Salesforce AI Security Engineer interview questions

The order lookup is the whole interview. Candidates who spend ten minutes on jailbreaks and two on authorization have it backwards.

STRIDE assumes components follow their code. A model follows its inputs. The scored answer keeps the six categories and adds what probabilistic, persuadable components need.

Privacy principles become engineering decisions about fields, retention and contracts. The scored answer walks one feature and makes each principle concrete.

Reviews fail when they arrive late, cover everything equally and produce vague findings. The scored answer scopes early, focuses on the riskiest decisions and writes findings as specific, owned changes.

Interviewers want a security engineer who can say no without becoming the department of no. The scored answer shows evidence, an alternative that met the goal, and a working relationship afterwards.

Severity disputes are usually disagreements about facts or assumptions. The scored answer finds which, settles it with evidence and the agreed scale, and has an escalation path that does not damage trust.

AI features need the usual secure development steps plus a few that most lifecycles lack. The scored answer places each activity at the stage where it is cheapest and names the gate.

A leadership question. The scored answer finds out what exists, fixes the highest-impact exposures, and builds the few shared controls that make every later project cheaper.

Good metrics change decisions. The scored answer picks a few in coverage, risk, outcomes and speed, defines each precisely, and explains what action each one triggers.

Security engineers rarely have authority over the teams whose code matters most. The scored answer makes the secure path the easy one, earns trust through help, and gives teams ownership.

All three face the same impossible brief: let the user's device use a secret without letting the user have it. The good designs change the brief instead of pretending to meet it.

mTLS authenticates both ends, but only as well as your private CA and identity scheme. The scored answer designs issuance, identity, rotation and authorisation, and contrasts it with the public web.

Any trusted CA can issue a certificate for your domain. The scored answer explains how public logs make that visible and how to turn the logs into an alert.

Revocation asks every client to check a third party on every connection, and most clients quietly do not. The scored answer explains each mechanism's failure mode and why the industry is moving to short lifetimes.

A classic that tests whether you know how hash functions work inside. The scored answer explains length extension, the nested HMAC construction, and how to verify a MAC safely.

Encryption hides content, not length. The scored answer shows how compression turns length into a leak when secrets and attacker text share a message, and where that bites today.

Most cryptographic failures are misuse of good primitives, not broken algorithms. The scored answer has a checklist that catches the common ones and a strong default to replace them.

Using one key for several purposes quietly couples their security. The scored answer explains extract and expand, shows key separation by context, and says when HKDF is the wrong tool.

TLS protects bytes on the wire between two endpoints. The scored answer lists what lies outside that boundary, so nobody mistakes 'we use HTTPS' for a security design.

Drawing the arrows is half the answer. The other half is pinning an attack to every parameter: state, redirect URI, code, verifier, audience.

Every candidate knows OIDC is 'OAuth plus identity'. Fewer can say which token goes where, and what breaks when they swap.

Documents are shared with people, folders, teams and links. Roles alone collapse under that, and the interviewer wants to see you notice when.

A valid token is not valid everywhere. The scored answer explains audience binding, why forwarding a caller's token downstream breaks it, and what MCP's authorisation rules require instead.

Most OAuth breaches come from a few well-known mistakes. The scored answer explains each attack and the specific rule that stops it, as consolidated in the 2025 OAuth security best current practice.

Two enterprise workhorses with very different designs. The scored answer explains each flow, where the trust lives, and the attacks that follow from it.

A bearer token works for whoever holds it. The scored answer explains how binding a token to a key changes that, the two standard ways to do it, and the cost.

An MCP server is an API that a model drives. The scored answer treats it as an OAuth resource server, authorises every tool call against the user, and keeps upstream credentials out of the client's hands.

Scattered permission checks drift apart until one is wrong. The scored answer weighs a central decision service against latency, availability and consistency, and keeps enforcement close to the data.

The attacker never needs the password: the victim grants their app access. The scored answer explains why MFA does not help, then controls consent at the tenant and watches the grants.

A confirmation click proves someone was present; step-up proves it was the user, recently. The scored answer decides which actions need it and wires it through tokens so the agent cannot fake it.

Stolen session tokens skip MFA entirely, which is why infostealers sell them. The scored answer looks for the same session appearing in two places, binds what it can, and makes revocation fast.

API keys identify a caller; OAuth delegates a user's authority. The scored answer picks by who is acting and on whose behalf, and makes API keys as safe as they can be when used.

Validate tenant selection, enforce resource permissions, and test the boundaries that signed context and row-level security do not cover automatically. Follow one request through retrieval, caches and a queued job.

Trace a withdrawn grant through cached decisions, exchanged tokens and queued work. Define when new actions are denied and account for effects already dispatched.

The signature verifies, and the application reads a different element than the one that was signed. Most SAML bugs are some version of that sentence.

Each token verifies against some trusted key. The bug is that the key belonged to a different issuer than the one the token claims, or the user ID means something different there.

The user never types anything an attacker could replay, and the browser, not the user, decides which site is asking. Those two facts are the whole phishing story; the ceremony is how they are enforced.

The victim types a code on the real Microsoft sign-in page, passes MFA, and hands the attacker their tokens. The scored answer explains why nothing looks wrong and which policy actually stops it.

Nobody broke into the CRM. An integration that customers had approved years ago simply asked for the data, with valid tokens. The scored answer treats third-party grants as identities you own.

A strict CSP blocks many XSS payloads but not all, and DOM XSS has paths it cannot see. The scored answer explains what a nonce-based policy stops, where it fails, and why Trusted Types targets the DOM sinks.

Work through tenant, role, object and field checks, then extend the review to bulk exports, permission changes and resource budgets with executable acceptance cases.

Verify the sender protocol, persist recoverable intake, distinguish delivery retries from business effects, and work through two offline fixtures and crash boundaries.

Two injection classes where a parser or template engine does far more than the developer intended. The scored answer explains the dangerous feature in each and turns it off.

Model a bounded reservation workflow, run an offline invariant fixture, and reason about retries, contention, immutable intent and uncertain external outcomes.

The commonest serious bug in AI tools is the oldest: fetching an object by ID without checking who is asking. The scored answer finds it, fixes it at the data access, and tests across users and tenants.

Two servers disagree about where one request ends and the next begins. The scored answer explains the ambiguity, what an attacker gains, and why consistent parsing and HTTP/2 end to end fix it.

URL validation is where string checks fail most visibly. The scored answer parses, resolves and allowlists, then tests the classic bypasses.

Every attribute answers one question: over which connections, to which scripts, from which sites and to which hosts does this cookie travel? Get those four right and most session theft paths close.

Logging in is one moment; a session lasts hours or months. Most session bugs live in what happens between: identifiers that never change, timeouts nobody enforces, and logouts that only clear the browser.

The user clicks a button on your page while believing they are on someone else's. The fix is a response header that tells the browser who may frame you, not script that tries to escape the frame.

No error messages does not mean no injection. And the sort column is the one place where 'just use parameters' does not work, so you need a different fix.

An ORM parameterises the queries it builds. It cannot protect the queries you build around it, or the data you trusted because it came from your own database.

No SQL does not mean no injection. When a query is a JSON object, the attack is sending an object where the code expected a string.

CORS never blocks a request from being sent. It decides whether another site's script may read the answer, and with credentials allowed, that answer contains the logged-in user's data.

Every check passed and every write succeeded. The money still left twice, because the check and the write were two steps and another request got between them.

CSRF defences stop other sites from acting as the user. XSS is not another site: it is code running inside yours, with everything your own pages can do.

The same injection bug can leak one table or hand over the server. The difference is decided by grants made long before the bug was written.

Both platforms let an app declare its transport rules in a file the reviewer can read in seconds. Knowing which lines are dangerous makes you fast in a mobile review.

A key the app cannot export is only half the story. The other half is making the key usable only after the user is really present, which a hooked 'authentication succeeded' callback can fake.

On a phone, the signing key is the app's identity: it decides who can ship updates, which data the app can share, and what it is entitled to do. Lose it, or let someone else sign, and that identity changes hands.

An AI system's behaviour lives in more places than its code. The scored answer versions every one of them together, so you can return to a known-good state in minutes after a bad change or a poisoning.

You cannot protect data you have not found, and you cannot find it once it has been copied into ten places. The toolchain answer follows data from discovery to the AI index.

Promotion to production is a deployment decision dressed as a metadata change. The scored answer gives it change control, binds it to evidence, and makes swaps detectable.

An MCP server is code you run or trust, plus text your model reads. The scored answer reviews who wrote it, what it can reach, what its tool descriptions say, and pins it so it cannot change silently.

A vendor breach becomes yours through the access you gave them. The scored answer inventories that access, rotates and revokes it, looks for misuse, and works out what data was exposed.

A model update can quietly undo controls you rely on. The scored answer runs a fixed security suite with thresholds agreed in advance, checks the artefact too, and decides what blocks a release.

A framework is only useful if it changes decisions. The scored answer maps the product onto SAIF's components, picks the risks that apply, and assigns controls to whoever can actually implement them.

Breadth first, then priority. The answer that scores follows one sensitive value through every copy the system makes and fixes the two that leak most.

An incident question disguised as debugging. The answer that scores treats it as a possible breach, preserves evidence, and checks the four usual causes in order of likelihood.

LLM observability quietly becomes the largest copy of customer data in the company. The scored answer minimises what is captured, separates what must be kept, and treats trace stores as production data.

There is no single answer, and saying so is the start. The scored answer decides per check from what its failure would let through, and designs the latency budget so the choice is rarely forced.

Fine-tuning moves data from a database you can query and delete into weights you cannot. The scored answer covers memorisation, tenant separation, poisoning and the deletion problem.

When people act on wrong output, the harm is real even though nothing was hacked. The scored answer names the concrete failures and designs the product so verification is easy and required where it matters.

The connector copies documents out of a system that enforces permissions into one that must re-create them. The scored answer treats permission fidelity and freshness as the core problem.

A gateway turns dozens of ad hoc model integrations into one place to enforce and observe. The scored answer chooses what belongs centrally and what must stay in each application.

Banning tools people find useful mostly moves the leak somewhere you cannot see. The scored answer offers an approved route, then adds policy, technical controls and visibility around it.

Regulated data turns every copy the AI pipeline makes into an audit question. The scored answer keeps the regulated data out of the model where possible and brings each remaining copy under the regime.

Most bad retrieval is a quality bug; some of it is an attack or an access failure. The scored answer separates the cases quickly and checks the security ones first.

An integrity investigation with three suspects: the sources, the index and the model. The scored answer uses versions and provenance to tell them apart quickly.

The assistant becomes a new client of every API the product has, with a confused-deputy problem built in. The scored answer finds the new trust boundaries and keeps the old access model intact.

Rendering is an outbound channel. The scored answer removes images, rewrites unapproved links, strips raw HTML, and only releases streamed text once it can no longer turn into something dangerous.

The regulator does not care which classifier you used. The design that scores puts authorisation and commitments in code, uses classifiers where they are good, and decides in advance what happens when a streamed answer goes wrong halfway.

One agent is a design review. Four hundred agents is an operations problem: who owns each, what it can touch, how much it can spend, and how you stop one, a class or all of them in minutes.

A2A standardises how agents find and talk to each other. It does not decide who to trust, what to share or what to believe, and those three decisions are the answer.

A label is one bit of information per query. A probability vector is a map of the decision boundary, delivered on request.

Fraudsters are the original adaptive adversaries. The scored answer attacks with realistic, feasible changes, probes the whole decision system rather than the model alone, and measures dollars, not just accuracy.

A framework, a certifiable standard and a law. They overlap heavily and substitute for each other not at all.

Tiers are decided by use, not by model. And for high-risk providers, Article 15 makes AI security a legal requirement.

You cannot govern what you have not listed. The register is the list; the routing is what makes it worth keeping.

Yes, it is certifiable, and it is built to sit next to 27001. The follow-up is what a certificate does not prove.

Location of the office is not the test. Where the system is placed, used, or where its output is used, is.

The core RMF is generic; the profile makes it specific to generative AI. The scored answer names the twelve risks, shows how they map onto the four functions, and picks the ones a security team owns.

Most model cards describe the model's best day. The scored answer adds what a reviewer needs: intended use, limits, evaluations with conditions, data provenance and security-relevant behaviour.

Three GDPR questions that shape every AI system handling EU personal data. The scored answer gets the legal structure right and turns each into engineering work.

A policy saying humans review decisions proves nothing. The scored answer specifies the logs, metrics and tests that show reviewers can and do change outcomes.

When everyone owns AI risk, nobody does. The scored answer puts one accountable owner on each decision and makes the specialist teams responsible for the work they are best at.

AI vendors add questions a standard security questionnaire never asked. The scored answer covers training use, retention, subprocessors, model changes and incident terms, and verifies rather than trusts.

The obligations most consumer AI products meet first. The scored answer separates provider and deployer duties, gives the dates, and turns each into a product requirement.

Regulatory reporting has to plug into ordinary incident response. The scored answer knows who reports what to whom and by when, and is honest about the open question on timing.

Six months is possible for a well-run organisation with a narrow scope. The scored answer sets the scope first, reuses an existing management system, and schedules the audits backwards from the date.

Seven characteristics that frame most AI governance conversations. The scored answer names them precisely and shows how security supports, and trades off against, the others.

Fairness has several incompatible definitions, so the audit starts with a decision, not a metric. The scored answer picks measures for the context, gets the data to compute them, and audits the whole decision process.

Slides on prompt injection change little. The scored answer teaches through the developers' own code, gives them paved roads, and measures behaviour change.

The one governance answer that goes stale. The scored answer gives the timeline as amended in 2026, the fine tiers, and a process for tracking changes rather than memorised certainty.

'Prompt injection' is a technique, not a risk entry. Entries that get funded describe a scenario, an asset, a consequence in business terms, an owner and a measurable treatment.

A central committee reviewing every AI feature either blocks the company or gets bypassed. The model that works centralises standards and platforms, tiers by risk, and gives teams paved roads they want to use.

There is no single 'AI incident' notification rule. The incident is usually a personal-data, contractual or sector incident that happens to involve AI, and the clock may already be running.

Three bugs, one cause. The answer that scores names the cause, explains why parameters are structural, and lands on why prompts have no parameters.

'Sanitise input' is the answer that fails. The interviewer wants encoding at the point of output, for the specific context, with CSP behind it.

A browsing tool is a URL fetcher whose destination is chosen by text anyone can write. The interviewer wants the defences in the tool and the network, not the prompt.

Reading files top to bottom finds style issues. A security review starts from sources, sinks and the checks between them, and AI code adds a new source.

The model is not the attacker, but whoever wrote the document it just read might be. Every argument in a tool call is untrusted input.

Scanners rarely find it, because every request looks valid. Finding it at scale is a testing design problem, not a scanning problem.

Three browser rules that candidates mix up constantly. The JWT follow-up exposes whether you know which one depends on cookies.

The format is the bug. JSON cannot call functions; pickle is designed to. The AI version is the model checkpoint you just downloaded.