46.10 Scenario Round — Sahyadri / Raja-Rani

Q91. Scenario: Sahyadri Traders Pune EC2 shows thousands of failed SSH attempts. What do you do?

I treat it as an active brute-force event. I confirm whether any login succeeded in /var/log/secure, restrict the security group to known IPs, verify password auth is off, ensure key-only SSH, consider fail2ban, and watch CloudTrail/GuardDuty if enabled. I document timeline and communicate to the owner Shahrukh in plain language.

Q92. Scenario: Raja-Rani’s developer committed AWS keys to a public repo. Your steps?

I deactivate the keys immediately, rotate all related secrets, review CloudTrail for API calls from those keys, remove secrets from git history as process allows, switch the app to an instance role, and add secret scanning. I do not leave "we will rotate tomorrow".

Q93. Scenario: A Juice Shop-style order page on your lab shows IDOR. How do you answer?

I explain I only tested my OWN lab app. I changed order_id and saw another user’s order because authorisation was missing. Fix: every query checks user_id from the session. I retested after the fix and the other user’s order returned 403/empty.

Q94. Scenario: S3 bucket listing is public for "temporary marketing images". Response?

I enable Block Public Access patterns appropriate to the account, remove public ACLs/policies, move public needs to CloudFront or deliberate static hosting with review, and scan for sensitive objects already exposed. Temporary often becomes forever.

Q95. Scenario: Interviewer asks you to scan their production during the interview Wi-Fi. Answer?

I refuse politely. I explain I only scan systems with written authorisation and that interview Wi-Fi production is out of scope. I offer to discuss methodology or show screenshots from my host-only lab instead. Ethics over performance theatre.

Q96. Scenario: Ransomware popup on a warehouse PC at Solapur fiction site. First moves?

I isolate the PC from the network per playbook, preserve traffic/logs if possible, identify the account used, check backups’ offline integrity, and escalate. I do not pay from the interview seat as advice; I stress preparation and segmentation so blast radius stays small.

Q97. Scenario: MySQL on EC2 is bound to 0.0.0.0 and SG open. How do you harden?

I bind MySQL to localhost or private IP, close 3306 from the internet, allow only the app SG, enforce strong DB users with least privilege, ensure backups, and review whether RDS private would be cleaner. Then I re-scan my EIP to confirm 3306 is filtered.

Q98. Scenario: Explain a Build-Hack-Fix you did for Sahyadri in under two minutes.

I built a weak PHP login on my host-only Amazon Linux VM for fictional Sahyadri Traders, proved SQL injection on the order lookup from Kali, then fixed it with prepared statements, HTTPS cookie flags, and tight firewall rules. I retested and the old payload failed. I only attacked my VM at 192.168.56.50.