Infrastructure Security and Access Control Questions

Design and implementation of security controls within infrastructure and access management. Topics include network segmentation and isolation, security groups and network access control lists, identity and access management policies and least privilege principles, encryption at rest and in transit, secrets management and key management practices, audit logging and monitoring, secure remote access patterns such as bastion hosts and virtual private networks, session recording and privileged access governance, threat modeling for infrastructure components, and trade offs for compliance and operational complexity.

HardTechnical

45 practiced

Design a solution for provisioning secrets to ephemeral containers in Kubernetes such that secrets are least-privilege, auto-rotated, and not persisted on disk in plaintext. Include the roles of Kubernetes ServiceAccounts, an external vault (e.g., Vault/Azure Key Vault), the CSI Secrets Store driver, and any admission controls.

Sample Answer

**Clarify goals**- Ephemeral containers get least-privilege secrets- Secrets auto-rotate / short TTL- No plaintext persisted to disk- Audit and admission-enforced

Solution (high-level)1. Authentication & least-privilege- Create a dedicated Kubernetes ServiceAccount per workload class (or pod) with minimal K8s RBAC.- Map each SA to a Vault role using Kubernetes Auth (vault role bound to SA name + namespace). Vault policy grants only required secrets/paths.

2. Secret issuance & rotation- Configure Vault to mint short-lived credentials (dynamic DB creds, cloud IAM tokens) or issue short TTL wrapped secrets.- Use Vault TTL/renewal and periodic rotation policies. Set max TTLs to enforce frequent rotation.

3. Delivery to pods (no disk plaintext)- Deploy the Secrets Store CSI Driver + Vault provider (or cloud provider CSI provider).- Create SecretProviderClass per secret type that requests dynamic credentials or secrets from Vault.- Mount CSI volume into pod at a path backed by tmpfs (the CSI mount is in-memory; ensure provider writes files with restrictive mode 0440 and ownership).- Alternatively use Vault Agent sidecar that writes to an in-memory tmpfs-mounted emptyDir with medium: Memory and restrictive perms; application reads from that path or envFrom a small wrapper that reads and injects variables at runtime.

4. Admission controls & enforcement- Use an Admission Controller (Gatekeeper/OPA) to enforce policies: - Only allow pods that use permitted ServiceAccounts and annotated SecretProviderClass. - Deny hostPath or persistent volume mounts to secret paths. - Require secrets be mounted via CSI driver or memory-backed emptyDir (emptyDir.medium: Memory). - Require annotation that indicates intended Vault role—reject otherwise.- Optionally use PodSecurityPolicies / PSP replacement to prevent containers from writing to /tmp or other disk paths.

5. Audit, monitoring, and key management- Enable Vault audit logging and Kubernetes audit webhook to trace token exchanges.- Use KMS (cloud KMS) to seal/unseal Vault for key protection.- Monitor CSI driver failures and Vault token renewals; alert on credential expiry events.

Example flow (runtime)- Pod created with ServiceAccount "app-sa" and SecretProviderClass referencing Vault role "app-role".- CSI driver fetches dynamic creds from Vault using the pod’s bound service account token → Vault issues short-lived secret → CSI writes secret into mounted tmpfs path with 0400/0440.- App reads secret from mount; no plaintext on node disk. When TTL expires Vault auto-rotates; CSI driver rotation option triggers update in-mount without pod restart.

Trade-offs & notes- CSI provider maturity varies by vault; test provider behavior for in-memory writes and file permissions.- Some languages expect env vars; env injection may expose secrets in process environment—prefer file-based reads.- Ensure node memory capacity for many tmpfs mounts.

This design enforces least privilege (per-SA Vault roles), auto-rotation (Vault TTLs + CSI rotation), and prevents disk-persistence (CSI/tmpfs + admission enforcement).

MediumTechnical

39 practiced

Design an automated access review and recertification process for user and service accounts in a hybrid environment. Include data sources, frequency, notifications, approver workflow, and how to handle stale or orphaned accounts.

EasyTechnical

52 practiced

Explain symmetric versus asymmetric encryption and give two practical infrastructure use-cases for each (for example: disk encryption, TLS, signing). Also mention performance and operational considerations that influence the choice.

EasyTechnical

74 practiced

What is multi-factor authentication (MFA), and which MFA patterns are recommended for system administrators accessing critical infrastructure? Discuss hardware tokens, TOTP, push-based methods, and integration points like SSO and PAM.

MediumTechnical

55 practiced

Write a Python script that rotates a simple API credential stored in HashiCorp Vault. Script requirements: authenticate to Vault using a token, fetch secret at path 'secret/data/app/api', generate a new credential value, write it back, and print a change summary. Outline error handling and idempotency expectations. (You do not need to implement the random generator; show function signatures and API calls.)

Sample Answer

**Approach (brief)**Authenticate using a Vault token (env var), read the secret at secret/data/app/api, generate a new credential (placeholder function), write it back with proper KV v2 payload, and print a concise change summary. Handle HTTP errors, missing keys, and ensure idempotency by checking if the new value differs before writing.

python

import os, requests, json

VAULT_ADDR = os.environ.get("VAULT_ADDR", "https://vault.example.com")
VAULT_TOKEN = os.environ["VAULT_TOKEN"]  # fail fast if missing
SECRET_PATH = "secret/data/app/api"      # KV v2 path

def generate_new_credential() -> str:
    # Placeholder: implement secure random generation elsewhere
    raise NotImplementedError

def vault_request(method, path, **kwargs):
    url = f"{VAULT_ADDR}/v1/{path}"
    headers = {"X-Vault-Token": VAULT_TOKEN}
    resp = requests.request(method, url, headers=headers, timeout=10, **kwargs)
    resp.raise_for_status()
    return resp.json()

def rotate_api_credential():
    try:
        current = vault_request("GET", SECRET_PATH)
        cur_value = current["data"]["data"].get("api_key")
    except requests.HTTPError as e:
        print("Error fetching secret:", e); return
    new_value = generate_new_credential()
    if new_value == cur_value:
        print("No change needed (idempotent)."); return
    payload = {"data": {"api_key": new_value}}
    try:
        vault_request("POST", "secret/data/app/api", json=payload)
        print(f"Rotated api_key: old_present={bool(cur_value)}, new_length={len(new_value)}")
    except requests.HTTPError as e:
        print("Error writing secret:", e)

if __name__ == "__main__":
    rotate_api_credential()

**Error handling**- Use exceptions from requests; print/log and exit gracefully- Validate JSON structure and missing keys- Timeouts and retries can be added for transient failures

**Idempotency**- Script checks existing value and skips write if identical- Safe to run repeatedly; avoid unnecessary version churn in Vault by not writing identical secrets

Unlock Full Question Bank

Get access to hundreds of Infrastructure Security and Access Control interview questions and detailed answers.

Join thousands of developers preparing for their dream job.