AWS Engineer mock interview questions
19 questions a AWS Engineer panel actually asks, with what each one tests and what a strong answer contains, then practice any of them live. Service-depth and architecture round for AWS engineer interviews.
Answer one real AWS Engineer question now
A question a AWS Engineer panel actually asks, answered out loud, scored on what you said and how you said it. Under two minutes, and nothing to sign up for.
“A Lambda function in a private subnet suddenly cannot reach a third-party API, but it can still read from S3. Walk me through what you check.”
We never store the audio. Your answer is deleted within 24 hours unless you save the result.
- Adaptive follow-ups, not a fixed question list
- Rubric scorecard with evidence from your answers
- Voice or text, with delivery coaching on voice sessions
Thinking past the interview? Carmen can help with your whole AWS Engineer career: a switch, a raise, or what comes next.
19 aws engineer mock interview questions
The questions a AWS Engineer panel actually asks, with what each one is testing and what a strong answer contains. Click any question to run it in a live session: your AI interviewer will cover it and score how you answer.
- 1.
A Lambda function in a private subnet suddenly cannot reach a third-party API, but it can still read from S3. Walk me through what you check.
Why they ask it: A VPC networking scenario that tests whether you know how traffic actually leaves a private subnet, and why S3 can behave differently.
A strong answer: S3 access may be going through a gateway VPC endpoint, which explains why it still works. Internet-bound traffic needs a route from the private subnet to a NAT gateway in a public subnet with an internet gateway. Check the route table, the NAT gateway health and its elastic IP, security group egress, network ACLs in both directions including ephemeral ports, DNS resolution, and whether the third party recently started allowlisting source IPs.
- 2.
Explain how IAM evaluates a request when an identity policy, a resource policy, a permissions boundary and an SCP are all involved.
Why they ask it: IAM evaluation logic is the foundation of AWS security, and most real access bugs come from misunderstanding it.
A strong answer: By default everything is denied. An explicit deny anywhere wins. SCPs and permissions boundaries set a ceiling and do not grant anything themselves. Within an account, an allow in either the identity policy or the resource policy is generally enough. Cross-account access usually needs both sides to allow. Session policies further restrict assumed roles. Mentioning the policy simulator or access analyzer as debugging tools reads well.
- 3.
Design a web application on AWS that must survive the loss of an Availability Zone and handle a traffic spike during a sale.
Why they ask it: The standard AWS design round. Tests service selection, fault isolation and scaling.
A strong answer: An application load balancer across at least two AZs, compute in an auto scaling group or ECS service spread across AZs with scaling policies, a Multi-AZ database such as RDS or Aurora, caching with ElastiCache, static assets on S3 behind CloudFront, queues with SQS to absorb bursts for non-interactive work, and health checks that actually test dependencies. Naming pre-warming or scheduled scaling for a known event is a practical detail.
- 4.
When would you choose Lambda, ECS on Fargate, or EC2 for a new service?
Why they ask it: A tradeoff question on compute. There is no single right answer.
A strong answer: Lambda for event-driven, spiky or low-volume workloads that fit within its execution time and memory limits, accepting cold starts. Fargate for long-running containers without managing hosts. EC2 when you need specific instance types, GPUs, steady high utilisation where reserved or savings plan pricing wins, or deep OS control. Cost at the expected load and team operational skill both belong in the answer.
- 5.
The monthly bill jumped significantly and nobody knows why. How do you investigate?
Why they ask it: Cost ownership is a real part of the role. Tests whether you know the tools and the usual culprits.
A strong answer: Cost Explorer grouped by service, account and usage type to find the jump, cost allocation tags to attribute it to a team, then the usual suspects: NAT gateway data processing, cross-AZ or internet data transfer, forgotten instances or unattached volumes, log ingestion, and a runaway scaling policy. Fix the cause, then add budgets and anomaly alerts.
- 6.
How do you structure accounts and infrastructure as code for several teams and environments?
Why they ask it: Tests multi-account strategy and IaC practice at an organisational level.
A strong answer: AWS Organizations with separate accounts per environment and often per workload, SCPs for guardrails, centralised logging and security accounts, SSO for human access instead of long-lived IAM users, Terraform or CloudFormation modules with remote state and locking, changes applied through a pipeline with plan review, and drift detection.
- 7.
Tell me about an outage you were involved in on AWS. What was your part, and what changed after?
Why they ask it: Behavioural, aimed at operational ownership, which is most of the job once systems are live.
A strong answer: What failed and the customer impact, how it was detected, your specific actions during mitigation, the root cause found afterwards, and concrete follow-ups such as alarms, runbooks or architectural changes, told without blaming individuals.
How the AWS Engineer interview runs
Usually a recruiter screen, then a technical round that goes deep on core AWS services: IAM, VPC networking, compute choices and storage. Most loops include a design round where you architect a workload on AWS and defend service choices, and many add a troubleshooting scenario or an infrastructure as code review in Terraform or CloudFormation. Expect questions about cost and about how you have handled an outage.
What the panel scores
Service depth
Whether you know how core AWS services really behave, not just their names.
- Explains VPC routing and endpoints precisely
- Understands IAM evaluation logic
- Chooses compute and storage from requirements
Architecture
Whether designs are resilient, scalable and justified.
- Designs across Availability Zones
- Uses queues and caches deliberately
- Names limits and tradeoffs of each service
Security and governance
Whether accounts and access are structured safely.
- Least privilege with roles, not long-lived keys
- Multi-account structure with guardrails
- Centralised logging and auditability
Operations and cost
Whether systems are observable, recoverable and affordable.
- Investigates cost with the right tools
- Builds alarms tied to user impact
- Learns from incidents without blame
Common questions in every interview
These come up in almost every AWS Engineer interview regardless of the company or the round.
- 8.
Tell me about yourself.
Why they ask it: Opens the interview and sets the frame. The interviewer is checking whether you can select what matters for this job rather than narrate your whole history.
A strong answer: A 60-90 second arc: where you are now, one or two proof points that match the posting, and why this role is the logical next step. Present, past, then future.
- 9.
Why do you want this role?
Why they ask it: Tests whether you read the job description or mass-applied. Weak answers are about what the candidate gets; strong answers connect to the work itself.
A strong answer: Two specifics from the posting or the company's actual work, plus an honest line about what you want to get better at here.
- 10.
Walk me through your resume.
Why they ask it: Checks that your story holds together and that the transitions were deliberate rather than accidental.
A strong answer: Chronological but fast, with a reason attached to each move and more time on the roles closest to this one.
- 11.
Tell me about a time you failed.
Why they ask it: Tests self-awareness and whether you own outcomes. Interviewers are listening for a real failure, not a disguised strength.
A strong answer: A genuine miss, what you specifically got wrong, the cost, and the concrete thing you changed afterwards that has since held up.
- 12.
Tell me about a conflict with a coworker or manager.
Why they ask it: Predicts how you behave when the team disagrees. The trap is blaming the other person.
A strong answer: The substance of the disagreement, what you did to understand their position, how it resolved, and what the working relationship looked like after.
- 13.
What's your greatest strength?
Why they ask it: Checks whether you know what you're actually good at and can prove it.
A strong answer: One strength that maps to the posting, plus a short example where it produced a measurable result.
- 14.
What's your greatest weakness?
Why they ask it: Tests honesty and whether you're actively working on something. Rehearsed non-answers ('I work too hard') read as evasive.
A strong answer: A real limitation that isn't core to the job, the system you built to manage it, and evidence it's improving.
- 15.
Tell me about a time you had to influence someone without authority.
Why they ask it: Almost every role depends on getting people who don't report to you to change course.
A strong answer: What you wanted, why they resisted, the evidence or framing that moved them, and what actually shipped as a result.
- 16.
Where do you see yourself in five years?
Why they ask it: Tests whether this job fits your trajectory, which is a retention question in disguise.
A strong answer: A direction rather than a title, and a line about the skills this role would build toward it. Vague ambition and rigid title-chasing both land badly.
- 17.
Why are you leaving your current job?
Why they ask it: Screens for red flags. Interviewers listen for how you talk about people you no longer work with.
A strong answer: Forward-looking and specific about what you're moving toward. Criticism of a former employer costs you more than it gains, even when it's deserved.
- 18.
What are your salary expectations?
Why they ask it: Checks whether you've done market research and whether you're in range before anyone spends more time.
A strong answer: A researched range with your target near the bottom of it, framed against the scope of the role. Deflect once if the posting has no band, then answer.
- 19.
Do you have any questions for us?
Why they ask it: The most under-prepared question in the interview, and the one that most changes the final impression.
A strong answer: Two or three questions about how the team actually works: what the first 90 days look like, how success is measured, what the hardest part of the job is.
Every round ends in a scorecard like this
Your AWS Engineer answers, quoted back, scored on what this role is judged on, with the line to say instead.
Real screen from the app. Sample from a product design round.
Related roles
All Engineering →No spam. Unsubscribe anytime.
Ready to practice as a AWS Engineer?
Sign up free, no card. 30 voice minutes and unlimited typed interviews, each ending in the complete scorecard: rubric scores, strengths, and what to fix next. Nothing is blurred.
- ✓ Predefined role or paste any job description
- ✓ Rubric scores with evidence quotes
- ✓ 888+ roles to choose from
Questions & answers
- Is the AWS Engineer mock interview free?
- Yes. 30 voice minutes and unlimited typed AWS Engineer interviews, no card. You get the complete rubric scorecard every time, with the evidence quoted from your own answers. Nothing is blurred.
- Can I use my own job description instead?
- Yes. Predefined roles are starting points. Paste any JD in the setup form and your AI interviewer will tailor questions to that posting.
- How is scoring tailored to this role?
- We pre-fill a realistic AWS Engineer job description and interview format so questions and the scorecard match how this role is actually interviewed.
- Should I tailor my resume before practicing?
- Run a resume fit check against a AWS Engineer job description first, then practice the interview with the same JD for a tighter loop.