Amazon AI Security Engineer interview questions

Candidates who say 'everything is new' and candidates who say 'nothing is new' both lose this one. The answer that scores names exactly three differences and keeps the rest of the toolkit.

Reciting the six letters earns little. What scores is a diagram drawn aloud, one boundary walked in depth, and a list of threats with owners.

The order lookup is the whole interview. Candidates who spend ten minutes on jailbreaks and two on authorization have it backwards.

Definitions take ten seconds. The interviewer wants a worked failure: which layer broke, which one held, and why they did not break together.

Three words people use interchangeably, and a prioritisation question that exposes whether you have ever had a backlog of thirty findings.

Most candidates start by deleting the commit. The key was copied the minute it went public; the clock starts with revocation.

A reset flow is a second login page with weaker checks. Interviewers use it because every step has a classic bug, and the strong answer finds them in order.

Two classic tools that structure attacker thinking. The scored answer uses each for what it is good at and names the blind spots before an interviewer does.

STRIDE assumes components follow their code. A model follows its inputs. The scored answer keeps the six categories and adds what probabilistic, persuadable components need.

Detection quality is decided before the first alert, by what you logged and how you set the threshold. The scored answer derives both from the questions an investigator will ask.

Reviews fail when they arrive late, cover everything equally and produce vague findings. The scored answer scopes early, focuses on the riskiest decisions and writes findings as specific, owned changes.

Every senior security engineer has one. The scored answer shows you reduced the risk, made the residual visible, got the right owner to accept it, and kept watching.

Interviewers want a security engineer who can say no without becoming the department of no. The scored answer shows evidence, an alternative that met the goal, and a working relationship afterwards.

Severity disputes are usually disagreements about facts or assumptions. The scored answer finds which, settles it with evidence and the agreed scale, and has an escalation path that does not damage trust.

AI features need the usual secure development steps plus a few that most lifecycles lack. The scored answer places each activity at the stage where it is cheapest and names the gate.

Leaked keys remain one of the commonest breach causes, and agents create new places to leak them. The scored answer prefers no secret at all, then short-lived ones, and keeps them out of every model context.

Good metrics change decisions. The scored answer picks a few in coverage, risk, outcomes and speed, defines each precisely, and explains what action each one triggers.

A judgement question with an ethical edge. The scored answer makes the risk clear in business terms, offers options, accepts a properly informed decision, and knows the rare cases where it is not enough.

Most candidates say 'rings' and stop. The interviewer is listening for who enforces the boundary, where the kernel must distrust its caller, and why one kernel bug undoes every process boundary at once.

Isolation is enforced by page tables and credentials, then deliberately punched through by debuggers, shared memory and IPC. A strong answer names both the wall and the doors.

Reading rwx bits is the easy half. Interviewers check whether you know what execute means on a directory, why setuid binaries are an attack surface, and what the sticky bit does and does not protect.

The definition takes one sentence. The interview is about the four ways privilege actually moves, and why most escalations are misconfigurations rather than exploits.

The username tells you almost nothing. The interviewer wants the list of privilege transitions reachable from that process, and which of them you would have closed in advance.

Capabilities split root into pieces, but some pieces are nearly the whole thing. A strong answer knows the sets, the dangerous capabilities, and why 'drop all, add one' is the only defensible default.

Everyone knows MAC is 'stricter'. The scored part is why a compromised root process can still be confined, how labels differ from paths, and what you do when the policy blocks production at 2am.

Check, then use: two system calls, and an attacker in between. The answer interviewers want replaces names with handles and checks with atomic operations, and can show it in code.

OpenSSH's design is the model answer, but interviewers want you to derive it: what the parser must never hold, how small the privileged half can get, and the three mistakes that make a privilege drop reversible.

A checklist recital scores 'weak'. The strong answer orders controls by the attacker they stop, treats the baseline as code, and explains how you would notice when someone drifts from it.

Programs rarely name the file they run or load; they search for it. Whoever can write earlier in the search order chooses the code. The answer covers both platforms and the one rule that fixes both.

Linux candidates often freeze here. The model is learnable in five nouns, and interviewers reward the one insight that matters: privileges in a token can matter more than group membership.

Reciting the acronyms is the easy part. The scored answer pairs each mitigation with the exploitation step it blocks and the precondition that defeats it, which is why they only work together.

The CPU does work it later throws away, but the cache remembers. The strong answer explains that one sentence precisely, then turns it into isolation decisions for shared infrastructure.

Assume the parser will be exploited, then decide what the exploit gets. The scored design has a disposable worker with nothing worth stealing, no way out, and a narrow, validated return path.

Secure Boot refuses to run unsigned code; measured boot records what did run; a TPM lets someone else check that record. Candidates who blur the three cannot reason about attestation at all.

sudo is a policy engine that runs as root and parses user input. Grant it carelessly and 'run this one command' becomes 'run anything'.

A seccomp filter decides on a system call number and six integers. It cannot read the file path a pointer refers to, and that one limitation shapes every good policy.

Secure Boot checks signatures until the kernel is running. What keeps root from loading unsigned code into the kernel after that is a different set of controls, and interviewers check you know both.

Typing a command sets off a chain: a system call, a permission check, a loader, dynamic linking and memory protections. Every step is a place security is enforced, and a place it can be bypassed.

A vulnerability is a gap between what the code assumes and what an attacker can make true. Nearly every one falls into a handful of root causes, and each has a matching way to find and prevent it.

The kernel is the single shared authority on a machine. A bug there means any process can rewrite who it is.

Two things make Windows compromise spread: services that run with powerful identities, and a process that holds the credentials of everyone logged on.

Every platform that runs someone else's code (plugins, notebooks, AI agents, serverless) must pick a boundary. The right one depends on what the code may do and what a single bug in the boundary costs.

Both tools read logs and ban addresses after the fact. Knowing what that design can and cannot see is the whole answer, and most candidates call it an authentication control.

Turning off passwords is the easy half. The interview is about the other half: how keys are issued, how long they live, how a host proves itself, and how you cut someone off at 5pm on a Friday.

The classic 'what happens when you type google.com' turned into a security question. Interviewers want the stack in order, with the attacker who sits at each layer and the control that removes them.

Encryption alone does not stop a man in the middle: you could be encrypting to the attacker. The property that matters is authentication, and every successful MITM is a story about how it was skipped.

A classic warm-up that rewards precision: what state the server keeps, why spoofed SYNs cost the attacker nothing, and how SYN cookies move that state into the sequence number.

DNSSEC and DNS over HTTPS are often named in the same breath and protect entirely different things. The scored answer separates authenticity of the record from privacy of the query.

Users type a domain, not https://. That one habit gave attackers a plain-HTTP first request to hijack. HSTS closes it, and preloading closes it before the first visit, with a commitment you cannot easily undo.

NAT is not a firewall, and inbound rules are only half a policy. Interviewers check whether you know what each device decides, and why the outbound direction is where breaches are contained.

Flat networks turn one infected laptop into a company-wide incident. The scored answer draws zones from what talks to what, and shows how identity-based policy replaces IP lists as the network grows.

Every TLS error is a specific check failing. Engineers who can name which check, from the chain the client actually saw, fix outages in minutes and never 'fix' them by turning validation off.

Pinning trades availability for a narrower trust set. The answer that scores compares each pin target by what it survives, and uses HPKP's retirement as evidence of what goes wrong.

A VPN answers 'are you allowed on the network?'. Zero-trust access asks 'may this user, on this device, reach this application right now?'. The interview tests whether you can explain why the second question is safer.

SPF checks a server, DKIM checks a signature, and neither checks the From line the user reads. DMARC ties them to that line. Interviewers want the alignment idea, then the phishing that still gets through.

A 2 Tbps flood and one expensive API call per second are both denial of service. The answer that scores matches each attack to the place where it can be stopped, and knows which ones only a provider can absorb.

The internet's routing system still largely believes what networks announce. The strong answer explains why a more specific prefix wins, what RPKI signs, and why path manipulation survives it.

Attackers scan the whole internet continuously and know your forgotten test server before you do. The answer is an inventory built from several sources, compared with what is actually listening.

You cannot read the payload, but you can see who talked to whom, when, how much and how often. That metadata catches beaconing, exfiltration and lateral movement, if you know what normal looks like.

Interviewers do not want the seven OSI names recited. They want you to say which layer an attack lives at, because that decides which control can see it.

NAT drops unsolicited inbound packets as a side effect of bookkeeping, not policy. Port forwards, UPnP, outbound connections and IPv6 all walk around it.

A firewall is a list of match conditions evaluated in order against fields it can see, plus a table that remembers connections. Almost every firewall failure is in one of those three words: order, fields, remember.

Put a proxy in front of an app and two new questions appear: who is the real client, and does the proxy read the request the same way the app does?

Local network protocols were designed for a building full of colleagues. Anyone plugged into the same segment can claim to be the router, and the protocols believe them.

IPsec is two protocols that candidates blur together: IKE, which authenticates peers and agrees keys, and ESP, which protects every packet afterwards. Keep them apart and the rest follows.

WireGuard's configuration is a list of public keys and the IP ranges each may use. That small idea replaces most of what IPsec negotiates, and it is the part interviewers ask about.

Signing does not hide anything. It proves who sent a message and that nobody changed it, which is exactly what relay and tampering attacks need you not to check.

The packets are WireGuard; the interesting part is the coordination server that tells every device whose keys to accept. That server is what a strong answer threat-models.

A MAC address is a label the device chooses and announces in clear text on every frame. The answer turns on that one fact, and on what a network should check instead.

Most networks that say they do not run IPv6 run it anyway, unmanaged. The scored answer finds the three places that matters and decides deliberately.

Nobody attacks your DNS; they just claim the cloud resource your DNS still points at. The scored answer explains why it is so common and how to stop it at deprovisioning.

The most common screen question in security. The answer that scores sorts all four by one property: whether there is a key, and who holds it.

The trap is answering 'which is better'. Every protocol you use daily runs both, each doing the job the other cannot.

Message names are table stakes. The interviewer is listening for why CertificateVerify exists and what Finished actually checks.

Checking the signature is one step of seven. The bugs that matter live in the other six, and in code that switches validation off.

SHA-256 with a salt sounds right and fails. The answer that scores explains the attacker's economics and names the parameters.

Both detect tampering. The difference is who else could have made the tag, and that decides webhooks, tokens and audit evidence.

The question behind the question: if your server's private key leaks next year, what happens to the traffic someone recorded today?

'Yes, always' is the right default and the wrong answer. The interviewer wants the list of attackers it does nothing against.

Encryption without integrity has been exploited for decades. Nonce reuse under GCM is worse than most candidates think: it breaks integrity too.

Data keys, key-encryption keys, tenant isolation, rotation and crypto-shredding. The design is standard; the trade-offs at each level are the interview.

mTLS authenticates both ends, but only as well as your private CA and identity scheme. The scored answer designs issuance, identity, rotation and authorisation, and contrasts it with the public web.

Any trusted CA can issue a certificate for your domain. The scored answer explains how public logs make that visible and how to turn the logs into an alert.

Revocation asks every client to check a third party on every connection, and most clients quietly do not. The scored answer explains each mechanism's failure mode and why the industry is moving to short lifetimes.

A classic that tests whether you know how hash functions work inside. The scored answer explains length extension, the nested HMAC construction, and how to verify a MAC safely.

Encryption hides content, not length. The scored answer shows how compression turns length into a leak when secrets and attacker text share a message, and where that bites today.

Most cryptographic failures are misuse of good primitives, not broken algorithms. The scored answer has a checklist that catches the common ones and a strong default to replace them.

Cryptography assumes unpredictable numbers, and real systems have repeatedly failed to supply them. The scored answer gives the causes, the famous failures, and the rules that prevent repeats.

Both keep keys out of application memory; they differ in who you must trust and what you can prove. The scored answer chooses by threat model and requirement, not by fashion.

Trusted execution moves the trust boundary from the operator to the hardware and the attested code. The scored answer is precise about what that protects, what it assumes, and what it leaves open.

Using one key for several purposes quietly couples their security. The scored answer explains extract and expand, shows key separation by context, and says when HKDF is the wrong tool.

Data encrypted today can be recorded and decrypted when a capable quantum computer exists. The scored answer prioritises by how long data must stay secret, starts with key exchange, and builds crypto agility.

A small root hash that commits to millions of entries. The scored answer builds an inclusion proof, explains consistency proofs, and names the systems that depend on them.

TLS protects bytes on the wire between two endpoints. The scored answer lists what lies outside that boundary, so nobody mistakes 'we use HTTPS' for a security design.

The response differs sharply between a signing key and an encryption key. The scored answer contains use, rotates, revokes trust, assesses what the attacker could forge or read, and repairs what depended on it.

Preimage, second preimage and collision resistance sound alike and protect different things. The birthday bound explains why the last one costs half the bits.

Issuing a certificate is easy. Knowing every certificate you issued, renewing them before they expire, and surviving the day a CA key leaks is the design.

Being able to switch algorithms is essential. Letting an attacker choose which algorithm you switch to is a vulnerability with a long history.

Most candidates can recite TLS 1.3. Interviewers ask for 1.2 because it is still everywhere, and because every change in 1.3 is the fix for an attack on 1.2.

A certificate is a signed statement with a short list of claims: this key, these names, these uses, this period, issued by this CA. Every validation failure you have seen is one of those claims not holding.

There is no single list of trusted roots. Browsers, operating systems, language runtimes and container images each carry their own, updated on their own schedules, and production outages follow from the differences.

Domain-validated certificates prove one thing: whoever asked could answer a challenge on that domain at that moment. Every attack on issuance is a way to answer that challenge without owning the domain.

Mutual TLS proves who connected to whatever terminated the TLS. If that is a load balancer, the application only knows what a header tells it, and headers can be forged.

An HSM's promise is narrow and strong: the key cannot leave in plaintext. Everything else, including who may ask the HSM to use the key, is your design.

They all promise 'hardware security'. They protect different things from different attackers, and choosing well means knowing who you are defending against.

OpenSSL is two libraries and a command-line tool. Most TLS failures blamed on it are applications that never asked it to check the hostname, or told it to stop checking at all.

A certificate is a CA's signature over a structured statement about your key. Each step from key to padlock exists to stop one specific lie.

The root key is the one thing you can never easily replace, so it signs almost nothing. Everything about intermediates follows from that.

Ten seconds of definition, then the part that scores: why most access bugs happen to users who logged in perfectly.

Drawing the arrows is half the answer. The other half is pinning an attack to every parameter: state, redirect URI, code, verifier, audience.

Every candidate knows OIDC is 'OAuth plus identity'. Fewer can say which token goes where, and what breaks when they swap.

'JWTs are stateless and scale' is half an answer. The other half is what happens the day you need to log someone out right now.

The token tells you which algorithm to use and where to find the key. Believing it is how signature checks become no checks.

Static API keys in environment variables are the most common credential leak there is. The answer is platform-issued, short-lived, attested identity.

Escalation rarely needs an admin permission, just a permission that leads to one. The scored answer names the common paths, finds them as a graph, and removes the edges that matter.

Machine identities outnumber people in most organisations and are reviewed far less. The scored answer finds them, gives each an owner, shrinks their power and lifetime, and watches how they are used.

Scattered permission checks drift apart until one is wrong. The scored answer weighs a central decision service against latency, availability and consistency, and keeps enforcement close to the data.

A confirmation click proves someone was present; step-up proves it was the user, recently. The scored answer decides which actions need it and wires it through tokens so the agent cannot fake it.

API keys identify a caller; OAuth delegates a user's authority. The scored answer picks by who is acting and on whose behalf, and makes API keys as safe as they can be when used.

The signature verifies, and the application reads a different element than the one that was signed. Most SAML bugs are some version of that sentence.

Each token verifies against some trusted key. The bug is that the key belonged to a different issuer than the one the token claims, or the user ID means something different there.

The user never types anything an attacker could replay, and the browser, not the user, decides which site is asking. Those two facts are the whole phishing story; the ceremony is how they are enforced.

Moving passwords from config files into a secret manager helps only if the application's way of logging in to the secret manager is not itself a password in a config file.

Deleting the commit feels like fixing the leak. It isn't: the secret was public the moment it was pushed, and only revoking it ends the exposure.

Three bugs, one cause. The answer that scores names the cause, explains why parameters are structural, and lands on why prompts have no parameters.

'Sanitise input' is the answer that fails. The interviewer wants encoding at the point of output, for the specific context, with CSP behind it.

A browsing tool is a URL fetcher whose destination is chosen by text anyone can write. The interviewer wants the defences in the tool and the network, not the prompt.

Reading files top to bottom finds style issues. A security review starts from sources, sinks and the checks between them, and AI code adds a new source.

The model is not the attacker, but whoever wrote the document it just read might be. Every argument in a tool call is untrusted input.

Scanners rarely find it, because every request looks valid. Finding it at scale is a testing design problem, not a scanning problem.

Three browser rules that candidates mix up constantly. The JWT follow-up exposes whether you know which one depends on cookies.

The format is the bug. JSON cannot call functions; pickle is designed to. The AI version is the model checkpoint you just downloaded.

Work through tenant, role, object and field checks, then extend the review to bulk exports, permission changes and resource budgets with executable acceptance cases.

Verify the sender protocol, persist recoverable intake, distinguish delivery retries from business effects, and work through two offline fixtures and crash boundaries.

Two injection classes where a parser or template engine does far more than the developer intended. The scored answer explains the dangerous feature in each and turns it off.

Model a bounded reservation workflow, run an offline invariant fixture, and reason about retries, contention, immutable intent and uncertain external outcomes.

Each tool sees the application from a different angle and has a blind spot where another looks. The scored answer maps bug classes to tools and builds a pipeline that does not drown developers.

Small requests that trigger large work are the cheapest denial of service. The scored answer finds the multipliers, bounds every one, and adds the AI-era ones.

Two servers disagree about where one request ends and the next begins. The scored answer explains the ambiguity, what an attacker gains, and why consistent parsing and HTTP/2 end to end fix it.

URL validation is where string checks fail most visibly. The scored answer parses, resolves and allowlists, then tests the classic bypasses.

Generated code ships faster, which is the point and the risk. The scored answer names the specific failure modes and keeps the normal controls working at the new speed.

An LLM reviewer reads every change, which no human team can, and is confidently wrong some of the time. The scored answer places it as a triage layer, measures it, and protects it from the code it reads.

A practical round that tests clean code and detection judgement together. The scored answer parses defensively, picks a signal that separates stuffing from a forgetful user, and names what it misses.

An easy coding warm-up with traps a security engineer should spot: symlinks, huge files, unreadable files and paths outside the tree. The scored answer handles each and tests it.

A classic coding round with a security twist: the crawler fetches URLs that strangers wrote. The scored answer gets concurrency right, then adds scope, limits and SSRF protection.

Every attribute answers one question: over which connections, to which scripts, from which sites and to which hosts does this cookie travel? Get those four right and most session theft paths close.

Logging in is one moment; a session lasts hours or months. Most session bugs live in what happens between: identifiers that never change, timeouts nobody enforces, and logouts that only clear the browser.

No error messages does not mean no injection. And the sort column is the one place where 'just use parameters' does not work, so you need a different fix.

An ORM parameterises the queries it builds. It cannot protect the queries you build around it, or the data you trusted because it came from your own database.

No SQL does not mean no injection. When a query is a JSON object, the attack is sending an object where the code expected a string.

Interviewers ask for the list to see whether you are current. They ask how you would use it to see whether you understand it is an awareness document, not a standard.

The login form is the front door, but attackers use the side doors: reused passwords, guessable recovery, and MFA that can be phished or reset by a support agent.

Every check passed and every write succeeded. The money still left twice, because the check and the write were two steps and another request got between them.

Most database breaches are not clever. They are a reachable database, an over-privileged account, a leaked credential or an exposed backup.

The same injection bug can leak one table or hand over the server. The difference is decided by grants made long before the bug was written.

Managed databases remove patching chores but add a control plane: whoever can call the cloud API can often copy, share or expose the whole database.

These breaches rarely involved exploits. Databases built for trusted networks were put on the internet with no password, and automated scripts found them within hours.

Every database encryption option protects against someone. The question is whether it protects against the attacker you are worried about, and most only stop thieves of disks and backups.

A bot can send exactly the headers a browser sends. It is much harder for it to send the same TLS handshake, run the same JavaScript and behave like a person. Bot management stacks those differences.

The sandbox is a Linux user ID, SELinux and a signature that decides who you are. Get those three right and most Android security questions become reasoning rather than recall.

Every exported component is an API that any app on the phone can call. The vulnerabilities are the same ones you know from web APIs: missing authorization, trusted input, and a confused deputy.

Rooting is not one trick. It is a decision about the boot chain: either the owner unlocks it, or an exploit breaks it. Everything an app can detect follows from which.

The question is really 'what does hostile code have to break to reach the host?' Answer that for each option and the choice follows.

One link-local address hands out the machine's credentials to anything that can make a request from it. That includes a fooled agent with a fetch tool.

The provider secures the model service. Everything you put into it, connect to it and build on top of it is still yours.

Every layer parses something an attacker wrote, every request costs real money, and tenants share hardware. Walk the path and price each risk.

Training jobs need privileged-looking things: device access, big volumes, fast networking. Hardening is about granting exactly those and nothing else.

GPUs were built for throughput, not mutual distrust. Each sharing mode makes a different promise about memory, and some make none.

Containers are a bundle of kernel features, each limiting a different thing. The scored answer explains what each restricts, what it does not, and how to combine them for an untrusted workload.

Managed AI services remove servers, not responsibility. The scored answer covers identity, network, data, model, logging and governance controls that remain the customer's.

A customer model is customer code: loading it can execute anything, and serving it shares expensive hardware. The scored answer isolates execution, scans and constrains artefacts, and keeps tenants apart on GPUs and networks.

An AI request can cost a thousand times more than a web request, so volumetric thinking alone fails. The scored answer layers network, request and cost controls, and protects the GPU tier from ever seeing junk.

An AI system's behaviour lives in more places than its code. The scored answer versions every one of them together, so you can return to a known-good state in minutes after a bad change or a poisoning.

Most cloud breaches start with a setting, not an exploit. The scored answer moves those settings into reviewed code, checks them before deployment, and catches the drift that happens anyway.

Cloud attackers mostly use the same APIs your engineers do. The scored answer collects the right logs, writes detections for attacker behaviour, and keeps the logs out of the attacker's reach.

GPU nodes carry layers most patch programmes forget: drivers, firmware, CUDA libraries and container toolkits. The scored answer inventories them, prioritises by exposure, and patches without breaking month-long training runs.

Serving images bundle a model runtime, GPU libraries and dozens of Python packages. The scored answer controls what goes in, proves where it came from, and admits only verified images to production.

Sending prompts to a provider is a data flow like any other. The scored answer keeps it on private paths where possible, forces all model traffic through one controlled exit, and blocks everything else.

GPU hosts attract cryptominers and hold valuable weights and data. The scored answer contains without destroying evidence, scopes across the fleet, and rebuilds rather than cleans.

Serving nodes parse hostile input all day, so assume one falls. The design question is what it can reach: the registry, other tenants' models, the signing keys, or nothing at all.

Everything in Kubernetes goes through the API server, so most attacks are about who can talk to it and with what rights. The rest is what a pod can do to its node and to its neighbours.

Most escapes are not clever kernel exploits. They are configuration that handed the container the host: a privileged flag, a mounted socket, a host path or a shared namespace.

A bucket looks simple, but its policy, the identities that can touch it, its encryption keys, its logs and its lifecycle rules are each a way in or a way to lose it.

Snapshot a disk, read it somewhere else, delete the snapshot. That trick built a product category. Interviewers ask how it works, what permissions it needs, and what it cannot see.

Four open-source tools, four different questions: what happened, what is the state now, is this behaviour forbidden, and can the kernel stop it. Choosing well starts with knowing which question each answers.

IAM decides what a role may do; organisation guardrails decide what no role in an account may ever do. The scored answer explains the evaluation, the blind spots and a first set worth deploying.

RBAC decides who may create a pod; admission decides what kind of pod may exist. The scored answer layers the built-in options, handles webhook failure modes and remembers that the admission path is itself attack surface.

Models arrive like dependencies and run like code. The design puts one controlled door in front of them and checks everything that walks through.

'Keyless' means no long-lived key, not no keys. The follow-up that separates candidates: what does your verification policy actually check?

An SBOM lists libraries. An AI-BOM has to answer a harder question: which base model and which data is this behaviour descended from?

Three ways a package you never meant to run ends up in your build. AI coding assistants added a fourth: the package that never existed until someone registered it.

Provenance is only worth anything at the moment someone refuses to deploy because it does not match. Say where that moment is.

The pipeline holds the keys to production and runs code from pull requests. The scored answer separates untrusted from privileged work, pins what it executes, and removes long-lived secrets.

Promotion to production is a deployment decision dressed as a metadata change. The scored answer gives it change control, binds it to evidence, and makes swaps detectable.

Supply chain risk spans what you consume, how you build and what you ship. The scored answer sequences the work by risk reduced per effort and covers models and datasets as dependencies too.

Signed software outlives the certificate that signed it. The scored answer explains how a timestamp proves the signature was made while the certificate was valid, and how revocation dates interact with it.

Shai-Hulud showed that a stolen publishing token can turn one compromised maintainer into hundreds of poisoned packages within hours. The response is part incident handling, part credential hygiene, and the prevention lives in your CI.

CI already mixed untrusted input with powerful tokens. Adding an agent that reads issue text and can act turns a shell-injection problem into a prompt-injection problem. The scored answer fixes both.

Three words every SOC uses and many candidates blur. The answer that scores defines each by what it obliges you to do, and names the decision that turns an alert into an incident.

The process tree tells most of the story in five minutes. Interviewers want an order of questions, the evidence for each, and a clear point at which you contain rather than keep looking.

Anyone can write a query that matches an attack. The interview is about everything else: the data source you trust, the benign activity that looks the same, how you proved it fires, and what the analyst does when it does.

Detections are production code that pages people. Treating them that way means version control, tests that prove they fire, review, staged rollout and metrics that decide which ones live.

A green heatmap is the easiest thing in security to fake. Interviewers want ATT&CK used to plan and test, with coverage that means 'proven to fire on the variants we expect', not 'a rule exists'.

Process creation with full command line and parentage answers more questions than any other event. The rest of the answer is about the next five sources, how sensors collect them, and what attackers do to blind them.

Inbound is blocked, so the compromised host calls out. That single design choice tells defenders where to look: unusual parents spawning shells with network connections, and regular outbound traffic to places nobody else visits.

The miner is the symptom. The incident is how it got there and what else the attacker could reach. Interviewers watch whether you stop at killing the process or follow the entry point and the credentials.

Collect the things that disappear first, change as little as possible, write down everything you did, and know which artefact answers which question. That is most of practical forensics.

Candidates still recite 'preparation, detection, containment, eradication, recovery, lessons learned'. Revision 3 moved incident response into the Cybersecurity Framework's functions, and interviewers notice who has kept up.

Analysts closing ten thousand alerts a week will miss the one that matters. The fix is not more analysts; it is fewer, better alerts and automation for the rest, measured by outcomes rather than throughput.

Sorting by CVSS score sends teams after thousands of 'criticals' nobody will ever exploit. The answer weighs whether exploitation is happening, whether the asset is reachable, and what it would cost you.

A hunt is a testable hypothesis about an attacker your detections missed. Without one, it is just browsing logs. The output that justifies it is usually a new detection, not a captured attacker.

A logging pipeline is a distributed system with a threat model: attackers want it blind, analysts want it fast, finance wants it cheap. The staff answer designs for all three and for the day the queue backs up.

The first half is a Counter. The follow-up, an infinite stream and a memory cap, is the actual question: interviewers want a heavy-hitters algorithm and an honest statement of what it guarantees.

The review is where an incident pays for itself, or gets wasted. Interviewers want a factual timeline, contributing factors rather than a culprit, and actions with owners that someone checks.

Crypto miners steal your compute. LLMjackers steal your model quota and resell it, and the first alert is often the bill.

Deciding what to fix is half the job. The other half is getting a fix onto 20,000 machines without breaking them, and proving it landed. Few candidates can describe that half.

The patch is the easy part. The hard parts are finding every copy, deciding what to do where you cannot patch tonight, and checking whether someone used it before you knew.

A credential that nobody legitimate ever uses produces an alert with almost no false positives. The craft is in placing it where an intruder looks and making sure it grants nothing.

EDR sees so much because it runs with so much privilege. On 19 July 2024 that privilege turned one bad content file into millions of crashed Windows machines. The answer covers both halves.

Having backups is not the control; having backups an attacker with admin rights cannot delete, and restoring from them on schedule, is. The scored answer designs for both.

A knowledge check with two traps: two editions are in circulation with different numbers, and reciting names earns little. Grouping the ten into entries and impacts, and applying them to a system, earns the rest.

A framework question that rewards structure. The scored answer gives the axes NIST uses, places familiar attacks on them, and shows how a shared vocabulary changes real work.

Product security's favourite AI question, because the answer is mostly classic AppSec. The scored part is matching each sink to its control and preferring structured data over generated code.

A design round in miniature. The answer that scores follows the data through both halves of the pipeline and spends most of its time on authorization, where real leaks happen.

Similarity search has no idea who is asking. The answer that scores makes the index enforce the source system's rules, at query time and over time.

Poisoning a knowledge base is cheaper than poisoning a model. The answer that scores starts from who can write to the corpus and limits what a poisoned chunk can achieve.

An easy question with a revealing follow-up. The answer that scores limits cost at every layer, including the agent loop, not just requests per minute.

There is no single answer, and saying so is the start. The scored answer decides per check from what its failure would let through, and designs the latency budget so the choice is rarely forced.

Caches are shared state, and shared state crosses tenants. The scored answer separates response caches from prompt prefix caches and keys each so one user can never read or detect another's data.

When people act on wrong output, the harm is real even though nothing was hacked. The scored answer names the concrete failures and designs the product so verification is easy and required where it matters.

The service receives customers' source code all day. The scored answer protects that code across tenants, keeps secrets out of prompts and logs, and treats suggestions as untrusted output.

A gateway turns dozens of ad hoc model integrations into one place to enforce and observe. The scored answer chooses what belongs centrally and what must stay in each application.

Regulated data turns every copy the AI pipeline makes into an audit question. The scored answer keeps the regulated data out of the model where possible and brings each remaining copy under the regime.

An integrity investigation with three suspects: the sources, the index and the model. The scored answer uses versions and provenance to tell them apart quickly.

The assistant becomes a new client of every API the product has, with a confused-deputy problem built in. The scored answer finds the new trust boundaries and keeps the old access model intact.

Similarity scores, result counts, snippets and ranking all say something about what is in the index. If authorization is applied after search, the search itself is the leak.

Research has shown a handful of planted documents can steer targeted answers. The defence is not a detector that recognises poison; it is control over who can write, staged promotion, and a risk estimate that multiplies the stages.

The regulator does not care which classifier you used. The design that scores puts authorisation and commitments in code, uses classifiers where they are good, and decides in advance what happens when a streamed answer goes wrong halfway.

Requests per minute is the wrong unit when one request can cost ten thousand tokens. The interview checks the bucket arithmetic, the unknown output length, and what happens when two gateway nodes share one budget.

One agent is a design review. Four hundred agents is an operations problem: who owns each, what it can touch, how much it can spend, and how you stop one, a class or all of them in minutes.

A gateway is the one place every tool call passes, which makes it the natural home for policy. It is also blind to everything that does not pass through it, and that is the half of the answer most candidates skip.

Design-time controls decide what an agent may do. Runtime protection watches what it actually does, at four different layers, and each layer catches something the others miss.

A2A standardises how agents find and talk to each other. It does not decide who to trust, what to share or what to believe, and those three decisions are the answer.

Drift is the world changing. An attack is someone changing it on purpose. The evidence that separates them is where and how the errors cluster.

Hiding scores slows attackers down; it does not stop them. The scored answer explains decision-based search and transfer, and turns query patterns into a detection opportunity.

Fraudsters are the original adaptive adversaries. The scored answer attacks with realistic, feasible changes, probes the whole decision system rather than the model alone, and measures dollars, not just accuracy.

Naming Govern, Map, Measure and Manage takes five seconds. Saying what each one produces in your organisation is the answer.

The core RMF is generic; the profile makes it specific to generative AI. The scored answer names the twelve risks, shows how they map onto the four functions, and picks the ones a security team owns.

A policy saying humans review decisions proves nothing. The scored answer specifies the logs, metrics and tests that show reviewers can and do change outcomes.

Regulatory reporting has to plug into ordinary incident response. The scored answer knows who reports what to whom and by when, and is honest about the open question on timing.

Seven characteristics that frame most AI governance conversations. The scored answer names them precisely and shows how security supports, and trades off against, the others.

Fairness has several incompatible definitions, so the audit starts with a decision, not a metric. The scored answer picks measures for the context, gets the data to compute them, and audits the whole decision process.

Three frameworks, three different questions: what can go wrong in what we build, how attackers actually operate, and how the organisation manages the risk. Using one for another's job is the common mistake.

'Prompt injection' is a technique, not a risk entry. Entries that get funded describe a scenario, an asset, a consequence in business terms, an owner and a measurable treatment.

A central committee reviewing every AI feature either blocks the company or gets bypassed. The model that works centralises standards and platforms, tiers by risk, and gives teams paved roads they want to use.

There is no single 'AI incident' notification rule. The incident is usually a personal-data, contractual or sector incident that happens to involve AI, and the clock may already be running.

The first ten minutes of any design review decide its quality. This answer shows the sketch, the one question that finds most bugs, and why controls come last.

Neither 'block it' nor 'ship it' scores. The interviewer is watching whether you can find the one risk that matters in a day and offer a path to launch.

Five minutes, no jargon, one decision. Candidates who explain how attention works have already lost the room.

Privacy principles become engineering decisions about fields, retention and contracts. The scored answer walks one feature and makes each principle concrete.

How you treat the first reporter decides whether there is a second. The scored answer acknowledges quickly, validates safely, fixes by severity, communicates honestly and handles AI-specific scope questions.

A leadership question. The scored answer finds out what exists, fixes the highest-impact exposures, and builds the few shared controls that make every later project cheaper.

Security engineers rarely have authority over the teams whose code matters most. The scored answer makes the secure path the easy one, earns trust through help, and gives teams ownership.

A penetration test is a controlled, authorised simulation of an attacker with a scope, rules and a report. The legal and planning parts are what separate it from an attack.