The ticket
You have 12 minutes. The interviewer draws account 111122223333, hub 10.50.0.0/16, app 10.51.0.0/16, FortiGate 203.0.113.10. Talk like you closed these tickets.
Name the control → name the object (OU, sg-web, AppEC2Role, tgw-lab, tc-lab-app-logs) → name the proof command → name the classic trap. Weak: “check the logs.” Strong: “org trail in the Security OU, then aws cloudtrail get-trail-status, then GuardDuty finding — Trail is not GuardDuty.”
Account 111122223333 · OUs Security / Workloads · hub VPC 10.50.0.0/16 · app VPC 10.51.0.0/16 · SG sg-web · NACL acl-app · bucket tc-lab-app-logs · role AppEC2Role · TGW tgw-lab · VGW public 203.0.113.60 · on-prem FortiGate WAN 203.0.113.10. Dummy account ID. Not yours.
Twenty questions (say these out loud)
- Of-the-cloud vs in-the-cloud for EC2 guest OS vs S3 bucket policy.
- Why root on 111122223333 is not a daily user.
- Why IAM / Identity Center is the perimeter, not only the VPC.
- SCP: guardrail (deny/ceiling), not a grant.
- Why SCPs do not save a workload in the management account.
- Control Tower / OUs Security + Workloads before the first VPC.
- SG: stateful, ENI, allow-only — official compare.
- NACL: stateless, numbered, allow+deny — return/ephemeral must be explicit.
- Humans via Identity Center; no long-lived people keys.
- EC2 instance profile / IRSA vs AKIA in user-data.
- CMK vs AWS-owned when the question is “can you audit decrypt?”
- Where the DB password must not live.
- Gateway endpoint (S3/Dynamo) vs interface PrivateLink.
- Why NAT to public S3 is the wrong default.
- CloudTrail is the camera. Event history is not the archive.
- GuardDuty findings vs Security Hub aggregator.
- Why you do not peer-mesh 20 VPCs.
- Two VPN tunnels + TGW route tables as policy. VGW 203.0.113.60 vs TGW.
- Account Block Public Access. Logo vs
tc-lab-app-logs. - Access Analyzer + Trail data events after a public GET.
| # | One-line strong answer | Proof |
|---|---|---|
| 1–3 | Guest OS/IAM/data are yours; root is break-glass; keys beat VPCs | sts get-caller-identity |
| 4–6 | SCP filters; management is exempt; landing zone first | organizations list-policies |
| 7–8 | SG stateful allow; NACL numbered stateless | describe-security-groups / describe-network-acls |
| 9–12 | SSO + AppEC2Role + CMK; never user-data | get-role / describe-instance-attribute |
| 13–16 | Gateway for S3; org trail; GD ≠ Trail ≠ Hub | describe-vpc-endpoints / describe-trails |
| 17–20 | TGW hub, two tunnels, account BPA, Analyzer | describe-vpn-connections / get-public-access-block |
Four beats. Feature dumps fail. Reboots fail. Invented quotas fail.
Interview bench · dummy account
Weak vs strong
| Weak | Strong |
|---|---|
| AWS was hacked | Which principal, which API, which trail event |
| Open the SG / make the bucket public | Least-privilege SG + BPA + Analyzer |
| VPN is up | Both tunnels + TGW RT + VPC RT + SG/NACL |
| We use IAM | Identity Center for humans, roles for compute, no AKIA |
How to rehearse
Side A — draw
Account, two OUs, two VPCs, tgw-lab, two tunnels to 203.0.113.10, bucket, role. No notes.
Side B — five proofs
Speak Q2, Q4, Q8, Q14, Q19 with one CLI each.
Side C — quiz
Misses send you back to that lesson. Do not invent service limits.
aws sts get-caller-identity aws organizations list-organizational-units-for-parent --parent-id r-lab1 aws ec2 describe-security-groups --group-names sg-web sg-app aws cloudtrail describe-trails --query 'trailList[].IsOrganizationTrail' aws s3control get-public-access-block --account-id 111122223333
Four interview fails
1 · Feature dump
They asked for a path in this account.
2 · No proof command
Theory only. Say the CLI.
3 · Mixing Trail / GuardDuty / Hub
Camera, findings, aggregator. Three products.
4 · Invented quotas and prices
Two tunnels is documented. A dollar figure you guessed is not.
How to prove it
You can walk questions 1–20 without notes, name a dummy object from this lab, and name an aws cli command for each cluster.
Traps
| Trap | Fix |
|---|---|
| Memorising menu names without SG vs NACL | Draw stateful vs numbered |
| Saying SCP grants access | Lesson 2 — ceiling only |
| Using a live customer account id | Dummy 111122223333 only |
Knowledge check
Judgment items. One best answer. Reasons send you back to the matching section.
AWS security class series: Shared + IAM · Org / OU · SG vs NACL · Role not key · KMS + Secrets · VPC endpoint · Trail + GuardDuty · TGW hub · S3 public · Interview
Sources
- This series lessons 1–9 — official AWS pages cited there.
- AWS Shared Responsibility Model.
- AWS Organizations — SCPs.
- VPC — Compare security groups and network ACLs.
- IAM — Roles.
- KMS — Overview.
- PrivateLink — Concepts.
- CloudTrail User Guide.
- GuardDuty.
- Security Hub.
- Transit Gateway.
- Site-to-Site VPN.
- S3 Block Public Access.
Related: AWS session factory · Migration series.