Privilege escalation detected
Your cloud audit-log anomaly detector pages at 02:50: an IAM principal belonging to a low-privilege CI build role performed a sequence in 90 seconds — iam:CreateAccessKey for an admin user, iam:AttachUserPolicy attaching AdministratorAccess to a newly created user, then sts:AssumeRole into the prod admin role and ec2:DescribeInstances across all regions. The build role should only be able to push to one ECR repo. No human was on shift. You're the on-call security engineer. Triage and respond.
What a strong answer looks like
Stop the bleeding first (mitigate), then form hypotheses from real signals. Separate root cause from symptom, communicate status as you go, and close with what prevents a repeat.
0:00 of about 40 min
Which questions mattered is sealed until you submit. Telling you now would just be handing over the edge cases.
Run or narrate your approach, then ask the coach.