Palo Alto Networks Software, Data & Model Supply Chain interview questions

Half the answer is 'pickle runs code'. The half that scores is everything safetensors leaves open.

Models arrive like dependencies and run like code. The design puts one controlled door in front of them and checks everything that walks through.

Provenance is only worth anything at the moment someone refuses to deploy because it does not match. Say where that moment is.

Scanners are good at one thing: spotting code where only data should be. The scored answer explains how they work, how they are evaded, and why a clean scan is not a clean model.

Code that downloads a model by name trusts whoever owns that name today. The scored answer lists the ways that trust breaks and replaces names with pinned, mirrored, verified artefacts.

The mechanism takes a minute. The score comes from saying exactly what a valid signature does not prove, and running the key-theft response.

'Keyless' means no long-lived key, not no keys. The follow-up that separates candidates: what does your verification policy actually check?

An SBOM lists libraries. An AI-BOM has to answer a harder question: which base model and which data is this behaviour descended from?

Three ways a package you never meant to run ends up in your build. AI coding assistants added a fourth: the package that never existed until someone registered it.

A model is a directory, not a file. Sign the whole thing, tie the signature to the pipeline that produced it, and refuse to load anything that does not match.

The package ran with everything the training job could reach: data, credentials, checkpoints. Scope by what it could touch, not by what you hope it did.

The weights are safetensors and the code is a Python file from the same repository, fetched at load time. Guess which one runs with your credentials.

You can check the file and test the behaviour; you cannot prove a negative. The scored answer separates code-level threats from learned backdoors and is honest about what testing can find.

The pipeline holds the keys to production and runs code from pull requests. The scored answer separates untrusted from privileged work, pins what it executes, and removes long-lived secrets.

Promotion to production is a deployment decision dressed as a metadata change. The scored answer gives it change control, binds it to evidence, and makes swaps detectable.

Open weights arrive with code, configs, licences and unknown training. The scored answer turns due diligence into a repeatable gate that production enforces automatically.

Pinning a version is not pinning content. The scored answer verifies every file against a recorded hash, treats unexpected and missing files as failures, and explains where the lockfile's own trust comes from.

An MCP server is code you run or trust, plus text your model reads. The scored answer reviews who wrote it, what it can reach, what its tool descriptions say, and pins it so it cannot change silently.

Scraped data changes under you and anyone can write to the web. The scored answer snapshots and hashes what was collected, records where it came from, filters what it can, and keeps enough lineage to undo a mistake.

A vendor breach becomes yours through the access you gave them. The scored answer inventories that access, rotates and revokes it, looks for misuse, and works out what data was exposed.