Security, Access Control, and Compliance
Security questions test who can do what, where, and how it is enforced. Know the roles: organization-level roles (admin, member, billing) vs team roles on an application (admin, lead, developer, etc.) vs environment permissions. A trap is assuming an application team member can SSH to Prod-SSH access is granted per environment and per user, and Prod is often restricted.
Know the access paths: web UI, Cloud API, Drush/SSH, and Git. Each has its own credential (API token, SSH key, Git credentials). SSO/SAML at the organization level governs UI login but does not automatically grant SSH. Two-factor authentication and IP allowlisting are common controls. Questions may ask how to grant a contractor temporary access-answer: add to the team with the least privilege, scope to the needed environment, and remove after.
Secrets belong in environment variables, never in the repo. SSL/TLS certificates are managed at the application level (Acquia provides certificates, including Let's Encrypt). Compliance topics include logging/auditing, data residency (region choice), and encryption in transit and at rest. A trap is assuming backups are automatically downloadable by anyone-access is permissioned.
Worked rule of thumb: apply least privilege and separate duties-the person who deploys to Prod is not necessarily the person who can change billing. For "how do you secure a new environment," the answer usually combines restricted SSH, environment variables for secrets, and proper team roles.
Watch for questions on database and file access (credentials per environment) and on removing a user (remove from team and revoke keys/tokens, not just disable UI login).