defence in depth
AI security interview questions tagged defence in depth, across every topic.
6 questions · 3 unlocked for you
Concepts behind "defence in depth"
Explanations of the mechanisms these questions rely on.
Core
Least Privilege, Defence in Depth and Fail-Safe DefaultsThree design principles do most of the work in secure architecture. Least privilege limits what any one component, person or agent can do, so a compromise stays small. Defence in depth layers controls that fail independently, so another control may still block the path when one fails. Fail-safe defaults deny access unless something explicitly allows it. Use them to identify which consequences remain possible after a component is compromised. Security FoundationsSign in
Core
Content Security Policy in DepthA Content Security Policy is a response header the browser enforces for one document: it decides which scripts, styles, frames and connections the page may use, blocks the rest and can report violations. Host allowlists failed in practice because allowed domains host code an attacker can reuse. A strict policy trusts scripts by per-response nonce or by hash, propagates trust with strict-dynamic, and adds object-src and base-uri. Trusted Types closes DOM sinks. CSP limits XSS impact; it does not fix XSS or stop data leaving. Application SecuritySign in
Core
Guardrails and Their LimitsGuardrails are controls placed around a model to check or constrain its inputs and outputs: schema validators, allowlists, PII detectors, topic and safety classifiers, injection detectors and LLM-based judges. Correctly implemented deterministic controls enforce their specified rules independently of model intent; probabilistic controls aim to lower the rate of bad outcomes and need honest measurement of both misses and false positives. A good architecture uses each where it fits and never presents a classifier as a boundary. LLM Application SecuritySign in