Staff / Principal Interview Questions
228 questions across 34 categories
Expert-level and system-design questions — the scope, trade-offs, and organizational reasoning expected at the most senior technical levels.
How would you audit whether an ECS task role or Lambda execution role is actually scoped tightly, versus just copy-pasted from a broader existing role?
AdvancedAWS7 min
What CloudTrail-based alerting would you specifically set up for a narrowly-scoped static-key IAM user, and how would you tune it to avoid false positives?
AdvancedAWS7 min
How would you design the exception process for an SCP blocking IAM user creation, so legitimate cases aren't blocked indefinitely by bureaucracy?
AdvancedAWS7 min
How does the workload-identity comparison extend to EKS, where pod identity is yet another mechanism (IRSA or Pod Identity)?
ExpertAWSEKSKubernetes8 min
What's the mechanism difference between how EC2's IMDS delivers credentials versus how Lambda delivers them to a function's environment?
AdvancedAWSLambda6 min
You inherit an EC2 workload that authenticates to AWS using an IAM user with AdministratorAccess. How would you migrate it to least-privilege access without causing an outage?
AdvancedAWSIAMEC212 min
How would you prevent a new workload from ever being built directly on a static IAM user again, at an organizational level rather than case by case?
AdvancedAWS8 min
A detective scan finds dozens of pre-existing IAM users with active keys across many accounts. How would you prioritize remediation?
AdvancedAWS7 min
How would you design automated credential rotation to handle the overlap window safely, so the application never experiences an auth failure?
AdvancedAWS7 min
A third-party application only supports static AWS access keys and can't use an instance profile or role. How do you handle this without abandoning least privilege entirely?
AdvancedAWS8 min
Even after mitigating cold starts, a small amount of irreducible tail latency remains. How would you design the caller's retry behavior to handle that remaining tail?
AdvancedAWSLambda8 min
How would a circuit breaker's threshold and recovery behavior be tuned differently for a Lambda-backed service versus a traditional always-on service?
AdvancedAWSLambda7 min
What idempotency key design would you use for a payment-related Lambda function, given the higher stakes of a duplicate execution?
AdvancedAWSLambda8 min
How would you design a synthetic load test to reproduce and measure Lambda's bursty cold-start pattern before it shows up in production?
AdvancedAWSLambda7 min
How would you tune a hedge-request delay so it targets genuine cold-start tail latency without firing on every normal request?
AdvancedAWSLambda7 min
How would you audit all S3 buckets in an account for their current Block Public Access and policy configuration, at scale?
AdvancedAWSS37 min
How would you decide whether an S3 public-write exposure is a supply-chain security incident requiring broader notification, versus a contained issue?
AdvancedAWSS37 min
How would you determine, after an S3 public-write exposure, exactly which objects were added, modified, or deleted if versioning wasn't enabled?
AdvancedAWSS37 min
A security scanner just flagged one of your production S3 buckets as publicly readable. Walk through how you'd respond in the first hour and prevent a repeat.
AdvancedAWSS3Security10 min
How would you design alerting so a public S3 exposure is caught within minutes, rather than being discovered by an external scanner or a customer report?
AdvancedAWSS38 min
How would your incident response differ if an exposed S3 bucket allowed public write access, not just public read?
AdvancedAWSS38 min
How would you scale S3 public-exposure alerting for an organization with hundreds of AWS accounts, where per-account Config rules alone don't scale operationally?
ExpertAWS8 min