Breaking Into Cloud & Cybersecurity course questions

Question 1: “If AI generated this Terraform, how do you know it’s secure?” (CISO / CTO)

High-Authority Answer: “I don’t trust the generation — I gate it. The plan runs through policy-as-code (Checkov / OPA) enforcing least-privilege and CIS Benchmark baselines before it can merge; I reason about blast radius if a credential leaks, and I check the change against my side of the Shared Responsibility line for this service tier. The model’s job is a first draft; the control is the gate, and I own the gate.”

Question 2: “Why hire a junior at all if AI writes the code?” (CEO / VP)

High-Authority Answer: “Because generation got cheap and verification didn’t. Someone has to catch the plausible-but-wrong output, and accountability for a control attestation can’t be automated. Hiring and growing that verifier is also how you manufacture your next senior engineer — skip it and you’re buying senior talent in a thin market in three years at a premium. I’m the investment that protects revenue now and the pipeline later.”

Question 3: “How would you threat-model a system you didn’t write?” (Executive Auditor)

High-Authority Answer: “Authorship is irrelevant to threat modeling. I map data flows and trust boundaries, enumerate adversary tactics against each boundary using MITRE ATT&CK, and assume breach rather than assume correctness. AI-generated systems specifically demand this because surface area expands faster than informal review can track — so I model the system as it runs, not as it was written.”