Question 1

What is AWS KMS?

Accepted Answer

Key Management Service creates and controls cryptographic keys used across AWS services and in your applications. Keys never leave KMS unencrypted, every use is logged in CloudTrail, access is controlled by key policies and IAM, and keys support automatic annual rotation. The envelope encryption model is what to explain: KMS generates a data key, returns it in plaintext and encrypted form, your application encrypts with the plaintext key and stores the encrypted one alongside the data. That keeps large data encryption local and only key operations in KMS.

Question 2

What is the difference between an AWS managed key, a customer managed key and an AWS owned key?

Accepted Answer

AWS owned keys are used by a service across many accounts and are invisible to you. AWS managed keys are created by a service in your account, visible in KMS but with a policy you cannot change and rotation you cannot control. Customer managed keys are created by you, with a key policy, rotation setting, tags and full CloudTrail visibility. The reason to use a customer managed key is control and revocability: you can disable it to render data unreadable, restrict which principals may use it, and audit every operation. The trade-off is a monthly key charge and per-request costs.

Question 3

What is a KMS key policy and how does it interact with IAM?

Accepted Answer

Every KMS key has a resource-based key policy which is the primary access control — unlike most services, an IAM policy alone is not sufficient unless the key policy delegates to IAM. The common pattern is a key policy that allows the account root to use IAM policies for the key, plus explicit grants for specific principals. This is the fact that surprises people: an administrator with full IAM access still cannot use a key whose policy does not permit it. That property also makes KMS the mechanism for genuine separation of duties, since a security team can hold key control independently of workload administrators.

Question 4

What is a KMS grant?

Accepted Answer

A grant is a temporary, programmatic delegation of specific key operations to a principal, typically created by AWS services on your behalf when they need to use a key for a resource. Grants can be constrained by encryption context and retired when no longer needed. Grants exist because key policies are static documents that do not scale for dynamic, per-resource delegation. Encryption context constraints are the security-relevant detail — they bind the grant to specific metadata so it cannot be used for other resources.

Question 5

What is encryption context in KMS?

Accepted Answer

Encryption context is a set of non-secret key-value pairs supplied at encryption time and required, identically, at decryption. It is logged in CloudTrail and can be enforced in key policies and grants, providing additional authenticated data that binds a ciphertext to its intended purpose. The practical value is preventing a ciphertext being decrypted in the wrong context — for example a value encrypted for tenant A cannot be decrypted while claiming tenant B. It also makes CloudTrail logs far more useful because you can see what each decryption was for.

Question 6

What is the difference between KMS and CloudHSM?

Accepted Answer

KMS is a managed, multi-tenant service using FIPS-validated hardware, integrated with every AWS service, priced per key and per request. CloudHSM gives you dedicated single-tenant hardware security modules that you control entirely, with AWS having no access to the keys, used when regulation demands exclusive control or when you need PKCS#11 or specific cryptographic operations. The trade-off is that CloudHSM is your responsibility — you manage users, clusters, backups and availability. KMS custom key stores backed by CloudHSM are the middle path, giving KMS integration with keys held in your own HSM.

Question 7

How does KMS key rotation work?

Accepted Answer

Automatic rotation creates new key material annually, or on a configurable schedule, while retaining the old material so previously-encrypted data remains readable. The key ID and ARN do not change, so nothing needs reconfiguring. Existing data is not re-encrypted — the old material is simply retained for decryption. That rotation does not re-encrypt existing data is the fact interviewers check: it limits exposure for new encryptions but does not protect data already written. Manual rotation with a new key and re-encryption is required if you need that.

Question 8

What is AWS Secrets Manager and how does it differ from Parameter Store?

Accepted Answer

Secrets Manager stores secrets with automatic rotation via Lambda, cross-region replication, resource policies and versioning, charged per secret per month. Parameter Store holds configuration and encrypted SecureString values, is free for standard parameters, but has no built-in rotation. The deciding factor is rotation: if a credential must rotate without a deployment, Secrets Manager does it natively, including managed rotation for RDS credentials. For non-rotating configuration, Parameter Store is cheaper and perfectly adequate.

Question 9

How does automatic secret rotation work for a database credential?

Accepted Answer

Secrets Manager invokes a rotation Lambda which creates a new credential, tests it, marks it AWSPENDING then AWSCURRENT, and retires the previous version to AWSPREVIOUS. Using the alternating-users strategy, two database users are rotated alternately so there is always a valid credential during the transition. The alternating-users approach is what makes rotation non-disruptive: with a single user, there is a window where clients holding the old password fail. Naming the four staging labels shows you have implemented or debugged rotation rather than only enabled it.

Question 10

What is AWS WAF and how would you deploy it?

Accepted Answer

WAF is a web application firewall attached to CloudFront, ALB, API Gateway, AppSync or Cognito, with managed rule groups for the OWASP Top 10, bot control, IP reputation and account takeover prevention, plus custom and rate-based rules. Deploy managed rules in count mode first, review what would have been blocked, then switch to block. Count mode first is the discipline that matters, because managed rule groups produce false positives on real application traffic and enabling them straight into block mode on launch day breaks production. Naming that deployment sequence is what separates practice from theory.

Question 11

What is AWS Shield and what is the difference between Standard and Advanced?

Accepted Answer

Shield Standard is automatic and free, absorbing common volumetric layer 3 and 4 attacks at the edge for all AWS customers. Shield Advanced adds enhanced detection, near-real-time visibility, access to the Shield Response Team, automatic application-layer mitigation with WAF, and cost protection against scaling charges caused by an attack. The cost protection is an underrated feature: a DDoS against an autoscaling application generates a bill even if it stays up, and Shield Advanced credits those charges. The architectural point is that protection depends on being behind CloudFront or a load balancer.

Question 12

What is Amazon GuardDuty?

Accepted Answer

GuardDuty is a managed threat detection service analysing CloudTrail events, VPC Flow Logs, DNS logs, and optionally S3 data events, EKS audit logs, RDS login activity, Lambda network activity and EBS malware scanning, using machine learning and threat intelligence to produce findings such as cryptomining, credential exfiltration and reconnaissance. The value is that it requires no agents and no log pipeline — you enable it and it analyses sources you already produce. Enabling it organisation-wide from a delegated administrator account is the deployment pattern to name.

Question 13

What is AWS Security Hub?

Accepted Answer

Security Hub aggregates findings from GuardDuty, Inspector, Macie, IAM Access Analyzer, Config and third-party tools into one view, normalises them into a common finding format, and runs automated compliance checks against standards such as CIS, PCI DSS and the AWS Foundational Security Best Practices. The aggregation across accounts and the common finding format are what make it operationally useful — otherwise each service has its own console and severity scale. Automated response through EventBridge rules on findings is the next step worth naming.

Question 14

What is Amazon Inspector?

Accepted Answer

Inspector continuously scans EC2 instances, container images in ECR and Lambda functions for software vulnerabilities and unintended network exposure, using the SSM agent for EC2 with no separate scanning schedule, and reports findings with a contextual risk score to Security Hub. The continuous rescanning is the important property: an image clean at build time becomes vulnerable when a new CVE is published, so a one-off scan in CI is insufficient. The network reachability analysis, which flags whether a vulnerable port is actually reachable, is what makes prioritisation possible.

Question 15

What is Amazon Macie?

Accepted Answer

Macie discovers and classifies sensitive data in S3 — personal data, financial data, credentials — using managed and custom identifiers, and reports on bucket security posture including public access, encryption and sharing. It answers the question that precedes any data protection work: where is the sensitive data. Naming the cost consideration — scanning large buckets is charged by data volume, so scope and sampling matter — shows you have run it rather than only enabled it.

Question 16

What are the most common AWS misconfigurations you would look for first?

Accepted Answer

Public S3 buckets; security groups open to 0.0.0.0/0 on SSH, RDP or database ports; IAM users with long-lived access keys and no MFA; overly broad IAM policies and use of AdministratorAccess; unencrypted volumes, snapshots and databases; disabled or unmonitored CloudTrail; root account with access keys; and default VPCs in use for production. The stronger answer names how you would *prevent* each rather than only detect: S3 Block Public Access at the account level, SCPs denying key creation and region use, Config rules with automatic remediation. Detection without prevention means finding the same issue every quarter.

Question 17

How do you respond to a compromised IAM credential?

Accepted Answer

Contain first — deactivate the access key or attach a deny-all policy, and revoke active role sessions with a token-issue-time condition. Preserve CloudTrail evidence before deleting anything. Investigate what the credential did and what it could reach. Rotate everything in that blast radius, then remediate the leak source and add detection. The token-issue-time revocation technique is the detail few candidates know and it is essential, because deactivating a key does not invalidate role sessions already issued. Contain, preserve, investigate, remediate is the sequence interviewers assess.

Question 18

What is defence in depth applied to an AWS workload?

Accepted Answer

Layered independent controls: SCPs preventing dangerous configuration; least-privilege IAM on per-workload roles with no long-lived keys; network isolation with private subnets, security groups and controlled egress; encryption with customer managed keys; WAF and Shield at the edge; CloudTrail and Config to a locked logging account; and GuardDuty, Inspector and Security Hub for detection. The framing that scores is that each layer assumes the previous has failed — "if a credential is stolen, the SCP still prevents the attacker using an unapproved region, and the KMS key policy still prevents decryption". That reasoning is what distinguishes a design from a checklist.

Question 19

How do you protect CloudTrail logs from tampering?

Accepted Answer

Create an organisation trail delivering to an S3 bucket in a dedicated logging account with restricted IAM, Object Lock in compliance mode, and MFA delete; enable log file validation so tampering is detectable; deny trail deletion and modification with an SCP; and alarm on any change to the trail configuration. Disabling logging is a standard early step in an intrusion, so logs stored in the same account as the compromised workload can be destroyed by the attacker. Separation plus immutability plus an alarm on configuration change is what makes them evidence.

Question 20

What is the difference between a security group and a WAF?

Accepted Answer

A security group operates at layers 3 and 4 on IP addresses and ports around an ENI, and cannot inspect request content. WAF operates at layer 7 on HTTP requests at the edge, inspecting paths, headers, query strings and bodies, applying rules for injection attacks, bots and rate limits before traffic reaches any backend. They are complementary rather than alternatives: a security group cannot stop SQL injection, and WAF cannot stop a connection to a database port. A design relying only on security groups has no application-layer protection at all.

Question 21

How do you secure secrets in a CI/CD pipeline?

Accepted Answer

Store them in Secrets Manager or Parameter Store and grant the pipeline role access to specific secrets; never commit them or pass them as Docker build arguments, which persist in image layers; authenticate the pipeline to AWS with OIDC federation rather than stored access keys; and scan the repository for committed secrets. The Docker build-arg leak is the specific trap worth naming, because a secret passed that way is recoverable from the published image history. OIDC federation for the pipeline itself removes the largest static credential in most organisations.

Question 22

What is AWS Config and how is it used for security?

Accepted Answer

Config records resource configuration over time and evaluates resources against rules — managed or custom — reporting compliance and optionally remediating automatically through SSM Automation documents. Conformance packs bundle rules for a standard, and an aggregator gives an organisation-wide view. Automatic remediation is the feature that turns Config from a report into a control: a rule that detects a public S3 bucket and immediately removes the grant. The distinction from CloudTrail — Config records state, CloudTrail records the API call — is the other thing interviewers check.

Question 23

What is a VPC endpoint policy and why does it matter for security?

Accepted Answer

An endpoint policy restricts what can be accessed through a VPC endpoint — for example allowing S3 access only to buckets in your own organisation. It prevents data exfiltration to an attacker-controlled bucket even by a principal with valid credentials, because the network path itself is constrained. This is the AWS answer to credential-based exfiltration, analogous to a data perimeter. Combining endpoint policies with the aws:PrincipalOrgID and aws:ResourceOrgID condition keys is how organisations build a data perimeter that IAM alone cannot express.

Question 24

What is a data perimeter on AWS?

Accepted Answer

A data perimeter is a set of controls ensuring only trusted identities access trusted resources over trusted networks: SCPs and resource policies using aws:PrincipalOrgID, aws:ResourceOrgID and aws:SourceVpce conditions, plus VPC endpoint policies, so corporate data cannot flow to external accounts and external identities cannot reach your resources. It addresses the gap that IAM leaves: a valid credential used from anywhere can copy data to an attacker's bucket. Naming the three specific condition keys is what demonstrates you have implemented rather than read about it.

Question 25

How do you handle PII in an AWS data platform?

Accepted Answer

Discover and classify with Macie; tokenise or mask at ingestion where possible; enforce column and row level access with Lake Formation; encrypt with customer managed keys; keep data inside a data perimeter; enable CloudTrail data events on the sensitive stores; and apply retention so data is deleted when no longer needed. Retention is the part most candidates omit and regulators care about most, since holding personal data indefinitely is itself a violation under several regimes. Naming lifecycle deletion alongside access control is what makes the answer complete.

Question 26

What is Amazon Detective?

Accepted Answer

Detective builds a linked graph from CloudTrail, VPC Flow Logs and GuardDuty findings, letting you investigate a finding by pivoting across entities — which role, which instance, what activity before and after — without writing queries or building a pipeline. The value is investigation speed: turning a GuardDuty finding into a scoped timeline of what the compromised entity did normally takes hours of Athena queries over CloudTrail. Detective pre-computes that graph, which is the difference in an incident.

Question 27

How do you enforce encryption across an organisation?

Accepted Answer

SCPs denying creation of unencrypted resources such as EBS volumes, RDS instances and S3 objects without encryption headers; account-level defaults such as EBS encryption by default and S3 default encryption; Config rules detecting non-compliant resources with automatic remediation; and key policies restricting which principals may use each key. The account-level EBS encryption default is the highest-value single setting because it removes the possibility of an unencrypted volume being created at all. Combining preventive SCPs with detective Config rules is the defence-in-depth pattern for compliance.

Question 28

What is AWS Firewall Manager?

Accepted Answer

Firewall Manager centrally configures and enforces WAF rules, Shield Advanced protections, security group policies, Network Firewall and Route 53 Resolver DNS Firewall across all accounts in an organisation, automatically applying them to new resources as they are created. The automatic application to new resources is the point: without it, a new account or a new load balancer starts unprotected until someone remembers. Centralised enforcement is what makes security posture consistent rather than aspirational.

Question 29

What is the AWS shared responsibility model in security terms?

Accepted Answer

AWS secures the cloud — physical facilities, hardware, hypervisor, managed service internals. The customer secures what is in the cloud — IAM, security groups, encryption configuration, guest OS patching where exposed, application code and data classification. The line moves up the stack as the service becomes more managed. The clarification that matters is that AWS certifications cover their layer only — being on AWS does not make your workload PCI compliant. Candidates who say "AWS is compliant so we are covered" have the model wrong, which is exactly what the question tests.

Question 30

How do you approach a compliance certification such as ISO 27001 or PCI DSS on AWS?

Accepted Answer

Start from AWS Artifact for their audit reports covering the infrastructure layer, then map the controls that remain yours. Use Control Tower guardrails and Config conformance packs for enforced configuration, Security Hub compliance standards to track posture, Audit Manager to collect evidence, and CloudTrail export for the audit trail. Audit Manager is worth naming because evidence collection, not control implementation, is where most compliance effort actually goes. Being clear that AWS certification covers their layer only is the framing error to avoid.

Question 31

How do you detect and prevent cryptomining in a compromised account?

Accepted Answer

Prevent with SCPs restricting regions and expensive instance types, quotas capping how much compute can be created, and no long-lived credentials. Detect with GuardDuty cryptomining findings, anomalous-spend detection in Cost Anomaly Detection, and alarms on unusual EC2 RunInstances activity in unused regions. Quotas as a security control is the insight worth volunteering: an attacker with compute permissions is bounded by regional limits, so keeping unused regions at zero quota caps the damage. Most candidates think of quotas only as a cost mechanism.

Question 32

What is IMDSv2 and why does it matter?

Accepted Answer

Instance Metadata Service version 2 requires a session token obtained by a PUT request before any metadata read, which defeats server-side request forgery attacks that could otherwise trick an application into fetching instance role credentials. It should be enforced with HttpTokens set to required. The SSRF-to-credential-theft path via IMDSv1 caused well-publicised breaches, which is why enforcing v2 is one of the highest-value EC2 hardening steps. It can be set as an account-wide default and enforced by an SCP or Config rule.

Question 33

How do you secure container workloads on AWS?

Accepted Answer

Scan images in ECR and block vulnerable ones from deploying; use minimal or distroless base images; run as non-root with a read-only root filesystem; give each task or pod its own least-privileged role via task roles or IRSA; use awsvpc mode for task-level security groups; keep secrets in Secrets Manager; and enable GuardDuty runtime monitoring. Per-task IAM is the highest-value item because otherwise every container on a node shares the node role's permissions. GuardDuty runtime monitoring for ECS and EKS is the current detection layer and shows you are current rather than reciting older guidance.

Question 34

What is a break-glass procedure and how would you implement it on AWS?

Accepted Answer

A pre-defined, audited path to emergency elevated access: a dedicated role assumable only by a small group, requiring MFA, with an EventBridge alarm firing to the security team on every assumption, automatic session expiry, and mandatory post-use review. It should be tested but rarely used. The design requirement is that it must be usable under pressure but impossible to use quietly. If break-glass access is convenient and unmonitored it becomes the normal path, which defeats every other control you have built.

Question 35

What logs would you send to a SIEM from AWS?

Accepted Answer

CloudTrail management and selected data events, VPC Flow Logs, DNS query logs, WAF logs, load balancer access logs, GuardDuty and Security Hub findings, Config configuration items, and application logs. Route them through an organisation trail and Kinesis Data Firehose or an S3 bucket the SIEM reads. The volume-versus-value trade-off is real: Flow Logs and CloudTrail data events can dominate SIEM ingest cost, so sampling and selective enablement are genuine decisions. Naming Security Lake, which normalises these into OCSF in a central account, shows current knowledge.

Question 36

What is Amazon Security Lake?

Accepted Answer

Security Lake centralises security data from AWS services, on-premises sources and third parties into a purpose-built data lake in your account, normalised into the Open Cybersecurity Schema Framework and stored as Parquet in S3, queryable by Athena or your SIEM. The normalisation into a common schema is the value: correlating a CloudTrail event with a firewall log and an endpoint alert normally requires bespoke parsing per source. Owning the lake also avoids paying a SIEM vendor per gigabyte for raw storage.

Question 37

How do you prevent data exfiltration by someone with legitimate access?

Accepted Answer

Minimise what each identity can reach with least privilege and per-workload roles; implement a data perimeter with SCPs and endpoint policies so data cannot be written to external accounts; restrict egress with Network Firewall domain allow-lists; enable CloudTrail data events with alerting on unusual read volume; and separate duties so nobody can both extract data and delete the logs. The honest acknowledgement is that you cannot prevent someone reading data they legitimately need — you can only minimise the scope, make bulk extraction difficult, and make it detectable. Framing it as minimise-and-detect rather than prevent is the mature position.

Question 38

What is AWS Certificate Manager and how do you manage TLS?

Accepted Answer

ACM provisions and automatically renews public certificates free of charge for use with CloudFront, ALB, API Gateway and other integrated services, with DNS validation being the automatable option. ACM Private CA issues internal certificates for service-to-service TLS. The constraint to name is that ACM public certificates cannot be exported, so they only work with integrated services — an EC2 instance terminating TLS itself needs a certificate from elsewhere. The us-east-1 requirement for CloudFront certificates is the other classic gotcha.

Question 39

Design the security architecture for a healthcare application on AWS.

Accepted Answer

Organizations with Control Tower, OUs per environment, and SCPs restricting regions, denying disabling of logging, and forbidding IAM key creation. IAM Identity Center federated with the corporate IdP and MFA enforced; workloads on per-service roles with no keys. Private subnets with no public IPs, centralised egress inspection with Network Firewall, VPC endpoints with restrictive policies and a data perimeter. Customer managed KMS keys with rotation for all storage and databases; Secrets Manager with rotation. CloudFront with WAF and Shield Advanced as the only public ingress. Macie for PII discovery, Lake Formation for column-level access, and CloudTrail with data events plus Config, GuardDuty, Inspector and Security Hub delivering to a locked logging account with Object Lock. Tested incident response and break-glass procedures. The closing scenario. The senior markers are enforcing controls with SCPs rather than convention, building a data perimeter so credentials alone cannot exfiltrate, isolating and locking the audit trail, and treating tested incident response as part of the architecture rather than paperwork.

AWS Security, KMS & Threat Detection Interview Questions and Answers

How to use this set