are you looking to master the cloud
architect technical interview
or the cloud security architect
interview if so this video is for you
hi my name is michael gibbs and i'm the
founder and ceo of go cloud architects
and we're an organization dedicated
towards building high performance
cloud computing careers today we're
going to talk about some cloud architect
technical interview questions
to help you prepare for the cloud
architect technical interview
now when we do cloud architect technical
interviews what we do is we ask
open-ended questions and we answer
ask open-ended questions because we want
to see what your answers are going to be
we're not looking for one word answers
we're looking to see if you're
technically competent and we're also
looking to see
if you can communicate well see as a
cloud architect it's going to be a
customer facing position
and because it's a customer facing
position you're going to have to explain
your solutions and complicated
technologies
to the customer but you're also going to
have to be able to listen to them
and learn about whatever their complex
application environments are their
complex network environment their
complex computing and storage
environments
and be able to take those and design
something
so on this cloud architect technical
interview we're going to assess your
competency and your communication skills
so let's talk about some cloud architect
security questions today and we're going
to talk about several of them
security is absolutely critical to any
computing environment
the first question we're going to ask is
what is a man in the middle attack
a man in the middle attack is simply if
you've got two users user a
user b and user a is communicating to
user b
and user a is user a and user b is user
b and communication is occurring
that's perfect but in the manner in the
middle of the cac is you you attack is
you have user a
and you have user b but there's this
sneaky guy c that comes up between a and
b
and c pretends to be b by impersonation
so user a talks to user b when i mean
user c when they're really trying to
talk to user b
and what happens if user a speaks to the
pretend user b but it's actually user c
and divulges secret or confidential
information
that is what a man in the mill attack a
man in the middle attack is when you've
got
two people or two computers or two
network systems or two anything on the
environment
and something sneaks in between the
communication pretends to be another
endpoint
and and uh communication secrets are
divulged
big problem so the next question would
be how do you prevent
a man-in-the-middle attack well the only
way to really prevent a
man-in-the-middle attack is to do some
form of
endpoint verification and the best way
to do endpoint verification
is by using some form of encryption so
for example ipsec does
those user endpoint verification if you
force an https session you know that
that's also going to force endpoint
verification so you know who the sender
is and who the receiver is going to be
if you're using wireless you can use web
or wpa encryption
or you can use public key pair based
authentication but really the key is
you're going to have to just verify your
endpoints
that's how you prevent a man-of-the-mill
attack
the next question is really what is data
protection
when they talk about encryption in
transit versus encryption at rest really
they talk about protecting your data and
this one's not that complicated but we
find people get this confused all the
time
data protection at rest is when
basically you encrypt a volume or you
encrypt a hard drive and all the data
stored on the hard drive
is encrypted or you have a bucket and
you encrypt your data so when it's
sitting there
it's encrypted so somewhere to pick up
that server or that storage array where
it's at
and they wanted to get access to your
information they can't because they
don't have the decryption key
by comparison encryption in transit is
when you send a message from user a to
user b and encrypt the message well
let's be there
so this is again talking about
encryption technologies such as vpns
which typically are ipsec
https or those types of things so that's
the difference
between data encryption and data
protection
data encryption at rest versus in
transit at rest it's sitting there on an
encrypted drive and
in transit it's being encrypted along
the network or along by the host of the
receiver
via something like https
the next question we're going to ask is
what's the difference between symmetric
and asymmetric encryption
and this is really for us to ascertain
whether the user really knows anything
about encryption
and how it works so to make something
complicated fairly simple
symmetric encryption is when you use the
same encryption key to send and receive
your traffic going back and forth
that's symmetric encryption it's very
fast it's been around for a long period
of time and it works
well but what if you wanted further
security
what if you wanted to use this one
encryption key for sending your data and
another encryption key for receiving
your data
well that would be even more secure and
that's what's called
asymmetric encryption and that's
basically using a different
encryption key to send versus a
different encryption key to receive
that's asymmetric encryption now if
someone is really good they can tell you
the difference but they can also tell
you the challenges associated with
asymmetric encryption and here's the
thing
how do you get both keys across in a
secure environment
so it's often common that you would
actually set up symmetric encryption
just to exchange your keys and then
and then after that move to what you
really wanted to use which was
asymmetric encryption or you can send
your encryption keys via out of bound
via some other communication method
so when we hear these things and we know
somebody knows the difference between
symmetric and asymmetric encryption
we've got a good understanding that they
actually understand encryption
the next question i like to ask people
is what is nmap
and why do i like to ask this question i
like to ask this question because if
anybody's done any kind of security in
their life at some point
they've used nmap and nmap is really
just a network mapper and it's a free
open source tool that really will scan
your hosts
for you so you can find hosts that are
available you can find open ports on
your systems you can find security risks
and it can help you hack into a system
so it's used by white hat or ethical
hackers to find things that are open
to basically try and use them to
penetrate the systems and then tell the
organization what to use
and it's also used by black cat hyper
people that want to do ill will to the
organization
they use nmap to basically scan things
in vulnerabilities and then they attack
based upon the vulnerabilities they find
the next thing i'm going to ask and i
know we've talked about this question
before but today we're focused on the
cloud architect technical interview or
the cloud security architect interview
so we're going to talk about some of our
security things
what is iam and realistically what we're
looking for is not
identity and access management because
that really tells me nothing
we just want to know that the user knows
what is iam
and if they say that basically iam is
identification of the users that access
your system
authorizing them to do things that are
related to their roles
and only their roles and then locking
what they did when they're done so you
can track what they've done
then i know they understand i am
i often hear the concept of aaa see when
i started out we used to say
authentication authorization accounting
and that was really simple
we all knew what it meant where i am is
a little complicated but
authentication making sure the user is
the user
authorization determining what the user
is allowed to do on their system and
letting them do it
and accounting tracking what they did
that's what i am is when we hear
something like that we know that people
are familiar with iam
another question we like to ask is what
is social engineering
and we like to ask this because we want
to see if someone truly has a grasp of
it but can they communicate it as well
and social engineering quite simply is
the use of deception
to elicit information from people that
they wouldn't normally give you
that's really it so in other words
you're asking someone
you're pretending to be something maybe
to get someone's password maybe to get
some
other critical pieces of information and
then you're going to use that
information you've
gained through social engineering to
exploit or attack into the systems
the next question i like to ask and this
is probably one you've heard if you've
been following our aws interview
questions or some of our cloud security
work that we do
is how would you secure an enterprise
the reason we asked this question is we
can find the aws certified only folks
without a background
because they basically say things
network acl
security group and wealth and if we hear
something like that we know that a
person's got some aws certification
knowledge
but it tells us that they don't really
understand security
see for security it is going to be a
multi-layered approach
first and foremost it's going to start
with a policy and the policy will
describe what
what what assets are worth protecting
the types of protections that are going
to be used
the how and the why and the rationale
it's an overarching document
and then you're going to look at it from
a few things you're going to look at it
from a user perspective
an encryption perspective and i am
prescribed perspective but you're going
to look at it next from a tech
perspective
see the way you secure an organization
is first you build an impenetrable
forward or at least you try to but at
the edge of your network you stick a
firewall
and a firewall basically lets your good
traffic out and return but it keeps all
your bad guys out
the firewall is the edge in your network
it's your perimeter protection
it keeps people out but what if the
hacker gets in
and at some point they will you need
something sitting right behind the
behind the firewall to keeps up anybody
that gets in and that's your
ids ips systems intrusion detection
intrusion prevention systems
these systems literally monitor for be
hit patterns of behavior that don't look
right and they stop
them maybe they add a new firewall rule
or maybe they reset a tcp connection but
they stop them
they're adaptive and they stop them so
first the firewall and then after the
firewall you need an ids ips system
now realistically speaking if you've got
any web facing things you're going to
need some ddos protection so that's when
you start thinking about things like
cloudflare or aws shield
some type of dns protection because you
obviously don't
want to be hacked and you don't want
denial of service attacks
so after that you know now you got to
start thinking about protecting the
subnets in your network and you can do
that with acls on routers
you can do them with network acls in a
cloud computing environment and then you
got to start thinking about protecting
your hosts
so what do you do with aws for example
you use a security group which protects
the traffic into the host
but that's really not enough on your
host you still want to do some endpoint
protection
maybe an additional host-based firewall
maybe some malware protection
this is going to give you some good
protection from the edge of your network
all the way to your systems
but you're still going to have to make
sure your data that stored is encrypted
you're still going to have to secure the
integrity of your physical systems
for example if you've got a router that
connects to your cloud in the middle of
the room and anybody can plug into it
anybody can access your cloud and
violate pretty much all of your security
you're going to have to think about
identity and access management
you're going to have to think about
training your users to avoid things like
phishing attacks and social engineering
that's what goes into securing an
enterprise
i'd like to thank you so much for
watching this video and i'd like to talk
to you about some things we're doing for
the cloud architect community
every monday and every thursday we have
a free how to get your first cloud
architect job webinar
and on these webinars we tell you what
hiring managers desire they tell you
what your resume should look like we
tell you how to become technically
competent
we tell you what skills the hiring
managers want so you can focus on them
and what skills the hiring managers
don't care about so you can focus your
times on the things they actually do
care about
we will tell you how to bypass hr so you
can get
a resume directly in the hands of the
hiring manager and so much more
we do this free on every monday and
every thursday and if you've got any
cloud architect career questions you can
ask us that
and on these calls we will answer your
questions live in real time
on tuesdays we have a cloud architect
experience webinar
and this webinar is purely focused on
how you can get the necessary experience
to get your first cloud architect job
see when you're trying to build your
cloud architect career or how to get
your first cloud architect job you
typically run into this problem
and players want experience but how are
you going to get experience if you don't
have a job
so on this webinar we will tell you and
teach you exactly how to get the type of
experience from your home
that hiring managers desire to help you
get hired and we do that every tuesday
now a lot of times on these we
give you a bonus and we don't just tell
you what to do we run a cloud
architecture challenge and we provide
live cloud architecture training free
on these calls and what do we do with
our cloud architecture training you will
interview a mock cio
and they will give you the business
legal and technical requirements for
their enterprise
and then you will be tasked with whether
you should migrate their enterprise to
the cloud
and if so you will design an
architecture for the cloud but you won't
just design it for one cloud you'll do
it on at least two cloud
for at least two clouds on every cloud
architect experience webinar that we
have
where we give you a cloud architect
challenge because cloud architecture
training involves
understanding what goes in the cloud
what doesn't go in the cloud how to use
the cloud
how the cloud works how to design things
in the cloud and how to work in
multi-vendor or hybrid cloud
environments
because that's what's going on the next
thing i'd like to tell you is that on
every wednesday we have a youtube live
and on the youtube live you can ask us
any questions to build your cloud
architect career or your tech career
bring us your questions related to your
cloud architect career development or
your cloud architect career
development plan or program and we will
work very hard
to answer your questions and help guide
you so you can build
the best cloud computing career in a
shorter period of time as possible
we are launching in the next week or two
a new collaboration platform for the
cloud computing community and what's
going to occur is we've built a slack
channel my team's been working on it for
about a month
and they've been integrating all of the
best tools to allow for communication
collaboration calls on demand live zoom
meetings on demand
so literally people that are studying
cloud computing from all over the world
will be able to talk to each other
communicate and get help we will provide
free advice on this channel we will be
showing you videos that we produce or
training things that we do we will give
you the most up-to-date
best training that we possibly can on
our public channel and on our private
channel obviously we do our
communications with our students because
we communicate with our students very
frequently
you can't just buy a career never
interact with the instructors and expect
to get something
you want you but you buy a training
program you need to be asked questions
so we have this environment for our
people
as well the last thing i wanted to tell
you is related to aws certifications
now as an organization we are not
focused on aws certifications we help
people either get their first cloud
architect job
or we help people escalate their career
and accelerate their career to go from
technical to management
or from cloud architect to senior cloud
architect to principal clinic
that's our focus but we understand that
certification training
is important and because of that we've
created our own because we couldn't find
anything else that we liked
aws certified solution architect
associate e-course and e-books
and the link to the iws certified
solution architect associate e-course
and e-books
are low below they are completely free
because of a lot of requests
we are hosting a free aws certified
solution architect professional
boot camp and we're going to host it on
youtube live so we can do it for free
what we're going to do is we're going to
be presenting the material for 20
minutes and then stopping for 10 minutes
for everyone to ask questions
and that way we can give you a live boot
camp experience to help you pass the aws
certified solution architect
professional training
and because we're doing it on youtube
live it will be completely free and
we're pretty excited about that
so those are the things that we're doing
to help you in your cloud computing
career
i want to thank you so much for watching
this video it's an honor and a privilege
to be part of the cloud architect
community
i take it very seriously and we try to
produce the best content
if you've got any suggestions of things
that we could do better or help you more
please send an email to ask cloud mike
again the link is in the description
below and we'll do everything we can to
assist you in your cloud computing
careers
thank you so much for watching this
video we look forward to seeing you soon
you