47.6 Cloud and AWS Security MNC Themes

Q45. What AWS mistakes do interviewers expect you to catch?

Frequently asked across MNC cloud-security rounds (candidate-reported). Public S3 without Block Public Access, IAM users with unused access keys, security groups open 0.0.0.0/0 on 22/3389/3306, long-lived keys in code, and missing CloudTrail/GuardDuty. I use Sahyadri Free Tier labs to practise fixes.

Q46. Explain least privilege for IAM.

(Theme: TechGig / Wipro PoLP — candidate-reported; cloud application frequent across MNCs.) Grant only the actions and resources needed for a task. Prefer roles on EC2 over embedded access keys. Review unused privileges. For Amir the developer I avoid AdministratorAccess "just for speed".

Q47. How do you respond if AWS keys were committed to a public repo?

Frequently asked scenario across MNC interviews (candidate-reported). Deactivate keys immediately, rotate secrets, review CloudTrail for API use, scrub git history per process, move the app to an instance role, and add secret scanning. Same day – not "tomorrow".

Q48. Security group versus NACLs – interview short form?

Frequently asked (candidate-reported). Security groups are stateful allow-rules on ENIs; NACLs are subnet-level and stateless. Most day-to-day EC2 exposure mistakes I see in labs are SG 0.0.0.0/0 rules.

Q49. Why enable CloudTrail and GuardDuty in a talking-point answer?

Frequently asked (candidate-reported). CloudTrail records control-plane API activity for investigation. GuardDuty adds managed threat findings. Together they support detect and respond for an AWS account used by Raja-Rani’s lab.

Q50. S3 public website versus accidental public bucket?

Frequently asked (candidate-reported). Deliberate static hosting is a design choice with review. Accidental public listing of private objects is a breach pattern. Default to Block Public Access patterns; use CloudFront when public read is required.

Q51. How does encryption protect data at rest?

(Theme: TechGig / Wipro — candidate-reported.) Encryption turns data into ciphertext without the key. If a disk or snapshot is stolen, plaintext is not trivial to read. I still manage keys carefully (KMS ideas), because encryption without key hygiene fails open to the key holder.

Q52. Zero-day – what do you say in an MNC round?

(Theme: TechGig / Wipro — candidate-reported.) A zero-day is a vulnerability without a public patch at discovery/exploit time. Mitigation mindset: defence-in-depth, least privilege, IDS/EDR behavioural detection, rapid patch when vendor fix lands, and network exposure reduction. No fake claims that I "found zero-days for clients".