Access
Who should be able to log into production, and how?
Whether the candidate can reconcile least privilege with the reality that emergencies require access, without pretending either away.
The situation behind the question
A company grants every engineer permanent administrator access to the production cloud account, justified by "we need to be able to fix things fast". There is no session logging. Two people who left last quarter still have keys because offboarding is a manual checklist.