Google AI Security Engineer interview questions

The first ten minutes of any design review decide its quality. This answer shows the sketch, the one question that finds most bugs, and why controls come last.

Candidates who say 'everything is new' and candidates who say 'nothing is new' both lose this one. The answer that scores names exactly three differences and keeps the rest of the toolkit.

Reciting the six letters earns little. What scores is a diagram drawn aloud, one boundary walked in depth, and a list of threats with owners.

The order lookup is the whole interview. Candidates who spend ten minutes on jailbreaks and two on authorization have it backwards.

Definitions take ten seconds. The interviewer wants a worked failure: which layer broke, which one held, and why they did not break together.

Three words people use interchangeably, and a prioritisation question that exposes whether you have ever had a backlog of thirty findings.

Neither 'block it' nor 'ship it' scores. The interviewer is watching whether you can find the one risk that matters in a day and offer a path to launch.

Five minutes, no jargon, one decision. Candidates who explain how attention works have already lost the room.

Most candidates start by deleting the commit. The key was copied the minute it went public; the clock starts with revocation.

A reset flow is a second login page with weaker checks. Interviewers use it because every step has a classic bug, and the strong answer finds them in order.

Two classic tools that structure attacker thinking. The scored answer uses each for what it is good at and names the blind spots before an interviewer does.

STRIDE assumes components follow their code. A model follows its inputs. The scored answer keeps the six categories and adds what probabilistic, persuadable components need.

Detection quality is decided before the first alert, by what you logged and how you set the threshold. The scored answer derives both from the questions an investigator will ask.

Privacy principles become engineering decisions about fields, retention and contracts. The scored answer walks one feature and makes each principle concrete.

Reviews fail when they arrive late, cover everything equally and produce vague findings. The scored answer scopes early, focuses on the riskiest decisions and writes findings as specific, owned changes.

Every senior security engineer has one. The scored answer shows you reduced the risk, made the residual visible, got the right owner to accept it, and kept watching.

Interviewers want a security engineer who can say no without becoming the department of no. The scored answer shows evidence, an alternative that met the goal, and a working relationship afterwards.

Severity disputes are usually disagreements about facts or assumptions. The scored answer finds which, settles it with evidence and the agreed scale, and has an escalation path that does not damage trust.

AI features need the usual secure development steps plus a few that most lifecycles lack. The scored answer places each activity at the stage where it is cheapest and names the gate.

How you treat the first reporter decides whether there is a second. The scored answer acknowledges quickly, validates safely, fixes by severity, communicates honestly and handles AI-specific scope questions.

Leaked keys remain one of the commonest breach causes, and agents create new places to leak them. The scored answer prefers no secret at all, then short-lived ones, and keeps them out of every model context.

Good metrics change decisions. The scored answer picks a few in coverage, risk, outcomes and speed, defines each precisely, and explains what action each one triggers.

Security engineers rarely have authority over the teams whose code matters most. The scored answer makes the secure path the easy one, earns trust through help, and gives teams ownership.

A judgement question with an ethical edge. The scored answer makes the risk clear in business terms, offers options, accepts a properly informed decision, and knows the rare cases where it is not enough.

A penetration test is a controlled, authorised simulation of an attacker with a scope, rules and a report. The legal and planning parts are what separate it from an attack.

Internal assessments rarely need exotic exploits. They follow the credentials, and the controls that matter are the ones that stop credentials from spreading.

Attackers are not wizards; they repeat a small number of moves because those moves keep working. The answer names the moves and the choke points where one control breaks many intrusions.

When finding a bug costs a few dollars of compute, the defender's advantage has to come from somewhere else. A staff-level answer says exactly where.

Most candidates say 'rings' and stop. The interviewer is listening for who enforces the boundary, where the kernel must distrust its caller, and why one kernel bug undoes every process boundary at once.

Isolation is enforced by page tables and credentials, then deliberately punched through by debuggers, shared memory and IPC. A strong answer names both the wall and the doors.

Reading rwx bits is the easy half. Interviewers check whether you know what execute means on a directory, why setuid binaries are an attack surface, and what the sticky bit does and does not protect.

The definition takes one sentence. The interview is about the four ways privilege actually moves, and why most escalations are misconfigurations rather than exploits.

The username tells you almost nothing. The interviewer wants the list of privilege transitions reachable from that process, and which of them you would have closed in advance.

Capabilities split root into pieces, but some pieces are nearly the whole thing. A strong answer knows the sets, the dangerous capabilities, and why 'drop all, add one' is the only defensible default.

Everyone knows MAC is 'stricter'. The scored part is why a compromised root process can still be confined, how labels differ from paths, and what you do when the policy blocks production at 2am.

Check, then use: two system calls, and an attacker in between. The answer interviewers want replaces names with handles and checks with atomic operations, and can show it in code.

OpenSSH's design is the model answer, but interviewers want you to derive it: what the parser must never hold, how small the privileged half can get, and the three mistakes that make a privilege drop reversible.

A checklist recital scores 'weak'. The strong answer orders controls by the attacker they stop, treats the baseline as code, and explains how you would notice when someone drifts from it.

Programs rarely name the file they run or load; they search for it. Whoever can write earlier in the search order chooses the code. The answer covers both platforms and the one rule that fixes both.

Linux candidates often freeze here. The model is learnable in five nouns, and interviewers reward the one insight that matters: privileges in a token can matter more than group membership.

Kernel exploits make headlines; misconfigured services, impersonation and stored credentials do the work. The scored answer groups escalation into classes and attaches a control and a detection to each.

Interviewers ask for the protocol first because every AD attack is a protocol property used against you. The strong answer derives each attack from a step in the ticket flow, then attaches the control that breaks it.

You cannot stop every laptop being compromised. You can decide what that laptop holds. The strong answer is about which credentials live where, and making stolen ones useless elsewhere.

Interviewers listen for precision: an overflow is an out-of-bounds write, an over-read is a different bug, and a use-after-free is about lifetime, not bounds. Getting the taxonomy right is most of the easy question.

Reciting the acronyms is the easy part. The scored answer pairs each mitigation with the exploitation step it blocks and the precondition that defeats it, which is why they only work together.

Once data could not run as code, attackers stopped bringing code. The interview checks that you understand code reuse as an idea, and what forward-edge and backward-edge protections each enforce.

'It's just a crash' and 'mitigations are on' are the two answers that get candidates marked down. The scored answer separates the primitive, the reachability and the privilege, and treats a read bug as half of an exploit.

'Rewrite it in Rust' is a slogan, not a plan. The staff answer ranks components by exposure, stops new bugs at the boundary first, and keeps the old code contained while the language mix shifts.

Random input finds shallow bugs. Coverage feedback, sanitizers and a harness that reaches the parser are what make fuzzing find the deep ones. The interview checks all three, plus what happens after the crash.

Tool names are not the answer. Interviewers want to know what each view can and cannot tell you, and why a decompiler's output is a hypothesis to be checked at runtime.

Interviewers give an unfamiliar binary to see method, not stamina. Start from the question, find the code that touches the secret through imports and strings, confirm at runtime, and report what you proved and what you did not.

A bypass screenshot is not a finding. Interviewers look for whether you can separate 'I changed my own copy of the program' from 'I can now do something the server should have stopped'.

The CPU does work it later throws away, but the cache remembers. The strong answer explains that one sentence precisely, then turns it into isolation decisions for shared infrastructure.

Assume the parser will be exploited, then decide what the exploit gets. The scored design has a disposable worker with nothing worth stealing, no way out, and a narrow, validated return path.

Secure Boot refuses to run unsigned code; measured boot records what did run; a TPM lets someone else check that record. Candidates who blur the three cannot reason about attestation at all.

Every obfuscation must still run on the CPU in a form the CPU understands. That single fact tells you how each one is undone, and why obfuscation buys time rather than secrecy.

A single check is a single patch. The design question is how to make removing protection expensive, detectable at scale, and pointless because the server holds the real decisions.

EDR products, profilers, game cheats and banking trojans all use the same trick: make a call to function A run your code first. Knowing the mechanics tells you both how to detect it and why user-mode hooks are a weak place for security controls.

The algorithm is correct and the key never leaves the chip. The attacker reads it anyway from how long, how loud or how hot the computation is, or breaks it by making the chip skip one instruction.

All three face the same impossible brief: let the user's device use a secret without letting the user have it. The good designs change the brief instead of pretending to meet it.

Most Mac compromises do not break these controls. They persuade the user to step around them, or borrow the permissions of an app that already has them.

'It's signed' means different things depending on when the signature is checked: once at install, every time the binary loads, or on every page of memory as it executes.

sudo is a policy engine that runs as root and parses user input. Grant it carelessly and 'run this one command' becomes 'run anything'.

A seccomp filter decides on a system call number and six integers. It cannot read the file path a pointer refers to, and that one limitation shapes every good policy.

Secure Boot checks signatures until the kernel is running. What keeps root from loading unsigned code into the kernel after that is a different set of controls, and interviewers check you know both.

NTLM proves you can answer a challenge. It never proves which server you meant to answer, so whoever sits in the middle can pass your answer to a server you never chose.

Once an attacker is admin on one machine, the credentials cached there decide whether they stop at one machine or reach the domain. Every control in this answer is about that step.

Browsers assume the JavaScript engine will be exploited. The architecture is built so that one bug buys an attacker a locked room, and they need a second, different bug to leave it.

W^X says memory is writable or executable, never both. A JIT compiler's whole job is writing code and then running it. How a runtime squares that circle decides how much an attacker gains from a memory bug.

Typing a command sets off a chain: a system call, a permission check, a loader, dynamic linking and memory protections. Every step is a place security is enforced, and a place it can be bypassed.

On macOS, root is not enough to read a user's documents or watch the screen. TCC decides that, and XPC is how privileged helpers talk, so both are prime targets.

A vulnerability is a gap between what the code assumes and what an attacker can make true. Nearly every one falls into a handful of root causes, and each has a matching way to find and prevent it.

A crash is not an exploit. Turning one into the other takes several steps, and every modern mitigation is designed to break one of them.

The kernel is the single shared authority on a machine. A bug there means any process can rewrite who it is.

Two things make Windows compromise spread: services that run with powerful identities, and a process that holds the credentials of everyone logged on.

Every platform that runs someone else's code (plugins, notebooks, AI agents, serverless) must pick a boundary. The right one depends on what the code may do and what a single bug in the boundary costs.

Both tools read logs and ban addresses after the fact. Knowing what that design can and cannot see is the whole answer, and most candidates call it an authentication control.

Turning off passwords is the easy half. The interview is about the other half: how keys are issued, how long they live, how a host proves itself, and how you cut someone off at 5pm on a Friday.

A patch is a map to the bug it fixes. The interview question is what that means for disclosure timing, open-source fixes and your own patch deadlines.

An agent that renames 4,000 functions overnight is a real gain. An agent that confidently explains what a function does without checking is a liability. Interviewers want both halves and the controls in between.

Default-deny execution is one of the strongest endpoint controls there is, and one of the least deployed. The scored answer explains the rule types, the bypass classes and how to roll it out without a revolt.

The classic 'what happens when you type google.com' turned into a security question. Interviewers want the stack in order, with the attacker who sits at each layer and the control that removes them.

Encryption alone does not stop a man in the middle: you could be encrypting to the attacker. The property that matters is authentication, and every successful MITM is a story about how it was skipped.

A classic warm-up that rewards precision: what state the server keeps, why spoofed SYNs cost the attacker nothing, and how SYN cookies move that state into the sequence number.

DNSSEC and DNS over HTTPS are often named in the same breath and protect entirely different things. The scored answer separates authenticity of the record from privacy of the query.

Users type a domain, not https://. That one habit gave attackers a plain-HTTP first request to hijack. HSTS closes it, and preloading closes it before the first visit, with a commitment you cannot easily undo.

NAT is not a firewall, and inbound rules are only half a policy. Interviewers check whether you know what each device decides, and why the outbound direction is where breaches are contained.

Every TLS error is a specific check failing. Engineers who can name which check, from the chain the client actually saw, fix outages in minutes and never 'fix' them by turning validation off.

Pinning trades availability for a narrower trust set. The answer that scores compares each pin target by what it survives, and uses HPKP's retirement as evidence of what goes wrong.

A VPN answers 'are you allowed on the network?'. Zero-trust access asks 'may this user, on this device, reach this application right now?'. The interview tests whether you can explain why the second question is safer.

SPF checks a server, DKIM checks a signature, and neither checks the From line the user reads. DMARC ties them to that line. Interviewers want the alignment idea, then the phishing that still gets through.

A shared password, a capture of one handshake and an offline dictionary is still how many Wi-Fi networks fall. The answer explains why, what SAE changed, and why enterprises use certificates instead.

A 2 Tbps flood and one expensive API call per second are both denial of service. The answer that scores matches each attack to the place where it can be stopped, and knows which ones only a provider can absorb.

The internet's routing system still largely believes what networks announce. The strong answer explains why a more specific prefix wins, what RPKI signs, and why path manipulation survives it.

Attackers scan the whole internet continuously and know your forgotten test server before you do. The answer is an inventory built from several sources, compared with what is actually listening.

Interviewers do not want the seven OSI names recited. They want you to say which layer an attack lives at, because that decides which control can see it.

NAT drops unsolicited inbound packets as a side effect of bookkeeping, not policy. Port forwards, UPnP, outbound connections and IPv6 all walk around it.

A firewall is a list of match conditions evaluated in order against fields it can see, plus a table that remembers connections. Almost every firewall failure is in one of those three words: order, fields, remember.

Put a proxy in front of an app and two new questions appear: who is the real client, and does the proxy read the request the same way the app does?

Local network protocols were designed for a building full of colleagues. Anyone plugged into the same segment can claim to be the router, and the protocols believe them.

WireGuard's configuration is a list of public keys and the IP ranges each may use. That small idea replaces most of what IPsec negotiates, and it is the part interviewers ask about.

The VPN gateway is the one internet-facing system that grants network access to whoever passes its login. Treat it like that and most design choices answer themselves.

Signing does not hide anything. It proves who sent a message and that nobody changed it, which is exactly what relay and tampering attacks need you not to check.

The packets are WireGuard; the interesting part is the coordination server that tells every device whose keys to accept. That server is what a strong answer threat-models.

A MAC address is a label the device chooses and announces in clear text on every frame. The answer turns on that one fact, and on what a network should check instead.

The device that guards the network is itself a server on the internet, often unmonitored and rarely patched. Interviewers want to hear how you would treat it like one.

Blocking bad domains at the resolver is one of the cheapest controls there is, until the client stops asking your resolver. A strong answer covers both halves.

SASE is the firewall, proxy and access gateway moved into a provider's network so they sit in front of users wherever they are. The interview is about what each piece inspects, and what you hand the provider in exchange.

In a plant, availability and physical safety outrank confidentiality, and the controllers may be older than the security team. The scored answer adapts IT habits instead of copying them.

Short-range radio assumes that being close means being trusted. The scored answer explains pairing models, key negotiation bugs and why relays need distance measurement, not stronger encryption.

Most networks that say they do not run IPv6 run it anyway, unmanaged. The scored answer finds the three places that matters and decides deliberately.

Nobody attacks your DNS; they just claim the cloud resource your DNS still points at. The scored answer explains why it is so common and how to stop it at deprovisioning.

Sender authentication proves which domain sent a message, not that the message is safe. The scored answer walks the layers after it and where each one is blind.

The most common screen question in security. The answer that scores sorts all four by one property: whether there is a key, and who holds it.

The trap is answering 'which is better'. Every protocol you use daily runs both, each doing the job the other cannot.

Message names are table stakes. The interviewer is listening for why CertificateVerify exists and what Finished actually checks.

Checking the signature is one step of seven. The bugs that matter live in the other six, and in code that switches validation off.

SHA-256 with a salt sounds right and fails. The answer that scores explains the attacker's economics and names the parameters.

Both detect tampering. The difference is who else could have made the tag, and that decides webhooks, tokens and audit evidence.

The question behind the question: if your server's private key leaks next year, what happens to the traffic someone recorded today?

'Yes, always' is the right default and the wrong answer. The interviewer wants the list of attackers it does nothing against.

Encryption without integrity has been exploited for decades. Nonce reuse under GCM is worse than most candidates think: it breaks integrity too.

Data keys, key-encryption keys, tenant isolation, rotation and crypto-shredding. The design is standard; the trade-offs at each level are the interview.

mTLS authenticates both ends, but only as well as your private CA and identity scheme. The scored answer designs issuance, identity, rotation and authorisation, and contrasts it with the public web.

Any trusted CA can issue a certificate for your domain. The scored answer explains how public logs make that visible and how to turn the logs into an alert.

Revocation asks every client to check a third party on every connection, and most clients quietly do not. The scored answer explains each mechanism's failure mode and why the industry is moving to short lifetimes.

A classic that tests whether you know how hash functions work inside. The scored answer explains length extension, the nested HMAC construction, and how to verify a MAC safely.

Encryption hides content, not length. The scored answer shows how compression turns length into a leak when secrets and attacker text share a message, and where that bites today.

Most cryptographic failures are misuse of good primitives, not broken algorithms. The scored answer has a checklist that catches the common ones and a strong default to replace them.

Cryptography assumes unpredictable numbers, and real systems have repeatedly failed to supply them. The scored answer gives the causes, the famous failures, and the rules that prevent repeats.

Both keep keys out of application memory; they differ in who you must trust and what you can prove. The scored answer chooses by threat model and requirement, not by fashion.

Encryption at rest is the easy part; weights must be decrypted somewhere to be used. The scored answer controls where decryption happens, who can cause it, and how fast misuse is noticed.

Trusted execution moves the trust boundary from the operator to the hardware and the attested code. The scored answer is precise about what that protects, what it assumes, and what it leaves open.

Using one key for several purposes quietly couples their security. The scored answer explains extract and expand, shows key separation by context, and says when HKDF is the wrong tool.

Data encrypted today can be recorded and decrypted when a capable quantum computer exists. The scored answer prioritises by how long data must stay secret, starts with key exchange, and builds crypto agility.

A small root hash that commits to millions of entries. The scored answer builds an inclusion proof, explains consistency proofs, and names the systems that depend on them.

TLS protects bytes on the wire between two endpoints. The scored answer lists what lies outside that boundary, so nobody mistakes 'we use HTTPS' for a security design.

The response differs sharply between a signing key and an encryption key. The scored answer contains use, rotates, revokes trust, assesses what the attacker could forge or read, and repairs what depended on it.

Preimage, second preimage and collision resistance sound alike and protect different things. The birthday bound explains why the last one costs half the bits.

Issuing a certificate is easy. Knowing every certificate you issued, renewing them before they expire, and surviving the day a CA key leaks is the design.

Being able to switch algorithms is essential. Letting an attacker choose which algorithm you switch to is a vulnerability with a long history.

Most candidates can recite TLS 1.3. Interviewers ask for 1.2 because it is still everywhere, and because every change in 1.3 is the fix for an attack on 1.2.

A certificate is a signed statement with a short list of claims: this key, these names, these uses, this period, issued by this CA. Every validation failure you have seen is one of those claims not holding.

There is no single list of trusted roots. Browsers, operating systems, language runtimes and container images each carry their own, updated on their own schedules, and production outages follow from the differences.

Domain-validated certificates prove one thing: whoever asked could answer a challenge on that domain at that moment. Every attack on issuance is a way to answer that challenge without owning the domain.

Mutual TLS proves who connected to whatever terminated the TLS. If that is a load balancer, the application only knows what a header tells it, and headers can be forged.

An HSM's promise is narrow and strong: the key cannot leave in plaintext. Everything else, including who may ask the HSM to use the key, is your design.

They all promise 'hardware security'. They protect different things from different attackers, and choosing well means knowing who you are defending against.

OpenSSL is two libraries and a command-line tool. Most TLS failures blamed on it are applications that never asked it to check the hostname, or told it to stop checking at all.

A certificate is a CA's signature over a structured statement about your key. Each step from key to padlock exists to stop one specific lie.

The root key is the one thing you can never easily replace, so it signs almost nothing. Everything about intermediates follows from that.

Ten seconds of definition, then the part that scores: why most access bugs happen to users who logged in perfectly.

Drawing the arrows is half the answer. The other half is pinning an attack to every parameter: state, redirect URI, code, verifier, audience.

Every candidate knows OIDC is 'OAuth plus identity'. Fewer can say which token goes where, and what breaks when they swap.

'JWTs are stateless and scale' is half an answer. The other half is what happens the day you need to log someone out right now.

Documents are shared with people, folders, teams and links. Roles alone collapse under that, and the interviewer wants to see you notice when.

The token tells you which algorithm to use and where to find the key. Believing it is how signature checks become no checks.

Both are 'something you have'. One can be typed into a fake page in real time; the other checks which page is asking.

A service account is the easy answer and the wrong one. The interviewer wants both identities visible in every call, scoped to the task, and revocable by the user.

A 1988 bug report that describes most agent incidents. The answer that scores turns it into a design rule: authority travels with the request.

Static API keys in environment variables are the most common credential leak there is. The answer is platform-issued, short-lived, attested identity.

A valid token is not valid everywhere. The scored answer explains audience binding, why forwarding a caller's token downstream breaks it, and what MCP's authorisation rules require instead.

Most OAuth breaches come from a few well-known mistakes. The scored answer explains each attack and the specific rule that stops it, as consolidated in the 2025 OAuth security best current practice.

Two enterprise workhorses with very different designs. The scored answer explains each flow, where the trust lives, and the attacks that follow from it.

Escalation rarely needs an admin permission, just a permission that leads to one. The scored answer names the common paths, finds them as a graph, and removes the edges that matter.

A bearer token works for whoever holds it. The scored answer explains how binding a token to a key changes that, the two standard ways to do it, and the cost.

An MCP server is an API that a model drives. The scored answer treats it as an OAuth resource server, authorises every tool call against the user, and keeps upstream credentials out of the client's hands.

Machine identities outnumber people in most organisations and are reviewed far less. The scored answer finds them, gives each an owner, shrinks their power and lifetime, and watches how they are used.

Zero trust is a set of engineering decisions, not a product. The scored answer names them, shows how they replace network location as a trust signal, and admits where they are hard.

Scattered permission checks drift apart until one is wrong. The scored answer weighs a central decision service against latency, availability and consistency, and keeps enforcement close to the data.

The attacker never needs the password: the victim grants their app access. The scored answer explains why MFA does not help, then controls consent at the tenant and watches the grants.

A confirmation click proves someone was present; step-up proves it was the user, recently. The scored answer decides which actions need it and wires it through tokens so the agent cannot fake it.

Stolen session tokens skip MFA entirely, which is why infostealers sell them. The scored answer looks for the same session appearing in two places, binds what it can, and makes revocation fast.

API keys identify a caller; OAuth delegates a user's authority. The scored answer picks by who is acting and on whose behalf, and makes API keys as safe as they can be when used.

Validate tenant selection, enforce resource permissions, and test the boundaries that signed context and row-level security do not cover automatically. Follow one request through retrieval, caches and a queued job.

Trace a withdrawn grant through cached decisions, exchanged tokens and queued work. Define when new actions are denied and account for effects already dispatched.

The signature verifies, and the application reads a different element than the one that was signed. Most SAML bugs are some version of that sentence.

Each token verifies against some trusted key. The bug is that the key belonged to a different issuer than the one the token claims, or the user ID means something different there.

The user never types anything an attacker could replay, and the browser, not the user, decides which site is asking. Those two facts are the whole phishing story; the ceremony is how they are enforced.

Moving passwords from config files into a secret manager helps only if the application's way of logging in to the secret manager is not itself a password in a config file.

Deleting the commit feels like fixing the leak. It isn't: the secret was public the moment it was pushed, and only revoking it ends the exposure.

Liveness checks were built to catch a photo held up to a camera. Deepfakes often never go near the camera at all.

Phishing-resistant MFA is only as strong as the process that replaces it when someone loses their phone. Attackers have noticed, and so do interviewers.

A user agent string is a claim anyone can type. A signature over the request is a claim only the key holder can make. The interesting part is what that signature still does not tell the site.

The victim types a code on the real Microsoft sign-in page, passes MFA, and hands the attacker their tokens. The scored answer explains why nothing looks wrong and which policy actually stops it.

Nobody broke into the CRM. An integration that customers had approved years ago simply asked for the data, with valid tokens. The scored answer treats third-party grants as identities you own.

Three bugs, one cause. The answer that scores names the cause, explains why parameters are structural, and lands on why prompts have no parameters.

'Sanitise input' is the answer that fails. The interviewer wants encoding at the point of output, for the specific context, with CSP behind it.

A browsing tool is a URL fetcher whose destination is chosen by text anyone can write. The interviewer wants the defences in the tool and the network, not the prompt.

Reading files top to bottom finds style issues. A security review starts from sources, sinks and the checks between them, and AI code adds a new source.

Scanners rarely find it, because every request looks valid. Finding it at scale is a testing design problem, not a scanning problem.

Three browser rules that candidates mix up constantly. The JWT follow-up exposes whether you know which one depends on cookies.

The format is the bug. JSON cannot call functions; pickle is designed to. The AI version is the model checkpoint you just downloaded.

File tools take paths from the model, and the model takes ideas from whatever it read. A string check for '..' is not confinement.

The model did not write malicious HTML on its own; a web page it summarised did. Then the conversation was shared, and the renderer trusted it.

A strict CSP blocks many XSS payloads but not all, and DOM XSS has paths it cannot see. The scored answer explains what a nonce-based policy stops, where it fails, and why Trusted Types targets the DOM sinks.

Work through tenant, role, object and field checks, then extend the review to bulk exports, permission changes and resource budgets with executable acceptance cases.

Verify the sender protocol, persist recoverable intake, distinguish delivery retries from business effects, and work through two offline fixtures and crash boundaries.

Two injection classes where a parser or template engine does far more than the developer intended. The scored answer explains the dangerous feature in each and turns it off.

Model a bounded reservation workflow, run an offline invariant fixture, and reason about retries, contention, immutable intent and uncertain external outcomes.

Each tool sees the application from a different angle and has a blind spot where another looks. The scored answer maps bug classes to tools and builds a pipeline that does not drown developers.

Small requests that trigger large work are the cheapest denial of service. The scored answer finds the multipliers, bounds every one, and adds the AI-era ones.

The commonest serious bug in AI tools is the oldest: fetching an object by ID without checking who is asking. The scored answer finds it, fixes it at the data access, and tests across users and tenants.

Two servers disagree about where one request ends and the next begins. The scored answer explains the ambiguity, what an attacker gains, and why consistent parsing and HTTP/2 end to end fix it.

URL validation is where string checks fail most visibly. The scored answer parses, resolves and allowlists, then tests the classic bypasses.

Generated code ships faster, which is the point and the risk. The scored answer names the specific failure modes and keeps the normal controls working at the new speed.

An LLM reviewer reads every change, which no human team can, and is confidently wrong some of the time. The scored answer places it as a triage layer, measures it, and protects it from the code it reads.

A practical round that tests clean code and detection judgement together. The scored answer parses defensively, picks a signal that separates stuffing from a forgetful user, and names what it misses.

An easy coding warm-up with traps a security engineer should spot: symlinks, huge files, unreadable files and paths outside the tree. The scored answer handles each and tests it.

A classic coding round with a security twist: the crawler fetches URLs that strangers wrote. The scored answer gets concurrency right, then adds scope, limits and SSRF protection.

Every attribute answers one question: over which connections, to which scripts, from which sites and to which hosts does this cookie travel? Get those four right and most session theft paths close.

Logging in is one moment; a session lasts hours or months. Most session bugs live in what happens between: identifiers that never change, timeouts nobody enforces, and logouts that only clear the browser.

The user clicks a button on your page while believing they are on someone else's. The fix is a response header that tells the browser who may frame you, not script that tries to escape the frame.

CORS never blocks a request from being sent. It decides whether another site's script may read the answer, and with credentials allowed, that answer contains the logged-in user's data.

Interviewers ask for the list to see whether you are current. They ask how you would use it to see whether you understand it is an awareness document, not a standard.

The login form is the front door, but attackers use the side doors: reused passwords, guessable recovery, and MFA that can be phished or reset by a support agent.

CSRF defences stop other sites from acting as the user. XSS is not another site: it is code running inside yours, with everything your own pages can do.

Most database breaches are not clever. They are a reachable database, an over-privileged account, a leaked credential or an exposed backup.

The same injection bug can leak one table or hand over the server. The difference is decided by grants made long before the bug was written.

Managed databases remove patching chores but add a control plane: whoever can call the cloud API can often copy, share or expose the whole database.

These breaches rarely involved exploits. Databases built for trusted networks were put on the internet with no password, and automated scripts found them within hours.

Every database encryption option protects against someone. The question is whether it protects against the attacker you are worried about, and most only stop thieves of disks and backups.

The model's guess is cheap; the proof is what matters. Strong answers describe the oracle that turns a hypothesis into evidence, and the triage that keeps maintainers from drowning.

A patch that makes the scanner go quiet is not the same as a patch that fixes the bug. The interview is about how you would tell the difference at scale, and what the tool itself can be tricked into doing.

A bot can send exactly the headers a browser sends. It is much harder for it to send the same TLS handshake, run the same JavaScript and behave like a person. Bot management stacks those differences.

The app works, the demo is great, and every row in the database is readable from the browser. The scored answer explains the architecture that makes this common and a one-hour review that catches it.

An extension with 'read and change all your data on all websites' sits inside every session your staff open, and it updates itself. The scored answer treats extensions like software you deploy, because they are.

A WebSocket starts as an HTTP request that carries the user's cookies and skips CORS. The scored answer explains the hijack, then the controls that a long-lived connection needs that a normal request does not.

Both platforms sandbox apps and require signing; they differ in who decides what runs and how fast fixes arrive. Interviewers want the shared model first, then the differences that change a threat model.

The sandbox is a Linux user ID, SELinux and a signature that decides who you are. Get those three right and most Android security questions become reasoning rather than recall.

A standard is a checklist only if you use it badly. The answer interviewers want maps the app's data and threats onto MASVS areas, then picks which MASTG tests are worth the time.

'Use the Keychain' is half an answer. Interviewers check whether you know the key never leaves the hardware, the data it protects still does, and which settings stop it riding along in a backup.

Every exported component is an API that any app on the phone can call. The vulnerabilities are the same ones you know from web APIs: missing authorization, trusted input, and a confused deputy.

Any app can claim myapp://. That single fact breaks OAuth redirects, password-reset links and payment flows that trust a custom scheme. The fix is a link the operating system verifies against your domain.

A WebView puts a browser inside your app, without the browser's address bar, and often with a bridge to native code. XSS in that page is no longer 'just XSS'.

The token is safely in the Keychain, and also in the crash log, the analytics payload and the app-switcher screenshot. Interviewers want the list of side doors, not the front door again.

The device is in the attacker's hand in half the scenarios. A strong model sorts threats by where the attacker sits, then puts every decision that moves money behind a check the phone cannot fake.

Pinning narrows trust, and every outage story about it is a rotation story. The scored answer decides whether to pin at all, pins public keys with backups, and plans for the release that can never update.

Two different questions hide here: does the app validate TLS at all, and does it pin? Testers who merge them either miss the critical bug or report a non-issue as one.

Detection that runs on the attacker's device reports whatever the attacker allows it to. Interviewers want to hear what it is still good for, and what it must never decide alone.

Attestation gives your server a signed statement it did not have to trust the client for. The design question is what that statement covers, how you bind it to a request, and what you do when it is missing.

Anything in the app binary belongs to whoever downloads it. The strong answer stops trying to hide a client secret and builds on user tokens, PKCE, device-bound keys and server-side limits.

Unzip, decompile, read the manifest, then watch it run. The interview checks whether you know where the interesting parts of an app hide, and that obfuscation changes your effort, not your conclusions.

Moving a secret into C changes who can find it in an afternoon, not whether it can be found. The scored answer shows how an analyst would recover it, then replaces the design with one that does not need a shared secret.

No shield is unbreakable, so 'can it be bypassed' is the wrong test. Measure how much it raises an attacker's cost on the threats you actually face, and what it costs you in crashes, performance and false positives.

Everything shipped on the phone belongs to the person holding it: the weights, the system prompt and any key the assistant uses. And the assistant now reads notifications, messages and screens written by strangers.

Pinning protects the user from the network. It was never going to protect your API from the person holding the phone, and the good answer explains both halves.

Both platforms let an app declare its transport rules in a file the reviewer can read in seconds. Knowing which lines are dangerous makes you fast in a mobile review.

A key the app cannot export is only half the story. The other half is making the key usable only after the user is really present, which a hooked 'authentication succeeded' callback can fake.

On a phone, the signing key is the app's identity: it decides who can ship updates, which data the app can share, and what it is entitled to do. Lose it, or let someone else sign, and that identity changes hands.

Rooting is not one trick. It is a decision about the boot chain: either the owner unlocks it, or an exploit breaks it. Everything an app can detect follows from which.

Most mobile findings do not need root at all. The ones that do usually point to the same conclusion: the server must not trust the client.

Taking over a modern Android phone takes several bugs in a row. Each link targets a different layer, and Android's design adds a defence at every one.

iOS has fewer ways in than most platforms, so attackers aim at the few that remain: messages, the browser and the kernel. Apple's defences are built around those exact paths.

Most mobile malware never breaks the sandbox. It persuades the user to hand over the permissions that let it read the screen and act as them.

Your app can be fully patched on a phone whose kernel is two years old. The answer separates what you control, what the platform controls, and what you can only measure.

Exploit chains used by mercenary spyware depend on memory corruption. Tagging every allocation and checking the tag on every access attacks that dependency directly. The answer is how it works and where it stops.

Employees will read company email on their own phones either way. The scored answer protects the data without owning the device, and is honest about what IT can and cannot see.

Spyware chains usually arrive through features most people never use. The scored answer trades those features away for the people who need it, and plans for what happens when protection is not enough.

The question is really 'what does hostile code have to break to reach the host?' Answer that for each option and the choice follows.

One link-local address hands out the machine's credentials to anything that can make a request from it. That includes a fooled agent with a fetch tool.

The provider secures the model service. Everything you put into it, connect to it and build on top of it is still yours.

Every layer parses something an attacker wrote, every request costs real money, and tenants share hardware. Walk the path and price each risk.

Assume the code is hostile and design until that stops mattering. Then the interviewer adds a GPU and the internet, and you design again.

One copy is a total loss. The design is about how few places weights exist, how few people can touch them, and whether a bulk copy can leave unnoticed.

Training clusters hold the data and the weights, and run code from hundreds of dependencies. Default-deny egress is the control that holds when everything else is fooled.

Many ML tools assume they run on a trusted network and offer 'run this code' as a feature. Put them on the internet and that feature is remote code execution.

Training jobs need privileged-looking things: device access, big volumes, fast networking. Hardening is about granting exactly those and nothing else.

GPUs were built for throughput, not mutual distrust. Each sharing mode makes a different promise about memory, and some make none.

Containers are a bundle of kernel features, each limiting a different thing. The scored answer explains what each restricts, what it does not, and how to combine them for an untrusted workload.

Managed AI services remove servers, not responsibility. The scored answer covers identity, network, data, model, logging and governance controls that remain the customer's.

A customer model is customer code: loading it can execute anything, and serving it shares expensive hardware. The scored answer isolates execution, scans and constrains artefacts, and keeps tenants apart on GPUs and networks.

An AI request can cost a thousand times more than a web request, so volumetric thinking alone fails. The scored answer layers network, request and cost controls, and protects the GPU tier from ever seeing junk.

The people who build frontier models need access to them, which is exactly the risk. The scored answer reduces who can touch weights directly, makes exfiltration hard and visible, and does it without poisoning research culture.

A framework that ties security investment to attacker capability. The scored answer explains the five levels, why the top ones are qualitatively different, and how labs use the idea.

An AI system's behaviour lives in more places than its code. The scored answer versions every one of them together, so you can return to a known-good state in minutes after a bad change or a poisoning.

Most cloud breaches start with a setting, not an exploit. The scored answer moves those settings into reviewed code, checks them before deployment, and catches the drift that happens anyway.

Cloud attackers mostly use the same APIs your engineers do. The scored answer collects the right logs, writes detections for attacker behaviour, and keeps the logs out of the attacker's reach.

GPU nodes carry layers most patch programmes forget: drivers, firmware, CUDA libraries and container toolkits. The scored answer inventories them, prioritises by exposure, and patches without breaking month-long training runs.

Serving images bundle a model runtime, GPU libraries and dozens of Python packages. The scored answer controls what goes in, proves where it came from, and admits only verified images to production.

Sending prompts to a provider is a data flow like any other. The scored answer keeps it on private paths where possible, forces all model traffic through one controlled exit, and blocks everything else.

Weights pass through more systems than most teams draw. The scored answer maps every hop, asks what an attacker could steal or swap at each, and puts integrity checks where they cannot be skipped.

GPU hosts attract cryptominers and hold valuable weights and data. The scored answer contains without destroying evidence, scopes across the fleet, and rebuilds rather than cleans.

Python sits on top of a lot of C and C++. The scored answer explains the bug class, what the mitigations do and do not stop, and where ML stacks are exposed.

Serving nodes parse hostile input all day, so assume one falls. The design question is what it can reach: the registry, other tenants' models, the signing keys, or nothing at all.

Everything in Kubernetes goes through the API server, so most attacks are about who can talk to it and with what rights. The rest is what a pod can do to its node and to its neighbours.

Most escapes are not clever kernel exploits. They are configuration that handed the container the host: a privileged flag, a mounted socket, a host path or a shared namespace.

A bucket looks simple, but its policy, the identities that can touch it, its encryption keys, its logs and its lifecycle rules are each a way in or a way to lose it.

Snapshot a disk, read it somewhere else, delete the snapshot. That trick built a product category. Interviewers ask how it works, what permissions it needs, and what it cannot see.

You cannot protect data you have not found, and you cannot find it once it has been copied into ten places. The toolchain answer follows data from discovery to the AI index.

Four open-source tools, four different questions: what happened, what is the state now, is this behaviour forbidden, and can the kernel stop it. Choosing well starts with knowing which question each answers.

IAM decides what a role may do; organisation guardrails decide what no role in an account may ever do. The scored answer explains the evaluation, the blind spots and a first set worth deploying.

RBAC decides who may create a pod; admission decides what kind of pod may exist. The scored answer layers the built-in options, handles webhook failure modes and remembers that the admission path is itself attack surface.

The mechanism takes a minute. The score comes from saying exactly what a valid signature does not prove, and running the key-theft response.

Half the answer is 'pickle runs code'. The half that scores is everything safetensors leaves open.

Models arrive like dependencies and run like code. The design puts one controlled door in front of them and checks everything that walks through.

'Keyless' means no long-lived key, not no keys. The follow-up that separates candidates: what does your verification policy actually check?

An SBOM lists libraries. An AI-BOM has to answer a harder question: which base model and which data is this behaviour descended from?

Three ways a package you never meant to run ends up in your build. AI coding assistants added a fourth: the package that never existed until someone registered it.

A model is a directory, not a file. Sign the whole thing, tie the signature to the pipeline that produced it, and refuse to load anything that does not match.

Provenance is only worth anything at the moment someone refuses to deploy because it does not match. Say where that moment is.

The package ran with everything the training job could reach: data, credentials, checkpoints. Scope by what it could touch, not by what you hope it did.

The weights are safetensors and the code is a Python file from the same repository, fetched at load time. Guess which one runs with your credentials.

You can check the file and test the behaviour; you cannot prove a negative. The scored answer separates code-level threats from learned backdoors and is honest about what testing can find.

The pipeline holds the keys to production and runs code from pull requests. The scored answer separates untrusted from privileged work, pins what it executes, and removes long-lived secrets.

Promotion to production is a deployment decision dressed as a metadata change. The scored answer gives it change control, binds it to evidence, and makes swaps detectable.

Pinning a version is not pinning content. The scored answer verifies every file against a recorded hash, treats unexpected and missing files as failures, and explains where the lockfile's own trust comes from.

An MCP server is code you run or trust, plus text your model reads. The scored answer reviews who wrote it, what it can reach, what its tool descriptions say, and pins it so it cannot change silently.

Scraped data changes under you and anyone can write to the web. The scored answer snapshots and hashes what was collected, records where it came from, filters what it can, and keeps enough lineage to undo a mistake.

If two independent builds from the same source produce identical bytes, a compromised build server cannot hide. The scored answer explains how, what breaks reproducibility, and why ML needs provenance instead of bit-for-bit equality.

A model update can quietly undo controls you rely on. The scored answer runs a fixed security suite with thresholds agreed in advance, checks the artefact too, and decides what blocks a release.

Supply chain risk spans what you consume, how you build and what you ship. The scored answer sequences the work by risk reduced per effort and covers models and datasets as dependencies too.

Code that downloads a model by name trusts whoever owns that name today. The scored answer lists the ways that trust breaks and replaces names with pinned, mirrored, verified artefacts.

Signed software outlives the certificate that signed it. The scored answer explains how a timestamp proves the signature was made while the certificate was valid, and how revocation dates interact with it.

A release is only as trustworthy as the weakest step a customer cannot check. The scored answer chains source, build, artefact and publication into evidence a consumer verifies automatically.

Typosquatting waits for a human typo. Slopsquatting waits for a model to invent the same wrong name again, and models repeat themselves.

Shai-Hulud showed that a stolen publishing token can turn one compromised maintainer into hundreds of poisoned packages within hours. The response is part incident handling, part credential hygiene, and the prevention lives in your CI.

CI already mixed untrusted input with powerful tokens. Adding an agent that reads issue text and can act turns a shell-injection problem into a prompt-injection problem. The scored answer fixes both.

Three words every SOC uses and many candidates blur. The answer that scores defines each by what it obliges you to do, and names the decision that turns an alert into an incident.

The process tree tells most of the story in five minutes. Interviewers want an order of questions, the evidence for each, and a clear point at which you contain rather than keep looking.

Anyone can write a query that matches an attack. The interview is about everything else: the data source you trust, the benign activity that looks the same, how you proved it fires, and what the analyst does when it does.

Detections are production code that pages people. Treating them that way means version control, tests that prove they fire, review, staged rollout and metrics that decide which ones live.

A green heatmap is the easiest thing in security to fake. Interviewers want ATT&CK used to plan and test, with coverage that means 'proven to fire on the variants we expect', not 'a rule exists'.

Process creation with full command line and parentage answers more questions than any other event. The rest of the answer is about the next five sources, how sensors collect them, and what attackers do to blind them.

Inbound is blocked, so the compromised host calls out. That single design choice tells defenders where to look: unusual parents spawning shells with network connections, and regular outbound traffic to places nobody else visits.

The miner is the symptom. The incident is how it got there and what else the attacker could reach. Interviewers watch whether you stop at killing the process or follow the entry point and the credentials.

Encryption is the last stage of a ransomware attack, not the first. The strong answer contains spread fast, protects backups and identity systems, and knows that recovery depends on choices made months earlier.

Collect the things that disappear first, change as little as possible, write down everything you did, and know which artefact answers which question. That is most of practical forensics.

The group change is one event; the question is the chain behind it. The strong answer treats tier 0 as compromised until proven otherwise and works backwards from who made the change and with what credentials.

Resetting the password is step four, not step one. Attackers keep access through sessions, app consents and mailbox rules, and the money moves faster than the investigation.

Candidates still recite 'preparation, detection, containment, eradication, recovery, lessons learned'. Revision 3 moved incident response into the Cybersecurity Framework's functions, and interviewers notice who has kept up.

Analysts closing ten thousand alerts a week will miss the one that matters. The fix is not more analysts; it is fewer, better alerts and automation for the rest, measured by outcomes rather than throughput.

Sorting by CVSS score sends teams after thousands of 'criticals' nobody will ever exploit. The answer weighs whether exploitation is happening, whether the asset is reachable, and what it would cost you.

A hunt is a testable hypothesis about an attacker your detections missed. Without one, it is just browsing logs. The output that justifies it is usually a new detection, not a captured attacker.

Hash lookups catch yesterday's file. A good rule targets what the family cannot easily change, and gets tested against a corpus of clean files before anyone trusts it.

A logging pipeline is a distributed system with a threat model: attackers want it blind, analysts want it fast, finance wants it cheap. The staff answer designs for all three and for the day the queue backs up.

The first half is a Counter. The follow-up, an infinite stream and a memory cap, is the actual question: interviewers want a heavy-hitters algorithm and an honest statement of what it guarantees.

The review is where an incident pays for itself, or gets wasted. Interviewers want a factual timeline, contributing factors rather than a culprit, and actions with owners that someone checks.

Malware is just software that does what its operator wants on your machine. Every stage leaves evidence, and every stage has a control that can stop it.

Getting in once is not enough for an attacker. Persistence is where they must leave a mark on the system, which makes it one of the best places to catch them.

Crypto miners steal your compute. LLMjackers steal your model quota and resell it, and the first alert is often the bill.

The Arup case cost about US$25 million because everyone on the call looked and sounded right. The control that works does not involve spotting the fake at all.

Deciding what to fix is half the job. The other half is getting a fix onto 20,000 machines without breaking them, and proving it landed. Few candidates can describe that half.

The patch is the easy part. The hard parts are finding every copy, deciding what to do where you cannot patch tonight, and checking whether someone used it before you knew.

A credential that nobody legitimate ever uses produces an alert with almost no false positives. The craft is in placing it where an intruder looks and making sure it grants nothing.

Importing hashes and IP addresses from a report feels productive and changes almost nothing. The answer climbs from indicators to behaviours and ends with a test that proves the change.

EDR sees so much because it runs with so much privilege. On 19 July 2024 that privilege turned one bad content file into millions of crashed Windows machines. The answer covers both halves.

Having backups is not the control; having backups an attacker with admin rights cannot delete, and restoring from them on schedule, is. The scored answer designs for both.

Infostealers turned stolen passwords and cookies into a commodity with sellers, buyers and price lists. The scored answer follows the supply chain and cuts it at the points you control.

Headlines promised self-writing AI malware. The reports show something narrower and more useful to defenders: malware with a dependency on someone else's API. The scored answer separates hype from evidence and turns that dependency into detections.

A knowledge check with two traps: two editions are in circulation with different numbers, and reciting names earns little. Grouping the ten into entries and impacts, and applying them to a system, earns the rest.

Knowing the acronym is the easy part. Mapping a real attack chain onto tactics, and saying what that mapping is useful for, is what gets scored.

The LLM list has one item for agency. The agentic list spends ten on it. The answer that scores explains why, and which new risks only exist once agents act, remember and talk to each other.

A framework question that rewards structure. The scored answer gives the axes NIST uses, places familiar attacks on them, and shows how a shared vocabulary changes real work.

Same product, two different adversaries and two different teams. The scored answer separates them by what the attacker gets, and shows where they meet.

A framework is only useful if it changes decisions. The scored answer maps the product onto SAIF's components, picks the risks that apply, and assigns controls to whoever can actually implement them.

AI security did not start with LLMs. The scored answer explains how these classifiers learn, the adversarial dynamics they have lived with for decades, and the lessons that carry over.

A motivation question that is really a skills question. The scored answer gives a specific reason, maps existing skills to AI security work honestly, and shows what you have already done to close the gaps.

Product security's favourite AI question, because the answer is mostly classic AppSec. The scored part is matching each sink to its control and preferring structured data over generated code.

The question catches candidates who think exfiltration needs a tool. The answer that scores starts with the browser and ends with deterministic controls in the client.

A design round in miniature. The answer that scores follows the data through both halves of the pipeline and spends most of its time on authorization, where real leaks happen.

Similarity search has no idea who is asking. The answer that scores makes the index enforce the source system's rules, at query time and over time.

Breadth first, then priority. The answer that scores follows one sensitive value through every copy the system makes and fixes the two that leak most.

Poisoning a knowledge base is cheaper than poisoning a model. The answer that scores starts from who can write to the corpus and limits what a poisoned chunk can achieve.

Both, plus the layer most people forget: the action boundary. The scored skill is placing each check where it sees the right thing and labelling which ones are boundaries.

The tempting answer is that embeddings are one-way hashes. They are not. The answer that scores explains inversion and protects the index like the documents.

There is no single answer, and saying so is the start. The scored answer decides per check from what its failure would let through, and designs the latency budget so the choice is rarely forced.

A guardrail that blocks everything scores perfectly on attacks. The scored answer measures both errors, tests with attacks the guardrail has not seen, and reports with intervals at the operating threshold.

Caches are shared state, and shared state crosses tenants. The scored answer separates response caches from prompt prefix caches and keys each so one user can never read or detect another's data.

When people act on wrong output, the harm is real even though nothing was hacked. The scored answer names the concrete failures and designs the product so verification is easy and required where it matters.

The connector copies documents out of a system that enforces permissions into one that must re-create them. The scored answer treats permission fidelity and freshness as the core problem.

The service receives customers' source code all day. The scored answer protects that code across tenants, keeps secrets out of prompts and logs, and treats suggestions as untrusted output.

Regulated data turns every copy the AI pipeline makes into an audit question. The scored answer keeps the regulated data out of the model where possible and brings each remaining copy under the regime.

Most bad retrieval is a quality bug; some of it is an attack or an access failure. The scored answer separates the cases quickly and checks the security ones first.

An integrity investigation with three suspects: the sources, the index and the model. The scored answer uses versions and provenance to tell them apart quickly.

A trust and safety design question. The scored answer connects policy, detection, review, enforcement and appeals into one loop, and sizes it to the volume and the harm.

The assistant becomes a new client of every API the product has, with a confused-deputy problem built in. The scored answer finds the new trust boundaries and keeps the old access model intact.

Rendering is an outbound channel. The scored answer removes images, rewrites unapproved links, strips raw HTML, and only releases streamed text once it can no longer turn into something dangerous.

Similarity scores, result counts, snippets and ranking all say something about what is in the index. If authorization is applied after search, the search itself is the leak.

The most similar chunk is often the one written to be retrieved. The answer adds provenance to every chunk, ranks with it outside the model, and refuses to let text declare its own authority.

Research has shown a handful of planted documents can steer targeted answers. The defence is not a detector that recognises poison; it is control over who can write, staged promotion, and a risk estimate that multiplies the stages.

The regulator does not care which classifier you used. The design that scores puts authorisation and commitments in code, uses classifiers where they are good, and decides in advance what happens when a streamed answer goes wrong halfway.

Requests per minute is the wrong unit when one request can cost ten thousand tokens. The interview checks the bucket arithmetic, the unknown output length, and what happens when two gateway nodes share one budget.

Refusals stop single requests; disruption stops operators. The scored answer explains how providers find the actor behind thousands of innocent-looking requests, what they do about it, and how to read their reports critically.

One agent is a design review. Four hundred agents is an operations problem: who owns each, what it can touch, how much it can spend, and how you stop one, a class or all of them in minutes.

A gateway is the one place every tool call passes, which makes it the natural home for policy. It is also blind to everything that does not pass through it, and that is the half of the answer most candidates skip.

Design-time controls decide what an agent may do. Runtime protection watches what it actually does, at four different layers, and each layer catches something the others miss.

A2A standardises how agents find and talk to each other. It does not decide who to trust, what to share or what to believe, and those three decisions are the answer.

Giving an agent a card number is the wrong design. The scored answer separates consent, spending limits and agent identity, and shows how 2025-26 protocols handle each.

A skill is instructions plus code that runs with the agent's own permissions, with no process boundary in between. The scored answer reviews it like software and like a prompt, because it is both.

One attacks the model's inputs, the other its upbringing. The phase decides the defence, and interviewers want you to say so.

The attacker never sees the dataset. They see how much more confident the model is about one record than it should be.

The API is the attack surface and every response is a training example. Prevention is unrealistic; slowing, limiting and noticing are not.

Detection alone loses: clean-label poisons look correct. The answer that scores builds a pipeline where poison is hard to add, easy to trace and contained when it slips through.

Every model makes mistakes. An adversarial example is a mistake someone chose for it, and that changes how you measure and defend.

Language models are trained to predict text, and sometimes the best prediction is the exact text they saw. Rare, repeated and sensitive strings are the risk.

The guarantee is about what an observer can learn from your presence in the data, not about hiding the data. Epsilon bounds it; delta is the small print.

The model passes your evaluation because your evaluation does not contain the trigger. And safety training may teach it to hide better.

A label is one bit of information per query. A probability vector is a map of the decision boundary, delivered on request.

Drift is the world changing. An attack is someone changing it on purpose. The evidence that separates them is where and how the errors cluster.

The two attacks every robustness paper starts from. The scored answer explains the gradient step, the budget as a threat model, and why the iterative attack is the standard for evaluation.

The one defence that has held up in research, at a price. The scored answer explains the min-max objective and names the costs: accuracy, compute, and robustness only to the threat model trained on.

A defence that breaks the attacker's tools is not a defence that stops the attacker. The scored answer explains how masking fools gradient attacks, how to spot it, and how adaptive attacks get around it.

Most broken defences were evaluated by their authors. The scored answer pins down the threat model, attacks the defence specifically, runs sanity checks, and reports robust accuracy with the conditions attached.

Hiding scores slows attackers down; it does not stop them. The scored answer explains decision-based search and transfer, and turns query patterns into a detection opportunity.

Fraudsters are the original adaptive adversaries. The scored answer attacks with realistic, feasible changes, probes the whole decision system rather than the model alone, and measures dollars, not just accuracy.

Every poisoned example looks correctly labelled to a reviewer. The scored answer explains the mechanism, why label audits miss it, and the defences that work at the pipeline level.

The intuition that a huge dataset dilutes poison turns out to be wrong for some attacks. The scored answer cites the evidence, explains why, and moves the defence to data provenance and testing.

Three attacks that all start with queries and end with something the owner did not intend to share. The scored answer separates them by what is stolen and maps each to its defence.

Removing names removes the obvious identifier and leaves the rest. The scored answer explains re-identification, why models amplify it, and what actually bounds the risk.

DP gives a real guarantee with a real cost. The scored answer explains clipping, noise and accounting, then compares DP with cheaper controls for a concrete dataset.

The leak is in the weights, so the playbook differs from a database breach. The scored answer confirms, contains at the output, scopes from data lineage, and decides between filtering, retraining and withdrawal.

A watermark is evidence of origin under conditions, not a detector of all AI text. The scored answer explains how it works, how it fails, and what claims it can support.

A research-depth question. The scored answer explains why 'was this in training' blurs at web scale, why many published attacks measured distribution shift instead, and what questions remain answerable.

Two security goals that pull against each other. The scored answer explains the mechanism, the evidence, and how to make the trade-off explicit in a design.

'Clean the dataset' is not an investigation. The answer freezes evidence, traces what changed and who could change it, tests causality by retraining, and treats the pipeline as possibly compromised too.

An attacker who cannot see your model can attack one they can see, and much of the damage carries over. That single property turns 'the weights are secret' into a weak defence.

Two different attacks hide in 'malicious images'. One writes instructions a model can read; the other optimises pixels to push the model's internal representation. They need different tests and different defences.

Generic leakage benchmarks will not tell you whether your customers' records got easier to extract. Planted canaries, matched controls and an attack-economics view of severity will.

Evasion testing is a search problem with a budget. Start from real harmful content, transform it while keeping its meaning, adapt to what gets through, and report false negatives and false positives by category.

Breaking a model means different things to different attackers. What they can touch (training data, the API, the weights) decides what they can do.

'73 percent on expert CTFs' sounds precise. A strong answer explains the task design, the attempt budget, the missing defenders and the confidence interval that sit behind a number like that.

A framework, a certifiable standard and a law. They overlap heavily and substitute for each other not at all.

Tiers are decided by use, not by model. And for high-risk providers, Article 15 makes AI security a legal requirement.

Naming Govern, Map, Measure and Manage takes five seconds. Saying what each one produces in your organisation is the answer.

Yes, it is certifiable, and it is built to sit next to 27001. The follow-up is what a certificate does not prove.

Two layers: documentation, copyright and transparency for every GPAI model provider, then evaluation, incident reporting and cybersecurity once a model crosses into systemic risk.

A policy that says 'AI systems shall be secure' changes nothing. A release gate that blocks deployment until the red-team regression suite passes changes everything.

The core RMF is generic; the profile makes it specific to generative AI. The scored answer names the twelve risks, shows how they map onto the four functions, and picks the ones a security team owns.

Most model cards describe the model's best day. The scored answer adds what a reviewer needs: intended use, limits, evaluations with conditions, data provenance and security-relevant behaviour.

Three GDPR questions that shape every AI system handling EU personal data. The scored answer gets the legal structure right and turns each into engineering work.

A policy saying humans review decisions proves nothing. The scored answer specifies the logs, metrics and tests that show reviewers can and do change outcomes.

When everyone owns AI risk, nobody does. The scored answer puts one accountable owner on each decision and makes the specialist teams responsible for the work they are best at.

The obligations most consumer AI products meet first. The scored answer separates provider and deployer duties, gives the dates, and turns each into a product requirement.

Regulatory reporting has to plug into ordinary incident response. The scored answer knows who reports what to whom and by when, and is honest about the open question on timing.

Seven characteristics that frame most AI governance conversations. The scored answer names them precisely and shows how security supports, and trades off against, the others.

Fairness has several incompatible definitions, so the audit starts with a decision, not a metric. The scored answer picks measures for the context, gets the data to compute them, and audits the whole decision process.

The same model in a different context carries different obligations and harms. The scored answer names what each sector adds on top of baseline AI security.

Regulation does not tell you how to red-team, but it decides what you must be able to show. The scored answer maps programme outputs to the evidence each framework expects.

Slides on prompt injection change little. The scored answer teaches through the developers' own code, gives them paved roads, and measures behaviour change.

The one governance answer that goes stale. The scored answer gives the timeline as amended in 2026, the fine tiers, and a process for tracking changes rather than memorised certainty.

Three frameworks, three different questions: what can go wrong in what we build, how attackers actually operate, and how the organisation manages the risk. Using one for another's job is the common mistake.

'Prompt injection' is a technique, not a risk entry. Entries that get funded describe a scenario, an asset, a consequence in business terms, an owner and a measurable treatment.

A central committee reviewing every AI feature either blocks the company or gets bypassed. The model that works centralises standards and platforms, tiers by risk, and gives teams paved roads they want to use.

There is no single 'AI incident' notification rule. The incident is usually a personal-data, contractual or sector incident that happens to involve AI, and the clock may already be running.

A composite safety score asks the reader to trust you. An assurance case states specific claims, shows the argument and evidence for each, and lists what would make it false.

Security asks who can steal the data. Privacy also asks what the agent itself collects, infers, remembers and passes on, about the user and about everyone in their inbox who never agreed to anything.

Frontier labs promise to add safeguards when models cross capability thresholds. A large share of those safeguards are security controls, and someone has to build and prove them.

Mythos-class models and Gemini's Flash Cyber variants did not ship to everyone. Knowing why, and what joining a vetted-access programme commits you to, is now a governance interview staple.

Signed provenance and invisible watermarks are often lumped together as 'AI detection'. They prove different things and fail in different ways, which is the whole answer.

There is no single US AI law, and the state laws keep changing. The scored answer knows which ones are in force, which were replaced, and which security obligations they actually create.

Frameworks for AI risk are plentiful; baselines that say what security controls an AI system needs are newer. The scored answer knows what each one is, how binding it is, and how to turn it into a control set.

A leadership question. The scored answer finds out what exists, fixes the highest-impact exposures, and builds the few shared controls that make every later project cheaper.

The tools are free; running them is not. A strong answer picks a small set by risk, assigns owners, and treats every security tool as software that can be compromised or relicensed.

Flat networks turn one infected laptop into a company-wide incident. The scored answer draws zones from what talks to what, and shows how identity-based policy replaces IP lists as the network grows.

Inspection is a man in the middle the organisation chose. Interviewers want the mechanism, then a clear view of the new single point of failure it creates and the traffic it must never touch.

You cannot read the payload, but you can see who talked to whom, when, how much and how often. That metadata catches beaconing, exfiltration and lateral movement, if you know what normal looks like.

IPsec is two protocols that candidates blur together: IKE, which authenticates peers and agrees keys, and ESP, which protects every packet afterwards. Keep them apart and the rest follows.

The whole IPv4 internet is scanned many times a day. If a service answers, assume someone has already catalogued it.

Use external discovery as an ownership hypothesis. Bound testing, establish data and identity relationships, and decide which trust connections can safely be introduced.