Cloudflare AI Security Engineer interview questions

The tools are free; running them is not. A strong answer picks a small set by risk, assigns owners, and treats every security tool as software that can be compromised or relicensed.

Every platform that runs someone else's code (plugins, notebooks, AI agents, serverless) must pick a boundary. The right one depends on what the code may do and what a single bug in the boundary costs.

Both tools read logs and ban addresses after the fact. Knowing what that design can and cannot see is the whole answer, and most candidates call it an authentication control.

Turning off passwords is the easy half. The interview is about the other half: how keys are issued, how long they live, how a host proves itself, and how you cut someone off at 5pm on a Friday.

The whole IPv4 internet is scanned many times a day. If a service answers, assume someone has already catalogued it.

The packets are WireGuard; the interesting part is the coordination server that tells every device whose keys to accept. That server is what a strong answer threat-models.

Blocking bad domains at the resolver is one of the cheapest controls there is, until the client stops asking your resolver. A strong answer covers both halves.

SASE is the firewall, proxy and access gateway moved into a provider's network so they sit in front of users wherever they are. The interview is about what each piece inspects, and what you hand the provider in exchange.

Most networks that say they do not run IPv6 run it anyway, unmanaged. The scored answer finds the three places that matters and decides deliberately.

Nobody attacks your DNS; they just claim the cloud resource your DNS still points at. The scored answer explains why it is so common and how to stop it at deprovisioning.

Sender authentication proves which domain sent a message, not that the message is safe. The scored answer walks the layers after it and where each one is blind.

A certificate is a CA's signature over a structured statement about your key. Each step from key to padlock exists to stop one specific lie.

The root key is the one thing you can never easily replace, so it signs almost nothing. Everything about intermediates follows from that.

A user agent string is a claim anyone can type. A signature over the request is a claim only the key holder can make. The interesting part is what that signature still does not tell the site.

The victim types a code on the real Microsoft sign-in page, passes MFA, and hands the attacker their tokens. The scored answer explains why nothing looks wrong and which policy actually stops it.

A bot can send exactly the headers a browser sends. It is much harder for it to send the same TLS handshake, run the same JavaScript and behave like a person. Bot management stacks those differences.

An extension with 'read and change all your data on all websites' sits inside every session your staff open, and it updates itself. The scored answer treats extensions like software you deploy, because they are.

A WebSocket starts as an HTTP request that carries the user's cookies and skips CORS. The scored answer explains the hijack, then the controls that a long-lived connection needs that a normal request does not.

The patch is the easy part. The hard parts are finding every copy, deciding what to do where you cannot patch tonight, and checking whether someone used it before you knew.

A credential that nobody legitimate ever uses produces an alert with almost no false positives. The craft is in placing it where an intruder looks and making sure it grants nothing.

Infostealers turned stolen passwords and cookies into a commodity with sellers, buyers and price lists. The scored answer follows the supply chain and cuts it at the points you control.

An easy question with a revealing follow-up. The answer that scores limits cost at every layer, including the agent loop, not just requests per minute.

A gateway is the one place every tool call passes, which makes it the natural home for policy. It is also blind to everything that does not pass through it, and that is the half of the answer most candidates skip.

Giving an agent a card number is the wrong design. The scored answer separates consent, spending limits and agent identity, and shows how 2025-26 protocols handle each.

Signed provenance and invisible watermarks are often lumped together as 'AI detection'. They prove different things and fail in different ways, which is the whole answer.

The classic 'what happens when you type google.com' turned into a security question. Interviewers want the stack in order, with the attacker who sits at each layer and the control that removes them.

Encryption alone does not stop a man in the middle: you could be encrypting to the attacker. The property that matters is authentication, and every successful MITM is a story about how it was skipped.

A classic warm-up that rewards precision: what state the server keeps, why spoofed SYNs cost the attacker nothing, and how SYN cookies move that state into the sequence number.

DNSSEC and DNS over HTTPS are often named in the same breath and protect entirely different things. The scored answer separates authenticity of the record from privacy of the query.

Users type a domain, not https://. That one habit gave attackers a plain-HTTP first request to hijack. HSTS closes it, and preloading closes it before the first visit, with a commitment you cannot easily undo.

NAT is not a firewall, and inbound rules are only half a policy. Interviewers check whether you know what each device decides, and why the outbound direction is where breaches are contained.

Flat networks turn one infected laptop into a company-wide incident. The scored answer draws zones from what talks to what, and shows how identity-based policy replaces IP lists as the network grows.

Every TLS error is a specific check failing. Engineers who can name which check, from the chain the client actually saw, fix outages in minutes and never 'fix' them by turning validation off.