Databricks Cloud, Container & AI Infrastructure Security interview questions

The provider secures the model service. Everything you put into it, connect to it and build on top of it is still yours.

Many ML tools assume they run on a trusted network and offer 'run this code' as a feature. Put them on the internet and that feature is remote code execution.

Training jobs need privileged-looking things: device access, big volumes, fast networking. Hardening is about granting exactly those and nothing else.

Containers are a bundle of kernel features, each limiting a different thing. The scored answer explains what each restricts, what it does not, and how to combine them for an untrusted workload.

Managed AI services remove servers, not responsibility. The scored answer covers identity, network, data, model, logging and governance controls that remain the customer's.

A customer model is customer code: loading it can execute anything, and serving it shares expensive hardware. The scored answer isolates execution, scans and constrains artefacts, and keeps tenants apart on GPUs and networks.

An AI system's behaviour lives in more places than its code. The scored answer versions every one of them together, so you can return to a known-good state in minutes after a bad change or a poisoning.

Serving images bundle a model runtime, GPU libraries and dozens of Python packages. The scored answer controls what goes in, proves where it came from, and admits only verified images to production.

Sending prompts to a provider is a data flow like any other. The scored answer keeps it on private paths where possible, forces all model traffic through one controlled exit, and blocks everything else.

Serving nodes parse hostile input all day, so assume one falls. The design question is what it can reach: the registry, other tenants' models, the signing keys, or nothing at all.

A bucket looks simple, but its policy, the identities that can touch it, its encryption keys, its logs and its lifecycle rules are each a way in or a way to lose it.

Inference servers are built to run on a trusted machine, so most have no authentication and some trust their own network completely. Internet scans keep finding them anyway.

You cannot protect data you have not found, and you cannot find it once it has been copied into ten places. The toolchain answer follows data from discovery to the AI index.

Four open-source tools, four different questions: what happened, what is the state now, is this behaviour forbidden, and can the kernel stop it. Choosing well starts with knowing which question each answers.

The question is really 'what does hostile code have to break to reach the host?' Answer that for each option and the choice follows.

One link-local address hands out the machine's credentials to anything that can make a request from it. That includes a fooled agent with a fetch tool.

Every layer parses something an attacker wrote, every request costs real money, and tenants share hardware. Walk the path and price each risk.

Assume the code is hostile and design until that stops mattering. Then the interviewer adds a GPU and the internet, and you design again.

One copy is a total loss. The design is about how few places weights exist, how few people can touch them, and whether a bulk copy can leave unnoticed.

Training clusters hold the data and the weights, and run code from hundreds of dependencies. Default-deny egress is the control that holds when everything else is fooled.