# Interview: say the control, the dummy ARN, and the aws cli proof Source: https://ai.techclick.in/blog_aws_security_interview_20 Markdown: https://ai.techclick.in/blog_aws_security_interview_20.md Publisher: Techclick Infosec Pvt Ltd Twenty AWS security interview scenarios from this lab: IAM, SCP, SG vs NACL, roles, KMS, endpoints, Trail, TGW, S3. ## The ticket You have 12 minutes. The interviewer draws account 111122223333 , hub 10.50.0.0/16 , app 10.51.0.0/16 , FortiGate 203.0.113.10 . Talk like you closed these tickets. Strong answer pattern Name the control → name the object (OU, sg-web , AppEC2Role , tgw-lab , tc-lab-app-logs ) → name the proof command → name the classic trap. Weak: “check the logs.” Strong: “org trail in the Security OU, then aws cloudtrail get-trail-status , then GuardDuty finding — Trail is not GuardDuty.” Hero · whiteboard If you cannot draw SG vs NACL, you are not ready. Lab data · dummy only Account 111122223333 · OUs Security / Workloads · hub VPC 10.50.0.0/16 · app VPC 10.51.0.0/16 · SG sg-web · NACL acl-app · bucket tc-lab-app-logs · role AppEC2Role · TGW tgw-lab · VGW public 203.0.113.60 · on-prem FortiGate WAN 203.0.113.10 . Dummy account ID. Not yours. ## Twenty questions (say these out loud) - Of-the-cloud vs in-the-cloud for EC2 guest OS vs S3 bucket policy. - Why root on 111122223333 is not a daily user. - Why IAM / Identity Center is the perimeter, not only the VPC. - SCP: guardrail (deny/ceiling), not a grant. - Why SCPs do not save a workload in the management account. - Control Tower / OUs Security + Workloads before the first VPC. - SG: stateful, ENI, allow-only — official compare. - NACL: stateless, numbered, allow+deny — return/ephemeral must be explicit. - Humans via Identity Center; no long-lived people keys. - EC2 instance profile / IRSA vs AKIA in user-data. - CMK vs AWS-owned when the question is “can you audit decrypt?” - Where the DB password must not live. - Gateway endpoint (S3/Dynamo) vs interface PrivateLink. - Why NAT to public S3 is the wrong default. - CloudTrail is the camera. Event history is not the archive. - GuardDuty findings vs Security Hub aggregator. - Why you do not peer-mesh 20 VPCs. - Two VPN tunnels + TGW route tables as policy. VGW 203.0.113.60 vs TGW. - Account Block Public Access. Logo vs tc-lab-app-logs . - Access Analyzer + Trail data events after a public GET. # One-line strong answer Proof 1–3 Guest OS/IAM/data are yours; root is break-glass; keys beat VPCs sts get-caller-identity 4–6 SCP filters; management is exempt; landing zone first organizations list-policies 7–8 SG stateful allow; NACL numbered stateless describe-security-groups / describe-network-acls 9–12 SSO + AppEC2Role + CMK; never user-data get-role / describe-instance-attribute 13–16 Gateway for S3; org trail; GD ≠ Trail ≠ Hub describe-vpc-endpoints / describe-trails 17–20 TGW hub, two tunnels, account BPA, Analyzer describe-vpn-connections / get-public-access-block Answer shape Control - Lab object aws cli Trap Four beats. Feature dumps fail. Reboots fail. Invented quotas fail. https://111122223333.signin.aws.amazon.com/console Training mock · not live AWS console VPC IAM S3 CloudTrail IAM → Dashboard ### Interview bench · dummy account Account 111122223333 · OUs Security / Workloads Network hub 10.50.0.0/16 · app 10.51.0.0/16 · tgw-lab On-prem FortiGate 203.0.113.10 · 10.20.30.0/24 · VGW 203.0.113.60 Identity Identity Center humans · AppEC2Role · no people keys Proof sts / organizations / ec2 / cloudtrail / s3control Cancel Save Walk this mock, not a memorised dump. Training mock. ## Weak vs strong Weak Strong AWS was hacked Which principal, which API, which trail event Open the SG / make the bucket public Least-privilege SG + BPA + Analyzer VPN is up Both tunnels + TGW RT + VPC RT + SG/NACL We use IAM Identity Center for humans, roles for compute, no AKIA ## How to rehearse #### Side A — draw Account, two OUs, two VPCs, tgw-lab, two tunnels to 203.0.113.10, bucket, role. No notes. - #### Side B — five proofs Speak Q2, Q4, Q8, Q14, Q19 with one CLI each. - #### Side C — quiz Misses send you back to that lesson. Do not invent service limits. aws cli · interview bench aws sts get-caller-identity aws organizations list-organizational-units-for-parent --parent-id r-lab1 aws ec2 describe-security-groups --group-names sg-web sg-app aws cloudtrail describe-trails --query 'trailList[].IsOrganizationTrail' aws s3control get-public-access-block --account-id 111122223333 ## Four interview fails ### 1 · Feature dump They asked for a path in this account. ### 2 · No proof command Theory only. Say the CLI. ### 3 · Mixing Trail / GuardDuty / Hub Camera, findings, aggregator. Three products. ### 4 · Invented quotas and prices Two tunnels is documented. A dollar figure you guessed is not. ## How to prove it You are ready when You can walk questions 1–20 without notes, name a dummy object from this lab, and name an aws cli command for each cluster. ## Traps Trap Fix Memorising menu names without SG vs NACL Draw stateful vs numbered Saying SCP grants access Lesson 2 — ceiling only Using a live customer account id Dummy 111122223333 only ## Knowledge check Judgment items. One best answer. Reasons send you back to the matching section. Q1 Best proof of who you are in the account? aws sts get-caller-identity Reboot EC2 Disable BPA Delete the trail Correct: a . Lesson 1. Q2 An SCP Allow means Priya can perform the action? Yes, SCP grants No — SCP does not grant; identity must also allow Only on S3 Only via NACL Correct: b . Lesson 2. Q3 Custom NACL allows inbound 443 only. Common miss? Stateless return / ephemeral outbound SGs becoming stateless KMS deleting the ENI Identity Center Correct: a . Lesson 3. Q4 Stolen AKIA from an IAM user is usually prevented by… Identity Center + instance profile / IRSA, no people keys A bigger NAT Public S3 Turning off CloudTrail Correct: a . Lesson 4. Q5 NAT to public S3 from a private subnet is… Required Wrong default — use a gateway endpoint How CMKs work A GuardDuty detector Correct: b . Lesson 6. Q6 Strong interview pattern? Control + lab object + aws cli + trap Reboot first Invent a quota Say AWS was hacked Correct: a . This lesson. Check answers Reset AWS security class series: Shared + IAM · Org / OU · SG vs NACL · Role not key · KMS + Secrets · VPC endpoint · Trail + GuardDuty · TGW hub · S3 public · Interview ## Sources - This series lessons 1–9 — official AWS pages cited there. - AWS Shared Responsibility Model . - AWS Organizations — SCPs . - VPC — Compare security groups and network ACLs . - IAM — Roles . - KMS — Overview . - PrivateLink — Concepts . - CloudTrail User Guide . - GuardDuty . - Security Hub . - Transit Gateway . - Site-to-Site VPN . - S3 Block Public Access . Related: AWS session factory · Migration series . --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt