Breaking Into Cloud & Cybersecurity course questions
“If AI generated this Terraform, how do you know it’s secure?” (CISO / CTO)
“I don’t trust the generation, I gate it. The plan runs through policy-as-code (Checkov / OPA) enforcing least-privilege and CIS Benchmark baselines before it can merge; I reason about blast radius if a credential leaks, and I check the change against my side of the Shared Responsibility line for this service tier. The model’s job is a first draft; the control is the gate, and I own the gate.”
“Why hire a junior at all if AI writes the code?” (CEO / VP)
“Because generation got cheap and verification didn’t. Someone has to catch the plausible-but-wrong output, and accountability for a control attestation can’t be automated. Hiring and growing that verifier is also how you manufacture your next senior engineer, skip it and you’re buying senior talent in a thin market in three years at a premium. I’m the investment that protects revenue now and the pipeline later.”
“How would you threat-model a system you didn’t write?” (Executive Auditor)
“Authorship is irrelevant to threat modeling. I map data flows and trust boundaries, enumerate adversary tactics against each boundary using MITRE ATT&CK, and assume breach rather than assume correctness. AI-generated systems specifically demand this because surface area expands faster than informal review can track, so I model the system as it runs, not as it was written.”
Discussion
- No comments yet, be the first to add one.