Cloud Security and Compliance
What to know
Security questions test identity first. Understand authentication (who you are) versus authorization (what you may do), and the principle of least privilege applied through roles, policies, and scoped credentials. Know federation and single sign-on so identities from a corporate directory map to cloud roles without long-lived keys. Data protection spans encryption at rest (provider-managed vs. customer-managed keys), encryption in transit (TLS), and key management lifecycle - rotation, separation of duties, and who can decrypt. Network controls (security groups, network ACLs, private subnets) and logging/monitoring (audit trails, anomaly detection) round out detection and response.
Compliance
Compliance is about evidence and scope. Frameworks (e.g., ISO 27001, SOC 2, PCI DSS, HIPAA) impose controls; the provider's certifications cover the provider's layer, while you inherit only what applies to your workload. Data residency, retention, and classification drive where data may live and how long it is kept.
Traps
Watch for "encryption solves it" - encryption without access control or key governance is weak. Questions may imply that a provider's compliance certification makes your workload compliant; it does not. Also distinguish audit logging (who did what) from monitoring (is it healthy) and from vulnerability scanning (what is exposed).
Worked example
An app must let staff use corporate credentials and avoid stored secrets. Answer: federated SSO to cloud roles, short-lived tokens, least-privilege policies, and key management separated from application admins. Rule of thumb: identity is the new perimeter - prefer short-lived, federated credentials over static keys.