In this article
How this list is ordered
The questions run from the basics to money, in the order a cloud round usually builds: what the service is, the states an instance moves through, where data lives, who can reach the instance, and how it is paid for. Each answer is short enough to say aloud. For the wider map of what to learn around EC2, start from the DevOps and cloud interview learning path; for the broader set of AWS services a DevOps round touches, see AWS interview questions for DevOps, while this page stays on EC2 itself. The one worked calculation, on per-second billing, comes after the questions.
EC2 basics
What is Amazon EC2?
Amazon Elastic Compute Cloud (EC2) provides on-demand, scalable computing capacity in the AWS Cloud, and an EC2 instance is a virtual server in the AWS Cloud (What is Amazon EC2?, accessed October 2026). You choose an instance type, which sets the hardware of the host computer, and an image to boot from. Once the instance is running, you use it as you would a computer in front of you.
Why it is asked: it opens the round and shows whether you can define the service without jargon. Source: What is Amazon EC2?.
What is an AMI, and what does the instance type decide?
An Amazon Machine Image (AMI) is the image that boots an instance. At launch you specify both the AMI and the instance type. The instance type determines the hardware of the host computer, and the AMI is used to boot the instance on it (Amazon EC2 User Guide, instance state changes, accessed October 2026). So the type answers "how much machine" and the image answers "what software starts on it".
Why it is asked: launching an instance needs both choices, and candidates often name only one. Source: Amazon EC2 User Guide, instance state changes.
Knowing it is half the job. Saying it is the other half.
Interview Clozo is an AI interview copilot for real interview rounds: it hears the question and puts a strong answer on your screen, and you say it in your own words. See the features or how it works.
Start Free Trial →Instance states and billing
What states does an EC2 instance go through, and which are billed?
A launched instance is pending, then running; stopping gives stopping then stopped; ending gives shutting-down then terminated. Only running is billed. The one exception is hibernation, which is billed while the instance is in stopping (Amazon EC2 User Guide, instance state changes, accessed October 2026). A stopped instance can be started at any time; a terminated one cannot.
Why it is asked: states and billing are the base of most cost and recovery questions. Source: Amazon EC2 User Guide, instance state changes.
What is the difference between stopping and terminating an instance?
Stopping shuts an instance down so that it can be started again; terminating permanently deletes it, and you cannot start or recover it. For an instance whose root volume is an Amazon Elastic Block Store (EBS) volume, the root volume is preserved on stop but deleted by default on terminate. Instance store data is erased in both cases (Amazon EC2 User Guide, instance state changes, accessed October 2026).
Why it is asked: it checks whether you know what you lose before you click. Source: Amazon EC2 User Guide, instance state changes.
What is the difference between stopping and hibernating an instance?
Hibernation signals the operating system to suspend to disk. Hibernate saves the contents of memory, called random-access memory (RAM), to the EBS root volume. On start, the root volume is restored and the RAM contents are reloaded. A plain stop erases RAM. Hibernation must be enabled when you launch the instance, and the root volume must be an encrypted EBS volume. It is billed while the instance is in stopping, and you pay for EBS storage, including the saved RAM data, afterwards (Amazon EC2 User Guide, instance state changes, accessed October 2026).
Why it is asked: it separates people who know the lifecycle table from people who know "stop" only. Source: Amazon EC2 User Guide, instance state changes.
How is a reboot different from a stop and start?
A reboot is equivalent to rebooting an operating system: the instance stays on the same host computer and keeps its public Domain Name System (DNS) name, private address and instance store data. A stop and start usually moves the instance to a new host computer and erases its instance store data. A reboot does not start a new billing period, so there is no new one-minute minimum (Amazon EC2 User Guide, instance state changes, accessed October 2026).
Why it is asked: it tests whether you pick the right recovery step for a failing instance. Source: Amazon EC2 User Guide, instance state changes.
Text description of the diagram
- A reboot keeps instance store data.
- Hibernate saves memory to the root volume.
- Terminate deletes the root volume by default.
- Terminate disassociates the Elastic IP address; it is not released.
How is EC2 billed, and do you pay for a stopped instance?
On-Demand Instances are paid for by the second (Amazon EC2 User Guide, purchasing options, accessed October 2026). For most operating systems, from the running state you are billed for each second, with a one-minute minimum, even if the instance is idle. A stopped instance has no usage charge, but EBS volumes and Elastic Internet Protocol (IP) addresses incur charges whatever the instance's state (Amazon EC2 User Guide, instance state changes, accessed October 2026).
Why it is asked: "stopped means free" is a common wrong answer. Source: Amazon EC2 User Guide, instance state changes.
Storage and data
What happens to instance store data and EBS data when an instance stops?
Data on instance store volumes is lost when you stop and start an instance, because the instance moves to a new host computer and the volumes belonged to the previous one. A reboot preserves it. An EBS root volume is preserved on stop, and so are attached EBS data volumes (Amazon EC2 User Guide, instance state changes, accessed October 2026). Keep anything you must not lose on EBS, not on the instance store.
Why it is asked: it is the standard data-loss question. Source: Amazon EC2 User Guide, instance state changes.
What does the DeleteOnTermination attribute do?
The DeleteOnTermination attribute of an EBS volume controls whether the volume is deleted or kept when you terminate the instance it is attached to. The default is to delete the root volume and preserve any other EBS volumes (Amazon EC2 User Guide, instance state changes, accessed October 2026). If the root volume holds data you need after termination, change the setting before you terminate.
Why it is asked: it tests whether you know a default that can silently remove data. Source: Amazon EC2 User Guide, instance state changes.
How do you protect an instance from being terminated by mistake?
Enable termination protection: with it on, you cannot terminate the instance from the console, the command line tool or the application interface. It has limits: it does not stop an Auto Scaling group from scaling the instance in, a Spot interruption, or an operating system shutdown when the shutdown behaviour is set to terminate (Amazon EC2 User Guide, termination protection, accessed October 2026). That setting, InstanceInitiatedShutdownBehavior, decides whether a shutdown run inside an EBS-backed instance stops or terminates it, and the default is to stop (Amazon EC2 User Guide, instance state changes, accessed October 2026). An instance with an instance store root volume is always terminated by an operating system shutdown.
Why it is asked: it checks for practical guard rails, not only definitions. Source: Amazon EC2 User Guide, termination protection and instance state changes.
Networking and security groups
What is a security group?
A security group is a virtual firewall for EC2 instances that controls incoming and outgoing traffic through inbound and outbound rules. If you name none at launch, EC2 uses the default security group of the virtual private cloud (VPC). You can change an instance's groups after launch, attach several groups to one instance, and attach one group to several instances. There is no extra charge (Amazon EC2 User Guide, security groups, accessed October 2026).
Why it is asked: it is the first networking question in almost every EC2 round. Source: Amazon EC2 User Guide, security groups.
Are security groups stateful?
Yes. If you send a request from your instance, the response traffic is allowed in whatever the inbound rules say. Responses to allowed inbound traffic are likewise allowed out whatever the outbound rules say (Amazon EC2 User Guide, security groups, accessed October 2026). You therefore write a rule for the direction in which a connection starts, not a matching rule for the reply.
Why it is asked: stateful behaviour is the usual follow-up to "what is a security group". Source: Amazon EC2 User Guide, security groups.
How do you let only your own network connect to an instance over SSH?
Add an inbound rule to the instance's security group that allows Secure Shell (SSH) traffic, which uses Transmission Control Protocol (TCP) port 22, from your network. The documentation explains that the only traffic reaching the instance is the traffic the security group rules allow (Amazon EC2 User Guide, security groups, accessed October 2026). Name your own address range in the rule, for example a single address written with a /32 suffix, and do not open the port to everyone. To log in you also need the private key of the instance's key pair.
Why it is asked: it turns the definition into a task. Source: Amazon EC2 User Guide, security groups.
What is a key pair, and how do you log in to an instance?
A key pair is a set of security credentials made of a public key and a private key. EC2 stores the public key on your instance, and you keep the private key; you use the private key to prove who you are when you connect, for example over SSH to a Linux instance (Amazon EC2 User Guide, key pairs, accessed October 2026). Name the key pair when you launch the instance. Anyone who holds the private key can log in, so store it safely.
Why it is asked: it connects the networking answer to actually getting a shell. Source: Amazon EC2 User Guide, key pairs.
What happens to addresses and the Elastic IP address when an instance stops?
On stop and start the instance keeps its private Internet Protocol version 4 (IPv4) address and its IPv6 (IP version 6) address, and an Elastic IP address stays associated. Its public IPv4 address changes, unless a secondary network interface or secondary private address is tied to an Elastic IP. Terminate disassociates the Elastic IP address; it is not released, so it stays in your account and keeps incurring charges until you release it (Amazon EC2 User Guide, instance state changes, accessed October 2026).
Why it is asked: it explains why a server's public address changes after a restart. Source: Amazon EC2 User Guide, instance state changes.
What are placement groups?
A placement group lets you influence how your instances are placed on the underlying hardware. Three strategies are common (the page also lists a fourth, precision time). A cluster group packs instances close together for low-latency networking, a partition group spreads them across partitions that do not share hardware, and a spread group puts each instance on separate hardware to limit correlated failures (Amazon EC2 User Guide, placement groups, accessed October 2026). Pick by the goal: speed between nodes or fault isolation.
Why it is asked: it tests whether you can trade performance against failure risk. Source: Amazon EC2 User Guide, placement groups.
Purchasing options and cost
What are the EC2 purchasing options?
The purchasing options page lists seven, and also describes Capacity Blocks for machine learning (ML). On-Demand is paid by the second. Savings Plans and Reserved Instances commit you for a term of 1 or 3 years. Spot Instances use unused capacity at a reduced cost. Dedicated Instances run on single-tenant hardware, Dedicated Hosts give you a whole physical host, and Capacity Reservations hold capacity in a specific Availability Zone (Amazon EC2 User Guide, purchasing options, accessed October 2026).
Why it is asked: cost choices show whether you think beyond launching a server. Source: Amazon EC2 User Guide, purchasing options.
What is the difference between Reserved Instances and Savings Plans?
Savings Plans are a commitment to a consistent amount of usage, measured in dollars per hour, for a term of 1 or 3 years. Reserved Instances are a commitment to a consistent instance configuration, including instance type and Region, for the same terms (Amazon EC2 User Guide, purchasing options, accessed October 2026). They are not the same thing: one commits to spend, the other to a specific configuration.
Why it is asked: candidates often treat the two as one. Source: Amazon EC2 User Guide, purchasing options.
When do you use Dedicated Hosts and when Dedicated Instances?
Dedicated Instances are paid by the hour and run on single-tenant hardware. With Dedicated Hosts you pay for a physical host fully dedicated to your instances, and you can bring existing per-socket, per-core or per-virtual-machine software licenses (Amazon EC2 User Guide, purchasing options, accessed October 2026). So licence rules that depend on the physical host point to Dedicated Hosts; isolation alone points to Dedicated Instances.
Why it is asked: it tests whether you link a business constraint to a product option. Source: Amazon EC2 User Guide, purchasing options.
What is a Capacity Reservation?
A Capacity Reservation reserves capacity for your EC2 instances in a specific Availability Zone (Amazon EC2 User Guide, purchasing options, accessed October 2026). It is billed at the On-Demand rate whether or not you use it (Amazon EC2 User Guide, Capacity Reservations, accessed October 2026). It is mainly defined by where the capacity sits, whereas Savings Plans are defined by a spend and Reserved Instances by an instance configuration. A strong answer says which problem you are solving: price, configuration commitment or assured space in a zone.
Why it is asked: it shows whether you can separate capacity from price. Source: Amazon EC2 User Guide, purchasing options.
What are Spot Instances, and what workload suits them?
Spot Instances let you request unused EC2 instances, which can reduce your EC2 costs significantly (Amazon EC2 User Guide, purchasing options, accessed October 2026). Because the capacity is spare, design the workload to tolerate losing an instance. The interruption notice is a warning issued two minutes before EC2 interrupts a Spot Instance; it does not apply when the interruption behaviour is hibernate (Spot Instance interruption notices, accessed October 2026). In those two minutes, checkpoint the work and drain the instance from the load balancer.
Why it is asked: it tests the link between cost and fault tolerance. Source: Spot Instance interruption notices.
Does terminating an instance stop Reserved Instance charges?
No. Reserved Instances that applied to terminated instances are billed until the end of their term, according to their payment option. Usage charges for the instance itself end once it reaches shutting-down or terminated (Amazon EC2 User Guide, instance state changes, accessed October 2026). A commitment is a promise about the term, not about a particular instance.
Why it is asked: it checks that you know a commitment outlives the instance. Source: Amazon EC2 User Guide, instance state changes.
Worked example: what per-second billing means
On-Demand billing is per second, with a one-minute minimum each time an instance starts, for most operating systems. The runs below use an illustrative rate of one rate unit per hour and illustrative run lengths, so every cost is a fraction of one hour's price.1 A 20-second run is billed 60 seconds. Three separate 30-second runs add up to 90 seconds of running but are billed 180, because each start carries its own minimum.
| Case (illustrative) | Seconds running | Seconds billed | Cost in rate units |
|---|---|---|---|
| One 20-second run | 20 | 60 | 0.0167 |
| One 90-second run | 90 | 90 | 0.025 |
| Three 30-second runs | 90 | 180 | 0.05 |
| One run of one hour | 3,600 | 3,600 | 1.0 |
A reboot in the middle of a run does not start a new billing period, so a 90-second run with a reboot still bills 90 seconds.1 The lesson for an interview: frequent start and stop of short jobs can cost more than the running time suggests.
Follow-up questions
What AWS interview questions on EC2 are asked?
The twenty-two above cover the topics that recur: what an instance and an image are, the lifecycle states, instance store against EBS, security groups, key pairs, and the purchasing options. Reported questions vary by role, so use them as a map. For the design side of cloud rounds, read the system design guide.
How do you cut the cost of EC2 instances?
Match the purchasing option to the workload: Savings Plans or Reserved Instances for steady use, Spot Instances for interruptible work, On-Demand for the rest, and stop instances that sit idle, remembering that EBS storage is still charged. Say which commitment you would choose and why.
What is the difference between a security group and a network access control list?
A security group is a stateful firewall that allows traffic by rules and has allow rules only (Amazon VPC User Guide, security group rules, accessed October 2026). A network access control list (ACL) is stateless and supports both allow and deny rules (Amazon VPC User Guide, network ACLs, accessed October 2026), so you must allow the reply traffic explicitly.
What else should you learn next to EC2?
Cloud rounds usually continue into the command line, containers and delivery pipelines. The Linux commands page covers what you run on an instance, the Kubernetes interview questions cover container scheduling, what Jenkins is covers the build and release side, and how Terraform works covers creating instances as code.
- An instance is a virtual server; the AMI boots it and the instance type sets its hardware.
- Stop keeps EBS data and erases instance store data; terminate deletes the instance, and the root volume by default.
- Only the
runningstate is billed, plus hibernation while it isstopping; EBS volumes and Elastic IP addresses are charged in any state. - Security groups are stateful virtual firewalls: write the rule for the direction a connection starts.
- Savings Plans commit to spend per hour; Reserved Instances commit to a configuration; Capacity Reservations hold space in a zone.
Sources
- What is Amazon EC2? (EC2 User Guide) — Amazon Web Services, 26 Oct 2026
- Amazon EC2 billing and purchasing options (EC2 User Guide) — Amazon Web Services, 26 Oct 2026
- Amazon EC2 instance state changes (EC2 User Guide) — Amazon Web Services, 26 Oct 2026
- Amazon EC2 security groups for your EC2 instances (EC2 User Guide) — Amazon Web Services, 26 Oct 2026
- Spot Instance interruption notices (EC2 User Guide) — Amazon Web Services, 26 Oct 2026
- Control subnet traffic with network access control lists (Amazon VPC User Guide) — Amazon Web Services, 26 Oct 2026
- Amazon EC2 key pairs and instances (EC2 User Guide) — Amazon Web Services, 26 Oct 2026
- Placement groups (EC2 User Guide) — Amazon Web Services, 26 Oct 2026
- Enable termination protection for your EC2 instance (EC2 User Guide) — Amazon Web Services, 26 Oct 2026
- Amazon EC2 Capacity Reservations (EC2 User Guide) — Amazon Web Services, 26 Oct 2026
- Security group rules (Amazon VPC User Guide) — Amazon Web Services, 26 Oct 2026
