Prev Next

Cloud / Amazon EBS (Elastic Block Storage) Interview questions

Last updated

1. What is Amazon EBS? 2. What are the main types of Amazon EBS volumes? 3. What is a General Purpose SSD (gp3) volume? 4. What is a Provisioned IOPS SSD volume? 5. What are Throughput Optimized HDD (st1) and Cold HDD (sc1) volumes? 6. What is an EBS snapshot? 7. What is the purpose of an EBS-optimized instance? 8. How do you attach an EBS volume to an EC2 instance? 9. What is the durability and availability of EBS volumes? 10. What is the purpose of the Delete on Termination flag? 11. What is Amazon EBS encryption? 12. What is an EBS root volume? 13. What is EBS Multi-Attach? 14. What are Elastic Volumes in EBS? 15. What are IOPS and throughput in EBS? 16. What is the Availability Zone restriction on EBS volumes? 17. What is Amazon Data Lifecycle Manager? 18. What is the EBS Snapshot Archive tier? 19. What is the difference between EBS and instance store? 20. What is the difference between gp2 and gp3? 21. How does the gp2 burst bucket work? 22. Why is gp3 preferred over gp2 for most workloads? 23. How are EBS snapshots incremental? 24. What happens when you delete an EBS snapshot? 25. How do you move an EBS volume to another Availability Zone? 26. How do you copy an EBS snapshot to another Region? 27. How do you encrypt an existing unencrypted EBS volume? 28. How does EBS encryption work with KMS? 29. Why do volumes restored from snapshots have slow first reads? 30. What is Fast Snapshot Restore and when should you use it? 31. How do you increase the size of an EBS volume without downtime? 32. Why can't you shrink an EBS volume, and how do you work around it? 33. How does EBS Multi-Attach work and what are its limitations? 34. When would you choose io2 Block Express over gp3? 35. When would you choose st1 over gp3? 36. How do you troubleshoot slow EBS performance? 37. Which CloudWatch metrics monitor EBS volumes? 38. When should you use RAID 0 or RAID 1 with EBS? 39. How do you take application-consistent EBS snapshots? 40. How can you share an EBS snapshot with another AWS account? 41. What happens to an EBS volume when an EC2 instance stops or terminates? 42. How do you recover data from the root volume of an unreachable instance? 43. How can you optimize EBS costs? 44. How does the EBS Recycle Bin protect against accidental deletion? 45. Explain the lifecycle of an EBS volume? 46. How do you mount and persist a new EBS volume on Linux? 47. What are EBS direct APIs and when are they useful? 48. What is the difference between EBS, EFS, and S3? 49. How do you protect EBS snapshots from deletion or ransomware? 50. How do you size an EBS volume for a target IOPS?

1. What is Amazon EBS?

Amazon Elastic Block Store (EBS) is a block-level storage service that gives EC2 instances persistent volumes. A volume shows up in the operating system as a raw disk, so you format it with a file system (ext4, XFS, NTFS) or hand it directly to a database.

Data lives independently of the instance. If you stop or even terminate the instance, a non-root volume keeps its data unless you delete it.

  • Volumes are tied to a single Availability Zone and attach to instances in that same AZ.
  • You choose size and volume type (SSD or HDD) based on your IOPS and throughput needs.
  • You can back volumes up with snapshots stored durably in S3-managed storage.
  • Volumes can be resized and retuned while in use with Elastic Volumes.

Typical uses are boot disks, relational and NoSQL databases, and big-data or log-processing workloads that need disk-like access.

Take quiz
What does an EBS volume look like to the operating system of an EC2 instance?
An S3 bucket exposed as a folder
A read-only container image
An NFS share mounted over the network
A raw block device that you format with a file system
What happens to data on a non-root EBS volume when its EC2 instance is terminated (default settings)?
The volume and its data are kept
The data is moved to S3 automatically
The volume is always wiped and deleted
The volume is converted to a snapshot and removed

2. What are the main types of Amazon EBS volumes?

EBS volumes fall into three groups: SSD-backed, HDD-backed, and the legacy magnetic type.

Type Family Best for
gp3 / gp2 General Purpose SSD Boot volumes, dev/test, most apps
io2 Block Express / io1 Provisioned IOPS SSD Latency-sensitive databases
st1 Throughput Optimized HDD Big data, logs, streaming reads
sc1 Cold HDD Infrequently accessed, lowest cost
Magnetic (standard) Previous generation Legacy only

SSD volumes are optimized for IOPS (small random I/O). HDD volumes are optimized for MiB/s throughput on large sequential I/O, and st1/sc1 cannot be used as boot volumes.

Take quiz
Which EBS volume type is the lowest-cost HDD option for cold data?
st1
sc1
io2 Block Express
gp3
Which volume families can NOT be used as boot volumes?
Every EBS type can boot
gp3 and gp2 SSD volumes
st1 and sc1 HDD volumes
io1 and io2 volumes

3. What is a General Purpose SSD (gp3) volume?

gp3 is the current default EBS volume type. It balances price and performance for a wide range of workloads such as boot volumes, dev/test environments, and small to mid-sized databases.

Every gp3 volume includes a baseline of 3,000 IOPS and 125 MiB/s no matter how large it is. You can provision more of either independently of capacity, up to 80,000 IOPS and 2,000 MiB/s, and sizes now reach 64 TiB (the limits were raised in September 2025).

Because IOPS and throughput are decoupled from size, you no longer have to buy extra gigabytes just to get more performance, which was the gp2 pain point. Per-GB price is also about 20% lower than gp2.

Take quiz
What baseline performance does every gp3 volume include?
16,000 IOPS and 1,000 MiB/s
100 IOPS and 40 MiB/s
It depends on the volume size
3,000 IOPS and 125 MiB/s
How do you get more IOPS from a gp3 volume?
Provision additional IOPS independently of size
Switch the file system to XFS
Increase the size until 3 IOPS per GiB is reached
Attach it to a larger AZ

4. What is a Provisioned IOPS SSD volume?

Provisioned IOPS SSD volumes (io2 Block Express and the older io1) are the highest-performance EBS volumes. You specify the exact IOPS you need and EBS delivers it consistently with low latency.

io2 Block Express supports up to 256,000 IOPS, 4,000 MiB/s, and 64 TiB per volume, with sub-millisecond average latency on Nitro instances. It also offers 99.999% durability, versus 99.8-99.9% for other types. Since April 30, 2025, every io2 volume runs on Block Express.

They suit mission-critical databases such as SAP HANA, Oracle, and SQL Server. They are also the only types that support Multi-Attach. Expect to pay noticeably more than gp3.

Take quiz
What durability is io2 Block Express designed for?
99.5%
99.999%
99.0%
99.8%
Which volume types support Multi-Attach?
st1 and sc1
gp3 only
Provisioned IOPS (io1 and io2)
All SSD and HDD types

5. What are Throughput Optimized HDD (st1) and Cold HDD (sc1) volumes?

Both are HDD-backed volumes built for large, sequential I/O where MiB/s matters more than IOPS. They use a burst-bucket model tied to volume size.

st1 sc1
Baseline 40 MiB/s per TiB 12 MiB/s per TiB
Burst 250 MiB/s per TiB 80 MiB/s per TiB
Max throughput 500 MiB/s 250 MiB/s
Max IOPS 500 250
Use case Kafka, ETL, log processing, data warehouse Cold, rarely read archives

Size range is 125 GiB to 16 TiB. Neither can be a boot volume, and both perform poorly for small random reads, so do not put databases on them.

Take quiz
Which workload fits st1 best?
A latency-sensitive OLTP database
A Multi-Attach cluster disk
A root/boot volume
Streaming logs and large sequential ETL scans
What is the maximum throughput of a single st1 volume?
500 MiB/s
250 MiB/s
1,000 MiB/s
4,000 MiB/s

6. What is an EBS snapshot?

An EBS snapshot is a point-in-time backup of a volume, stored in Amazon S3 (managed by AWS, so you will not see it in your buckets). Snapshots are incremental: the first one copies all used blocks, and later ones store only blocks that changed.

Snapshots are regional, not tied to an AZ, which makes them the standard way to restore a volume in a different AZ, copy data to another Region, or share it with another account. You can also register a snapshot of a root volume as an AMI.

aws ec2 create-snapshot \
  --volume-id vol-0abc1234def567890 \
  --description "nightly backup"

Take quiz
Where are EBS snapshots stored?
On the same instance store disk
In AWS-managed S3 storage, available regionally
In a customer-owned S3 bucket you must create
Only inside the source Availability Zone
What does a second snapshot of the same volume contain?
Only the file system metadata
A complete copy of the whole volume
Only blocks changed since the previous snapshot
Nothing until the first snapshot is deleted

7. What is the purpose of an EBS-optimized instance?

EBS-optimized instances have dedicated bandwidth between the EC2 instance and EBS, so storage traffic does not compete with normal network traffic. That gives more consistent I/O performance.

Almost all current-generation instances are EBS-optimized by default at no extra charge, and Nitro-based types get this through the Nitro card. Older types needed the option turned on and sometimes cost extra.

Each instance type also has its own maximum EBS bandwidth and IOPS. If those are lower than what your volumes can deliver, the instance becomes the bottleneck.

Take quiz
What does EBS optimization primarily provide?
Cross-AZ replication of volumes
Automatic encryption of every volume
Free unlimited snapshots
Dedicated bandwidth between the instance and EBS
If a fast io2 volume seems slow on a small instance, what is a likely cause?
The instance type's EBS bandwidth or IOPS limit
The volume is in the wrong Region
Snapshots are disabled
The AMI is unencrypted

8. How do you attach an EBS volume to an EC2 instance?

The volume and the instance must be in the same Availability Zone, and the volume must be in the available state. Then attach it from the console (Actions > Attach volume) or the CLI, and pick a device name.

aws ec2 attach-volume \
  --volume-id vol-0abc1234def567890 \
  --instance-id i-0123456789abcdef0 \
  --device /dev/sdf

Attaching is not the last step. Inside the OS you still need to find the device (lsblk), create a file system if it is new (mkfs), and mount it. On Nitro instances the device appears as /dev/nvme1n1 rather than /dev/sdf.

Take quiz
What must be true before attaching a volume to an instance?
Both are in different Availability Zones
Both are in the same Availability Zone
The volume must be a snapshot
The instance must be terminated first
On a Nitro instance, how does a volume attached as /dev/sdf usually appear in Linux?
As /dev/cdrom0
It does not appear until reboot
As an NVMe device such as /dev/nvme1n1
As a mounted S3 path

9. What is the durability and availability of EBS volumes?

EBS volumes are replicated automatically across multiple servers within one Availability Zone, so a single hardware failure does not lose data.

Volume type Designed durability Annual failure rate
gp3, gp2, io1, st1, sc1 99.8% - 99.9% 0.1% - 0.2%
io2 Block Express 99.999% 0.001%

Replication stays inside the AZ. If the whole AZ fails, the volume is unavailable, so snapshots (regional) are your defense. For higher resilience, copy snapshots to another Region.

Take quiz
Where does EBS replicate volume data automatically?
Across all Regions
To a second AZ automatically
To an S3 bucket every second
Across multiple servers within one Availability Zone
What protects your data if an entire Availability Zone is lost?
Snapshots stored regionally
Multi-Attach
EBS-optimized instances
The volume's built-in cross-AZ mirror

10. What is the purpose of the Delete on Termination flag?

DeleteOnTermination controls whether an EBS volume is deleted automatically when its EC2 instance is terminated.

  • Root volume: defaults to true, so it disappears with the instance.
  • Additional volumes: default to false, so they survive termination.

Set it to false on a root volume if you need to keep the OS disk for forensics. The flag can be changed on a running instance:

aws ec2 modify-instance-attribute \
  --instance-id i-0123456789abcdef0 \
  --block-device-mappings '[{"DeviceName":"/dev/xvda","Ebs":{"DeleteOnTermination":false}}]'

Forgotten volumes that stay behind are a common source of silent EBS cost.

Take quiz
What is the default DeleteOnTermination value for a root volume?
false
true
It is always prompted
It depends on volume size
Why might you set DeleteOnTermination to false on a root volume?
To enable Multi-Attach
To make the volume faster
To keep the disk for troubleshooting or forensics after termination
To convert it to gp3

11. What is Amazon EBS encryption?

EBS encryption protects data at rest, data in transit between the instance and the volume, and the snapshots created from it. It uses AES-256 with keys managed in AWS KMS, either the AWS managed key (aws/ebs) or your own customer managed key.

You do not manage anything in the guest OS, and the performance impact is minimal on supported instance types. Snapshots of an encrypted volume are encrypted, and volumes made from them are too.

You can turn on EBS encryption by default per Region in an account, so every new volume is encrypted automatically.

Take quiz
Which service manages the keys used by EBS encryption?
Amazon Inspector
AWS Config
AWS Shield
AWS KMS
What does turning on 'EBS encryption by default' do?
Makes every newly created volume in that Region encrypted
Disables snapshots
Encrypts S3 buckets in the account
Encrypts existing volumes instantly

12. What is an EBS root volume?

The root volume is the EBS volume that holds the operating system an instance boots from. It is created from the AMI's root snapshot when you launch an EBS-backed instance.

Only SSD volume types (gp2, gp3, io1, io2) and legacy magnetic can be boot volumes. You can enlarge it, change its type, or snapshot it at any time. Because it is EBS-backed, the instance can be stopped and started without losing the OS state, unlike instance-store-backed instances.

By default the root volume is deleted when the instance terminates.

Take quiz
From what is a root volume created at launch?
An instance store disk
The AMI's root snapshot
A CloudFormation stack
An S3 bucket you name
What advantage does an EBS-backed root volume give?
It never costs anything
It can be shared without snapshots
The instance can be stopped and restarted keeping its OS state
It works across AZs

13. What is EBS Multi-Attach?

Multi-Attach lets a single io1 or io2 volume be attached to up to 16 Nitro-based instances in the same Availability Zone at once. Every instance gets full read and write access.

EBS does not coordinate the writes. You need a cluster-aware file system (or an application that manages concurrent access), because ordinary ext4 or XFS would corrupt when written from many hosts.

  • Same AZ only.
  • Not supported on the root volume.
  • Supported on io1/io2, not gp3 or HDD types.

Typical use cases are clustered databases and high-availability designs that need fast failover.

Take quiz
How many Nitro instances can a Multi-Attach volume connect to?
Up to 128
Unlimited
Up to 2
Up to 16
What is needed to safely write to a Multi-Attach volume from several instances?
A cluster-aware file system or application-level coordination
A larger instance type
An extra snapshot each minute
Standard ext4 is enough

14. What are Elastic Volumes in EBS?

Elastic Volumes is the feature that lets you change a volume's size, type, IOPS, and throughput while it is attached and in use, with no detach and no downtime for current-generation instances.

After you request a change, the volume moves through modifying and optimizing states before showing completed. It is usable during optimizing, though performance may be in between the old and new settings.

aws ec2 modify-volume \
  --volume-id vol-0abc1234def567890 \
  --volume-type gp3 --size 500 --iops 6000

Two rules to remember: you can only increase size, and you must wait about 6 hours (or until optimization ends) before modifying the same volume again. After growing, extend the partition and file system inside the OS.

Take quiz
Which change is NOT possible with Elastic Volumes?
Raising provisioned IOPS
Reducing the volume size
Changing gp2 to gp3
Increasing the volume size
What must you do inside the OS after growing a volume?
Nothing, it is automatic
Recreate the snapshot
Extend the partition and file system
Reinstall the OS

15. What are IOPS and throughput in EBS?

IOPS is the number of read/write operations per second. Throughput is the amount of data moved per second, in MiB/s. They are linked by I/O size:

Throughput = IOPS x I/O size

A database doing many small 8-16 KiB reads is limited by IOPS. A backup job streaming 1 MiB blocks is limited by throughput. That is why SSD volumes are rated by IOPS (measured at 16 KiB) and HDD volumes by MiB/s (measured at 1 MiB).

Whichever limit you hit first, volume or instance, caps performance.

Take quiz
Which workload is most sensitive to IOPS rather than throughput?
Video file streaming
Bulk log archival
A nightly sequential backup of large files
A transactional database issuing many small random reads
How is throughput derived?
IOPS multiplied by I/O size
IOPS divided by volume size
IOPS plus latency
Volume size multiplied by AZ count

16. What is the Availability Zone restriction on EBS volumes?

An EBS volume exists in exactly one Availability Zone, and it can be attached only to instances in that same AZ. You cannot attach it across AZs or Regions directly.

To move data, take a snapshot (a regional object), then create a new volume from it in the target AZ. For another Region, copy the snapshot first.

This also shapes HA design: an AZ outage makes its volumes unreachable. Spread instances across AZs and rely on snapshots, replication at the application layer, or a shared service like EFS.

Take quiz
Where can an EBS volume be attached?
To instances in different Regions
Only to instances in its own Availability Zone
To any instance in the Region
To any instance in the account
What is the usual way to get a volume's data into another AZ?
Detach and reattach it
Enable Multi-Attach
Snapshot it and create a volume from the snapshot there
Edit the volume's AZ attribute

17. What is Amazon Data Lifecycle Manager?

Amazon Data Lifecycle Manager (DLM) automates creating, retaining, copying, and deleting EBS snapshots and EBS-backed AMIs through policies, so you do not need cron jobs or Lambda scripts.

A policy targets resources by tags (for example Backup=daily), sets a schedule such as every 12 or 24 hours, and defines retention by count or age. Policies can also copy snapshots to another Region or account, and move them to the archive tier.

For central backup across many AWS services with reporting and compliance, AWS Backup is the broader option. DLM is simpler when the need is EBS only.

Take quiz
How does a DLM policy usually pick which volumes to back up?
By IAM user name
By instance hostname
By volume size only
By resource tags
Which task does DLM automate?
Scheduled snapshot creation and retention cleanup
Filesystem repair
Live volume resizing on demand
OS patching

18. What is the EBS Snapshot Archive tier?

Snapshot Archive is a low-cost storage tier for snapshots you rarely need, priced roughly 75% below the standard tier.

  • Archived snapshots are stored as full copies, not incrementally.
  • Minimum retention is 90 days, and early deletion is charged for the remainder.
  • Restoring takes 24 to 72 hours, so it is not for quick recovery.

It fits compliance backups, end-of-project data, and old monthly or yearly copies. Keep your recent snapshots in the standard tier for fast restores. The switch can be done manually or by a DLM policy.

Take quiz
What is the minimum retention in the Snapshot Archive tier?
1 year
90 days
7 days
24 hours
How long can an archived snapshot take to restore?
Exactly 5 minutes
A few seconds
24 to 72 hours
Up to 30 days

19. What is the difference between EBS and instance store?

Both give an EC2 instance block storage, but persistence and location differ.

EBS Instance store
Location Network-attached storage Disks physically on the host
Persistence Survives stop and terminate Lost on stop, terminate, or host failure
Snapshots Yes No
Resize/retune Yes (Elastic Volumes) No
Latency Low Very low (local NVMe)
Cost Billed per GB provisioned Included with instance type

Use instance store for caches, scratch data, and replicated systems that can rebuild themselves. Use EBS for anything you cannot afford to lose.

Take quiz
What happens to instance store data when the instance is stopped?
It is kept for 24 hours
It moves to S3
It is saved to EBS
It is lost
Which is the better fit for a temporary cache that can be rebuilt?
Instance store
An io2 volume with Multi-Attach
A snapshot in the archive tier
Cold HDD sc1

20. What is the difference between gp2 and gp3?

The main difference is how performance is tied to size. gp2 links IOPS to capacity, while gp3 lets you set them independently.

gp2 gp3
Baseline IOPS 3 IOPS per GiB (min 100) 3,000 flat
Max IOPS 16,000 80,000
Max throughput 250 MiB/s 2,000 MiB/s
Burst credits Yes, up to 3,000 IOPS on small volumes No, baseline is always available
Price per GB Higher About 20% lower

With gp2, a 100 GiB volume gets only 300 baseline IOPS. To reach 3,000 you had to allocate 1,000 GiB. gp3 gives 3,000 at any size, so most gp2 volumes can be migrated with Elastic Volumes for lower cost and better performance.

Take quiz
Which volume gives 3,000 baseline IOPS regardless of size?
gp2
gp3
sc1
st1
How many baseline IOPS does a 200 GiB gp2 volume have?
16,000
3,000
600
200

21. How does the gp2 burst bucket work?

Each gp2 volume earns I/O credits at its baseline rate of 3 IOPS per GiB. Volumes smaller than 1,000 GiB can spend credits to burst up to 3,000 IOPS. The bucket holds up to 5.4 million credits and starts full.

Example: a 100 GiB volume has a baseline of 300 IOPS. Bursting at 3,000 drains credits at 2,700 per second, so a full bucket lasts about 2,000 seconds (roughly 33 minutes). After that, it drops to 300 IOPS until credits refill.

Volumes at 1,000 GiB or larger have a baseline of 3,000 or more, so they never need bursting. Watch the BurstBalance CloudWatch metric. A steady fall to 0% explains sudden database slowdowns, and moving to gp3 removes the issue.

Take quiz
What is the maximum burst IOPS for a small gp2 volume?
100
16,000
300
3,000
Which CloudWatch metric shows remaining gp2 burst credits?
BurstBalance
VolumeIdleTime
VolumeQueueLength
VolumeReadBytes

22. Why is gp3 preferred over gp2 for most workloads?

gp3 is cheaper per GB and gives more predictable performance, so there is rarely a reason to choose gp2 for new volumes.

  1. Lower cost: about 20% less per GB than gp2.
  2. No burst cliff: 3,000 IOPS and 125 MiB/s are always available, not credit-based.
  3. Independent tuning: pay for extra IOPS or throughput without buying unused capacity.
  4. Higher ceilings: up to 80,000 IOPS and 2,000 MiB/s.

One caveat: a very large gp2 volume (say 5 TiB) already has 15,000 IOPS baseline, so compare costs, since matching that on gp3 needs paid extra IOPS. Even then the migration is a no-downtime modify-volume call.

Take quiz
What is the main reason gp3 avoids gp2's sudden slowdowns?
It ignores instance limits
It has no credit-based burst bucket, baseline is always available
It uses HDD platters
It is stored in S3
How can gp3 give more IOPS without extra capacity?
Volumes automatically grow
You disable encryption
IOPS can be provisioned independently of size
You attach it to two instances

23. How are EBS snapshots incremental?

The first snapshot of a volume stores all blocks in use. Each later snapshot stores only blocks that changed since the previous snapshot and points to older snapshots for everything unchanged.

flowchart LR
 V["Volume blocks A B C D"] --> S1["Snapshot 1: A B C D"]
 V2["B changed to B2"] --> S2["Snapshot 2: only B2, refs A C D"]
 V3["E added"] --> S3["Snapshot 3: only E, refs earlier blocks"]
 S1 --> S2 --> S3

Each snapshot is still independently restorable: EBS reconstructs the full volume from the chain of references. That means you pay for unique changed data, not for the volume size each time. Deleting an older snapshot never breaks a newer one, because EBS keeps the blocks that newer snapshots still need.

Take quiz
What does snapshot 3 store in an incremental chain?
Only file names
A copy of snapshots 1 and 2
All blocks of the volume
Only blocks changed since snapshot 2
Can you restore from snapshot 3 without keeping snapshot 1?
Yes, EBS retains the blocks snapshot 3 still needs
Only after archiving snapshot 1
No, snapshot 1 is always required
Only in the same AZ

24. What happens when you delete an EBS snapshot?

Only the blocks that no other snapshot references are removed. Blocks needed by later snapshots are moved to remain available, so every remaining snapshot still restores in full.

This means deleting one snapshot may free little storage, especially if data changes slowly. Expect the cost drop to match the unique data that snapshot held.

  • You cannot delete a snapshot that backs a registered AMI. Deregister the AMI first.
  • Deleted snapshots can be recovered if a Recycle Bin rule covers them.
  • Snapshot deletion is safe for the chain but is permanent otherwise.
Take quiz
What is removed when a middle snapshot in a chain is deleted?
All newer snapshots
Only blocks not referenced by any other snapshot
The source volume
Every block of every snapshot
Why might deleting a snapshot fail?
It is larger than 1 TiB
It is older than 30 days
It backs a registered AMI
It has no tags

25. How do you move an EBS volume to another Availability Zone?

EBS has no direct move. You go through a snapshot, because snapshots are regional.

  1. Snapshot the volume (pause writes or unmount for a clean copy).
  2. Create a new volume from that snapshot, choosing the target AZ.
  3. Attach the new volume to an instance in that AZ and mount it.
aws ec2 create-volume \
  --snapshot-id snap-0123456789abcdef0 \
  --availability-zone us-east-1b \
  --volume-type gp3

For a whole instance, create an AMI and launch it in the other AZ. Changes made after the snapshot are not included, so plan a final cutover snapshot.

Take quiz
Which resource lets you re-create a volume in a different AZ?
A security group
A placement group
An Elastic IP
A snapshot
What is missing from the new volume?
Writes made after the snapshot was taken
Its encryption key
The volume's size
The file system type

26. How do you copy an EBS snapshot to another Region?

Use the copy operation, run against the destination Region, naming the source Region and snapshot ID.

aws ec2 copy-snapshot \
  --region eu-west-1 \
  --source-region us-east-1 \
  --source-snapshot-id snap-0123456789abcdef0 \
  --encrypted --kms-key-id alias/dr-key

The first copy transfers all blocks, later copies to the same destination are incremental. You can encrypt an unencrypted snapshot during the copy, or re-encrypt it with a different KMS key. Encrypted snapshots need a key that exists in the destination Region.

Cross-Region copies underpin disaster recovery and moving workloads. Time-based copy can guarantee a completion window of 15 minutes to 48 hours.

Take quiz
Where do you run copy-snapshot?
From inside the guest OS
Against the destination Region
Against the source AZ
Only from the S3 console
What can you change while copying a snapshot?
The source volume's AZ
The snapshot's creation time
Turn on encryption or use a different KMS key
The number of IOPS

27. How do you encrypt an existing unencrypted EBS volume?

You cannot flip encryption on for a volume in place. Instead, create an encrypted copy through a snapshot.

  1. Snapshot the unencrypted volume.
  2. Copy the snapshot and choose Encrypt, selecting a KMS key.
  3. Create a new volume from the encrypted copy in the same AZ as the instance.
  4. Stop the instance, detach the old volume, attach the new one under the same device name, and start it.

Alternatively, launch a new instance from an AMI copy made with encryption on. Once the volume is encrypted, it cannot be converted back to unencrypted. To avoid this chore for future volumes, enable EBS encryption by default in the Region.

Take quiz
Which resource do you copy to get an encrypted version of an unencrypted volume?
The instance's security group
The VPC route table
The AMI's kernel
Its snapshot, with encryption selected
Can an encrypted volume later be changed back to unencrypted in place?
No
Yes, by stopping the instance
Yes, with modify-volume
Yes, only for gp3

28. How does EBS encryption work with KMS?

EBS uses envelope encryption. When you create an encrypted volume, EBS asks KMS for a unique data key under your chosen KMS key. The data key is stored, encrypted, alongside the volume metadata.

On attach, EBS calls KMS to decrypt the data key using the caller's permissions and loads the plaintext key into the host that runs the instance. Data is then encrypted and decrypted transparently between the instance and the volume, and never leaves the volume unencrypted at rest.

  • The IAM role or user needs kms:CreateGrant, kms:Decrypt, and kms:GenerateDataKeyWithoutPlaintext on the key.
  • Disabling or deleting the key makes the volume unreadable.
  • Snapshots inherit the volume's data key.

A common failure is an instance failing to launch because its role lacks permission on a customer managed key.

Take quiz
What does EBS request from KMS when an encrypted volume is created?
A copy of the whole volume
A unique data key protected by your KMS key
An IAM role
A TLS certificate
What happens if the KMS key is disabled?
The volume moves to sc1
Snapshots are deleted
The encrypted volume cannot be read
The volume becomes unencrypted

29. Why do volumes restored from snapshots have slow first reads?

A volume created from a snapshot is available immediately, but its blocks are lazily loaded from S3 the first time each block is accessed. That first touch has higher latency than a normal read.

The effect is visible on databases or freshly launched fleets that scan many blocks right after restore. Newly written blocks are not affected, only blocks not yet fetched.

  • Initialize manually: read every block, for example with fio or dd, before production use.
  • Fast Snapshot Restore (FSR): enable on the snapshot for full performance from the first I/O.
  • Volume initialization rate: set a target rate when creating the volume, for predictable warm-up.
Take quiz
Why is the first read of a block from a restored volume slower?
It is HDD-backed
The volume is always throttled to 100 IOPS
Encryption is disabled on the first read
The block is fetched from S3 on first access
Which option removes first-access latency without manual reads?
Fast Snapshot Restore
Enabling Multi-Attach
Deleting older snapshots
Moving to another AZ

30. What is Fast Snapshot Restore and when should you use it?

Fast Snapshot Restore (FSR) pre-warms a snapshot in the AZs you pick, so volumes created from it deliver full provisioned performance immediately, with no lazy-loading delay.

You enable it per snapshot per AZ. It is billed for every hour it stays enabled in each AZ, and each Region has a limit on the number of FSR-enabled snapshots, so treat it as selective.

  • Good fit: launching many instances from one golden AMI snapshot, disaster recovery drills, large database restores with tight RTO.
  • Poor fit: rare restores or dev volumes, where the cost buys nothing.
aws ec2 enable-fast-snapshot-restores \
  --availability-zones us-east-1a us-east-1b \
  --source-snapshot-ids snap-0123456789abcdef0

Take quiz
At what level is FSR enabled?
Per instance only
Per snapshot, per Availability Zone
Per IAM user
Per Region for all snapshots
When is FSR most worthwhile?
Reducing the snapshot's size
Storing a single yearly archive
Restoring many volumes that must perform fully at once
Encrypting volumes

31. How do you increase the size of an EBS volume without downtime?

Use Elastic Volumes to grow the volume, then extend the partition and file system inside the OS. Neither step needs a reboot.

  1. Modify the volume size in the console or with modify-volume.
  2. Wait until the state is optimizing or completed.
  3. Grow the partition, then the file system.
lsblk
sudo growpart /dev/nvme0n1 1
sudo xfs_growfs -d /        # XFS
# sudo resize2fs /dev/nvme0n1p1   # ext4

Take a snapshot first as a safety net. Remember that size can never be reduced, and the next modification on the same volume must wait about 6 hours.

Take quiz
Which command extends an XFS file system after a volume grows?
mkfs.xfs
mount -a
fsck
xfs_growfs
What should you do before resizing a production volume?
Take a snapshot
Detach the volume
Terminate the instance
Change the AZ

32. Why can't you shrink an EBS volume, and how do you work around it?

EBS only supports growing a volume. The service cannot know which blocks the file system still uses, and shrinking would risk cutting data, so the API refuses a smaller size.

The workaround is to copy the data to a smaller volume:

  1. Create a new, smaller volume and attach it to the instance.
  2. Format it and copy the data, using rsync -aHAX for Linux.
  3. Verify, then switch mount points (or swap the volume) and detach the old one.
  4. Snapshot the old volume, then delete it after a safe waiting period.

The file system must fit the smaller size, so trim unused data first. Windows and some LVM setups can shrink the partition, but that does not reduce the EBS bill unless a new volume replaces the old one.

Take quiz
What does EBS allow regarding volume size changes?
Both up and down freely
Only increasing size
Neither
Only decreasing size
What is the standard workaround to get a smaller volume?
Change the volume type to sc1
Delete the largest snapshot
Create a smaller volume and copy the data across
Run modify-volume with a smaller size

33. How does EBS Multi-Attach work and what are its limitations?

With Multi-Attach, the same io1/io2 volume is exposed as a block device to several Nitro instances in one AZ. The volume accepts I/O from all of them and does not arbitrate writes.

flowchart TD
 V[(io2 Multi-Attach volume)]
 A["Instance A"] --> V
 B["Instance B"] --> V
 C["Instance C"] --> V
 V --> F["Cluster-aware FS or app-level locking"]
Limitation Detail
Volume types io1 and io2 only
Instances Up to 16, Nitro-based, same AZ
File system Must be cluster-aware (for example GFS2), not ext4/XFS
Root volume Not supported
Elastic Volumes Some changes are restricted while attached to multiple instances

io2 Block Express also supports I/O fencing (NVMe reservations) so a cluster manager can block a failed node from writing.

Take quiz
Who arbitrates concurrent writes on a Multi-Attach volume?
The instance metadata service
The AWS Shield service
The EBS service automatically
Your cluster file system or application
Which feature helps block a failed node from writing on io2 Multi-Attach?
NVMe reservations (I/O fencing)
EBS encryption
Volume Recycle Bin
Snapshot Archive

34. When would you choose io2 Block Express over gp3?

Pick io2 Block Express when a single volume must exceed what gp3 can give or when a stricter guarantee is required. Otherwise gp3 is cheaper and enough.

Need gp3 io2 Block Express
Max IOPS 80,000 256,000
Max throughput 2,000 MiB/s 4,000 MiB/s
Latency Single-digit ms Sub-millisecond average
Durability 99.8-99.9% 99.999%
Multi-Attach No Yes

Typical choices for io2: SAP HANA, Oracle or SQL Server production databases where IOPS above 80,000, consistent latency, or Multi-Attach for clustering is required. If your workload stays under 80,000 IOPS with millisecond tolerance, start on gp3 and measure.

Take quiz
Which requirement justifies moving from gp3 to io2 Block Express?
Storing rarely used archives
Needing more than 80,000 IOPS on one volume
Needing HDD throughput
Wanting a lower per-GB price
Which feature is available on io2 but not gp3?
Snapshots
Elastic Volumes
Multi-Attach
Encryption

35. When would you choose st1 over gp3?

Choose st1 when data is large, read and written in big sequential chunks, and cost per GB matters more than IOPS.

  • Log processing, Kafka brokers, MapReduce and Hadoop data nodes, ETL staging, data warehouse scans.
  • You need up to 500 MiB/s per volume at a low price per GB.

Avoid st1 for boot volumes, small random I/O, or databases, since it caps at 500 IOPS (measured with 1 MiB I/O). For that pattern gp3 is far better even if it costs more per GB.

Also note that gp3 can now deliver up to 2,000 MiB/s, so for high throughput needs on smaller datasets gp3 may be both simpler and competitive. Compare price per GB against your actual throughput target before choosing.

Take quiz
Which pattern suits st1 the best?
Tiny random reads with low latency
Boot disks
Multi-Attach clusters
Large sequential reads and writes at low cost per GB
Why is st1 a bad fit for an OLTP database?
It is limited to about 500 IOPS with high latency for random I/O
It cannot have snapshots
It only works in one Region
It cannot be encrypted

36. How do you troubleshoot slow EBS performance?

Work from the volume outward and check each limit that could cap I/O:

  1. Volume limits: compare VolumeReadOps + VolumeWriteOps and throughput against provisioned IOPS and MiB/s. For gp2, st1, and sc1, check BurstBalance.
  2. Queue depth: a consistently high VolumeQueueLength means the volume cannot keep up.
  3. Instance limits: confirm the instance type's EBS bandwidth and IOPS are not lower than the volume's.
  4. Snapshot initialization: restored volumes may still be lazily loading blocks.
  5. Modification in progress: an optimizing volume may be temporarily slower.
  6. I/O pattern: small I/O hits IOPS limits, large I/O hits throughput limits.

Use iostat -x 1 in Linux to see latency and utilization. Often the cure is moving gp2 to gp3, raising provisioned IOPS, or picking a larger instance.

Take quiz
Which metric points to a volume that cannot keep up with demand?
BurstBalance at 100%
A consistently high VolumeQueueLength
VolumeIdleTime near 100%
Zero VolumeReadOps
Which non-volume limit often caps EBS performance?
The security group rules
The KMS alias
The instance type's EBS bandwidth and IOPS
The AMI name

37. Which CloudWatch metrics monitor EBS volumes?

EBS publishes volume metrics to CloudWatch in the AWS/EBS namespace, at 1-minute periods for volumes on Nitro instances (5 minutes otherwise).

Metric What it tells you
VolumeReadOps / VolumeWriteOps I/O operations, divide by period for IOPS
VolumeReadBytes / VolumeWriteBytes Data transferred, gives throughput
VolumeQueueLength Pending I/O requests, high means saturation
VolumeIdleTime Seconds with no I/O, spots unused volumes
BurstBalance Remaining burst credits on gp2, st1, sc1
VolumeThroughputPercentage Percent of provisioned IOPS delivered (Provisioned IOPS)
VolumeTotalReadTime / WriteTime Latency per operation when divided by ops

Alarm on BurstBalance, queue length, and idle time to catch slowdowns and waste.

Take quiz
Which metric helps find EBS volumes that are attached but unused?
BurstBalance
VolumeTotalWriteTime
VolumeQueueLength
VolumeIdleTime
Which metric shows remaining burst credits?
BurstBalance
VolumeWriteBytes
VolumeReadOps
VolumeIdleTime

38. When should you use RAID 0 or RAID 1 with EBS?

EBS already replicates each volume inside its AZ, so RAID is used to change performance or capacity, not as your main safety net.

RAID 0 (stripe) RAID 1 (mirror)
Goal Higher IOPS, throughput, capacity Extra redundancy
Fault tolerance None, one volume lost loses all data Survives a volume failure
Cost Volumes add up Pays for double storage and double write bandwidth

Use RAID 0 to exceed a single volume's limits, though gp3's 64 TiB, 80,000 IOPS ceiling and io2's 256,000 IOPS make it less common now. It is still limited by the instance's EBS bandwidth.

AWS discourages RAID 5 and 6, since parity writes eat a large share of the IOPS you pay for. Whatever you choose, keep snapshots, and note that stripes need coordinated snapshots (multi-volume snapshots) to stay consistent.

Take quiz
What is the main risk of RAID 0 on EBS?
It disables snapshots
Losing one volume loses the whole array
It cuts IOPS in half
It needs io2 only
Why does AWS advise against RAID 5 or 6 on EBS?
They cannot use SSD
They are unsupported by Linux
Parity writes consume IOPS you pay for
They need instance store

39. How do you take application-consistent EBS snapshots?

A snapshot captures data on disk, so it is crash-consistent by default, like a sudden power loss. Data still in memory or in-flight transactions may be missing. Applications like databases need extra steps for application consistency.

  1. Quiesce the application: flush buffers, put the database in backup mode, or lock tables.
  2. Freeze the file system with fsfreeze (Linux) or use VSS (Windows).
  3. Start the snapshot. Once the API confirms it has begun, you can resume writes.
  4. Unfreeze and resume normal operation.
sudo fsfreeze -f /data
aws ec2 create-snapshot --volume-id vol-0abc1234def567890
sudo fsfreeze -u /data

For automation, Data Lifecycle Manager supports pre and post scripts through Systems Manager, and create-snapshots with an instance target takes crash-consistent snapshots of all volumes at the same moment.

Take quiz
What type of consistency does a plain snapshot provide?
Encrypted-consistent
Transaction-log-consistent
Fully application-consistent
Crash-consistent
Which tool freezes a Linux file system before snapshotting?
fsfreeze
fdisk
lsblk
growpart

40. How can you share an EBS snapshot with another AWS account?

Modify the snapshot's createVolumePermission to add the target account ID, then the other account can create volumes from it or copy it.

aws ec2 modify-snapshot-attribute \
  --snapshot-id snap-0123456789abcdef0 \
  --attribute createVolumePermission \
  --operation-type add --user-ids 123456789012

  • Unencrypted snapshots can be shared with specific accounts or made public (avoid public).
  • Encrypted snapshots can only be shared if encrypted with a customer managed KMS key, and that key must also be shared with the recipient. The default aws/ebs key cannot be shared.

The recipient should copy the snapshot into their own account (and re-encrypt with their own key), so they do not lose access if you revoke sharing. Turn on block public access for snapshots to prevent accidents.

Take quiz
Which KMS key type is required to share an encrypted snapshot?
The default aws/ebs key
A customer managed key
No key is needed
A root user password
Why should the recipient copy a shared snapshot?
To disable encryption
To change its AZ
So they keep access even if sharing is revoked
To make it smaller

41. What happens to an EBS volume when an EC2 instance stops or terminates?

It depends on the action and the volume's settings:

Action Root volume Extra volumes
Reboot Kept, no change Kept
Stop Kept and still billed Kept, still attached
Hibernate Kept, RAM contents saved to it Kept
Terminate Deleted by default (DeleteOnTermination = true) Kept by default, become available

Instance store volumes, in contrast, are wiped on stop or terminate. A stopped instance costs nothing for compute but you still pay for provisioned EBS storage, so delete leftover volumes and snapshots you no longer need.

Take quiz
What is the default fate of a non-root EBS volume when the instance terminates?
It is encrypted and archived
It moves to another AZ
It is deleted
It is kept and becomes available
What does hibernation write to the root EBS volume?
The contents of RAM
The instance's security groups
A snapshot of the AMI
CloudWatch logs

42. How do you recover data from the root volume of an unreachable instance?

Attach the broken root volume to a healthy rescue instance in the same AZ, fix or copy files, then put it back.

  1. Snapshot the root volume as a safety copy.
  2. Stop the broken instance (not terminate).
  3. Detach its root volume and attach it to the rescue instance as a secondary device, such as /dev/sdf.
  4. Mount it, then repair /etc/fstab, SSH keys, or logs, or copy out the data.
  5. Unmount, detach, reattach to the original instance using its root device name (e.g. /dev/xvda), and start it.

Common causes are a bad fstab entry, a full disk, broken SSH configuration, or a kernel issue. Newer options include EC2 Serial Console, Systems Manager Automation runbooks, and the replace root volume feature.

Take quiz
Where must the rescue instance be relative to the broken volume?
In any Region
In the same Availability Zone
It does not matter
In a different account
Which step keeps the original volume safe before repairs?
Terminate the instance
Delete /etc/fstab
Take a snapshot first
Change the key pair

43. How can you optimize EBS costs?

EBS bills for provisioned GB, IOPS, and throughput, plus stored snapshot data, whether or not you use them. Savings come from removing waste:

  1. Migrate gp2 to gp3 for roughly 20% lower per-GB cost with better baseline performance.
  2. Delete unattached volumes (state available) and volumes with near-zero VolumeIdleTime activity.
  3. Right-size IOPS and throughput on gp3 and io2 using CloudWatch data or Compute Optimizer recommendations.
  4. Expire old snapshots with Data Lifecycle Manager retention, and move long-term ones to the Snapshot Archive.
  5. Use st1/sc1 for cold, sequential data.
  6. Tag volumes so Cost Explorer can attribute spend to teams.

Since volumes cannot shrink, avoid oversizing at creation. Delete leftover snapshots after deregistering AMIs.

Take quiz
Which change usually cuts per-GB cost with no downtime?
Moving gp3 to io2
Adding RAID 1
Turning on Multi-Attach
Moving gp2 volumes to gp3
Which volume state usually signals a possible cost leak?
Available (unattached)
Optimizing
In-use
Creating

44. How does the EBS Recycle Bin protect against accidental deletion?

Recycle Bin holds deleted EBS snapshots and EBS-backed AMIs for a retention period you define, so you can restore them instead of losing them.

  • Create retention rules for a Region or tag-matched resources.
  • Retention runs from 1 day to 1 year.
  • Restore a resource with a console click or restore-snapshot-from-recycle-bin.
  • Items in the bin are billed at the normal rate and are purged after the period ends.

It covers snapshots and AMIs, not volumes, so keep snapshots current for volume protection. Use IAM policies and rule locks so nobody can shorten or delete the retention rule.

Take quiz
What resources does Recycle Bin protect for EBS?
Running instances
Snapshots and EBS-backed AMIs
KMS keys
Volumes directly
What is the retention range for a Recycle Bin rule?
30 days fixed
1 hour to 7 days
1 day to 1 year
Unlimited

45. Explain the lifecycle of an EBS volume?

A volume moves through a small set of states as you create, use, and delete it.

stateDiagram-v2
 [*] --> creating
 creating --> available
 available --> in_use: attach
 in_use --> available: detach
 available --> deleting: delete
 deleting --> deleted
 creating --> error
 deleted --> [*]
  • creating: being provisioned, possibly from a snapshot.
  • available: ready but not attached, still billed.
  • in-use: attached to an instance, even when the instance is stopped.
  • deleting / deleted: being removed, then gone permanently.
  • error: a failure during creation.

Detach cleanly by unmounting first. Snapshots taken while the volume is in any of these usable states remain after the volume is deleted.

Take quiz
Which state means a volume exists but is not attached?
creating
deleting
in-use
available
What state does a volume return to after it is detached?
available
error
creating
deleted

46. How do you mount and persist a new EBS volume on Linux?

After attaching, format the disk if it is new, mount it, and add an /etc/fstab entry so it mounts after a reboot.

lsblk
sudo file -s /dev/nvme1n1        # 'data' = no file system yet
sudo mkfs -t xfs /dev/nvme1n1
sudo mkdir /data && sudo mount /dev/nvme1n1 /data
sudo blkid /dev/nvme1n1          # copy the UUID
echo &#x27;UUID=<uuid> /data xfs defaults,nofail 0 2&#x27; | sudo tee -a /etc/fstab
sudo mount -a                    # test fstab

Use the UUID, not the device name, because NVMe names can change between reboots. Add nofail so a missing volume does not stop the instance booting. Skip mkfs for a volume restored from a snapshot, or you erase its data.

Take quiz
Why use the UUID in /etc/fstab?
It enables encryption
Device names like nvme1n1 can change across reboots
It grows the volume
UUIDs make volumes faster
What does the nofail option do?
Makes the mount read-only
Skips the file system check permanently
Lets the instance boot even if the volume is missing
Disables snapshots

47. What are EBS direct APIs and when are they useful?

EBS direct APIs let you read and write snapshot contents at the block level over the API, without creating a volume from the snapshot. Blocks are 512 KiB.

API Purpose
ListSnapshotBlocks Lists blocks that hold data in a snapshot
ListChangedBlocks Shows blocks that differ between two snapshots
GetSnapshotBlock Reads one block
StartSnapshot, PutSnapshotBlock, CompleteSnapshot Build a new snapshot from your own data

Useful for third-party backup tools doing efficient incremental copies, for reading diffs to speed up cross-account or on-premises backups, and for importing disk images as snapshots. Access needs the ebs: IAM actions.

Take quiz
Which API lists the blocks that differ between two snapshots?
StartSnapshot
CompleteSnapshot
GetSnapshotBlock
ListChangedBlocks
What is the main benefit of direct APIs?
Reading snapshot data without restoring a volume
Resizing volumes
Increasing IOPS
Encrypting the root volume

48. What is the difference between EBS, EFS, and S3?

They are three storage models for different access patterns.

EBS EFS S3
Type Block File (NFS) Object (HTTP API)
Scope One AZ, usually one instance Multi-AZ, thousands of clients Regional, unlimited
Best for Boot disks, databases Shared content, home directories Backups, media, data lakes
Mounted as A disk you format A shared directory Not mounted, accessed by API

Pick EBS for low-latency single-host storage, EFS when many Linux instances need the same file tree, and S3 for durable, cheap object storage accessed by applications.

Take quiz
Which service gives many Linux instances a shared NFS file system?
EBS
EFS
S3 Glacier
Instance store
Which storage type is EBS?
Object storage
File storage over NFS
Block storage
Tape archive

49. How do you protect EBS snapshots from deletion or ransomware?

Use EBS Snapshot Lock, which makes a snapshot immutable for a set duration so no one can delete it, including compromised admin credentials.

Mode Behavior
Governance Authorized users with the right IAM permission can change or remove the lock
Compliance Nobody can remove it after an optional cooling-off period ends, even the root user

Lock durations run from 1 day up to about 100 years. Pair it with Recycle Bin rule locks, cross-account and cross-Region copies, and tight IAM policies on ec2:DeleteSnapshot. Store copies in a separate backup account so one breach cannot reach every copy.

Take quiz
Which mode prevents even the root user from removing a lock after cooling-off?
Recycle mode
Governance mode
Archive mode
Compliance mode
What does Snapshot Lock make a snapshot?
Immutable for a chosen duration
Public
Faster to restore
Free to store

50. How do you size an EBS volume for a target IOPS?

Each type has a maximum IOPS-to-size ratio, so a target IOPS sets a minimum size.

Type IOPS per GiB Size needed for 16,000 IOPS
gp2 3 (baseline) 5,334 GiB
gp3 up to 500 provisioned 32 GiB
io1 up to 50 320 GiB
io2 Block Express up to 1,000 16 GiB

For throughput on gp3, the ceiling is 0.25 MiB/s per provisioned IOPS, so reaching 1,000 MiB/s requires at least 4,000 IOPS. Then confirm the instance type can carry that load.

This is why gp3 replaced gp2: 10,000 IOPS on gp2 needs about 3,334 GiB, but only 20 GiB on gp3.

Take quiz
Roughly what gp2 size gives 10,000 baseline IOPS?
About 200 GiB
About 3,334 GiB
About 20 GiB
About 32 GiB
What is the maximum provisioned IOPS-to-size ratio for gp3?
1,000 IOPS per GiB
50 IOPS per GiB
500 IOPS per GiB
3 IOPS per GiB
«
»

Comments & Discussions