Skip to main content

Cloud Security

Cloud platforms introduce new risks, shared responsibility boundaries, and configuration-driven attack surfaces, so interviewers focus heavily on misconfigurations, IAM, segmentation, and visibility.

This lesson teaches you how to explain cloud risks clearly, design secure architectures, and answer cloud security questions with structure and confidence.

Interviewers want to see whether you can:

  • Explain the shared responsibility model and how security duties shift across IaaS, PaaS, and SaaS.
  • Identify common cloud misconfigurations and their impact.
  • Design secure identity, data, and network controls at scale. This is covered in our Security System Design Course.

What to expect

Typical interview prompts include:

  • “How would you prevent public S3 bucket exposure?”
  • “What’s your approach to securing IAM roles across multiple accounts?”
  • “How do you segment workloads in the cloud?”
  • “How would you secure data stored in cloud databases?”
  • “How do you detect suspicious activity in a cloud account?”

The majority of questions on cloud security are scenario-based.

The shared responsibility model

Every cloud platform uses a version of the shared responsibility model.

It defines which security tasks the cloud provider handles and which the customer must manage.

Provider responsibilities

  • Physical infrastructure: data centers, hardware, networking
  • Virtualization layer and tenant isolation
  • Managed service availability

Customer responsibilities

  • Identity and access controls
  • Network configuration and segmentation
  • Securing applications and data
  • Logging, monitoring, and threat detection
  • Encryption setup and key management

How responsibilities differ across IaaS, PaaS, SaaS

ModelProvider handlesCustomer handlesExample
IaaSPhysical security, hardware, and virtualization.OS patching, IAM, network config, encryption.EC2, Compute Engine, Azure VMs.
PaaSRuntime and platform services.Application security, IAM, data protection.AWS RDS, Azure SQL, GCP App Engine.
SaaSEntire app stack and infrastructure.Data classification, identity management, MFA.Google Workspace, Salesforce, Office 365.

The higher you go (SaaS), the less you manage, but IAM and data protection always remain your responsibility.

Cloud misconfigurations

Most cloud breaches stem from configuration mistakes, not exotic exploits.

Interviewers want to see if you can connect: Misconfiguration → Risk → Mitigation

CategoryExampleRiskPrevention
Storage exposurePublic S3 buckets, open GCS/Azure Blob containers.Data leaks and compliance violations.Use private ACLs, enforce IAM, and enable encryption by default.
IAM overprivilegeAttaching admin policies to roles or users.Privilege escalation and lateral movement.Apply least privilege, role separation, and regular audits.
Network exposureWide-open security groups or firewall rules.External access and unauthorized entry points.Restrict inbound rules, use VPC segmentation and private endpoints.
Unrestricted API accessAPIs without auth or rate limits.Abuse or data exfiltration.Require authentication, authorization, and throttling.
Disabled loggingCloudTrail, Stackdriver, or Activity Log disabled.No visibility for detection or forensics.Enforce mandatory audit logging and alert on configuration drift.
Unencrypted dataMissing encryption at rest or in transit.Data theft or tampering.Use KMS, HSM, and TLS 1.2+.

Explain each in terms of impact and mitigation, not vendor commands.

Platform-specific examples

ProviderExample misconfigurationRecommended control
AWSPublic S3 buckets, unrestricted security groups.Use AWS Config and SCPs to enforce private defaults.
GCPOverly broad IAM bindings or public GCS buckets.Implement organization policies to restrict allUsers access.
AzureDisabled Defender for Cloud or missing NSG rules.Use Azure Policy for compliance and monitoring.

Keep your answers provider-agnostic by describing principles like ownership, least privilege, and automation.

Next Lesson