Walk into the interview already prepared.

Fresher (0–3 years): Cloud Security Associate

1. How would you secure the root / Global Administrator account?
2. A storage bucket was found publicly readable. What do you do?
3. What logs would you enable on day one in a cloud account?
4. What is the principle of least privilege?
5. Encryption at rest protects data…
6. Which AWS service records API calls for auditing?
7. Leaving SSH (22) open to 0.0.0.0/0 is risky because…
8. Where should application secrets live?
9. What does a CSPM tool do?

Mid-level (3–8 years): Cloud Security Engineer

1. Access keys were leaked on GitHub. Walk through your response.
2. How do you design network security for a cloud workload?
3. How do you improve a low cloud security score across many accounts?
4. Best way for CI/CD to deploy to the cloud without long-lived keys?
5. Keep PaaS/storage traffic off the internet.
6. Who controls key rotation and access with customer-managed keys?
7. GuardDuty reports API calls from a known malicious IP using valid credentials. Likely cause?
8. An IAM policy with "Action": "*" and "Resource": "*" is…
9. A web application firewall mainly protects against…

Experienced (8–15 years): Cloud Security Architect

1. Design an identity strategy for a multi-cloud company.
2. How would you build cloud security monitoring for 200 accounts?
3. How do you meet data residency and compliance requirements in the cloud?
4. How do you enforce guardrails that account admins cannot bypass?
5. Data classification should drive…
6. Centralising security findings across clouds is best done with…
7. Zero trust for workloads means…
8. Detect data exfiltration in the cloud.
9. Which reduces blast radius the most?