We use analytics and advertising cookies to understand how the site is used and whether our ads on Facebook and Instagram work. They are set only if you accept. See our Privacy Policy for details.
AWS security interviews turn on one skill: reading a set of policies and saying what actually happens. Expect an Access Denied you have to explain, a cross-account deploy you have to secure, and a guardrail that must stop a whole organization without blocking the security team.
Each question below is a scenario with four plausible answers and an explanation.
Answer a real AWS interview question before you browse the IAM & Security list. No signup needed.
A content management application runs on EC2 instances in an Auto Scaling group across three Availability Zones. Every instance must read and write the same set of user-uploaded files through a standard file system interface (POSIX), and files must remain available if an AZ fails. Which storage solution should a solutions architect choose?
Practice in a session
10 questions from AWS, one after another, then your score and streak.
IAM policy evaluation, identity vs resource-based policies, roles and STS, cross-account access, permissions boundaries, service control policies, KMS key policies and encryption, Secrets Manager rotation, Cognito federation, WAF rules, and the detection services: GuardDuty, Security Hub, Inspector and Macie.
Everything is denied by default. An explicit deny in any policy that applies overrides every allow. Otherwise a request needs an allow from an identity or resource policy, and every other layer that applies - SCPs, permissions boundaries and session policies - must also allow it.
A service control policy is set in AWS Organizations on an OU or account and caps what any principal in those accounts can do; it grants nothing and does not restrict the management account. A permissions boundary is set on one IAM user or role and caps that principal; its effective permissions are the intersection of its identity policies and the boundary.
Every KMS key has a key policy, and IAM policies grant access to a key only when the key policy allows it - usually through a statement that lets the account's IAM policies control access. If the key policy does not include that statement or name the principal, no IAM policy is enough.