White Belt interview questions
Building it is half the job. These are the questions an interviewer could ask about the White Belt, with answers you can make your own.
1. Why should you stop using the AWS root user after setting up the account?
The root user has unrestricted access to everything in the account, including billing and account closure, and its permissions cannot be reduced. If its credentials leak, nothing limits the damage. Day-to-day work goes through an IAM user or role with only the permissions it needs, protected by MFA, while root is kept for the few tasks that require it.
2. What is MFA and why does AWS push it so hard?
Multi-factor authentication adds a second proof of identity, such as an authenticator app code or a passkey, on top of the password. A stolen password alone is then not enough to sign in. Account takeovers that run up large bills usually start with a leaked password, so MFA on root and on every human user is the cheapest protection there is.
3. How does the AWS Free plan work now, and what is the catch?
New accounts get USD 100 in credits at sign-up and can earn up to USD 100 more by completing activities, plus always-free monthly limits on more than 30 services. On the Free account plan you are never charged, but the plan ends after six months or when the credits run out, and the account then closes unless you upgrade to the Paid plan. AWS keeps your content for 90 days after that.
4. What does an AWS Budgets alarm do, and what does it not do?
A budget alarm emails you when actual or forecast spending crosses an amount you set. It does not stop anything by itself: resources keep running and costs keep accruing until you act. That is why it belongs at the very start, before the first resource exists, and why every project ends with a cleanup step.
5. What is Amazon S3, and why is it a good place for a static website?
S3 is object storage: you upload files into buckets and S3 stores them durably across multiple facilities. A static site is just files, so S3 can hold it without any server to patch or scale, and it costs almost nothing for a small site. On its own S3 serves over plain HTTP, which is why CloudFront sits in front.
6. Why put CloudFront in front of an S3 bucket instead of making the bucket public?
CloudFront gives you HTTPS with a free certificate, caches the files at edge locations close to visitors, and lets the bucket stay private: an origin access control allows only CloudFront to read it. A public bucket serves over HTTP, is slower for distant visitors, and is the classic cause of accidental data exposure.
7. What is an origin access control?
It is the mechanism that lets a CloudFront distribution read from a private S3 bucket. CloudFront signs its requests to S3, and the bucket policy allows only that distribution. Visitors can reach the files through CloudFront but cannot read the bucket directly.
8. Your site changed but visitors still see the old version. What happened and what do you do?
CloudFront cached the old file at its edge locations and keeps serving it until the cache entry expires. You create an invalidation for the changed paths, or for /*, which tells every edge to fetch fresh copies. Alternatively you version file names so a change is a new file.
9. What is Amazon Bedrock?
Bedrock is a managed service that gives you access to foundation models from Amazon and other providers through one API and console, without running any model infrastructure. You pick a model from the catalog, then send it prompts and optionally documents. You pay per token processed.
10. How is Bedrock billed, and how did you keep it cheap?
On-demand use is billed per input and output token, with prices that differ by model. Generating one HTML page from a short profile is a few thousand tokens, so it costs cents. Choosing a small model such as Nova Lite, keeping prompts short, and not looping over many generations keeps it that way.
11. What is the difference between a Region and an edge location?
A Region is a geographic area with several isolated data centres where services such as S3 and Bedrock run and where your data lives. Edge locations are many smaller sites around the world that CloudFront uses to cache and serve content close to visitors. Your bucket is in one Region; your site is served from edges everywhere.
12. Under the shared responsibility model, what did AWS secure in this project and what did you?
AWS is responsible for security of the cloud: the physical facilities, hardware and the services themselves. You are responsible for security in the cloud: your account settings, MFA, IAM users and policies, keeping the bucket private, and what you publish. A leaked root password or a public bucket is on the customer side of the line.