Cloud Engineer interview question
How do you secure cloud networking?
Segment networks by trust, default-deny inbound and restrict egress, use private endpoints, least-privilege security groups, centralized inspection where justified, protected DNS, flow logs, and no broad administrative exposure.
Direct answer
What a strong answer covers
How it works
Cloud network security starts by assuming the perimeter will be crossed and limiting what that gains. Networks are segmented by trust level into separate VPCs or subnets; inbound is denied by default and opened per port and source; egress is restricted too, because exfiltration and command-and-control need outbound paths. Managed services are reached through private endpoints so traffic never touches the public internet. Security groups reference other groups rather than CIDR ranges where possible, centralised inspection is added where the risk justifies its cost, DNS is protected against tunnelling, flow logs feed detection, and administrative access goes through identity-aware proxies rather than open SSH or RDP.
Example
A payment environment lives in its own VPC with no internet gateway; the API accepts traffic only from a private load balancer, reaches the database through a security group that references the API’s group, and reaches S3 and KMS through interface endpoints. Egress to the card processor goes through a NAT with a firewall allowing only that domain. Engineers reach hosts through Session Manager with MFA and session recording; port 22 is closed everywhere.
Common mistakes
- Allowing 0.0.0.0/0 inbound on port 22 or 3389 to a fleet.
- Ignoring egress so a compromised host can reach anything on the internet.
- Routing internal traffic to managed services over the public internet.
A useful answer structure
Answer from your own work.
Do not memorise a script: use only examples you can explain honestly in follow-up questions.
Open the desktop workspace and rehearse a clear answer in your own words.