Cloud Security Engineer interview questions
100 real questions with model answers and explanations for Senior candidates.
See a Cloud Security Engineer resume example →Practice with flashcards
Spaced repetition · Hunter Pass
Questions
I would keep the OU tree shallow and align it to policy boundaries rather than the reporting hierarchy.
- Use Security, Infrastructure, Workloads-Prod, Workloads-NonProd, Sandbox, and Quarantine OUs, with at most 2 nested levels so SCP inheritance stays reviewable.
- Put log archive and security tooling in separate accounts under Security, and give each product at least one production and one non-production account to cap blast radius.
- Move newly acquired or nonconforming accounts into Quarantine under a deny-by-default SCP until the 12-control baseline passes.
Why interviewers ask this: The interviewer is testing whether the candidate can turn account structure into understandable isolation and policy boundaries.
I would deny regional API calls with aws:RequestedRegion and maintain a tested NotAction list for genuinely global APIs.
- Deny requests outside eu-west-1 and eu-central-1, while excluding IAM, Route 53, CloudFront, Organizations, Support, and only the other global services the platform actually uses.
- Treat aws:RequestedRegion as the endpoint region, not the resource location, and add separate controls for services such as S3 replication that can affect resources in another region.
- Analyze 30 days of CloudTrail with a dry-run tool that maps observed actions to the proposed SCP, then put account-specific exceptions in a 30-day OU rather than weakening all 180 accounts.
Why interviewers ask this: A strong answer must handle AWS global-service behavior without turning the region guardrail into a broad bypass.
I would block destructive actions globally and reserve configuration changes for a delegated security role, with one recovery role as the last resort.
- Deny CloudTrail StopLogging and DeleteTrail, GuardDuty DeleteDetector, and Config StopConfigurationRecorder, DeleteConfigurationRecorder, and DeleteDeliveryChannel for every workload principal.
- Allow PutEventSelectors, UpdateDetector, and PutConfigurationRecorder only to SecurityServiceAdmin in the delegated account; ArnNotLike also excludes one 30-minute hardware-MFA SecurityBreakGlass role.
- Alert on every denied call and either privileged role, then verify organization enrollment and expected configuration every 15 minutes.
Why interviewers ask this: The interviewer is evaluating precise deny controls, a bounded recovery path, and visibility into attempted bypasses.
I would make account creation a deterministic pipeline that attaches guardrails before handing the account to a team.
- Use Control Tower Account Factory for Terraform to create the account, place it in the requested OU, and install the 12 mandatory controls in one workflow.
- Bootstrap organization CloudTrail, AWS Config, GuardDuty, Security Hub, IAM Identity Center roles, budget alarms, and 3 approved regions before setting the account status to ready.
- Fail closed if any baseline check misses the 20-minute target, moving the account to Quarantine rather than allowing manual console repair.
Why interviewers ask this: The interviewer is checking whether fast self-service provisioning preserves atomic security baselines.
I would give each target account narrowly scoped deployment roles reached through a traceable short-lived platform identity.
- Trust one platform role whose original CI session carries an immutable source identity, and restrict role chaining to 30 minutes rather than relying on ExternalId inside one organization.
- Attach explicit role policies and permission boundaries for the approved services; allow only controlled transitive tags for team, repository, and environment.
- Split network, IAM, and application deployment into 3 roles, so one compromised application job cannot modify account trust or routing.
Why interviewers ask this: A strong answer limits both who can assume a deployment role and what each resulting session can change.
I would deliver organization logs into a dedicated archive account with immutable storage and an independently protected encryption key.
- Use an all-Region organization CloudTrail, S3 Object Lock in compliance mode, versioning, and a 7-year lifecycle on a bucket encrypted by a log-specific KMS key.
- Allow delivery only from the named organization trail with SourceArn and organization conditions, and deny bucket-policy changes or object deletion outside 2 archive roles.
- Protect DisableKey, PutKeyPolicy, and early ScheduleKeyDeletion through the key policy and SCP, then keep 90 days in the SIEM and move older data to Glacier Deep Archive.
Why interviewers ask this: The interviewer is testing immutable ownership, cross-account delivery controls, and a realistic retention-cost trade-off.
I would use one regional inspection VPC per trust domain with AWS Transit Gateway and Gateway Load Balancer, not one global appliance path.
- Put Gateway Load Balancer endpoints and firewall capacity in all 3 Availability Zones, preserving AZ affinity and symmetric routing through Transit Gateway appliance mode.
- Inspect internet egress and traffic crossing production, non-production, and partner zones, while leaving same-zone service traffic local to avoid double Transit Gateway charges.
- Size each regional pool for 2 times normal peak and test whether production fails closed while explicitly low-risk sandbox egress can fail open.
Why interviewers ask this: A strong answer balances inspection coverage, regional failure domains, routing correctness, and throughput cost.
I would onboard the accounts through a staged OU sequence instead of attaching the production SCP set immediately.
- Collect 30 days of CloudTrail and AWS Config data in an Observe OU, then simulate the 15 target denies against actual API use.
- Move 5 low-criticality accounts at a time into a Restricted OU with logging and region controls first, leaving service-specific denies for the next wave.
- Permit a 14-day account-scoped exception only when a named API dependency is documented, avoiding an acquisition-wide bypass that becomes permanent.
Why interviewers ask this: The interviewer is evaluating safe adoption of organization controls when legacy dependencies are not yet known.
I would permit broad experimentation but make public storage, production connectivity, resource lifetime, and spend explicit sandbox boundaries.
- Enforce organization-level S3 Block Public Access and deny changes to it; deny internet gateways, public IP allocation, and external snapshot or AMI sharing so other data stores have no public network path.
- For service APIs whose public flag cannot be constrained by SCP, omit the create permission and expose only an approved private IaC module; OPA and AWS Config verify that path rather than serving as the boundary.
- Warn at a $120 forecast, freeze creation and quarantine at $150, and delete resources on a 7-day TTL; billing delay means AWS cannot guarantee an exact $200 hard cap.
Why interviewers ask this: A strong answer preserves useful experimentation while making cost and connectivity boundaries technically enforceable.
I would assign a dedicated security-tooling account as delegated administrator and manage coverage through AWS Organizations.
- Enable GuardDuty organization auto-enrollment and all supported protection plans in the 4 approved regions from the delegated account.
- Configure Security Hub central configuration with one home region and linked regions, applying the production policy to 90 accounts and a lighter sandbox policy to the rest.
- Keep Organizations access in the management account read-only for 2 platform roles, accepting separate administration planes to reduce management-account exposure.
Why interviewers ask this: The interviewer is checking organization-wide service design without concentrating daily privilege in the management account.
I would put an identity-aware proxy in front of every application and evaluate user, device, and session risk on each access decision.
- Federate Entra ID with phishing-resistant FIDO2, require managed-device posture for 55 sensitive apps, and allow personal phones only to the 15 low-risk apps.
- Issue application-scoped sessions for 8 hours on managed devices and 1 hour on personal devices instead of granting network-level reachability.
- Recheck device compliance every 15 minutes and revoke sessions on disabled users or failed posture, accepting more sign-ins for the smaller unmanaged-device blast radius.
Why interviewers ask this: A strong answer replaces network trust with concrete identity, device, application, and session controls.
I would use AWS Systems Manager Session Manager with identity-based authorization and no bastion hosts.
- Give instances an SSM role and private endpoints for ssm and ssmmessages; add ec2messages only in regions that still use it and S3 or CloudWatch endpoints only for the chosen transcript path.
- Grant production access through a 30-minute IAM Identity Center permission set with MFA and resource tags limiting each operator to owned services.
- Store complete session transcripts in an Object Lock bucket in the archive account, removing inbound port 22 and private-key distribution from all 600 instances.
Why interviewers ask this: The interviewer is testing whether administrative access can be short-lived, private, scoped, and recorded.
I would use a service mesh for workload identity, strict mutual TLS, and default-deny service authorization without changing application code.
- Give each workload a SPIFFE identity tied to cluster, namespace, and service account, then enable Istio strict mTLS in 5-cluster waves.
- Add default-deny AuthorizationPolicy and explicit source-to-destination rules, because encryption alone would still let any mesh workload call any other service.
- Require 99.9 percent mesh coverage for 7 days and p99 proxy overhead below 2 ms before enforcement; outliers get a dedicated mTLS gateway, never plaintext.
Why interviewers ask this: A strong answer combines cryptographic workload identity with a measurable rollout and an explicit latency trade-off.
I would start with default-deny Kubernetes network policies and add explicit identity-based service paths.
- Apply namespace-wide deny ingress and egress, then permit UDP and TCP 53 to CoreDNS plus the frontend service account to its named API on port 8443.
- Use Cilium policies for service-account and FQDN-aware rules because standard NetworkPolicy cannot express either constraint reliably.
- Validate every policy with 3 positive and 3 negative connectivity tests in CI, accepting more policy maintenance for a bounded lateral path.
Why interviewers ask this: The interviewer is evaluating whether zero-trust segmentation becomes concrete allow rules with testable behavior.
I would make device posture a continuously evaluated condition and terminate finance access as soon as the device becomes noncompliant.
- Feed EDR health, disk encryption, OS patch age under 14 days, and device-certificate status into Entra Conditional Access.
- Put the SaaS behind a session-control proxy that reevaluates posture every 10 minutes, blocks downloads immediately, and revokes the application session on a failed check.
- Offer only a separate remediation portal from the noncompliant laptop; the finance application remains unavailable until EDR health returns.
Why interviewers ask this: A strong answer shows how device trust changes during a session and how degraded access remains bounded.
I would authenticate each partner and workload at the API edge with mutually independent identity controls.
- Require partner-specific mTLS certificates from a private CA plus OAuth 2 client credentials with a 15-minute token lifetime and audience bound to the payments API.
- Place the API behind PrivateLink for large AWS partners and a restricted public endpoint with WAF for others, keeping both paths under the same authorization policy.
- Rate-limit each partner to its contract tier and rotate certificates every 90 days, accepting certificate operations to avoid one shared network credential across 40 firms.
Why interviewers ask this: The interviewer is testing layered partner identity, scoped connectivity, and isolation under meaningful throughput.
I would route workload egress through identity-aware proxies and authorize destinations by service and DNS name.
- Use Cilium FQDN policies to allow each namespace only its required domains and send HTTP traffic through Envoy for method and host enforcement.
- Resolve and cache approved DNS answers for at most 5 minutes, while blocking direct IP traffic and external DNS to prevent bypass.
- Run 3 regional proxy pools sized for 2 times peak traffic, accepting proxy cost and a controlled fail-closed dependency for production workloads.
Why interviewers ask this: A strong answer handles dynamic SaaS addressing without falling back to unrestricted internet egress.
I would move users and services from network-level VPN trust to application and workload identities.
- Put human-facing services behind an identity-aware proxy with FIDO2 and device posture, exposing only HTTPS rather than 10 VPC CIDRs.
- Connect machine services through mTLS gateways using SPIFFE identities and explicit service pairs, not office source addresses.
- Keep the VPN for 6 legacy protocols in isolated subnets with port-specific firewall rules and a 12-month removal date, accepting temporary dual operation over a risky big-bang cutover.
Why interviewers ask this: The interviewer is evaluating a practical migration from location trust to per-application and per-workload authorization.
I would use S3 SSE-KMS with S3 Bucket Keys, letting S3 perform envelope encryption without one KMS call per object.
- S3 encrypts each object with a data key and protects the bucket key under a customer-managed KMS key, so object bytes never go to KMS.
- Enable Bucket Keys on the high-volume buckets to cut KMS request volume by up to 99 percent across 5 billion objects.
- Use separate KMS keys per account and data domain, with bucket ARN encryption-context conditions, rather than one key that exposes the whole estate.
Why interviewers ask this: A strong answer explains the data-key hierarchy and the concrete cost-versus-isolation choices at scale.
I would use a KMS multi-Region primary key and replica so ciphertext can be decrypted in either region under related key material.
- Replicate the key to us-west-2, keep identical aliases in deployment configuration, and grant only the regional workload roles access.
- Replicate data continuously and test 15-minute failover quarterly because key availability alone does not make the storage path ready.
- Keep independent regional keys for data requiring stronger failure isolation, accepting re-encryption complexity instead of correlated key administration.
Why interviewers ask this: The interviewer is testing whether regional key design is tied to recovery timing and explicit isolation trade-offs.
Locked questions
- 21
A central security account administers KMS keys used by 70 application accounts, but application owners need encrypt and decrypt access without permission to change policies; how would you write the control model?
encryption - 22
A multi-tenant SaaS stores records for 20,000 customers in one DynamoDB table, and a single customer key per tenant would exceed operational limits; how would you isolate encryption?
encryptioncryptographydynamodb - 23
A signing service needs keys inside FIPS 140-2 Level 3 hardware and must sustain 6,000 signatures per second across 3 Availability Zones; would you use KMS or CloudHSM?
cloud-securityavailability - 24
An API fleet peaks at 60,000 decrypt operations per second and begins approaching the regional KMS quota; how would you reduce calls without leaving plaintext keys on disk?
api - 25
A company enables annual automatic rotation on 300 KMS keys and assumes all existing 2 PB of ciphertext is re-encrypted; how would you correct the design?
encryptiondesign - 26
A backup account must copy encrypted EBS snapshots from 120 workload accounts, but workload roles must not decrypt backup data directly; how would you design KMS access?
designbackupsencryption - 27
Your architecture uses one KMS key for logs, databases, and application secrets across 35 accounts; how would you split it without creating hundreds of unmanaged keys?
databasesecretsarchitecture - 28
Two hundred AWS accounts produce 8 TB of security telemetry per day, but the SIEM budget supports indexing only 2 TB; what detection architecture would you build?
indexesarchitecturesiem - 29
GuardDuty must cover 300 AWS accounts and deliver high-severity findings to Microsoft Sentinel in under 2 minutes; how would you route and normalize them?
normalizationseverity-priority - 30
Design a SIEM rule for use of an AWS root user across 250 accounts where legitimate root access occurs only during quarterly tests.
designtestingsiem - 31
Your environment creates 40 million AssumeRole events per day; how would you detect unusual cross-account role use without alerting on every new session?
sessionsalerting - 32
You need a detection that catches public S3 exposure within 5 minutes across 90 production accounts, including changes made through access points; what events and logic would you use?
detectionaws - 33
A payment service normally makes 300 KMS decrypt calls per minute from one role; design a rule that catches abnormal key use without paging on traffic peaks.
design - 34
Route 53 Resolver logs contain 12 billion DNS queries per day; how would you detect DNS tunneling while keeping the daily alert count below 50?
queriesdnsalerting - 35
Twenty-five EKS clusters send audit logs to the SIEM; design rules for unauthorized shell access and privileged pod creation with a 3-minute target latency.
kubernetessiemdesign - 36
Your cloud detections depend on 6 log sources, and missing telemetry must be visible within 10 minutes; how would you monitor detection-pipeline health?
detectioncloud-securitymonitoring - 37
One hundred and twenty Terraform repositories must block public S3 buckets before merge, but 8 repositories intentionally publish static sites; how would you implement the OPA policy?
terraformawspolicy - 38
A platform team wants to enforce every AWS rule through SCPs, while developers want only CI checks; where would you place a deny on leaving approved regions and a rule requiring RDS backups?
backups - 39
OPA blocks 6 percent of 2,000 weekly Terraform runs, and teams have started adding blanket waivers; how would you redesign the exception mechanism?
policyterraformerror-handling - 40
You must roll out 35 new OPA policies to 120 repositories without increasing median CI time by more than 20 seconds; what pipeline design would you use?
policydesignci-cd - 41
Forty EKS clusters must reject privileged workloads even when manifests bypass CI; how would you combine OPA checks with admission control?
policykubernetes - 42
Terraform plans contain 15,000 IAM statements per day, and simple wildcard checks create too many false positives; how would you write a semantic OPA rule?
policyidentity-accessdetection-tuning - 43
OPA validates Terraform before deployment, but administrators can still change 500 production resources in the console; how would you cover drift?
terraformdeploymentiac - 44
Fifteen thousand employees need access to 220 AWS accounts through Entra ID, with no IAM users and production privilege limited to 1 hour; how would you design workforce identity?
identity-accessdesign - 45
Design break-glass access for 220 AWS accounts when Entra ID or IAM Identity Center may be unavailable, but standing administrator credentials are prohibited.
identity-accessdesign - 46
Three hundred EKS workloads currently share node IAM roles, and each pod should reach only its own S3 prefix or SQS queue; how would you migrate identity?
kubernetesawsdata-structures - 47
A service runs in AWS and GCP and currently stores long-lived service-account keys in both clouds; how would you build keyless workload federation?
cloud-securityidentity-access - 48
Two hundred GitHub repositories deploy to 60 AWS accounts, and storing AWS access keys in GitHub is forbidden; what workload identity model would you use?
deployment - 49
Nine hundred services across Kubernetes and virtual machines need mutual authentication, and certificates must rotate within 24 hours without application teams managing them; what architecture would you choose?
authcryptographyidentity-access - 50
Four hundred application pods open 12,000 connections to Amazon RDS, and static database passwords must be removed without exceeding connection limits; how would you design authentication?
authpasswordsidentity-access - 51
At 09:00 GuardDuty reports an IAM access key using a production administrator role from a new country across 12 AWS accounts; how do you contain it within 15 minutes without destroying evidence or stopping checkout?
identity-access - 52
At 14:20 Entra ID flags token theft for a cloud administrator assigned to 38 Azure subscriptions, and payroll closes in 2 hours; what sequence do you run without revoking all 6,000 employees?
tokenscloud-security - 53
A self-hosted GitHub Actions runner was compromised 25 minutes ago and could assume deploy roles in 20 AWS accounts through OIDC; how do you preserve delivery for an emergency fix due in 90 minutes?
ci-cddeploymentincident-response - 54
A GCP service-account key committed publicly 40 minutes ago can administer 9 production projects, but disabling it immediately may stop a 24/7 ingestion pipeline; how do you respond?
ci-cd - 55
An Azure app-registration secret used by 16 services appears in a vendor ticket at 11:30 and expires in 8 months; how do you rotate it by end of day with zero failed requests?
procurementsecrets - 56
A Kubernetes service-account token from a payments pod was copied 12 minutes ago, and the account can read 3 Secrets in one namespace; how do you contain it without restarting all 400 pods?
secretstokenskubernetes - 57
At 03:10 CloudTrail shows one AWS root ConsoleLogin without MFA in a production account, but the source IP belongs to your recovery provider; what do you do in the first 30 minutes?
identity-accesscloud-security - 58
A cosign identity used by 60 repositories signed an unknown container digest 18 minutes ago, and 7 EKS clusters deploy continuously; how do you stop propagation without freezing every build for a day?
containersdeploymentkubernetes - 59
A CNAPP vendor reports that its cross-account AWS role token may have leaked 3 hours ago and the role is read-only in 210 accounts; do you revoke it immediately if that removes active visibility?
procurementtokenscss - 60
A 1-hour AWS STS session for a deployment role was stolen at minute 20 and is changing Lambda environment variables in 6 accounts; how do you stop it before expiry without blocking all deployments?
deploymentconfigsessions - 61
At 08:40 Macie confirms that a public S3 bucket exposed 2.3 million customer records for 47 minutes, and disabling the website endpoint breaks order tracking; how do you contain exploitation?
attacksendpointsaws - 62
An SSRF flaw is actively querying IMDSv1 on 35 EC2 web instances, and forcing IMDSv2 may break the legacy agent on 8 of them; what do you do in the next 60 minutes?
queriesaws - 63
A GCS bucket with 600 GB of research data had allUsers objectViewer for 19 minutes, and 4 public reports must remain downloadable; how do you contain and recover within 1 hour?
- 64
A 30-day Azure Blob SAS token with read and list rights was posted publicly 6 hours ago and serves 11 partner jobs; how do you revoke it today without losing the partner batch window?
tokensbatch - 65
An internet-exposed Kubernetes Dashboard granted cluster-admin for 22 minutes in one of 14 clusters, and shutting the cluster down breaches a 99.95 percent SLA; how do you contain it?
kubernetes - 66
A security group exposed unauthenticated Redis on port 6379 for 3 hours, and the instance now runs an unknown process while supporting 40 percent of session traffic; what is your containment sequence?
sessionsincident-responseredis - 67
A public AWS Lambda Function URL was invoked 180,000 times in 12 minutes and its role can write one DynamoDB table; how do you stop abuse while keeping the API available to 3 partners?
dynamodbapilambda - 68
An encrypted RDS snapshot was shared with an unfamiliar external AWS account for 26 minutes and copied there, while the source database must stay online; what do you do in the first 4 hours?
databaseencryptionsnapshot - 69
GuardDuty reports S3 data exfiltration from one role: 480 GB left over 38 minutes; how do you prove what moved using CloudTrail, S3 data events, and VPC Flow Logs within 6 hours?
data-exfiltrationcloud-securitynetworking - 70
GuardDuty flags UnusualNetworkConnection from 9 EC2 instances to 185.77.1.24 for 17 minutes, but the IP is also a new vendor endpoint; how do you decide containment within 45 minutes?
procurementendpointsaws - 71
Threat intelligence says 91.214.6.88 used stolen AWS keys during the last 14 days; how do you hunt 260 accounts and deliver an evidence-backed result in 8 hours?
threat-intel - 72
Route 53 Resolver logs show 75 hosts querying bad-update.example every 30 seconds for 2 days, but endpoint engineering says it may be telemetry; how do you hunt and decide by noon?
queriesendpoints - 73
An analytics role downloaded 1.1 million S3 objects in 22 minutes, ten times its baseline, during an approved job; how do you determine exfiltration within 3 hours without stopping the job immediately?
data-exfiltrationaws - 74
Azure Defender for Cloud reports 320 GB read from one storage account through a new service principal over 50 minutes; how do you scope exfiltration before the 4-hour legal checkpoint?
data-exfiltrationcloud-security - 75
A GCP principal ran 46 BigQuery extract jobs totaling 7 TB to an unfamiliar bucket in 35 minutes; how do you hunt the action chain and contain it within 1 hour?
bigquery - 76
Falco detects curl to 45.9.148.12 followed by a miner process in 28 pods across 3 EKS clusters; how do you hunt the common entry point within 90 minutes without evicting 2,000 clean pods?
http-toolskubernetesconcurrency - 77
A compromised third-party API key is loaded by 48 services handling 18,000 requests per second; how do you rotate it in 6 hours with zero downtime and only 2 concurrent provider keys?
incident-responseapiconcurrency - 78
An Amazon RDS for PostgreSQL password used by 25 Kubernetes services behind RDS Proxy was exposed, and the database allows only 200 connections; how do you rotate it within 2 hours without a connection storm?
databasepostgrespasswords - 79
Private keys for 120 TLS certificates on Azure Application Gateway listeners may be stolen, and certificate issuance is limited to 20 per hour; how do you recover within 8 hours?
tlscryptographygateway - 80
Ransomware has encrypted 73 of 200 Windows EC2 instances in 18 minutes, and the recovery point objective is 4 hours; how do you contain and restore without trusting the domain?
encryptionmalwareaws - 81
An attacker deleted or encrypted 14 million S3 objects in 35 minutes, versioning is enabled, and customer downloads must resume in 3 hours; what recovery sequence do you use?
encryptionversioningaws - 82
A malicious admission webhook changed workloads in 12 Kubernetes clusters for 70 minutes, and etcd backups are 6 hours old; how do you recover without rolling every cluster back?
backupswebhookskubernetes - 83
A poisoned container image reached 320 deployments across 9 EKS clusters 2 hours ago, but the previous image has a known medium vulnerability; which image do you restore and on what timeline?
containersdeploymentkubernetes - 84
A PCI DSS audit fails because S3 data events were disabled for 6 cardholder-data buckets for 41 days; how do you close the finding in 10 business days without claiming evidence you do not have?
aws - 85
A SOC 2 auditor finds 27 dormant Azure owners still eligible in PIM, including 3 former contractors, and evidence is due in 5 days; how do you close the access-review failure?
compliancesoc-operations - 86
A FedRAMP assessor finds AWS Config stopped in 11 of 84 in-scope accounts for 9 days, and the monthly package closes in 72 hours; how do you remediate and report it?
config - 87
A CIS control audit finds 74 of 500 EC2 instances still allow IMDSv1, but 12 run an agent that fails with IMDSv2; how do you close the finding in 14 days?
aws - 88
A PCI segmentation test reaches the cardholder database on port 5432 from 2 of 40 out-of-scope subnets, and retesting is in 7 days; how do you close the failure without disrupting settlement?
databasenetworkingnetwork-security - 89
An ISO 27001 audit samples 30 GCP projects and finds 9 service accounts with user-managed keys older than 400 days; how do you close the finding in 3 weeks without breaking nightly jobs?
governanceidentity-access - 90
AWS Config marks a production S3 bucket public at 10:00, but an EventBridge-to-Lambda remediation could break a 15-minute partner upload; how do you automate containment under a 5-minute risk target?
incident-responserisk-managementconfig - 91
An EventBridge rule will auto-close security groups exposing SSH to 0.0.0.0/0 across 140 accounts, but 6 disaster-recovery hosts rely on temporary access; how do you roll it out in 2 weeks?
networkingssh - 92
SSM Patch Manager auto-remediation rebooted 18 of 60 production nodes at once and caused a 12-minute outage; how do you fix the rollout before the next patch window in 9 days?
- 93
A Config change storm produces 80,000 EventBridge events in 6 minutes and the remediation Lambda starts throttling production APIs; how do you stabilize it within 30 minutes without dropping critical findings?
configapilambda - 94
A Lambda auto-remediator set RDS backup retention to 35 days on 220 databases, raising cost 28 percent, after AWS Config mislabeled a 7-day requirement; how do you correct it in 48 hours?
retentiondatabaseconfig - 95
Cross-account EventBridge delivery silently failed in 17 of 120 accounts for 11 hours, so Config auto-remediation missed 43 findings; how do you recover today and prevent another blind spot?
config - 96
A junior engineer's Lambda removed a database security-group rule from 14 services and caused a 9-minute outage; how do you mentor them while restoring automation within 10 days?
mentoringdatabaselambda - 97
Two teams handled the same stolen AWS key differently, taking 12 minutes and 74 minutes to revoke it; what concrete response standard do you establish before next month's exercise?
- 98
An SRE joining cloud security misses an indicator hidden in 30 million CloudTrail events during a 4-hour hunt; how do you mentor them to run the next hunt independently in 3 weeks?
mentoringcloud-security - 99
Five incident reports disagree on whether VPC Flow Logs prove file exfiltration, and 11 engineers need one evidence standard within 2 weeks; what do you implement?
conflictincidentsnetworking - 100
A team requests a 90-day IMDSv1 exception for 36 EC2 instances because its agent upgrade missed the 7-day deadline; how do you coach the owner and set a defensible standard?
estimationerror-handlingaws