Medium AI security interview questions

Candidates who say 'everything is new' and candidates who say 'nothing is new' both lose this one. The answer that scores names exactly three differences and keeps the rest of the toolkit.

The order lookup is the whole interview. Candidates who spend ten minutes on jailbreaks and two on authorization have it backwards.

Neither 'block it' nor 'ship it' scores. The interviewer is watching whether you can find the one risk that matters in a day and offer a path to launch.

Five minutes, no jargon, one decision. Candidates who explain how attention works have already lost the room.

A reset flow is a second login page with weaker checks. Interviewers use it because every step has a classic bug, and the strong answer finds them in order.

Two classic tools that structure attacker thinking. The scored answer uses each for what it is good at and names the blind spots before an interviewer does.

Detection quality is decided before the first alert, by what you logged and how you set the threshold. The scored answer derives both from the questions an investigator will ask.

Privacy principles become engineering decisions about fields, retention and contracts. The scored answer walks one feature and makes each principle concrete.

Reviews fail when they arrive late, cover everything equally and produce vague findings. The scored answer scopes early, focuses on the riskiest decisions and writes findings as specific, owned changes.

Every senior security engineer has one. The scored answer shows you reduced the risk, made the residual visible, got the right owner to accept it, and kept watching.

Interviewers want a security engineer who can say no without becoming the department of no. The scored answer shows evidence, an alternative that met the goal, and a working relationship afterwards.

Severity disputes are usually disagreements about facts or assumptions. The scored answer finds which, settles it with evidence and the agreed scale, and has an escalation path that does not damage trust.

AI features need the usual secure development steps plus a few that most lifecycles lack. The scored answer places each activity at the stage where it is cheapest and names the gate.

How you treat the first reporter decides whether there is a second. The scored answer acknowledges quickly, validates safely, fixes by severity, communicates honestly and handles AI-specific scope questions.

Leaked keys remain one of the commonest breach causes, and agents create new places to leak them. The scored answer prefers no secret at all, then short-lived ones, and keeps them out of every model context.

Good metrics change decisions. The scored answer picks a few in coverage, risk, outcomes and speed, defines each precisely, and explains what action each one triggers.

Security engineers rarely have authority over the teams whose code matters most. The scored answer makes the secure path the easy one, earns trust through help, and gives teams ownership.

Attackers are not wizards; they repeat a small number of moves because those moves keep working. The answer names the moves and the choke points where one control breaks many intrusions.

The tools are free; running them is not. A strong answer picks a small set by risk, assigns owners, and treats every security tool as software that can be compromised or relicensed.

The username tells you almost nothing. The interviewer wants the list of privilege transitions reachable from that process, and which of them you would have closed in advance.

Capabilities split root into pieces, but some pieces are nearly the whole thing. A strong answer knows the sets, the dangerous capabilities, and why 'drop all, add one' is the only defensible default.

Everyone knows MAC is 'stricter'. The scored part is why a compromised root process can still be confined, how labels differ from paths, and what you do when the policy blocks production at 2am.

A checklist recital scores 'weak'. The strong answer orders controls by the attacker they stop, treats the baseline as code, and explains how you would notice when someone drifts from it.

Programs rarely name the file they run or load; they search for it. Whoever can write earlier in the search order chooses the code. The answer covers both platforms and the one rule that fixes both.

Linux candidates often freeze here. The model is learnable in five nouns, and interviewers reward the one insight that matters: privileges in a token can matter more than group membership.

Reciting the acronyms is the easy part. The scored answer pairs each mitigation with the exploitation step it blocks and the precondition that defeats it, which is why they only work together.

Random input finds shallow bugs. Coverage feedback, sanitizers and a harness that reaches the parser are what make fuzzing find the deep ones. The interview checks all three, plus what happens after the crash.

Interviewers give an unfamiliar binary to see method, not stamina. Start from the question, find the code that touches the secret through imports and strings, confirm at runtime, and report what you proved and what you did not.

Secure Boot refuses to run unsigned code; measured boot records what did run; a TPM lets someone else check that record. Candidates who blur the three cannot reason about attestation at all.

EDR products, profilers, game cheats and banking trojans all use the same trick: make a call to function A run your code first. Knowing the mechanics tells you both how to detect it and why user-mode hooks are a weak place for security controls.

Most Mac compromises do not break these controls. They persuade the user to step around them, or borrow the permissions of an app that already has them.

sudo is a policy engine that runs as root and parses user input. Grant it carelessly and 'run this one command' becomes 'run anything'.

Typing a command sets off a chain: a system call, a permission check, a loader, dynamic linking and memory protections. Every step is a place security is enforced, and a place it can be bypassed.

Two things make Windows compromise spread: services that run with powerful identities, and a process that holds the credentials of everyone logged on.

Both tools read logs and ban addresses after the fact. Knowing what that design can and cannot see is the whole answer, and most candidates call it an authentication control.

Turning off passwords is the easy half. The interview is about the other half: how keys are issued, how long they live, how a host proves itself, and how you cut someone off at 5pm on a Friday.

The classic 'what happens when you type google.com' turned into a security question. Interviewers want the stack in order, with the attacker who sits at each layer and the control that removes them.

DNSSEC and DNS over HTTPS are often named in the same breath and protect entirely different things. The scored answer separates authenticity of the record from privacy of the query.

Users type a domain, not https://. That one habit gave attackers a plain-HTTP first request to hijack. HSTS closes it, and preloading closes it before the first visit, with a commitment you cannot easily undo.

Flat networks turn one infected laptop into a company-wide incident. The scored answer draws zones from what talks to what, and shows how identity-based policy replaces IP lists as the network grows.

Every TLS error is a specific check failing. Engineers who can name which check, from the chain the client actually saw, fix outages in minutes and never 'fix' them by turning validation off.

Inspection is a man in the middle the organisation chose. Interviewers want the mechanism, then a clear view of the new single point of failure it creates and the traffic it must never touch.

A VPN answers 'are you allowed on the network?'. Zero-trust access asks 'may this user, on this device, reach this application right now?'. The interview tests whether you can explain why the second question is safer.

SPF checks a server, DKIM checks a signature, and neither checks the From line the user reads. DMARC ties them to that line. Interviewers want the alignment idea, then the phishing that still gets through.

A shared password, a capture of one handshake and an offline dictionary is still how many Wi-Fi networks fall. The answer explains why, what SAE changed, and why enterprises use certificates instead.

A 2 Tbps flood and one expensive API call per second are both denial of service. The answer that scores matches each attack to the place where it can be stopped, and knows which ones only a provider can absorb.

You cannot read the payload, but you can see who talked to whom, when, how much and how often. That metadata catches beaconing, exfiltration and lateral movement, if you know what normal looks like.

NAT drops unsolicited inbound packets as a side effect of bookkeeping, not policy. Port forwards, UPnP, outbound connections and IPv6 all walk around it.

A firewall is a list of match conditions evaluated in order against fields it can see, plus a table that remembers connections. Almost every firewall failure is in one of those three words: order, fields, remember.

Put a proxy in front of an app and two new questions appear: who is the real client, and does the proxy read the request the same way the app does?

Local network protocols were designed for a building full of colleagues. Anyone plugged into the same segment can claim to be the router, and the protocols believe them.

WireGuard's configuration is a list of public keys and the IP ranges each may use. That small idea replaces most of what IPsec negotiates, and it is the part interviewers ask about.

Signing does not hide anything. It proves who sent a message and that nobody changed it, which is exactly what relay and tampering attacks need you not to check.

The packets are WireGuard; the interesting part is the coordination server that tells every device whose keys to accept. That server is what a strong answer threat-models.

The device that guards the network is itself a server on the internet, often unmonitored and rarely patched. Interviewers want to hear how you would treat it like one.

Blocking bad domains at the resolver is one of the cheapest controls there is, until the client stops asking your resolver. A strong answer covers both halves.

SASE is the firewall, proxy and access gateway moved into a provider's network so they sit in front of users wherever they are. The interview is about what each piece inspects, and what you hand the provider in exchange.

In a plant, availability and physical safety outrank confidentiality, and the controllers may be older than the security team. The scored answer adapts IT habits instead of copying them.

Short-range radio assumes that being close means being trusted. The scored answer explains pairing models, key negotiation bugs and why relays need distance measurement, not stronger encryption.

Most networks that say they do not run IPv6 run it anyway, unmanaged. The scored answer finds the three places that matters and decides deliberately.

Nobody attacks your DNS; they just claim the cloud resource your DNS still points at. The scored answer explains why it is so common and how to stop it at deprovisioning.

Sender authentication proves which domain sent a message, not that the message is safe. The scored answer walks the layers after it and where each one is blind.

Message names are table stakes. The interviewer is listening for why CertificateVerify exists and what Finished actually checks.

Checking the signature is one step of seven. The bugs that matter live in the other six, and in code that switches validation off.

Both detect tampering. The difference is who else could have made the tag, and that decides webhooks, tokens and audit evidence.

The question behind the question: if your server's private key leaks next year, what happens to the traffic someone recorded today?

Encryption without integrity has been exploited for decades. Nonce reuse under GCM is worse than most candidates think: it breaks integrity too.

Any trusted CA can issue a certificate for your domain. The scored answer explains how public logs make that visible and how to turn the logs into an alert.

A classic that tests whether you know how hash functions work inside. The scored answer explains length extension, the nested HMAC construction, and how to verify a MAC safely.

Encryption hides content, not length. The scored answer shows how compression turns length into a leak when secrets and attacker text share a message, and where that bites today.

Most cryptographic failures are misuse of good primitives, not broken algorithms. The scored answer has a checklist that catches the common ones and a strong default to replace them.

Cryptography assumes unpredictable numbers, and real systems have repeatedly failed to supply them. The scored answer gives the causes, the famous failures, and the rules that prevent repeats.

Using one key for several purposes quietly couples their security. The scored answer explains extract and expand, shows key separation by context, and says when HKDF is the wrong tool.

TLS protects bytes on the wire between two endpoints. The scored answer lists what lies outside that boundary, so nobody mistakes 'we use HTTPS' for a security design.

Most candidates can recite TLS 1.3. Interviewers ask for 1.2 because it is still everywhere, and because every change in 1.3 is the fix for an attack on 1.2.

A certificate is a signed statement with a short list of claims: this key, these names, these uses, this period, issued by this CA. Every validation failure you have seen is one of those claims not holding.

Domain-validated certificates prove one thing: whoever asked could answer a challenge on that domain at that moment. Every attack on issuance is a way to answer that challenge without owning the domain.

OpenSSL is two libraries and a command-line tool. Most TLS failures blamed on it are applications that never asked it to check the hostname, or told it to stop checking at all.

A certificate is a CA's signature over a structured statement about your key. Each step from key to padlock exists to stop one specific lie.

The root key is the one thing you can never easily replace, so it signs almost nothing. Everything about intermediates follows from that.

Drawing the arrows is half the answer. The other half is pinning an attack to every parameter: state, redirect URI, code, verifier, audience.

Every candidate knows OIDC is 'OAuth plus identity'. Fewer can say which token goes where, and what breaks when they swap.

'JWTs are stateless and scale' is half an answer. The other half is what happens the day you need to log someone out right now.

Documents are shared with people, folders, teams and links. Roles alone collapse under that, and the interviewer wants to see you notice when.

The token tells you which algorithm to use and where to find the key. Believing it is how signature checks become no checks.

A 1988 bug report that describes most agent incidents. The answer that scores turns it into a design rule: authority travels with the request.

Static API keys in environment variables are the most common credential leak there is. The answer is platform-issued, short-lived, attested identity.

Two enterprise workhorses with very different designs. The scored answer explains each flow, where the trust lives, and the attacks that follow from it.

Escalation rarely needs an admin permission, just a permission that leads to one. The scored answer names the common paths, finds them as a graph, and removes the edges that matter.

A bearer token works for whoever holds it. The scored answer explains how binding a token to a key changes that, the two standard ways to do it, and the cost.

Zero trust is a set of engineering decisions, not a product. The scored answer names them, shows how they replace network location as a trust signal, and admits where they are hard.

The attacker never needs the password: the victim grants their app access. The scored answer explains why MFA does not help, then controls consent at the tenant and watches the grants.

Deleting the commit feels like fixing the leak. It isn't: the secret was public the moment it was pushed, and only revoking it ends the exposure.

A user agent string is a claim anyone can type. A signature over the request is a claim only the key holder can make. The interesting part is what that signature still does not tell the site.

The victim types a code on the real Microsoft sign-in page, passes MFA, and hands the attacker their tokens. The scored answer explains why nothing looks wrong and which policy actually stops it.

Nobody broke into the CRM. An integration that customers had approved years ago simply asked for the data, with valid tokens. The scored answer treats third-party grants as identities you own.

A browsing tool is a URL fetcher whose destination is chosen by text anyone can write. The interviewer wants the defences in the tool and the network, not the prompt.

Reading files top to bottom finds style issues. A security review starts from sources, sinks and the checks between them, and AI code adds a new source.

The model is not the attacker, but whoever wrote the document it just read might be. Every argument in a tool call is untrusted input.

Scanners rarely find it, because every request looks valid. Finding it at scale is a testing design problem, not a scanning problem.

Three browser rules that candidates mix up constantly. The JWT follow-up exposes whether you know which one depends on cookies.

The format is the bug. JSON cannot call functions; pickle is designed to. The AI version is the model checkpoint you just downloaded.

File tools take paths from the model, and the model takes ideas from whatever it read. A string check for '..' is not confinement.

The model did not write malicious HTML on its own; a web page it summarised did. Then the conversation was shared, and the renderer trusted it.

A strict CSP blocks many XSS payloads but not all, and DOM XSS has paths it cannot see. The scored answer explains what a nonce-based policy stops, where it fails, and why Trusted Types targets the DOM sinks.

Work through tenant, role, object and field checks, then extend the review to bulk exports, permission changes and resource budgets with executable acceptance cases.

Verify the sender protocol, persist recoverable intake, distinguish delivery retries from business effects, and work through two offline fixtures and crash boundaries.

Two injection classes where a parser or template engine does far more than the developer intended. The scored answer explains the dangerous feature in each and turns it off.

Each tool sees the application from a different angle and has a blind spot where another looks. The scored answer maps bug classes to tools and builds a pipeline that does not drown developers.

Small requests that trigger large work are the cheapest denial of service. The scored answer finds the multipliers, bounds every one, and adds the AI-era ones.

The commonest serious bug in AI tools is the oldest: fetching an object by ID without checking who is asking. The scored answer finds it, fixes it at the data access, and tests across users and tenants.

URL validation is where string checks fail most visibly. The scored answer parses, resolves and allowlists, then tests the classic bypasses.

Generated code ships faster, which is the point and the risk. The scored answer names the specific failure modes and keeps the normal controls working at the new speed.

An LLM reviewer reads every change, which no human team can, and is confidently wrong some of the time. The scored answer places it as a triage layer, measures it, and protects it from the code it reads.

A practical round that tests clean code and detection judgement together. The scored answer parses defensively, picks a signal that separates stuffing from a forgetful user, and names what it misses.

A classic coding round with a security twist: the crawler fetches URLs that strangers wrote. The scored answer gets concurrency right, then adds scope, limits and SSRF protection.

Logging in is one moment; a session lasts hours or months. Most session bugs live in what happens between: identifiers that never change, timeouts nobody enforces, and logouts that only clear the browser.

No error messages does not mean no injection. And the sort column is the one place where 'just use parameters' does not work, so you need a different fix.

No SQL does not mean no injection. When a query is a JSON object, the attack is sending an object where the code expected a string.

CORS never blocks a request from being sent. It decides whether another site's script may read the answer, and with credentials allowed, that answer contains the logged-in user's data.

CSRF defences stop other sites from acting as the user. XSS is not another site: it is code running inside yours, with everything your own pages can do.

The same injection bug can leak one table or hand over the server. The difference is decided by grants made long before the bug was written.

Managed databases remove patching chores but add a control plane: whoever can call the cloud API can often copy, share or expose the whole database.

Every database encryption option protects against someone. The question is whether it protects against the attacker you are worried about, and most only stop thieves of disks and backups.

A bot can send exactly the headers a browser sends. It is much harder for it to send the same TLS handshake, run the same JavaScript and behave like a person. Bot management stacks those differences.

The app works, the demo is great, and every row in the database is readable from the browser. The scored answer explains the architecture that makes this common and a one-hour review that catches it.

An extension with 'read and change all your data on all websites' sits inside every session your staff open, and it updates itself. The scored answer treats extensions like software you deploy, because they are.

GraphQL lets clients ask for exactly what they want, which includes things you did not mean to give them and queries that cost a thousand times a normal one. The scored answer moves controls to where GraphQL actually decides things.

A WebSocket starts as an HTTP request that carries the user's cookies and skips CORS. The scored answer explains the hijack, then the controls that a long-lived connection needs that a normal request does not.

'Use the Keychain' is half an answer. Interviewers check whether you know the key never leaves the hardware, the data it protects still does, and which settings stop it riding along in a backup.

Every exported component is an API that any app on the phone can call. The vulnerabilities are the same ones you know from web APIs: missing authorization, trusted input, and a confused deputy.

Any app can claim myapp://. That single fact breaks OAuth redirects, password-reset links and payment flows that trust a custom scheme. The fix is a link the operating system verifies against your domain.

The token is safely in the Keychain, and also in the crash log, the analytics payload and the app-switcher screenshot. Interviewers want the list of side doors, not the front door again.

The device is in the attacker's hand in half the scenarios. A strong model sorts threats by where the attacker sits, then puts every decision that moves money behind a check the phone cannot fake.

Two different questions hide here: does the app validate TLS at all, and does it pin? Testers who merge them either miss the critical bug or report a non-issue as one.

Detection that runs on the attacker's device reports whatever the attacker allows it to. Interviewers want to hear what it is still good for, and what it must never decide alone.

Unzip, decompile, read the manifest, then watch it run. The interview checks whether you know where the interesting parts of an app hide, and that obfuscation changes your effort, not your conclusions.

Both platforms let an app declare its transport rules in a file the reviewer can read in seconds. Knowing which lines are dangerous makes you fast in a mobile review.

On a phone, the signing key is the app's identity: it decides who can ship updates, which data the app can share, and what it is entitled to do. Lose it, or let someone else sign, and that identity changes hands.

Rooting is not one trick. It is a decision about the boot chain: either the owner unlocks it, or an exploit breaks it. Everything an app can detect follows from which.

Most mobile findings do not need root at all. The ones that do usually point to the same conclusion: the server must not trust the client.

Most mobile malware never breaks the sandbox. It persuades the user to hand over the permissions that let it read the screen and act as them.

Your app can be fully patched on a phone whose kernel is two years old. The answer separates what you control, what the platform controls, and what you can only measure.

Employees will read company email on their own phones either way. The scored answer protects the data without owning the device, and is honest about what IT can and cannot see.

Spyware chains usually arrive through features most people never use. The scored answer trades those features away for the people who need it, and plans for what happens when protection is not enough.

The question is really 'what does hostile code have to break to reach the host?' Answer that for each option and the choice follows.

One link-local address hands out the machine's credentials to anything that can make a request from it. That includes a fooled agent with a fetch tool.

Many ML tools assume they run on a trusted network and offer 'run this code' as a feature. Put them on the internet and that feature is remote code execution.

Managed AI services remove servers, not responsibility. The scored answer covers identity, network, data, model, logging and governance controls that remain the customer's.

An AI request can cost a thousand times more than a web request, so volumetric thinking alone fails. The scored answer layers network, request and cost controls, and protects the GPU tier from ever seeing junk.

An AI system's behaviour lives in more places than its code. The scored answer versions every one of them together, so you can return to a known-good state in minutes after a bad change or a poisoning.

Most cloud breaches start with a setting, not an exploit. The scored answer moves those settings into reviewed code, checks them before deployment, and catches the drift that happens anyway.

Cloud attackers mostly use the same APIs your engineers do. The scored answer collects the right logs, writes detections for attacker behaviour, and keeps the logs out of the attacker's reach.

GPU nodes carry layers most patch programmes forget: drivers, firmware, CUDA libraries and container toolkits. The scored answer inventories them, prioritises by exposure, and patches without breaking month-long training runs.

Serving images bundle a model runtime, GPU libraries and dozens of Python packages. The scored answer controls what goes in, proves where it came from, and admits only verified images to production.

Sending prompts to a provider is a data flow like any other. The scored answer keeps it on private paths where possible, forces all model traffic through one controlled exit, and blocks everything else.

GPU hosts attract cryptominers and hold valuable weights and data. The scored answer contains without destroying evidence, scopes across the fleet, and rebuilds rather than cleans.

Python sits on top of a lot of C and C++. The scored answer explains the bug class, what the mitigations do and do not stop, and where ML stacks are exposed.

Everything in Kubernetes goes through the API server, so most attacks are about who can talk to it and with what rights. The rest is what a pod can do to its node and to its neighbours.

A bucket looks simple, but its policy, the identities that can touch it, its encryption keys, its logs and its lifecycle rules are each a way in or a way to lose it.

Inference servers are built to run on a trusted machine, so most have no authentication and some trust their own network completely. Internet scans keep finding them anyway.

Snapshot a disk, read it somewhere else, delete the snapshot. That trick built a product category. Interviewers ask how it works, what permissions it needs, and what it cannot see.

The mechanism takes a minute. The score comes from saying exactly what a valid signature does not prove, and running the key-theft response.

Half the answer is 'pickle runs code'. The half that scores is everything safetensors leaves open.

'Keyless' means no long-lived key, not no keys. The follow-up that separates candidates: what does your verification policy actually check?

An SBOM lists libraries. An AI-BOM has to answer a harder question: which base model and which data is this behaviour descended from?

Three ways a package you never meant to run ends up in your build. AI coding assistants added a fourth: the package that never existed until someone registered it.

Provenance is only worth anything at the moment someone refuses to deploy because it does not match. Say where that moment is.

The weights are safetensors and the code is a Python file from the same repository, fetched at load time. Guess which one runs with your credentials.

The pipeline holds the keys to production and runs code from pull requests. The scored answer separates untrusted from privileged work, pins what it executes, and removes long-lived secrets.

Promotion to production is a deployment decision dressed as a metadata change. The scored answer gives it change control, binds it to evidence, and makes swaps detectable.

Open weights arrive with code, configs, licences and unknown training. The scored answer turns due diligence into a repeatable gate that production enforces automatically.

Pinning a version is not pinning content. The scored answer verifies every file against a recorded hash, treats unexpected and missing files as failures, and explains where the lockfile's own trust comes from.

An MCP server is code you run or trust, plus text your model reads. The scored answer reviews who wrote it, what it can reach, what its tool descriptions say, and pins it so it cannot change silently.

A vendor breach becomes yours through the access you gave them. The scored answer inventories that access, rotates and revokes it, looks for misuse, and works out what data was exposed.

A model update can quietly undo controls you rely on. The scored answer runs a fixed security suite with thresholds agreed in advance, checks the artefact too, and decides what blocks a release.

Scanners are good at one thing: spotting code where only data should be. The scored answer explains how they work, how they are evaded, and why a clean scan is not a clean model.

Code that downloads a model by name trusts whoever owns that name today. The scored answer lists the ways that trust breaks and replaces names with pinned, mirrored, verified artefacts.

Typosquatting waits for a human typo. Slopsquatting waits for a model to invent the same wrong name again, and models repeat themselves.

Anyone can write a query that matches an attack. The interview is about everything else: the data source you trust, the benign activity that looks the same, how you proved it fires, and what the analyst does when it does.

A green heatmap is the easiest thing in security to fake. Interviewers want ATT&CK used to plan and test, with coverage that means 'proven to fire on the variants we expect', not 'a rule exists'.

Process creation with full command line and parentage answers more questions than any other event. The rest of the answer is about the next five sources, how sensors collect them, and what attackers do to blind them.

Inbound is blocked, so the compromised host calls out. That single design choice tells defenders where to look: unusual parents spawning shells with network connections, and regular outbound traffic to places nobody else visits.

The miner is the symptom. The incident is how it got there and what else the attacker could reach. Interviewers watch whether you stop at killing the process or follow the entry point and the credentials.

Collect the things that disappear first, change as little as possible, write down everything you did, and know which artefact answers which question. That is most of practical forensics.

Resetting the password is step four, not step one. Attackers keep access through sessions, app consents and mailbox rules, and the money moves faster than the investigation.

Candidates still recite 'preparation, detection, containment, eradication, recovery, lessons learned'. Revision 3 moved incident response into the Cybersecurity Framework's functions, and interviewers notice who has kept up.

Analysts closing ten thousand alerts a week will miss the one that matters. The fix is not more analysts; it is fewer, better alerts and automation for the rest, measured by outcomes rather than throughput.

Sorting by CVSS score sends teams after thousands of 'criticals' nobody will ever exploit. The answer weighs whether exploitation is happening, whether the asset is reachable, and what it would cost you.

A hunt is a testable hypothesis about an attacker your detections missed. Without one, it is just browsing logs. The output that justifies it is usually a new detection, not a captured attacker.

Hash lookups catch yesterday's file. A good rule targets what the family cannot easily change, and gets tested against a corpus of clean files before anyone trusts it.

The first half is a Counter. The follow-up, an infinite stream and a memory cap, is the actual question: interviewers want a heavy-hitters algorithm and an honest statement of what it guarantees.

The review is where an incident pays for itself, or gets wasted. Interviewers want a factual timeline, contributing factors rather than a culprit, and actions with owners that someone checks.

Getting in once is not enough for an attacker. Persistence is where they must leave a mark on the system, which makes it one of the best places to catch them.

Crypto miners steal your compute. LLMjackers steal your model quota and resell it, and the first alert is often the bill.

The Arup case cost about US$25 million because everyone on the call looked and sounded right. The control that works does not involve spotting the fake at all.

Deciding what to fix is half the job. The other half is getting a fix onto 20,000 machines without breaking them, and proving it landed. Few candidates can describe that half.

A credential that nobody legitimate ever uses produces an alert with almost no false positives. The craft is in placing it where an intruder looks and making sure it grants nothing.

EDR sees so much because it runs with so much privilege. On 19 July 2024 that privilege turned one bad content file into millions of crashed Windows machines. The answer covers both halves.

Having backups is not the control; having backups an attacker with admin rights cannot delete, and restoring from them on schedule, is. The scored answer designs for both.

Infostealers turned stolen passwords and cookies into a commodity with sellers, buyers and price lists. The scored answer follows the supply chain and cuts it at the points you control.

Headlines promised self-writing AI malware. The reports show something narrower and more useful to defenders: malware with a dependency on someone else's API. The scored answer separates hype from evidence and turns that dependency into detections.

The single idea underneath most AI security answers. The scored part is the second half: the architectural moves that follow once you accept it.

Three ways to give a model your data, three different places the data ends up. The answer that scores follows the data and asks how you would delete it.

Neither option is simply safer. The answer that scores names who you are trusting in each case and which controls move from the provider to you.

Knowing the acronym is the easy part. Mapping a real attack chain onto tactics, and saying what that mapping is useful for, is what gets scored.

A communication question with a technical core. The answer that scores uses one good analogy, stays accurate, and ends with options and a decision.

Training objectives help form test hypotheses. The worked answer separates observed behavior, useful work, application enforcement and the limits of safe proxy tests.

The LLM list has one item for agency. The agentic list spends ten on it. The answer that scores explains why, and which new risks only exist once agents act, remember and talk to each other.

A framework question that rewards structure. The scored answer gives the axes NIST uses, places familiar attacks on them, and shows how a shared vocabulary changes real work.

Same product, two different adversaries and two different teams. The scored answer separates them by what the attacker gets, and shows where they meet.

Uploads bring classic file-handling bugs into AI products. The scored answer covers the parsers, fetchers and storage around the model, not only what the model reads.

Embeddings are not hashes. The scored answer explains what they capture, how attackers exploit similarity, and why a vector store deserves the same protection as the documents.

A schema can constrain fields and allowed values. Follow what remains: trusted facts, resource and task permissions, safe consumers and actual completion.

A framework is only useful if it changes decisions. The scored answer maps the product onto SAIF's components, picks the risks that apply, and assigns controls to whoever can actually implement them.

AI security did not start with LLMs. The scored answer explains how these classifiers learn, the adversarial dynamics they have lived with for decades, and the lessons that carry over.

A fallback changes the real request path. Review recipient eligibility, state compatibility and uncertain actions before trying another endpoint.

Review caller-controlled options by their actual information, resource and capability effects. Build a bounded product schema instead of forwarding arbitrary configuration.

Separate observed model resistance from a precisely enforced application rule. Examine the evidence, assumptions and remaining consequences before recommending a release.

Map each control to a specific read, operation or release. Check policy inputs, audience permissions, verdict timing and useful work instead of relying on defense labels.

Separate source cues, message integrity, learned instruction priority and service permissions. Compare the actual configurations on both violations and useful manual-reading work.

Compare actual sources, identities, audiences, effects and persistence. Review what tools add without dismissing text-only harms or assuming user-scoped credentials authorize every task.

Compare supplied demonstrations with live conversation history. Review summary loss, streaming exposure, attempt budgets and the cost to legitimate long-document work.

Find representation and context mismatches without assuming a universal bypass. Place checks before the real release, preserve source authority and keep legitimate decoding useful.

Separate Unicode normalization, hidden controls, bidirectional display and confusable identifiers. Use a harmless offline example to choose field-specific checks without damaging legitimate language.

Interpret a canary hit using placement, known copies, audience and delivery evidence. Separate a local marker check from an active callback and from complete leak prevention.

Reproduce the failure without assuming its cause. Check meaning, labels, routing and model or guard behavior, then measure safety and useful work by language.

Turn a filter-based launch claim into an actionable decision note: evidence, permission gaps, useful interim scope, owners and completion conditions.

Build an authorized evaluation with synthetic identities, a fidelity matrix and controlled effects after real permission checks. Report what the harness proves and what remains untested.

Follow individual fields from their authors through tools, summaries and actual model exposure. Separate service-authoritative identifiers from quoted prose, then check each output and operation.

Trace editable source material through retrieval, actual context, model behavior and observed effects. Work through a synthetic result with denied proposals and an unresolved receipt.

Map protected context to its actual readers. Distinguish unauthorized retrieval from redistribution, inspect drafts and rendering, and verify disclosure without assuming every prompt inevitably leaks.

Investigate message construction, intended instruction conflicts and actual effects. Distinguish a misleading promise from a service failure, and test the correct permission rule.

Product security's favourite AI question, because the answer is mostly classic AppSec. The scored part is matching each sink to its control and preferring structured data over generated code.

The question catches candidates who think exfiltration needs a tool. The answer that scores starts with the browser and ends with deterministic controls in the client.

Breadth first, then priority. The answer that scores follows one sensitive value through every copy the system makes and fixes the two that leak most.

Poisoning a knowledge base is cheaper than poisoning a model. The answer that scores starts from who can write to the corpus and limits what a poisoned chunk can achieve.

Both, plus the layer most people forget: the action boundary. The scored skill is placing each check where it sees the right thing and labelling which ones are boundaries.

An incident question disguised as debugging. The answer that scores treats it as a possible breach, preserves evidence, and checks the four usual causes in order of likelihood.

LLM observability quietly becomes the largest copy of customer data in the company. The scored answer minimises what is captured, separates what must be kept, and treats trace stores as production data.

There is no single answer, and saying so is the start. The scored answer decides per check from what its failure would let through, and designs the latency budget so the choice is rarely forced.

Caches are shared state, and shared state crosses tenants. The scored answer separates response caches from prompt prefix caches and keys each so one user can never read or detect another's data.

Fine-tuning moves data from a database you can query and delete into weights you cannot. The scored answer covers memorisation, tenant separation, poisoning and the deletion problem.

Regulated data turns every copy the AI pipeline makes into an audit question. The scored answer keeps the regulated data out of the model where possible and brings each remaining copy under the regime.

Most bad retrieval is a quality bug; some of it is an attack or an access failure. The scored answer separates the cases quickly and checks the security ones first.

An integrity investigation with three suspects: the sources, the index and the model. The scored answer uses versions and provenance to tell them apart quickly.

A trust and safety design question. The scored answer connects policy, detection, review, enforcement and appeals into one loop, and sizes it to the volume and the harm.

The assistant becomes a new client of every API the product has, with a confused-deputy problem built in. The scored answer finds the new trust boundaries and keeps the old access model intact.

Similarity scores, result counts, snippets and ranking all say something about what is in the index. If authorization is applied after search, the search itself is the leak.

Requests per minute is the wrong unit when one request can cost ten thousand tokens. The interview checks the bucket arithmetic, the unknown output length, and what happens when two gateway nodes share one budget.

Inventory the data, untrusted inputs and outbound routes, including tools with two roles. Propose one enforced restriction and explain what the first pass leaves unresolved.

Compare each task’s required effects with the functionality, permissions and autonomy the system exposes. Narrow the effective authority at enforceable boundaries while preserving legitimate workflows.

Review an integration by tracing model input, process access and credential recipients. Then name the component that refuses each unauthorized action.

Build a permission worksheet for each tool: acting principal, task grant, objects, recipients, bounds and enforcement. Treat reads and reversible writes as potentially consequential.

Distinguish metadata review from runtime authorization. Work through an uncalled tool, a changed definition and a server whose behavior changes without new metadata.

Design the review around a permitted action and an understandable consequence. Evaluate whether people catch relevant changes, while keeping authorization, exact-action binding and alternate delivery paths enforced outside the model.

Define automatic work within an existing grant, decisions that need new authority and prohibited effects. Assess data disclosure, impact, recovery and uncertain inputs without turning every step into another confirmation.

Contain affected authority, preserve evidence in parallel and reconcile actual effects. Work through shared inputs, queued jobs, uncertain outcomes and a tested path back to useful service.

Connect task authority, evidence, dispatch attempts and observed effects. Learn what references, hashes and signed logs can establish, and test collection gaps without overcollecting sensitive data.

Separate model judgment from enforceable invariants, then inspect the inputs and state transitions used by the policy code. Deterministic code is useful only when its authority and facts are trustworthy.

Bound work where it is dispatched, account for concurrent branches and retries, and keep uncertain operations reserved. Choose limits from workload evidence and operational capacity, then preserve useful progress when a bound is reached.

Contain financial actions and reconcile provider state in parallel. Work through a synthetic exposure table, uncertain dispatch, cancellation limits and the evidence needed for a controlled restart.

Define current task authority and forbidden effects, test policy and agent behavior together, and report proposals, outcomes and useful completion with honest denominators and uncertainty.

Choose narrow extraction or full-text reading according to the task. Preserve source evidence and uncertainty, and enforce data audiences and action authority independently of extracted claims.

Review customer, operator and service authority separately. Enforce order access and email release policy, govern contact changes, and test valid work alongside unauthorized reads and disclosures.

Choose fixed query tools or bounded exploratory SQL, then verify the database role, tenant context, views, callable functions and resource controls. Read-only and row limits alone do not protect confidentiality or cost.

Compare each proposed action with the task’s existing grant, current policy and remaining budget. Continue within that scope; stop when authority expires or the action changes materially, and preserve the state of work already dispatched.

Separate enforceable permissions from behavioral review. Measure the checker on the proposer’s actual failures, track legitimate actions it blocks, and test the execution service even when every model recommends proceeding.

Define memory classes and their purpose, then inventory active records, derivatives, in-flight tasks and restored copies. Report retrieval denial and physical removal as separate milestones with evidence for each.

Compare actions with current grants and policy, distinguish unusual behavior from violations, and handle legitimate task revisions. Verify observation coverage and respond to the affected operation.

The attacker never sees the dataset. They see how much more confident the model is about one record than it should be.

The API is the attack surface and every response is a training example. Prevention is unrealistic; slowing, limiting and noticing are not.

Detection alone loses: clean-label poisons look correct. The answer that scores builds a pipeline where poison is hard to add, easy to trace and contained when it slips through.

Language models are trained to predict text, and sometimes the best prediction is the exact text they saw. Rare, repeated and sensitive strings are the risk.

The guarantee is about what an observer can learn from your presence in the data, not about hiding the data. Epsilon bounds it; delta is the small print.

A label is one bit of information per query. A probability vector is a map of the decision boundary, delivered on request.

Drift is the world changing. An attack is someone changing it on purpose. The evidence that separates them is where and how the errors cluster.

The two attacks every robustness paper starts from. The scored answer explains the gradient step, the budget as a threat model, and why the iterative attack is the standard for evaluation.

The one defence that has held up in research, at a price. The scored answer explains the min-max objective and names the costs: accuracy, compute, and robustness only to the threat model trained on.

Three attacks that all start with queries and end with something the owner did not intend to share. The scored answer separates them by what is stolen and maps each to its defence.

An attacker who cannot see your model can attack one they can see, and much of the damage carries over. That single property turns 'the weights are secret' into a weak defence.

Evasion testing is a search problem with a budget. Start from real harmful content, transform it while keeping its meaning, adapt to what gets through, and report false negatives and false positives by category.

Breaking a model means different things to different attackers. What they can touch (training data, the API, the weights) decides what they can do.

Build an authorized chatbot assessment around real data and action boundaries, then turn observed effects into findings, useful-work checks and retest criteria.

Define the success event and trial unit, reconcile unknown outcomes and report a rate whose uncertainty and retry claims match the actual assessment.

Separate a suspicious signal, a verified effect and a causal hypothesis. Then contain the real path, scope exposure and record what is still unknown.

Turn a threat model into an executable agreement: authorized work, real checks, controlled effects, protected evidence and clear stop and restart decisions.

Choose people and automation by the evidence the task needs. Validate candidates, calibrate scoring and separate exploratory search from a defensible estimate.

Design records for identity, context provenance, authorization and actual effects. Include missing-event coverage and a protected way to retrieve evidence.

Turn a finding into a requirement-based test with real effect evidence. Keep unresolved runs visible and prevent reruns, tolerances or empty results from hiding a defect.

Rate the supported consequence and conditions, explain retry assumptions and separate severity from deployment risk and response priority.

Measure unnecessary refusal without confusing it with incomplete answers, errors or correct permission denials. Keep useful work and actual security effects visible.

Read benchmark scores through their tasks, budgets, scoring rules and missing outcomes. Work through a joint security-and-utility example before applying a result to your product.

Choose tooling from the evidence your workflow needs. Compare integration, effect scoring, state, data handling and maintenance using a representative authorized fixture.

Define what the stop control guarantees at admission and commit. Include queues, retries, accepted actions and a separately authorized restart.

Define the asset and prohibited use before scoring traffic. Distinguish imitation, partial extraction and credential compromise, and test signals against legitimate workloads.

Preserve the source and limits of each signal, verify model claims and bind response actions to exact targets. A passing authentication result does not prove benign mail.

Respond to a suspected credential exposure without testing it against an excluded service. Preserve restricted evidence and coordinate owner-led containment.

Tell an engagement story you can support: your role, the evidence, what changed and what remains uncertain. A clearly labeled learning project counts as learning.

Build a decision brief from verified impact, tested scope, unresolved effects and concrete options. Practise a fictional release memo without inventing likelihood or repair estimates.

Keep test purposes and exposure history explicit. Version justified corrections, split related cases and protect confirmation from both direct access and repeated tuning feedback.

Compute a zero-success bound under explicit trial assumptions, then state what it cannot establish. Keep missing effects, campaign units and release requirements visible.

A framework, a certifiable standard and a law. They overlap heavily and substitute for each other not at all.

Tiers are decided by use, not by model. And for high-risk providers, Article 15 makes AI security a legal requirement.

You cannot govern what you have not listed. The register is the list; the routing is what makes it worth keeping.

A startup cannot afford a governance department. It can afford two weeks that close the risks that would end the company.

Yes, it is certifiable, and it is built to sit next to 27001. The follow-up is what a certificate does not prove.

Location of the office is not the test. Where the system is placed, used, or where its output is used, is.

The core RMF is generic; the profile makes it specific to generative AI. The scored answer names the twelve risks, shows how they map onto the four functions, and picks the ones a security team owns.

When everyone owns AI risk, nobody does. The scored answer puts one accountable owner on each decision and makes the specialist teams responsible for the work they are best at.

AI vendors add questions a standard security questionnaire never asked. The scored answer covers training use, retention, subprocessors, model changes and incident terms, and verifies rather than trusts.

The same model in a different context carries different obligations and harms. The scored answer names what each sector adds on top of baseline AI security.

Regulation does not tell you how to red-team, but it decides what you must be able to show. The scored answer maps programme outputs to the evidence each framework expects.

Three frameworks, three different questions: what can go wrong in what we build, how attackers actually operate, and how the organisation manages the risk. Using one for another's job is the common mistake.

'Prompt injection' is a technique, not a risk entry. Entries that get funded describe a scenario, an asset, a consequence in business terms, an owner and a measurable treatment.

Security asks who can steal the data. Privacy also asks what the agent itself collects, infers, remembers and passes on, about the user and about everyone in their inbox who never agreed to anything.

Signed provenance and invisible watermarks are often lumped together as 'AI detection'. They prove different things and fail in different ways, which is the whole answer.

Frameworks for AI risk are plentiful; baselines that say what security controls an AI system needs are newer. The scored answer knows what each one is, how binding it is, and how to turn it into a control set.