Cloud Attack Vectors and Mitigations Questions

Encompasses cloud specific attack techniques and the architectural and operational controls used to mitigate them. Candidates should be able to explain threat scenarios such as identity and access management privilege escalation, public object storage exposure, server side request forgery enabling lateral movement, container and orchestration platform escapes, compromise of container images, misconfigured resource policies and cross account risks, and supply chain tampering. Discussions should include detection strategies and hardening controls such as least privilege and conditional access, network segmentation using virtual private clouds and private endpoints, secure configuration of object storage and compute, runtime protections for containers and virtual machines, container image provenance and scanning, secrets management, and patterns for cross account access and isolation. Candidates should also be prepared to discuss trade offs between detection coverage, performance, and cost, and the operational processes for validation, recovery, and forensics in cloud incidents.