All jobs / DevOps / SRE / cloud
Security interview questions
Security questions a DevOps / SRE / cloud can be asked, from first job to senior. Open one to see the strongest answer and why it works.
A `.env` with production URLs and a shared password is in git “for convenience.” What do you do?
The strongest answer: Remove it, rotate the password, and keep an `.env.example` with fake values — convenience is not a secret store
Why it works: Exactly. Example file, real secrets in the vault, rotate what was committed.
- Vault the real values.
- Commit only examples.
- Rotate what was in git.
- Do not encrypt-with-README.
Someone committed a cloud access key. What do you do first?
The strongest answer: Treat it as leaked: revoke / rotate, purge what policy requires, and put the new secret in the vault — deleting the file on main is not enough
Why it works: Exactly. Rotate first. History and forks still have the old key.
- Revoke and rotate.
- Assume copies exist.
- Vault the replacement.
- Do not tidy git and call it fixed.
A “temporary” object store is world-readable. What do you do?
The strongest answer: Close it, assume anything in it was public, and rotate what might have been there — I do not leave it because “there is no index.html”
Why it works: Exactly. Public is public. No-index is not a control. Rotate.
- Make it private.
- Assume leak.
- Rotate secrets that lived there.
- Do not trust an obscure URL.
A pipeline file prints `echo $DATABASE_URL`. What happens next?
The strongest answer: The secret lands in logs; I remove the echo, rotate the URL, and mask secrets in the CI settings
Why it works: Exactly. Logs are a copy. Rotate and mask.
- Do not echo secrets.
- Rotate what was printed.
- Mask in CI.
- Do not send them to chat.
Every engineer has AdministratorAccess “so we are not blocked.” What do you say?
The strongest answer: Least privilege with a break-glass — standing admin is how a laptop or a leaked key becomes the company
Why it works: Exactly. Standing admin is the incident, delayed. Break-glass exists so you can still move.
- Least privilege.
- Break-glass for the rare case.
- No standing admin for all.
- No keys in clients.
CI needs to publish to the cloud. What is the 2026 default?
The strongest answer: Short-lived OIDC / workload identity from the pipeline — not a long-lived access key in CI variables if the platform can do better
Why it works: Exactly. Identity federation. Long-lived keys are what get leaked in logs.
- Prefer OIDC / workload identity.
- Short-lived credentials.
- No founder keys.
- No keys in images.
A secret must reach twelve services. How?
The strongest answer: A secret manager / vault with IAM, rotation, and no chat paste — I do not multiply `.env` files in twelve repos
Why it works: Exactly. One store, identity, rotation. Twelve files and a canvas are copies.
- Use a secret manager.
- Identity to fetch.
- Rotate in one place.
- Do not paste to Slack or gists.
A CI role can delete the production database. How do you reshape it?
The strongest answer: Split roles: CI can deploy the app, a break-glass can destroy data, and I do not grant * “in case”
Why it works: Exactly. Split the blast. * is not a convenience; it is the incident.
- Split deploy vs destroy.
- No * “in case.”
- Break-glass for the rare destroy.
- Do not copy * to laptops.
You have never rotated the database password in production. What do you do before you need to?
The strongest answer: A drill: dual-write or a short dual-accept, a runbook, and a time we actually rotate — I do not wait for a leak to learn the order
Why it works: Exactly. Practice the order. Wiki-only is folklore. Never-rotate is a leak waiting.
- Run a drill.
- Dual-accept if you can.
- Write the order.
- Do not wait for the leak.
How do you know the image in prod is the image CI built?
The strongest answer: A digest and a signature / provenance (the 2026 default is signed provenance, not a tag we liked) — I do not trust a mutable latest
Why it works: Exactly. Digest + provenance. Tags move. Layer counts are comedy.
- Promote by digest.
- Sign / attest the build.
- Do not trust latest.
- Do not count layers.
You have 200 services and a human still pastes secrets at provision time. What do you build?
The strongest answer: Identity-based delivery (the workload fetches) and a ban on humans as the happy path — I keep break-glass, I do not keep paste-as-process
Why it works: Exactly. Workloads fetch. Humans are the exception. One mega-secret is a mega-blast.
- Workload identity to the vault.
- Humans as break-glass.
- Do not paste as process.
- Do not one-ball-of-secrets.
A squad needs to ship without being able to destroy another squad’s data. What is the shape?
The strongest answer: Accounts or strong IAM boundaries per environment / team, with a platform role for the paved road — I do not give everyone the parent org admin
Why it works: Exactly. Blast radius is an org chart in IAM. Culture is not a boundary.
- Boundary per team / env.
- Paved platform role.
- No org-admin for all.
- No shared key files.
Engineers still have long-lived cloud keys on laptops. What is the programme?
The strongest answer: SSO / short-lived creds, hardware 2FA, and a hunt for leftover keys — I do not “also add SSO” and leave the keys
Why it works: Exactly. Replace, then hunt. Also-SSO is two ways in.
- SSO and short-lived creds.
- Hardware 2FA.
- Revoke leftover keys.
- Do not run both forever.
What does a good IAM review look like that a good app review does not?
The strongest answer: Blast radius, standing vs just-in-time, and who can create more power — I do not LGTM a * because the YAML is tidy
Why it works: Exactly. Power, standing, who-mints-power. Pretty YAML is how * ships.
- Read the blast radius.
- Prefer JIT to standing.
- Watch who can grant.
- Do not LGTM a *.
Security wants a gate that takes 40 minutes on every PR. What do you negotiate?
The strongest answer: A fast subset on PR, the heavy scan on merge / nightly, and a break-the-build only on findings you will actually fix — I do not run theatre that everyone skips
Why it works: Exactly. Signal you will act on, split in time. Skip-trained gates are worse than no gate.
- Fast on PR.
- Heavy later.
- Break on real findings.
- Do not train people to skip.
Images pass a vulnerability scan at build time. A critical CVE is published a week later in a base library used by images that have been running for months.
What has to already exist for you to answer “which images, and by when”?
The strongest answer: An SBOM per image and continuous rescanning of the registry and running inventory, not only at build; scheduled base-image rebuilds and redeploys even without code changes; an owner per image and a fix window by severity
Why it works: Right — a build-time scan answers “was it clean then”; the programme answers “what is exposed now and who fixes it by when”.
- SBOM per image.
- Rescan continuously, not once.
- Rebuild base images on a schedule.
- Owner and window per severity.
An engineer wants prod data “to reproduce a bug” on their laptop. What is the bar?
The strongest answer: No raw prod on laptops: masked dumps, a break-glass query path, and a ticket — I do not call it “just this once”
Why it works: Exactly. Prod is other people’s lives. Mask or query in place. Once is how it becomes the habit.
- No raw prod on laptops.
- Mask or break-glass query.
- Ticket the access.
- Do not “just this once.”