which port a Linux process listens on?
Use a tool such as ss and check the protocol, address and port. You may need permission to see process details.
What does systemctl status show?
It reports a systemd unit’s state and can show recent logs. Check the unit name and exact failure.
What is journalctl useful for?
It reads logs collected by systemd-journald. Filter by service and time to narrow a diagnosis.
How do Linux file owners and groups affect access?
Permission bits apply to owner, group and others, subject to other controls. Check both the file and parent directories.
What does a shell exit code tell CI?
It tells the caller whether the command reported success or failure. Preserve failures when chaining commands.
Why avoid running every service as root?
A restricted service account limits the damage a bug or compromise can cause.
How do I investigate a full Linux disk?
Check filesystem capacity and inode usage, locate large directories, and confirm what can safely be removed.
Containers and orchestration
What is a container registry?
It stores container images for builds and deployments to push and pull with appropriate permissions.
What is a container image digest?
It is a content identifier that pins a specific image or manifest. A tag can later point elsewhere.
How does a multistage Docker build help?
It copies only required artifacts into the final stage, keeping unnecessary build tools out of the runtime image.
What does .dockerignore do?
It excludes specified files from the build context. Keep secrets out of the build context entirely.
How do Docker port mappings work?
They forward a host port to a container port. Choose the host bind address and check the container application listens as expected.
What does Docker Compose help with?
It defines a related set of local services, networks and volumes for repeatable development or testing.
Why use a non-root user in a container?
It limits privileges inside the container and can reduce the impact of a compromised process.
Why should a container handle a termination signal?
It lets the application stop accepting work, finish in-flight work where possible and shut down within a grace period.
What is a Kubernetes namespace?
It groups many types of resources and supports names, permissions and policies by scope. It is not a complete security boundary alone.
What is a Kubernetes ConfigMap?
It stores non-secret configuration used by workloads. Plan how applications receive updates.
Why is a Kubernetes Secret not automatically safe because it is encoded?
Base64 is reversible. Control access, avoid logging values and use supported encryption or external secret handling.
What are Kubernetes resource requests and limits?
Requests guide scheduling. Limits constrain usage where supported, such as CPU throttling or memory termination.
What is a Kubernetes startup probe?
It gives slow-starting containers time to initialize before liveness and readiness probes take effect.
What is a Kubernetes Ingress used for?
It defines HTTP or HTTPS routing to services and needs a controller that implements the rules.
How do I investigate a Kubernetes Pod stuck Pending?
Check events and scheduling conditions, including available resources, selectors and volume requirements.
How do I troubleshoot a Kubernetes image pull failure?
Check the image name, tag or digest, registry access, credentials and network connectivity.
CI and operations
What is a build artifact?
It is a versioned output such as a package or image that can be deployed and traced to a build.
Why promote the same artifact through environments?
It reduces differences between the tested and deployed binary. Supply environment-specific configuration separately.
What is a canary deployment?
It sends a small share of traffic to a new version first. Use measured criteria to expand or roll back.
What is a blue-green deployment?
It switches traffic between two environments running different versions. Plan database compatibility and rollback.
How do I verify a deployment after release?
Check a small set of real service paths, health and error metrics, then compare them with a baseline.
What is an SLI?
It is a measured service indicator, such as the proportion of successful requests.
What is an SLO?
It is a target for a service indicator over a stated window, such as 99.9% successful requests over 30 days.
What is an alert runbook?
It documents what an alert means, checks to run, escalation steps and safe mitigation options.
Why distinguish logs, metrics and traces?
Logs describe events, metrics summarize numerical trends, and traces follow requests across components.
When is a CI cache useful?
It speeds up repeat work such as dependency downloads. Key it by inputs that determine whether the cache is valid.
Why should deployment credentials be short-lived?
They reduce exposure if compromised. Give jobs only the permissions they need.
What is a Terraform plan useful for?
It previews proposed infrastructure changes. Review replacements, deletions and sensitive output before applying.
Why protect Terraform state?
It can contain sensitive values and tracks resources. Use restricted storage and coordination for shared changes.
What is configuration drift?
It is a difference between intended and actual configuration. Compare planned and observed resources before reconciling.
How do I test a backup before trusting it?
Restore it in a separate environment and validate application data and the recovery time.
What should a beginner AWS lab handover include?
Record the architecture, access decisions, verification output, cleanup steps and any resources that can still incur costs.
For further reading, see the official reference and compare ScholarLogic’s six courses.
