ECS and Compute Operations
ECS instances are the core compute primitive. A candidate must know the instance lifecycle (Pending, Running, Stopped, Stopping, Starting), the distinction between Stop and Release, and how billing mode interacts with both. Pay-as-you-go instances can be stopped and later restarted; subscription instances behave differently, and the "no charges while stopped" nuance only applies to certain billing/network combinations - questions love to ask whether a stopped instance still incurs cost.
Understand instance families (general purpose g, compute c, memory r, shared n, GPU), images (public, custom, shared, marketplace), and how custom images capture the system disk only. Know that replacing the system disk from an image resets the OS but leaves data disks intact. Instance metadata service access, user data scripts, and Cloud Assistant agents are common operational topics.
Traps: assuming a stopped instance keeps its public IP (classic public IP is released on stop unless it is an EIP); confusing security-group changes needing a reboot (they do not); assuming you can change instance type freely (only within constraints, and requires stop).
Rule of thumb: before any disruptive action (stop, replace system disk, change type), confirm the disk type, whether the public IP is an EIP, and the billing mode - these three determine blast radius.
Worked example: An instance with a classic public IP is stopped overnight; on restart the public IP changed. If the app needs a stable IP, attach an EIP instead.