Amazon Security Engineer Interview Questions

I would use them to track who did what, when, and from where across the environment. That makes it possible to detect suspicious access, investigate incidents, and support compliance. Good logging is only useful if it is centrally collected, protected from tampering, and actively reviewed.

I would revoke or rotate the key immediately, assess whether it was used maliciously, and search logs for suspicious activity. Then I would identify how the exposure happened and fix the process so the same issue is less likely to recur. Speed matters, but so does understanding the full blast radius.

I would place it behind controlled network boundaries, terminate TLS properly, restrict backend access, and add protection against common web attacks. I would also use monitoring, WAF-style protections, and strong identity controls so the application is defended at multiple layers.

Security groups are stateful and act like instance-level firewalls, while network ACLs are stateless and work at the subnet boundary. I would use security groups for precise workload access control and ACLs for broader subnet-level guardrails when needed. The difference matters because statefulness changes how return traffic is handled.

I would map assets, entry points, trust boundaries, and likely attacker goals, then list abuse cases and rank them by impact. The purpose is to focus the team on the highest-risk paths so the right controls get built early. Threat modeling is most useful when it leads directly to design changes.