CrowdStrike AI Security Engineer interview questions

Most candidates start by deleting the commit. The key was copied the minute it went public; the clock starts with revocation.

Two classic tools that structure attacker thinking. The scored answer uses each for what it is good at and names the blind spots before an interviewer does.

Detection quality is decided before the first alert, by what you logged and how you set the threshold. The scored answer derives both from the questions an investigator will ask.

Severity disputes are usually disagreements about facts or assumptions. The scored answer finds which, settles it with evidence and the agreed scale, and has an escalation path that does not damage trust.

A penetration test is a controlled, authorised simulation of an attacker with a scope, rules and a report. The legal and planning parts are what separate it from an attack.

Internal assessments rarely need exotic exploits. They follow the credentials, and the controls that matter are the ones that stop credentials from spreading.

Attackers are not wizards; they repeat a small number of moves because those moves keep working. The answer names the moves and the choke points where one control breaks many intrusions.

When finding a bug costs a few dollars of compute, the defender's advantage has to come from somewhere else. A staff-level answer says exactly where.

Most candidates say 'rings' and stop. The interviewer is listening for who enforces the boundary, where the kernel must distrust its caller, and why one kernel bug undoes every process boundary at once.

Isolation is enforced by page tables and credentials, then deliberately punched through by debuggers, shared memory and IPC. A strong answer names both the wall and the doors.

The definition takes one sentence. The interview is about the four ways privilege actually moves, and why most escalations are misconfigurations rather than exploits.

The username tells you almost nothing. The interviewer wants the list of privilege transitions reachable from that process, and which of them you would have closed in advance.

Capabilities split root into pieces, but some pieces are nearly the whole thing. A strong answer knows the sets, the dangerous capabilities, and why 'drop all, add one' is the only defensible default.

Check, then use: two system calls, and an attacker in between. The answer interviewers want replaces names with handles and checks with atomic operations, and can show it in code.

OpenSSH's design is the model answer, but interviewers want you to derive it: what the parser must never hold, how small the privileged half can get, and the three mistakes that make a privilege drop reversible.

Programs rarely name the file they run or load; they search for it. Whoever can write earlier in the search order chooses the code. The answer covers both platforms and the one rule that fixes both.

Linux candidates often freeze here. The model is learnable in five nouns, and interviewers reward the one insight that matters: privileges in a token can matter more than group membership.

Kernel exploits make headlines; misconfigured services, impersonation and stored credentials do the work. The scored answer groups escalation into classes and attaches a control and a detection to each.

Interviewers ask for the protocol first because every AD attack is a protocol property used against you. The strong answer derives each attack from a step in the ticket flow, then attaches the control that breaks it.

You cannot stop every laptop being compromised. You can decide what that laptop holds. The strong answer is about which credentials live where, and making stolen ones useless elsewhere.

Interviewers listen for precision: an overflow is an out-of-bounds write, an over-read is a different bug, and a use-after-free is about lifetime, not bounds. Getting the taxonomy right is most of the easy question.

Reciting the acronyms is the easy part. The scored answer pairs each mitigation with the exploitation step it blocks and the precondition that defeats it, which is why they only work together.

Once data could not run as code, attackers stopped bringing code. The interview checks that you understand code reuse as an idea, and what forward-edge and backward-edge protections each enforce.

'It's just a crash' and 'mitigations are on' are the two answers that get candidates marked down. The scored answer separates the primitive, the reachability and the privilege, and treats a read bug as half of an exploit.

Random input finds shallow bugs. Coverage feedback, sanitizers and a harness that reaches the parser are what make fuzzing find the deep ones. The interview checks all three, plus what happens after the crash.

Tool names are not the answer. Interviewers want to know what each view can and cannot tell you, and why a decompiler's output is a hypothesis to be checked at runtime.

Interviewers give an unfamiliar binary to see method, not stamina. Start from the question, find the code that touches the secret through imports and strings, confirm at runtime, and report what you proved and what you did not.

Every obfuscation must still run on the CPU in a form the CPU understands. That single fact tells you how each one is undone, and why obfuscation buys time rather than secrecy.

A single check is a single patch. The design question is how to make removing protection expensive, detectable at scale, and pointless because the server holds the real decisions.

EDR products, profilers, game cheats and banking trojans all use the same trick: make a call to function A run your code first. Knowing the mechanics tells you both how to detect it and why user-mode hooks are a weak place for security controls.

Most Mac compromises do not break these controls. They persuade the user to step around them, or borrow the permissions of an app that already has them.

'It's signed' means different things depending on when the signature is checked: once at install, every time the binary loads, or on every page of memory as it executes.

sudo is a policy engine that runs as root and parses user input. Grant it carelessly and 'run this one command' becomes 'run anything'.

Secure Boot checks signatures until the kernel is running. What keeps root from loading unsigned code into the kernel after that is a different set of controls, and interviewers check you know both.

NTLM proves you can answer a challenge. It never proves which server you meant to answer, so whoever sits in the middle can pass your answer to a server you never chose.

Once an attacker is admin on one machine, the credentials cached there decide whether they stop at one machine or reach the domain. Every control in this answer is about that step.

Browsers assume the JavaScript engine will be exploited. The architecture is built so that one bug buys an attacker a locked room, and they need a second, different bug to leave it.

Typing a command sets off a chain: a system call, a permission check, a loader, dynamic linking and memory protections. Every step is a place security is enforced, and a place it can be bypassed.

On macOS, root is not enough to read a user's documents or watch the screen. TCC decides that, and XPC is how privileged helpers talk, so both are prime targets.

A vulnerability is a gap between what the code assumes and what an attacker can make true. Nearly every one falls into a handful of root causes, and each has a matching way to find and prevent it.

The kernel is the single shared authority on a machine. A bug there means any process can rewrite who it is.

Two things make Windows compromise spread: services that run with powerful identities, and a process that holds the credentials of everyone logged on.

Both tools read logs and ban addresses after the fact. Knowing what that design can and cannot see is the whole answer, and most candidates call it an authentication control.

A patch is a map to the bug it fixes. The interview question is what that means for disclosure timing, open-source fixes and your own patch deadlines.

An agent that renames 4,000 functions overnight is a real gain. An agent that confidently explains what a function does without checking is a liability. Interviewers want both halves and the controls in between.

Default-deny execution is one of the strongest endpoint controls there is, and one of the least deployed. The scored answer explains the rule types, the bypass classes and how to roll it out without a revolt.

You cannot read the payload, but you can see who talked to whom, when, how much and how often. That metadata catches beaconing, exfiltration and lateral movement, if you know what normal looks like.

The VPN gateway is the one internet-facing system that grants network access to whoever passes its login. Treat it like that and most design choices answer themselves.

The whole IPv4 internet is scanned many times a day. If a service answers, assume someone has already catalogued it.

The device that guards the network is itself a server on the internet, often unmonitored and rarely patched. Interviewers want to hear how you would treat it like one.

Machine identities outnumber people in most organisations and are reviewed far less. The scored answer finds them, gives each an owner, shrinks their power and lifetime, and watches how they are used.

Zero trust is a set of engineering decisions, not a product. The scored answer names them, shows how they replace network location as a trust signal, and admits where they are hard.

The attacker never needs the password: the victim grants their app access. The scored answer explains why MFA does not help, then controls consent at the tenant and watches the grants.

Stolen session tokens skip MFA entirely, which is why infostealers sell them. The scored answer looks for the same session appearing in two places, binds what it can, and makes revocation fast.

Phishing-resistant MFA is only as strong as the process that replaces it when someone loses their phone. Attackers have noticed, and so do interviewers.

The victim types a code on the real Microsoft sign-in page, passes MFA, and hands the attacker their tokens. The scored answer explains why nothing looks wrong and which policy actually stops it.

Each tool sees the application from a different angle and has a blind spot where another looks. The scored answer maps bug classes to tools and builds a pipeline that does not drown developers.

A practical round that tests clean code and detection judgement together. The scored answer parses defensively, picks a signal that separates stuffing from a forgetful user, and names what it misses.

An easy coding warm-up with traps a security engineer should spot: symlinks, huge files, unreadable files and paths outside the tree. The scored answer handles each and tests it.

An extension with 'read and change all your data on all websites' sits inside every session your staff open, and it updates itself. The scored answer treats extensions like software you deploy, because they are.

Pinning protects the user from the network. It was never going to protect your API from the person holding the phone, and the good answer explains both halves.

On a phone, the signing key is the app's identity: it decides who can ship updates, which data the app can share, and what it is entitled to do. Lose it, or let someone else sign, and that identity changes hands.

Taking over a modern Android phone takes several bugs in a row. Each link targets a different layer, and Android's design adds a defence at every one.

iOS has fewer ways in than most platforms, so attackers aim at the few that remain: messages, the browser and the kernel. Apple's defences are built around those exact paths.

Most mobile malware never breaks the sandbox. It persuades the user to hand over the permissions that let it read the screen and act as them.

Exploit chains used by mercenary spyware depend on memory corruption. Tagging every allocation and checking the tag on every access attacks that dependency directly. The answer is how it works and where it stops.

Employees will read company email on their own phones either way. The scored answer protects the data without owning the device, and is honest about what IT can and cannot see.

Spyware chains usually arrive through features most people never use. The scored answer trades those features away for the people who need it, and plans for what happens when protection is not enough.

Containers are a bundle of kernel features, each limiting a different thing. The scored answer explains what each restricts, what it does not, and how to combine them for an untrusted workload.

Cloud attackers mostly use the same APIs your engineers do. The scored answer collects the right logs, writes detections for attacker behaviour, and keeps the logs out of the attacker's reach.

GPU hosts attract cryptominers and hold valuable weights and data. The scored answer contains without destroying evidence, scopes across the fleet, and rebuilds rather than cleans.

Most escapes are not clever kernel exploits. They are configuration that handed the container the host: a privileged flag, a mounted socket, a host path or a shared namespace.

Four open-source tools, four different questions: what happened, what is the state now, is this behaviour forbidden, and can the kernel stop it. Choosing well starts with knowing which question each answers.

RBAC decides who may create a pod; admission decides what kind of pod may exist. The scored answer layers the built-in options, handles webhook failure modes and remembers that the admission path is itself attack surface.

The mechanism takes a minute. The score comes from saying exactly what a valid signature does not prove, and running the key-theft response.

Three ways a package you never meant to run ends up in your build. AI coding assistants added a fourth: the package that never existed until someone registered it.

The pipeline holds the keys to production and runs code from pull requests. The scored answer separates untrusted from privileged work, pins what it executes, and removes long-lived secrets.

Supply chain risk spans what you consume, how you build and what you ship. The scored answer sequences the work by risk reduced per effort and covers models and datasets as dependencies too.

Three words every SOC uses and many candidates blur. The answer that scores defines each by what it obliges you to do, and names the decision that turns an alert into an incident.

The process tree tells most of the story in five minutes. Interviewers want an order of questions, the evidence for each, and a clear point at which you contain rather than keep looking.

Anyone can write a query that matches an attack. The interview is about everything else: the data source you trust, the benign activity that looks the same, how you proved it fires, and what the analyst does when it does.

Detections are production code that pages people. Treating them that way means version control, tests that prove they fire, review, staged rollout and metrics that decide which ones live.

A green heatmap is the easiest thing in security to fake. Interviewers want ATT&CK used to plan and test, with coverage that means 'proven to fire on the variants we expect', not 'a rule exists'.

Process creation with full command line and parentage answers more questions than any other event. The rest of the answer is about the next five sources, how sensors collect them, and what attackers do to blind them.

Inbound is blocked, so the compromised host calls out. That single design choice tells defenders where to look: unusual parents spawning shells with network connections, and regular outbound traffic to places nobody else visits.

The miner is the symptom. The incident is how it got there and what else the attacker could reach. Interviewers watch whether you stop at killing the process or follow the entry point and the credentials.

Encryption is the last stage of a ransomware attack, not the first. The strong answer contains spread fast, protects backups and identity systems, and knows that recovery depends on choices made months earlier.

Collect the things that disappear first, change as little as possible, write down everything you did, and know which artefact answers which question. That is most of practical forensics.

The group change is one event; the question is the chain behind it. The strong answer treats tier 0 as compromised until proven otherwise and works backwards from who made the change and with what credentials.

Resetting the password is step four, not step one. Attackers keep access through sessions, app consents and mailbox rules, and the money moves faster than the investigation.

Candidates still recite 'preparation, detection, containment, eradication, recovery, lessons learned'. Revision 3 moved incident response into the Cybersecurity Framework's functions, and interviewers notice who has kept up.

Analysts closing ten thousand alerts a week will miss the one that matters. The fix is not more analysts; it is fewer, better alerts and automation for the rest, measured by outcomes rather than throughput.

A hunt is a testable hypothesis about an attacker your detections missed. Without one, it is just browsing logs. The output that justifies it is usually a new detection, not a captured attacker.

Hash lookups catch yesterday's file. A good rule targets what the family cannot easily change, and gets tested against a corpus of clean files before anyone trusts it.

A logging pipeline is a distributed system with a threat model: attackers want it blind, analysts want it fast, finance wants it cheap. The staff answer designs for all three and for the day the queue backs up.

The first half is a Counter. The follow-up, an infinite stream and a memory cap, is the actual question: interviewers want a heavy-hitters algorithm and an honest statement of what it guarantees.

The review is where an incident pays for itself, or gets wasted. Interviewers want a factual timeline, contributing factors rather than a culprit, and actions with owners that someone checks.

Malware is just software that does what its operator wants on your machine. Every stage leaves evidence, and every stage has a control that can stop it.

Getting in once is not enough for an attacker. Persistence is where they must leave a mark on the system, which makes it one of the best places to catch them.

Crypto miners steal your compute. LLMjackers steal your model quota and resell it, and the first alert is often the bill.

The Arup case cost about US$25 million because everyone on the call looked and sounded right. The control that works does not involve spotting the fake at all.

Deciding what to fix is half the job. The other half is getting a fix onto 20,000 machines without breaking them, and proving it landed. Few candidates can describe that half.

A credential that nobody legitimate ever uses produces an alert with almost no false positives. The craft is in placing it where an intruder looks and making sure it grants nothing.

Importing hashes and IP addresses from a report feels productive and changes almost nothing. The answer climbs from indicators to behaviours and ends with a test that proves the change.

EDR sees so much because it runs with so much privilege. On 19 July 2024 that privilege turned one bad content file into millions of crashed Windows machines. The answer covers both halves.

Having backups is not the control; having backups an attacker with admin rights cannot delete, and restoring from them on schedule, is. The scored answer designs for both.

Infostealers turned stolen passwords and cookies into a commodity with sellers, buyers and price lists. The scored answer follows the supply chain and cuts it at the points you control.

Headlines promised self-writing AI malware. The reports show something narrower and more useful to defenders: malware with a dependency on someone else's API. The scored answer separates hype from evidence and turns that dependency into detections.

Knowing the acronym is the easy part. Mapping a real attack chain onto tactics, and saying what that mapping is useful for, is what gets scored.

AI security did not start with LLMs. The scored answer explains how these classifiers learn, the adversarial dynamics they have lived with for decades, and the lessons that carry over.

A motivation question that is really a skills question. The scored answer gives a specific reason, maps existing skills to AI security work honestly, and shows what you have already done to close the gaps.

Design-time controls decide what an agent may do. Runtime protection watches what it actually does, at four different layers, and each layer catches something the others miss.

One attacks the model's inputs, the other its upbringing. The phase decides the defence, and interviewers want you to say so.

The API is the attack surface and every response is a training example. Prevention is unrealistic; slowing, limiting and noticing are not.

Drift is the world changing. An attack is someone changing it on purpose. The evidence that separates them is where and how the errors cluster.

Hiding scores slows attackers down; it does not stop them. The scored answer explains decision-based search and transfer, and turns query patterns into a detection opportunity.

An attacker who cannot see your model can attack one they can see, and much of the damage carries over. That single property turns 'the weights are secret' into a weak defence.

Review an integration by tracing model input, process access and credential recipients. Then name the component that refuses each unauthorized action.

Inventory the data, untrusted inputs and outbound routes, including tools with two roles. Propose one enforced restriction and explain what the first pass leaves unresolved.

Reading rwx bits is the easy half. Interviewers check whether you know what execute means on a directory, why setuid binaries are an attack surface, and what the sticky bit does and does not protect.

Everyone knows MAC is 'stricter'. The scored part is why a compromised root process can still be confined, how labels differ from paths, and what you do when the policy blocks production at 2am.

A checklist recital scores 'weak'. The strong answer orders controls by the attacker they stop, treats the baseline as code, and explains how you would notice when someone drifts from it.

'Rewrite it in Rust' is a slogan, not a plan. The staff answer ranks components by exposure, stops new bugs at the boundary first, and keeps the old code contained while the language mix shifts.

A bypass screenshot is not a finding. Interviewers look for whether you can separate 'I changed my own copy of the program' from 'I can now do something the server should have stopped'.

The CPU does work it later throws away, but the cache remembers. The strong answer explains that one sentence precisely, then turns it into isolation decisions for shared infrastructure.