Wiz AI Security Engineer interview questions

Attackers are not wizards; they repeat a small number of moves because those moves keep working. The answer names the moves and the choke points where one control breaks many intrusions.

The username tells you almost nothing. The interviewer wants the list of privilege transitions reachable from that process, and which of them you would have closed in advance.

Capabilities split root into pieces, but some pieces are nearly the whole thing. A strong answer knows the sets, the dangerous capabilities, and why 'drop all, add one' is the only defensible default.

Everyone knows MAC is 'stricter'. The scored part is why a compromised root process can still be confined, how labels differ from paths, and what you do when the policy blocks production at 2am.

A checklist recital scores 'weak'. The strong answer orders controls by the attacker they stop, treats the baseline as code, and explains how you would notice when someone drifts from it.

A seccomp filter decides on a system call number and six integers. It cannot read the file path a pointer refers to, and that one limitation shapes every good policy.

Attackers scan the whole internet continuously and know your forgotten test server before you do. The answer is an inventory built from several sources, compared with what is actually listening.

The whole IPv4 internet is scanned many times a day. If a service answers, assume someone has already catalogued it.

Nobody attacks your DNS; they just claim the cloud resource your DNS still points at. The scored answer explains why it is so common and how to stop it at deprovisioning.

Escalation rarely needs an admin permission, just a permission that leads to one. The scored answer names the common paths, finds them as a graph, and removes the edges that matter.

Machine identities outnumber people in most organisations and are reviewed far less. The scored answer finds them, gives each an owner, shrinks their power and lifetime, and watches how they are used.

Deleting the commit feels like fixing the leak. It isn't: the secret was public the moment it was pushed, and only revoking it ends the exposure.

Nobody broke into the CRM. An integration that customers had approved years ago simply asked for the data, with valid tokens. The scored answer treats third-party grants as identities you own.

The app works, the demo is great, and every row in the database is readable from the browser. The scored answer explains the architecture that makes this common and a one-hour review that catches it.

One link-local address hands out the machine's credentials to anything that can make a request from it. That includes a fooled agent with a fetch tool.

Many ML tools assume they run on a trusted network and offer 'run this code' as a feature. Put them on the internet and that feature is remote code execution.

Most cloud breaches start with a setting, not an exploit. The scored answer moves those settings into reviewed code, checks them before deployment, and catches the drift that happens anyway.

Cloud attackers mostly use the same APIs your engineers do. The scored answer collects the right logs, writes detections for attacker behaviour, and keeps the logs out of the attacker's reach.

Everything in Kubernetes goes through the API server, so most attacks are about who can talk to it and with what rights. The rest is what a pod can do to its node and to its neighbours.

Most escapes are not clever kernel exploits. They are configuration that handed the container the host: a privileged flag, a mounted socket, a host path or a shared namespace.

Inference servers are built to run on a trusted machine, so most have no authentication and some trust their own network completely. Internet scans keep finding them anyway.

Snapshot a disk, read it somewhere else, delete the snapshot. That trick built a product category. Interviewers ask how it works, what permissions it needs, and what it cannot see.

Four open-source tools, four different questions: what happened, what is the state now, is this behaviour forbidden, and can the kernel stop it. Choosing well starts with knowing which question each answers.

IAM decides what a role may do; organisation guardrails decide what no role in an account may ever do. The scored answer explains the evaluation, the blind spots and a first set worth deploying.

RBAC decides who may create a pod; admission decides what kind of pod may exist. The scored answer layers the built-in options, handles webhook failure modes and remembers that the admission path is itself attack surface.

The miner is the symptom. The incident is how it got there and what else the attacker could reach. Interviewers watch whether you stop at killing the process or follow the entry point and the credentials.

Sorting by CVSS score sends teams after thousands of 'criticals' nobody will ever exploit. The answer weighs whether exploitation is happening, whether the asset is reachable, and what it would cost you.

Crypto miners steal your compute. LLMjackers steal your model quota and resell it, and the first alert is often the bill.

A skill is instructions plus code that runs with the agent's own permissions, with no process boundary in between. The scored answer reviews it like software and like a prompt, because it is both.

The question is really 'what does hostile code have to break to reach the host?' Answer that for each option and the choice follows.

The provider secures the model service. Everything you put into it, connect to it and build on top of it is still yours.

Every layer parses something an attacker wrote, every request costs real money, and tenants share hardware. Walk the path and price each risk.

Assume the code is hostile and design until that stops mattering. Then the interviewer adds a GPU and the internet, and you design again.

One copy is a total loss. The design is about how few places weights exist, how few people can touch them, and whether a bulk copy can leave unnoticed.

Training clusters hold the data and the weights, and run code from hundreds of dependencies. Default-deny egress is the control that holds when everything else is fooled.

Training jobs need privileged-looking things: device access, big volumes, fast networking. Hardening is about granting exactly those and nothing else.

GPUs were built for throughput, not mutual distrust. Each sharing mode makes a different promise about memory, and some make none.