Cloud / Amazon EBS (Elastic Block Storage) Interview questions
Last updated
1. What is Amazon EBS?
Amazon Elastic Block Store (EBS) is a block-level storage service that gives EC2 instances persistent volumes. A volume shows up in the operating system as a raw disk, so you format it with a file system (ext4, XFS, NTFS) or hand it directly to a database.
Data lives independently of the instance. If you stop or even terminate the instance, a non-root volume keeps its data unless you delete it.
- Volumes are tied to a single Availability Zone and attach to instances in that same AZ.
- You choose size and volume type (SSD or HDD) based on your IOPS and throughput needs.
- You can back volumes up with snapshots stored durably in S3-managed storage.
- Volumes can be resized and retuned while in use with Elastic Volumes.
Typical uses are boot disks, relational and NoSQL databases, and big-data or log-processing workloads that need disk-like access.
Take quiz
An S3 bucket exposed as a folder
A read-only container image
An NFS share mounted over the network
A raw block device that you format with a file system
The volume and its data are kept
The data is moved to S3 automatically
The volume is always wiped and deleted
The volume is converted to a snapshot and removed
2. What are the main types of Amazon EBS volumes?
EBS volumes fall into three groups: SSD-backed, HDD-backed, and the legacy magnetic type.
| Type | Family | Best for |
| gp3 / gp2 | General Purpose SSD | Boot volumes, dev/test, most apps |
| io2 Block Express / io1 | Provisioned IOPS SSD | Latency-sensitive databases |
| st1 | Throughput Optimized HDD | Big data, logs, streaming reads |
| sc1 | Cold HDD | Infrequently accessed, lowest cost |
| Magnetic (standard) | Previous generation | Legacy only |
SSD volumes are optimized for IOPS (small random I/O). HDD volumes are optimized for MiB/s throughput on large sequential I/O, and st1/sc1 cannot be used as boot volumes.
Take quiz
st1
sc1
io2 Block Express
gp3
Every EBS type can boot
gp3 and gp2 SSD volumes
st1 and sc1 HDD volumes
io1 and io2 volumes
3. What is a General Purpose SSD (gp3) volume?
gp3 is the current default EBS volume type. It balances price and performance for a wide range of workloads such as boot volumes, dev/test environments, and small to mid-sized databases.
Every gp3 volume includes a baseline of 3,000 IOPS and 125 MiB/s no matter how large it is. You can provision more of either independently of capacity, up to 80,000 IOPS and 2,000 MiB/s, and sizes now reach 64 TiB (the limits were raised in September 2025).
Because IOPS and throughput are decoupled from size, you no longer have to buy extra gigabytes just to get more performance, which was the gp2 pain point. Per-GB price is also about 20% lower than gp2.
Take quiz
16,000 IOPS and 1,000 MiB/s
100 IOPS and 40 MiB/s
It depends on the volume size
3,000 IOPS and 125 MiB/s
Provision additional IOPS independently of size
Switch the file system to XFS
Increase the size until 3 IOPS per GiB is reached
Attach it to a larger AZ
4. What is a Provisioned IOPS SSD volume?
Provisioned IOPS SSD volumes (io2 Block Express and the older io1) are the highest-performance EBS volumes. You specify the exact IOPS you need and EBS delivers it consistently with low latency.
io2 Block Express supports up to 256,000 IOPS, 4,000 MiB/s, and 64 TiB per volume, with sub-millisecond average latency on Nitro instances. It also offers 99.999% durability, versus 99.8-99.9% for other types. Since April 30, 2025, every io2 volume runs on Block Express.
They suit mission-critical databases such as SAP HANA, Oracle, and SQL Server. They are also the only types that support Multi-Attach. Expect to pay noticeably more than gp3.
Take quiz
99.5%
99.999%
99.0%
99.8%
st1 and sc1
gp3 only
Provisioned IOPS (io1 and io2)
All SSD and HDD types
5. What are Throughput Optimized HDD (st1) and Cold HDD (sc1) volumes?
Both are HDD-backed volumes built for large, sequential I/O where MiB/s matters more than IOPS. They use a burst-bucket model tied to volume size.
| st1 | sc1 | |
| Baseline | 40 MiB/s per TiB | 12 MiB/s per TiB |
| Burst | 250 MiB/s per TiB | 80 MiB/s per TiB |
| Max throughput | 500 MiB/s | 250 MiB/s |
| Max IOPS | 500 | 250 |
| Use case | Kafka, ETL, log processing, data warehouse | Cold, rarely read archives |
Size range is 125 GiB to 16 TiB. Neither can be a boot volume, and both perform poorly for small random reads, so do not put databases on them.
Take quiz
A latency-sensitive OLTP database
A Multi-Attach cluster disk
A root/boot volume
Streaming logs and large sequential ETL scans
500 MiB/s
250 MiB/s
1,000 MiB/s
4,000 MiB/s
6. What is an EBS snapshot?
An EBS snapshot is a point-in-time backup of a volume, stored in Amazon S3 (managed by AWS, so you will not see it in your buckets). Snapshots are incremental: the first one copies all used blocks, and later ones store only blocks that changed.
Snapshots are regional, not tied to an AZ, which makes them the standard way to restore a volume in a different AZ, copy data to another Region, or share it with another account. You can also register a snapshot of a root volume as an AMI.
aws ec2 create-snapshot \ --volume-id vol-0abc1234def567890 \ --description "nightly backup"
Take quiz
On the same instance store disk
In AWS-managed S3 storage, available regionally
In a customer-owned S3 bucket you must create
Only inside the source Availability Zone
Only the file system metadata
A complete copy of the whole volume
Only blocks changed since the previous snapshot
Nothing until the first snapshot is deleted
7. What is the purpose of an EBS-optimized instance?
EBS-optimized instances have dedicated bandwidth between the EC2 instance and EBS, so storage traffic does not compete with normal network traffic. That gives more consistent I/O performance.
Almost all current-generation instances are EBS-optimized by default at no extra charge, and Nitro-based types get this through the Nitro card. Older types needed the option turned on and sometimes cost extra.
Each instance type also has its own maximum EBS bandwidth and IOPS. If those are lower than what your volumes can deliver, the instance becomes the bottleneck.
Take quiz
Cross-AZ replication of volumes
Automatic encryption of every volume
Free unlimited snapshots
Dedicated bandwidth between the instance and EBS
The instance type's EBS bandwidth or IOPS limit
The volume is in the wrong Region
Snapshots are disabled
The AMI is unencrypted
8. How do you attach an EBS volume to an EC2 instance?
The volume and the instance must be in the same Availability Zone, and the volume must be in the available state. Then attach it from the console (Actions > Attach volume) or the CLI, and pick a device name.
aws ec2 attach-volume \ --volume-id vol-0abc1234def567890 \ --instance-id i-0123456789abcdef0 \ --device /dev/sdf
Attaching is not the last step. Inside the OS you still need to find the device (lsblk), create a file system if it is new (mkfs), and mount it. On Nitro instances the device appears as /dev/nvme1n1 rather than /dev/sdf.
Take quiz
Both are in different Availability Zones
Both are in the same Availability Zone
The volume must be a snapshot
The instance must be terminated first
As /dev/cdrom0
It does not appear until reboot
As an NVMe device such as /dev/nvme1n1
As a mounted S3 path
9. What is the durability and availability of EBS volumes?
EBS volumes are replicated automatically across multiple servers within one Availability Zone, so a single hardware failure does not lose data.
| Volume type | Designed durability | Annual failure rate |
| gp3, gp2, io1, st1, sc1 | 99.8% - 99.9% | 0.1% - 0.2% |
| io2 Block Express | 99.999% | 0.001% |
Replication stays inside the AZ. If the whole AZ fails, the volume is unavailable, so snapshots (regional) are your defense. For higher resilience, copy snapshots to another Region.
Take quiz
Across all Regions
To a second AZ automatically
To an S3 bucket every second
Across multiple servers within one Availability Zone
Snapshots stored regionally
Multi-Attach
EBS-optimized instances
The volume's built-in cross-AZ mirror
10. What is the purpose of the Delete on Termination flag?
DeleteOnTermination controls whether an EBS volume is deleted automatically when its EC2 instance is terminated.
- Root volume: defaults to true, so it disappears with the instance.
- Additional volumes: default to false, so they survive termination.
Set it to false on a root volume if you need to keep the OS disk for forensics. The flag can be changed on a running instance:
aws ec2 modify-instance-attribute \ --instance-id i-0123456789abcdef0 \ --block-device-mappings '[{"DeviceName":"/dev/xvda","Ebs":{"DeleteOnTermination":false}}]'
Forgotten volumes that stay behind are a common source of silent EBS cost.
Take quiz
false
true
It is always prompted
It depends on volume size
To enable Multi-Attach
To make the volume faster
To keep the disk for troubleshooting or forensics after termination
To convert it to gp3
11. What is Amazon EBS encryption?
EBS encryption protects data at rest, data in transit between the instance and the volume, and the snapshots created from it. It uses AES-256 with keys managed in AWS KMS, either the AWS managed key (aws/ebs) or your own customer managed key.
You do not manage anything in the guest OS, and the performance impact is minimal on supported instance types. Snapshots of an encrypted volume are encrypted, and volumes made from them are too.
You can turn on EBS encryption by default per Region in an account, so every new volume is encrypted automatically.
Take quiz
Amazon Inspector
AWS Config
AWS Shield
AWS KMS
Makes every newly created volume in that Region encrypted
Disables snapshots
Encrypts S3 buckets in the account
Encrypts existing volumes instantly
12. What is an EBS root volume?
The root volume is the EBS volume that holds the operating system an instance boots from. It is created from the AMI's root snapshot when you launch an EBS-backed instance.
Only SSD volume types (gp2, gp3, io1, io2) and legacy magnetic can be boot volumes. You can enlarge it, change its type, or snapshot it at any time. Because it is EBS-backed, the instance can be stopped and started without losing the OS state, unlike instance-store-backed instances.
By default the root volume is deleted when the instance terminates.
Take quiz
An instance store disk
The AMI's root snapshot
A CloudFormation stack
An S3 bucket you name
It never costs anything
It can be shared without snapshots
The instance can be stopped and restarted keeping its OS state
It works across AZs
13. What is EBS Multi-Attach?
Multi-Attach lets a single io1 or io2 volume be attached to up to 16 Nitro-based instances in the same Availability Zone at once. Every instance gets full read and write access.
EBS does not coordinate the writes. You need a cluster-aware file system (or an application that manages concurrent access), because ordinary ext4 or XFS would corrupt when written from many hosts.
- Same AZ only.
- Not supported on the root volume.
- Supported on io1/io2, not gp3 or HDD types.
Typical use cases are clustered databases and high-availability designs that need fast failover.
Take quiz
Up to 128
Unlimited
Up to 2
Up to 16
A cluster-aware file system or application-level coordination
A larger instance type
An extra snapshot each minute
Standard ext4 is enough
14. What are Elastic Volumes in EBS?
Elastic Volumes is the feature that lets you change a volume's size, type, IOPS, and throughput while it is attached and in use, with no detach and no downtime for current-generation instances.
After you request a change, the volume moves through modifying and optimizing states before showing completed. It is usable during optimizing, though performance may be in between the old and new settings.
aws ec2 modify-volume \ --volume-id vol-0abc1234def567890 \ --volume-type gp3 --size 500 --iops 6000
Two rules to remember: you can only increase size, and you must wait about 6 hours (or until optimization ends) before modifying the same volume again. After growing, extend the partition and file system inside the OS.
Take quiz
Raising provisioned IOPS
Reducing the volume size
Changing gp2 to gp3
Increasing the volume size
Nothing, it is automatic
Recreate the snapshot
Extend the partition and file system
Reinstall the OS
15. What are IOPS and throughput in EBS?
IOPS is the number of read/write operations per second. Throughput is the amount of data moved per second, in MiB/s. They are linked by I/O size:
Throughput = IOPS x I/O size
A database doing many small 8-16 KiB reads is limited by IOPS. A backup job streaming 1 MiB blocks is limited by throughput. That is why SSD volumes are rated by IOPS (measured at 16 KiB) and HDD volumes by MiB/s (measured at 1 MiB).
Whichever limit you hit first, volume or instance, caps performance.
Take quiz
Video file streaming
Bulk log archival
A nightly sequential backup of large files
A transactional database issuing many small random reads
IOPS multiplied by I/O size
IOPS divided by volume size
IOPS plus latency
Volume size multiplied by AZ count
16. What is the Availability Zone restriction on EBS volumes?
An EBS volume exists in exactly one Availability Zone, and it can be attached only to instances in that same AZ. You cannot attach it across AZs or Regions directly.
To move data, take a snapshot (a regional object), then create a new volume from it in the target AZ. For another Region, copy the snapshot first.
This also shapes HA design: an AZ outage makes its volumes unreachable. Spread instances across AZs and rely on snapshots, replication at the application layer, or a shared service like EFS.
Take quiz
To instances in different Regions
Only to instances in its own Availability Zone
To any instance in the Region
To any instance in the account
Detach and reattach it
Enable Multi-Attach
Snapshot it and create a volume from the snapshot there
Edit the volume's AZ attribute
17. What is Amazon Data Lifecycle Manager?
Amazon Data Lifecycle Manager (DLM) automates creating, retaining, copying, and deleting EBS snapshots and EBS-backed AMIs through policies, so you do not need cron jobs or Lambda scripts.
A policy targets resources by tags (for example Backup=daily), sets a schedule such as every 12 or 24 hours, and defines retention by count or age. Policies can also copy snapshots to another Region or account, and move them to the archive tier.
For central backup across many AWS services with reporting and compliance, AWS Backup is the broader option. DLM is simpler when the need is EBS only.
Take quiz
By IAM user name
By instance hostname
By volume size only
By resource tags
Scheduled snapshot creation and retention cleanup
Filesystem repair
Live volume resizing on demand
OS patching
18. What is the EBS Snapshot Archive tier?
Snapshot Archive is a low-cost storage tier for snapshots you rarely need, priced roughly 75% below the standard tier.
- Archived snapshots are stored as full copies, not incrementally.
- Minimum retention is 90 days, and early deletion is charged for the remainder.
- Restoring takes 24 to 72 hours, so it is not for quick recovery.
It fits compliance backups, end-of-project data, and old monthly or yearly copies. Keep your recent snapshots in the standard tier for fast restores. The switch can be done manually or by a DLM policy.
Take quiz
1 year
90 days
7 days
24 hours
Exactly 5 minutes
A few seconds
24 to 72 hours
Up to 30 days
19. What is the difference between EBS and instance store?
Both give an EC2 instance block storage, but persistence and location differ.
| EBS | Instance store | |
| Location | Network-attached storage | Disks physically on the host |
| Persistence | Survives stop and terminate | Lost on stop, terminate, or host failure |
| Snapshots | Yes | No |
| Resize/retune | Yes (Elastic Volumes) | No |
| Latency | Low | Very low (local NVMe) |
| Cost | Billed per GB provisioned | Included with instance type |
Use instance store for caches, scratch data, and replicated systems that can rebuild themselves. Use EBS for anything you cannot afford to lose.
Take quiz
It is kept for 24 hours
It moves to S3
It is saved to EBS
It is lost
Instance store
An io2 volume with Multi-Attach
A snapshot in the archive tier
Cold HDD sc1
20. What is the difference between gp2 and gp3?
The main difference is how performance is tied to size. gp2 links IOPS to capacity, while gp3 lets you set them independently.
| gp2 | gp3 | |
| Baseline IOPS | 3 IOPS per GiB (min 100) | 3,000 flat |
| Max IOPS | 16,000 | 80,000 |
| Max throughput | 250 MiB/s | 2,000 MiB/s |
| Burst credits | Yes, up to 3,000 IOPS on small volumes | No, baseline is always available |
| Price per GB | Higher | About 20% lower |
With gp2, a 100 GiB volume gets only 300 baseline IOPS. To reach 3,000 you had to allocate 1,000 GiB. gp3 gives 3,000 at any size, so most gp2 volumes can be migrated with Elastic Volumes for lower cost and better performance.
Take quiz
gp2
gp3
sc1
st1
16,000
3,000
600
200
21. How does the gp2 burst bucket work?
Each gp2 volume earns I/O credits at its baseline rate of 3 IOPS per GiB. Volumes smaller than 1,000 GiB can spend credits to burst up to 3,000 IOPS. The bucket holds up to 5.4 million credits and starts full.
Example: a 100 GiB volume has a baseline of 300 IOPS. Bursting at 3,000 drains credits at 2,700 per second, so a full bucket lasts about 2,000 seconds (roughly 33 minutes). After that, it drops to 300 IOPS until credits refill.
Volumes at 1,000 GiB or larger have a baseline of 3,000 or more, so they never need bursting. Watch the BurstBalance CloudWatch metric. A steady fall to 0% explains sudden database slowdowns, and moving to gp3 removes the issue.
Take quiz
100
16,000
300
3,000
BurstBalance
VolumeIdleTime
VolumeQueueLength
VolumeReadBytes
22. Why is gp3 preferred over gp2 for most workloads?
gp3 is cheaper per GB and gives more predictable performance, so there is rarely a reason to choose gp2 for new volumes.
- Lower cost: about 20% less per GB than gp2.
- No burst cliff: 3,000 IOPS and 125 MiB/s are always available, not credit-based.
- Independent tuning: pay for extra IOPS or throughput without buying unused capacity.
- Higher ceilings: up to 80,000 IOPS and 2,000 MiB/s.
One caveat: a very large gp2 volume (say 5 TiB) already has 15,000 IOPS baseline, so compare costs, since matching that on gp3 needs paid extra IOPS. Even then the migration is a no-downtime modify-volume call.
Take quiz
It ignores instance limits
It has no credit-based burst bucket, baseline is always available
It uses HDD platters
It is stored in S3
Volumes automatically grow
You disable encryption
IOPS can be provisioned independently of size
You attach it to two instances
23. How are EBS snapshots incremental?
The first snapshot of a volume stores all blocks in use. Each later snapshot stores only blocks that changed since the previous snapshot and points to older snapshots for everything unchanged.
flowchart LR V["Volume blocks A B C D"] --> S1["Snapshot 1: A B C D"] V2["B changed to B2"] --> S2["Snapshot 2: only B2, refs A C D"] V3["E added"] --> S3["Snapshot 3: only E, refs earlier blocks"] S1 --> S2 --> S3
Each snapshot is still independently restorable: EBS reconstructs the full volume from the chain of references. That means you pay for unique changed data, not for the volume size each time. Deleting an older snapshot never breaks a newer one, because EBS keeps the blocks that newer snapshots still need.
Take quiz
Only file names
A copy of snapshots 1 and 2
All blocks of the volume
Only blocks changed since snapshot 2
Yes, EBS retains the blocks snapshot 3 still needs
Only after archiving snapshot 1
No, snapshot 1 is always required
Only in the same AZ
24. What happens when you delete an EBS snapshot?
Only the blocks that no other snapshot references are removed. Blocks needed by later snapshots are moved to remain available, so every remaining snapshot still restores in full.
This means deleting one snapshot may free little storage, especially if data changes slowly. Expect the cost drop to match the unique data that snapshot held.
- You cannot delete a snapshot that backs a registered AMI. Deregister the AMI first.
- Deleted snapshots can be recovered if a Recycle Bin rule covers them.
- Snapshot deletion is safe for the chain but is permanent otherwise.
Take quiz
All newer snapshots
Only blocks not referenced by any other snapshot
The source volume
Every block of every snapshot
It is larger than 1 TiB
It is older than 30 days
It backs a registered AMI
It has no tags
25. How do you move an EBS volume to another Availability Zone?
EBS has no direct move. You go through a snapshot, because snapshots are regional.
- Snapshot the volume (pause writes or unmount for a clean copy).
- Create a new volume from that snapshot, choosing the target AZ.
- Attach the new volume to an instance in that AZ and mount it.
aws ec2 create-volume \ --snapshot-id snap-0123456789abcdef0 \ --availability-zone us-east-1b \ --volume-type gp3
For a whole instance, create an AMI and launch it in the other AZ. Changes made after the snapshot are not included, so plan a final cutover snapshot.
Take quiz
A security group
A placement group
An Elastic IP
A snapshot
Writes made after the snapshot was taken
Its encryption key
The volume's size
The file system type
26. How do you copy an EBS snapshot to another Region?
Use the copy operation, run against the destination Region, naming the source Region and snapshot ID.
aws ec2 copy-snapshot \ --region eu-west-1 \ --source-region us-east-1 \ --source-snapshot-id snap-0123456789abcdef0 \ --encrypted --kms-key-id alias/dr-key
The first copy transfers all blocks, later copies to the same destination are incremental. You can encrypt an unencrypted snapshot during the copy, or re-encrypt it with a different KMS key. Encrypted snapshots need a key that exists in the destination Region.
Cross-Region copies underpin disaster recovery and moving workloads. Time-based copy can guarantee a completion window of 15 minutes to 48 hours.
Take quiz
From inside the guest OS
Against the destination Region
Against the source AZ
Only from the S3 console
The source volume's AZ
The snapshot's creation time
Turn on encryption or use a different KMS key
The number of IOPS
27. How do you encrypt an existing unencrypted EBS volume?
You cannot flip encryption on for a volume in place. Instead, create an encrypted copy through a snapshot.
- Snapshot the unencrypted volume.
- Copy the snapshot and choose Encrypt, selecting a KMS key.
- Create a new volume from the encrypted copy in the same AZ as the instance.
- Stop the instance, detach the old volume, attach the new one under the same device name, and start it.
Alternatively, launch a new instance from an AMI copy made with encryption on. Once the volume is encrypted, it cannot be converted back to unencrypted. To avoid this chore for future volumes, enable EBS encryption by default in the Region.
Take quiz
The instance's security group
The VPC route table
The AMI's kernel
Its snapshot, with encryption selected
No
Yes, by stopping the instance
Yes, with modify-volume
Yes, only for gp3
28. How does EBS encryption work with KMS?
EBS uses envelope encryption. When you create an encrypted volume, EBS asks KMS for a unique data key under your chosen KMS key. The data key is stored, encrypted, alongside the volume metadata.
On attach, EBS calls KMS to decrypt the data key using the caller's permissions and loads the plaintext key into the host that runs the instance. Data is then encrypted and decrypted transparently between the instance and the volume, and never leaves the volume unencrypted at rest.
- The IAM role or user needs
kms:CreateGrant,kms:Decrypt, andkms:GenerateDataKeyWithoutPlaintexton the key. - Disabling or deleting the key makes the volume unreadable.
- Snapshots inherit the volume's data key.
A common failure is an instance failing to launch because its role lacks permission on a customer managed key.
Take quiz
A copy of the whole volume
A unique data key protected by your KMS key
An IAM role
A TLS certificate
The volume moves to sc1
Snapshots are deleted
The encrypted volume cannot be read
The volume becomes unencrypted
29. Why do volumes restored from snapshots have slow first reads?
A volume created from a snapshot is available immediately, but its blocks are lazily loaded from S3 the first time each block is accessed. That first touch has higher latency than a normal read.
The effect is visible on databases or freshly launched fleets that scan many blocks right after restore. Newly written blocks are not affected, only blocks not yet fetched.
- Initialize manually: read every block, for example with
fioordd, before production use. - Fast Snapshot Restore (FSR): enable on the snapshot for full performance from the first I/O.
- Volume initialization rate: set a target rate when creating the volume, for predictable warm-up.
Take quiz
It is HDD-backed
The volume is always throttled to 100 IOPS
Encryption is disabled on the first read
The block is fetched from S3 on first access
Fast Snapshot Restore
Enabling Multi-Attach
Deleting older snapshots
Moving to another AZ
30. What is Fast Snapshot Restore and when should you use it?
Fast Snapshot Restore (FSR) pre-warms a snapshot in the AZs you pick, so volumes created from it deliver full provisioned performance immediately, with no lazy-loading delay.
You enable it per snapshot per AZ. It is billed for every hour it stays enabled in each AZ, and each Region has a limit on the number of FSR-enabled snapshots, so treat it as selective.
- Good fit: launching many instances from one golden AMI snapshot, disaster recovery drills, large database restores with tight RTO.
- Poor fit: rare restores or dev volumes, where the cost buys nothing.
aws ec2 enable-fast-snapshot-restores \ --availability-zones us-east-1a us-east-1b \ --source-snapshot-ids snap-0123456789abcdef0
Take quiz
Per instance only
Per snapshot, per Availability Zone
Per IAM user
Per Region for all snapshots
Reducing the snapshot's size
Storing a single yearly archive
Restoring many volumes that must perform fully at once
Encrypting volumes
31. How do you increase the size of an EBS volume without downtime?
Use Elastic Volumes to grow the volume, then extend the partition and file system inside the OS. Neither step needs a reboot.
- Modify the volume size in the console or with
modify-volume. - Wait until the state is optimizing or completed.
- Grow the partition, then the file system.
lsblk sudo growpart /dev/nvme0n1 1 sudo xfs_growfs -d / # XFS # sudo resize2fs /dev/nvme0n1p1 # ext4
Take a snapshot first as a safety net. Remember that size can never be reduced, and the next modification on the same volume must wait about 6 hours.
Take quiz
mkfs.xfs
mount -a
fsck
xfs_growfs
Take a snapshot
Detach the volume
Terminate the instance
Change the AZ
32. Why can't you shrink an EBS volume, and how do you work around it?
EBS only supports growing a volume. The service cannot know which blocks the file system still uses, and shrinking would risk cutting data, so the API refuses a smaller size.
The workaround is to copy the data to a smaller volume:
- Create a new, smaller volume and attach it to the instance.
- Format it and copy the data, using
rsync -aHAXfor Linux. - Verify, then switch mount points (or swap the volume) and detach the old one.
- Snapshot the old volume, then delete it after a safe waiting period.
The file system must fit the smaller size, so trim unused data first. Windows and some LVM setups can shrink the partition, but that does not reduce the EBS bill unless a new volume replaces the old one.
Take quiz
Both up and down freely
Only increasing size
Neither
Only decreasing size
Change the volume type to sc1
Delete the largest snapshot
Create a smaller volume and copy the data across
Run modify-volume with a smaller size
33. How does EBS Multi-Attach work and what are its limitations?
With Multi-Attach, the same io1/io2 volume is exposed as a block device to several Nitro instances in one AZ. The volume accepts I/O from all of them and does not arbitrate writes.
flowchart TD V[(io2 Multi-Attach volume)] A["Instance A"] --> V B["Instance B"] --> V C["Instance C"] --> V V --> F["Cluster-aware FS or app-level locking"]
| Limitation | Detail |
| Volume types | io1 and io2 only |
| Instances | Up to 16, Nitro-based, same AZ |
| File system | Must be cluster-aware (for example GFS2), not ext4/XFS |
| Root volume | Not supported |
| Elastic Volumes | Some changes are restricted while attached to multiple instances |
io2 Block Express also supports I/O fencing (NVMe reservations) so a cluster manager can block a failed node from writing.
Take quiz
The instance metadata service
The AWS Shield service
The EBS service automatically
Your cluster file system or application
NVMe reservations (I/O fencing)
EBS encryption
Volume Recycle Bin
Snapshot Archive
34. When would you choose io2 Block Express over gp3?
Pick io2 Block Express when a single volume must exceed what gp3 can give or when a stricter guarantee is required. Otherwise gp3 is cheaper and enough.
| Need | gp3 | io2 Block Express |
| Max IOPS | 80,000 | 256,000 |
| Max throughput | 2,000 MiB/s | 4,000 MiB/s |
| Latency | Single-digit ms | Sub-millisecond average |
| Durability | 99.8-99.9% | 99.999% |
| Multi-Attach | No | Yes |
Typical choices for io2: SAP HANA, Oracle or SQL Server production databases where IOPS above 80,000, consistent latency, or Multi-Attach for clustering is required. If your workload stays under 80,000 IOPS with millisecond tolerance, start on gp3 and measure.
Take quiz
Storing rarely used archives
Needing more than 80,000 IOPS on one volume
Needing HDD throughput
Wanting a lower per-GB price
Snapshots
Elastic Volumes
Multi-Attach
Encryption
35. When would you choose st1 over gp3?
Choose st1 when data is large, read and written in big sequential chunks, and cost per GB matters more than IOPS.
- Log processing, Kafka brokers, MapReduce and Hadoop data nodes, ETL staging, data warehouse scans.
- You need up to 500 MiB/s per volume at a low price per GB.
Avoid st1 for boot volumes, small random I/O, or databases, since it caps at 500 IOPS (measured with 1 MiB I/O). For that pattern gp3 is far better even if it costs more per GB.
Also note that gp3 can now deliver up to 2,000 MiB/s, so for high throughput needs on smaller datasets gp3 may be both simpler and competitive. Compare price per GB against your actual throughput target before choosing.
Take quiz
Tiny random reads with low latency
Boot disks
Multi-Attach clusters
Large sequential reads and writes at low cost per GB
It is limited to about 500 IOPS with high latency for random I/O
It cannot have snapshots
It only works in one Region
It cannot be encrypted
36. How do you troubleshoot slow EBS performance?
Work from the volume outward and check each limit that could cap I/O:
- Volume limits: compare
VolumeReadOps + VolumeWriteOpsand throughput against provisioned IOPS and MiB/s. For gp2, st1, and sc1, checkBurstBalance. - Queue depth: a consistently high
VolumeQueueLengthmeans the volume cannot keep up. - Instance limits: confirm the instance type's EBS bandwidth and IOPS are not lower than the volume's.
- Snapshot initialization: restored volumes may still be lazily loading blocks.
- Modification in progress: an optimizing volume may be temporarily slower.
- I/O pattern: small I/O hits IOPS limits, large I/O hits throughput limits.
Use iostat -x 1 in Linux to see latency and utilization. Often the cure is moving gp2 to gp3, raising provisioned IOPS, or picking a larger instance.
Take quiz
BurstBalance at 100%
A consistently high VolumeQueueLength
VolumeIdleTime near 100%
Zero VolumeReadOps
The security group rules
The KMS alias
The instance type's EBS bandwidth and IOPS
The AMI name
37. Which CloudWatch metrics monitor EBS volumes?
EBS publishes volume metrics to CloudWatch in the AWS/EBS namespace, at 1-minute periods for volumes on Nitro instances (5 minutes otherwise).
| Metric | What it tells you |
| VolumeReadOps / VolumeWriteOps | I/O operations, divide by period for IOPS |
| VolumeReadBytes / VolumeWriteBytes | Data transferred, gives throughput |
| VolumeQueueLength | Pending I/O requests, high means saturation |
| VolumeIdleTime | Seconds with no I/O, spots unused volumes |
| BurstBalance | Remaining burst credits on gp2, st1, sc1 |
| VolumeThroughputPercentage | Percent of provisioned IOPS delivered (Provisioned IOPS) |
| VolumeTotalReadTime / WriteTime | Latency per operation when divided by ops |
Alarm on BurstBalance, queue length, and idle time to catch slowdowns and waste.
Take quiz
BurstBalance
VolumeTotalWriteTime
VolumeQueueLength
VolumeIdleTime
BurstBalance
VolumeWriteBytes
VolumeReadOps
VolumeIdleTime
38. When should you use RAID 0 or RAID 1 with EBS?
EBS already replicates each volume inside its AZ, so RAID is used to change performance or capacity, not as your main safety net.
| RAID 0 (stripe) | RAID 1 (mirror) | |
| Goal | Higher IOPS, throughput, capacity | Extra redundancy |
| Fault tolerance | None, one volume lost loses all data | Survives a volume failure |
| Cost | Volumes add up | Pays for double storage and double write bandwidth |
Use RAID 0 to exceed a single volume's limits, though gp3's 64 TiB, 80,000 IOPS ceiling and io2's 256,000 IOPS make it less common now. It is still limited by the instance's EBS bandwidth.
AWS discourages RAID 5 and 6, since parity writes eat a large share of the IOPS you pay for. Whatever you choose, keep snapshots, and note that stripes need coordinated snapshots (multi-volume snapshots) to stay consistent.
Take quiz
It disables snapshots
Losing one volume loses the whole array
It cuts IOPS in half
It needs io2 only
They cannot use SSD
They are unsupported by Linux
Parity writes consume IOPS you pay for
They need instance store
39. How do you take application-consistent EBS snapshots?
A snapshot captures data on disk, so it is crash-consistent by default, like a sudden power loss. Data still in memory or in-flight transactions may be missing. Applications like databases need extra steps for application consistency.
- Quiesce the application: flush buffers, put the database in backup mode, or lock tables.
- Freeze the file system with
fsfreeze(Linux) or use VSS (Windows). - Start the snapshot. Once the API confirms it has begun, you can resume writes.
- Unfreeze and resume normal operation.
sudo fsfreeze -f /data aws ec2 create-snapshot --volume-id vol-0abc1234def567890 sudo fsfreeze -u /data
For automation, Data Lifecycle Manager supports pre and post scripts through Systems Manager, and create-snapshots with an instance target takes crash-consistent snapshots of all volumes at the same moment.
Take quiz
Encrypted-consistent
Transaction-log-consistent
Fully application-consistent
Crash-consistent
fsfreeze
fdisk
lsblk
growpart
40. How can you share an EBS snapshot with another AWS account?
Modify the snapshot's createVolumePermission to add the target account ID, then the other account can create volumes from it or copy it.
aws ec2 modify-snapshot-attribute \ --snapshot-id snap-0123456789abcdef0 \ --attribute createVolumePermission \ --operation-type add --user-ids 123456789012
- Unencrypted snapshots can be shared with specific accounts or made public (avoid public).
- Encrypted snapshots can only be shared if encrypted with a customer managed KMS key, and that key must also be shared with the recipient. The default
aws/ebskey cannot be shared.
The recipient should copy the snapshot into their own account (and re-encrypt with their own key), so they do not lose access if you revoke sharing. Turn on block public access for snapshots to prevent accidents.
Take quiz
The default aws/ebs key
A customer managed key
No key is needed
A root user password
To disable encryption
To change its AZ
So they keep access even if sharing is revoked
To make it smaller
41. What happens to an EBS volume when an EC2 instance stops or terminates?
It depends on the action and the volume's settings:
| Action | Root volume | Extra volumes |
| Reboot | Kept, no change | Kept |
| Stop | Kept and still billed | Kept, still attached |
| Hibernate | Kept, RAM contents saved to it | Kept |
| Terminate | Deleted by default (DeleteOnTermination = true) | Kept by default, become available |
Instance store volumes, in contrast, are wiped on stop or terminate. A stopped instance costs nothing for compute but you still pay for provisioned EBS storage, so delete leftover volumes and snapshots you no longer need.
Take quiz
It is encrypted and archived
It moves to another AZ
It is deleted
It is kept and becomes available
The contents of RAM
The instance's security groups
A snapshot of the AMI
CloudWatch logs
42. How do you recover data from the root volume of an unreachable instance?
Attach the broken root volume to a healthy rescue instance in the same AZ, fix or copy files, then put it back.
- Snapshot the root volume as a safety copy.
- Stop the broken instance (not terminate).
- Detach its root volume and attach it to the rescue instance as a secondary device, such as
/dev/sdf. - Mount it, then repair
/etc/fstab, SSH keys, or logs, or copy out the data. - Unmount, detach, reattach to the original instance using its root device name (e.g.
/dev/xvda), and start it.
Common causes are a bad fstab entry, a full disk, broken SSH configuration, or a kernel issue. Newer options include EC2 Serial Console, Systems Manager Automation runbooks, and the replace root volume feature.
Take quiz
In any Region
In the same Availability Zone
It does not matter
In a different account
Terminate the instance
Delete /etc/fstab
Take a snapshot first
Change the key pair
43. How can you optimize EBS costs?
EBS bills for provisioned GB, IOPS, and throughput, plus stored snapshot data, whether or not you use them. Savings come from removing waste:
- Migrate gp2 to gp3 for roughly 20% lower per-GB cost with better baseline performance.
- Delete unattached volumes (state available) and volumes with near-zero
VolumeIdleTimeactivity. - Right-size IOPS and throughput on gp3 and io2 using CloudWatch data or Compute Optimizer recommendations.
- Expire old snapshots with Data Lifecycle Manager retention, and move long-term ones to the Snapshot Archive.
- Use st1/sc1 for cold, sequential data.
- Tag volumes so Cost Explorer can attribute spend to teams.
Since volumes cannot shrink, avoid oversizing at creation. Delete leftover snapshots after deregistering AMIs.
Take quiz
Moving gp3 to io2
Adding RAID 1
Turning on Multi-Attach
Moving gp2 volumes to gp3
Available (unattached)
Optimizing
In-use
Creating
44. How does the EBS Recycle Bin protect against accidental deletion?
Recycle Bin holds deleted EBS snapshots and EBS-backed AMIs for a retention period you define, so you can restore them instead of losing them.
- Create retention rules for a Region or tag-matched resources.
- Retention runs from 1 day to 1 year.
- Restore a resource with a console click or
restore-snapshot-from-recycle-bin. - Items in the bin are billed at the normal rate and are purged after the period ends.
It covers snapshots and AMIs, not volumes, so keep snapshots current for volume protection. Use IAM policies and rule locks so nobody can shorten or delete the retention rule.
Take quiz
Running instances
Snapshots and EBS-backed AMIs
KMS keys
Volumes directly
30 days fixed
1 hour to 7 days
1 day to 1 year
Unlimited
45. Explain the lifecycle of an EBS volume?
A volume moves through a small set of states as you create, use, and delete it.
stateDiagram-v2 [*] --> creating creating --> available available --> in_use: attach in_use --> available: detach available --> deleting: delete deleting --> deleted creating --> error deleted --> [*]
- creating: being provisioned, possibly from a snapshot.
- available: ready but not attached, still billed.
- in-use: attached to an instance, even when the instance is stopped.
- deleting / deleted: being removed, then gone permanently.
- error: a failure during creation.
Detach cleanly by unmounting first. Snapshots taken while the volume is in any of these usable states remain after the volume is deleted.
Take quiz
creating
deleting
in-use
available
available
error
creating
deleted
46. How do you mount and persist a new EBS volume on Linux?
After attaching, format the disk if it is new, mount it, and add an /etc/fstab entry so it mounts after a reboot.
lsblk sudo file -s /dev/nvme1n1 # 'data' = no file system yet sudo mkfs -t xfs /dev/nvme1n1 sudo mkdir /data && sudo mount /dev/nvme1n1 /data sudo blkid /dev/nvme1n1 # copy the UUID echo 'UUID=<uuid> /data xfs defaults,nofail 0 2' | sudo tee -a /etc/fstab sudo mount -a # test fstab
Use the UUID, not the device name, because NVMe names can change between reboots. Add nofail so a missing volume does not stop the instance booting. Skip mkfs for a volume restored from a snapshot, or you erase its data.
Take quiz
It enables encryption
Device names like nvme1n1 can change across reboots
It grows the volume
UUIDs make volumes faster
Makes the mount read-only
Skips the file system check permanently
Lets the instance boot even if the volume is missing
Disables snapshots
47. What are EBS direct APIs and when are they useful?
EBS direct APIs let you read and write snapshot contents at the block level over the API, without creating a volume from the snapshot. Blocks are 512 KiB.
| API | Purpose |
ListSnapshotBlocks |
Lists blocks that hold data in a snapshot |
ListChangedBlocks |
Shows blocks that differ between two snapshots |
GetSnapshotBlock |
Reads one block |
StartSnapshot, PutSnapshotBlock, CompleteSnapshot |
Build a new snapshot from your own data |
Useful for third-party backup tools doing efficient incremental copies, for reading diffs to speed up cross-account or on-premises backups, and for importing disk images as snapshots. Access needs the ebs: IAM actions.
Take quiz
StartSnapshot
CompleteSnapshot
GetSnapshotBlock
ListChangedBlocks
Reading snapshot data without restoring a volume
Resizing volumes
Increasing IOPS
Encrypting the root volume
48. What is the difference between EBS, EFS, and S3?
They are three storage models for different access patterns.
| EBS | EFS | S3 | |
| Type | Block | File (NFS) | Object (HTTP API) |
| Scope | One AZ, usually one instance | Multi-AZ, thousands of clients | Regional, unlimited |
| Best for | Boot disks, databases | Shared content, home directories | Backups, media, data lakes |
| Mounted as | A disk you format | A shared directory | Not mounted, accessed by API |
Pick EBS for low-latency single-host storage, EFS when many Linux instances need the same file tree, and S3 for durable, cheap object storage accessed by applications.
Take quiz
EBS
EFS
S3 Glacier
Instance store
Object storage
File storage over NFS
Block storage
Tape archive
49. How do you protect EBS snapshots from deletion or ransomware?
Use EBS Snapshot Lock, which makes a snapshot immutable for a set duration so no one can delete it, including compromised admin credentials.
| Mode | Behavior |
| Governance | Authorized users with the right IAM permission can change or remove the lock |
| Compliance | Nobody can remove it after an optional cooling-off period ends, even the root user |
Lock durations run from 1 day up to about 100 years. Pair it with Recycle Bin rule locks, cross-account and cross-Region copies, and tight IAM policies on ec2:DeleteSnapshot. Store copies in a separate backup account so one breach cannot reach every copy.
Take quiz
Recycle mode
Governance mode
Archive mode
Compliance mode
Immutable for a chosen duration
Public
Faster to restore
Free to store
50. How do you size an EBS volume for a target IOPS?
Each type has a maximum IOPS-to-size ratio, so a target IOPS sets a minimum size.
| Type | IOPS per GiB | Size needed for 16,000 IOPS |
| gp2 | 3 (baseline) | 5,334 GiB |
| gp3 | up to 500 provisioned | 32 GiB |
| io1 | up to 50 | 320 GiB |
| io2 Block Express | up to 1,000 | 16 GiB |
For throughput on gp3, the ceiling is 0.25 MiB/s per provisioned IOPS, so reaching 1,000 MiB/s requires at least 4,000 IOPS. Then confirm the instance type can carry that load.
This is why gp3 replaced gp2: 10,000 IOPS on gp2 needs about 3,334 GiB, but only 20 GiB on gp3.