Fifteen common cloud security interview questions
- Explain the shared responsibility model.
- How do you design identity and access management for least privilege?
- Roles versus long-lived access keys?
- How do you structure accounts, subscriptions or projects for security?
- How do you secure network access to workloads?
- Encryption at rest and in transit — how is it implemented and who holds the keys?
- What logs would you enable, and where do they go?
- An access key was committed to a public repository. What do you do?
- A storage bucket is publicly readable. How do you respond and prevent recurrence?
- What is policy as code?
- How do you secure containers and Kubernetes in the cloud?
- How do you manage secrets?
- What is cloud security posture management?
- How do you secure CI/CD pipelines that deploy to the cloud?
- How do you handle security across multiple cloud providers?
Identity first
Most cloud breaches involve identity: stolen credentials, over-privileged roles or misconfigured trust. Favour short-lived credentials through roles and workload identity over long-lived keys, enforce MFA for humans, use single sign-on, grant least privilege with permission boundaries or guardrail policies at the organisation level, and review unused permissions regularly. Separate production, development and security tooling into different accounts or projects to limit blast radius.
Core controls
| Area | Controls to mention |
|---|---|
| Network | Private subnets, security groups or firewall rules, private endpoints, no public management ports |
| Data | Encryption at rest with managed keys, TLS in transit, customer-managed keys where required |
| Logging | Control-plane audit logs, flow logs, storage access logs, centralised and tamper-resistant |
| Detection | Managed threat detection services, alerts on risky changes |
| Posture | Continuous configuration scanning against benchmarks |
| Secrets | Managed secrets services, rotation, no secrets in code or images |
Incident scenarios
- Leaked access key: deactivate and rotate it immediately, review audit logs for its use, investigate and revert unauthorised resources or changes, check billing for abuse, then prevent recurrence with secret scanning and by replacing keys with roles.
- Public bucket: block public access, assess what was exposed using access logs, notify per policy and regulation, and enforce account-level public-access blocks and policy checks in pipelines.
Prevention at scale
Policy as code — guardrails expressed as code and enforced in infrastructure pipelines and at the organisation level — stops misconfigurations before deployment rather than detecting them after. Combine it with infrastructure as code reviews, posture management for drift, and pipeline security: least-privilege deployment roles, signed artefacts, protected branches and secret scanning. See Terraform interview questions and DevSecOps interview questions.
Containers and multi-cloud
For containers: minimal images, vulnerability scanning, non-root users, image signing, Kubernetes RBAC, network policies and restricted pod security. For multi-cloud, standardise identity through a central provider, centralise logs, and use tools that apply consistent policies across providers — while respecting each provider's native controls.
A design question to prepare
“Set up a secure cloud foundation for a company starting out.” Cover an organisation with separate accounts or projects for security tooling, logging, production and development; single sign-on with MFA and role-based access; organisation-wide guardrail policies; centralised, immutable audit logging; baseline network patterns with private connectivity; encryption defaults; a secrets manager; posture scanning; and an incident response runbook. Explain the order you'd do it in and which controls are preventive versus detective.
Practising
Interviewers follow up on the most specific thing you say, so rehearse the second question as well as the first. CoPilot Interview, a free AI interview assistant, runs cloud security mock interviews with follow-ups and produces a report of likely next-round questions. Prepare the leaked-key and public-bucket responses as step-by-step answers. Provider-specific depth is in AWS, Azure and Google Cloud guides.
Disclosure: CoPilot Interview is our product, so weigh what we say about it accordingly. Everything else on this page applies whichever tool you use, or none.
Frequently asked questions
What questions are asked in a cloud security interview?
Shared responsibility, IAM and least privilege, account structure, network controls, encryption and key management, logging and detection, incident scenarios such as leaked keys or public buckets, policy as code, secrets, containers and pipeline security.
What is the shared responsibility model?
The cloud provider secures the underlying infrastructure; the customer secures what they build on it — identities, configurations, data, applications and, depending on the service, the operating system.
What do you do if a cloud access key leaks?
Deactivate and rotate it immediately, review audit logs for its use, revert unauthorised changes, check for resource abuse, and prevent recurrence with secret scanning and role-based credentials.
What is policy as code?
Expressing security and compliance rules as code that's automatically enforced in deployment pipelines and cloud organisations, preventing misconfigurations before they reach production.
Practise on real interview questions
Run 145 real interview questions across 10 tracks, answer out loud and see a structured answer to compare with yours. Free, no signup.
Try a practice question