Amazon Web Services Assessment: Sample Questions | Bryq
Beginner
Intermediate
Advanced
These are three sample questions from Bryq’s Amazon Web Services (AWS) assessment, a technical test for hiring cloud engineers, AWS solutions architects and DevOps engineers. The full assessment covers three levels: beginner, intermediate and advanced, from core AWS services to infrastructure automation, networking and security. Each question is multiple choice, with one correct answer out of four options.
Beginner
Question
Under the AWS shared responsibility model, which task is the customer’s responsibility?
Select your answer
Configuring security groups and IAM permissions.
Securing the physical data centers.
Patching the virtualization layer that runs EC2 instances.
Replacing failed server hardware.
WHY IS THIS THE CORRECT ANSWER
AWS is responsible for security of the cloud: data centers, hardware and the virtualization layer. Customers are responsible for security in the cloud, such as who has access through IAM, what network traffic security groups allow and how their own data is protected.
Intermediate
Question
An EC2 instance’s security group allows inbound HTTPS from anywhere, and all its outbound rules have been removed. Will clients still receive responses from the instance?
Select your answer
Yes, because security groups are stateful and automatically allow return traffic.
No, because outbound rules must explicitly allow the response traffic.
Only if a network ACL also allows the traffic inbound.
Only for clients inside the same VPC.
WHY IS THIS THE CORRECT ANSWER
Security groups are stateful: when inbound traffic is allowed, the response is automatically allowed back out, regardless of the outbound rules. Network ACLs are stateless, so they need explicit rules in both directions.
Advanced
Question
An application running on an EC2 instance needs to read objects from one S3 bucket. What is the most secure way to grant this access?
Select your answer
Attach an instance role with a policy allowing read access to that bucket only.
Store an IAM user’s access keys in the instance’s environment variables.
Add a bucket policy that allows requests from the instance’s public IP address.
Attach an instance role with s3:* permissions on all buckets.
WHY IS THIS THE CORRECT ANSWER
An IAM role attached to the instance supplies temporary credentials that rotate automatically, so no long-lived keys are stored on the server. Limiting the policy to read actions on that one bucket follows the principle of least privilege. Stored access keys can leak, IP-based rules are fragile, and broad permissions expose far more than the application needs.
