cloud security

One link-local address hands out the machine's credentials to anything that can make a request from it. That includes a fooled agent with a fetch tool.

The provider secures the model service. Everything you put into it, connect to it and build on top of it is still yours.

Most cloud breaches start with a setting, not an exploit. The scored answer moves those settings into reviewed code, checks them before deployment, and catches the drift that happens anyway.

Everything in Kubernetes goes through the API server, so most attacks are about who can talk to it and with what rights. The rest is what a pod can do to its node and to its neighbours.

A bucket looks simple, but its policy, the identities that can touch it, its encryption keys, its logs and its lifecycle rules are each a way in or a way to lose it.

Snapshot a disk, read it somewhere else, delete the snapshot. That trick built a product category. Interviewers ask how it works, what permissions it needs, and what it cannot see.

IAM decides what a role may do; organisation guardrails decide what no role in an account may ever do. The scored answer explains the evaluation, the blind spots and a first set worth deploying.

The miner is the symptom. The incident is how it got there and what else the attacker could reach. Interviewers watch whether you stop at killing the process or follow the entry point and the credentials.

Crypto miners steal your compute. LLMjackers steal your model quota and resell it, and the first alert is often the bill.