1.9Interview Depth Check

Question 1

Prompt: Your company is launching an AI-powered customer support chatbot that can look up orders and process refunds. The security team asks you to assess the AI-specific attack surface. Walk through the threat categories you would identify. What a strong answer should cover:

• The dual attack surface concept (traditional web + AI-specific)
• Specific AI threats: prompt injection (direct and indirect), system prompt extraction, data leakage, tool/plugin abuse, cross-session contamination
• That each capability (order lookup, refund processing, conversation history) is a separate attack vector
• Reference to the OWASP LLM Top 10 as the organizing framework Example answer:
• "I would start by mapping every AI capability to its attack vectors. The system prompt can be extracted via prompt injection. The order lookup API is an attack vector if the LLM bypasses access controls. Refund processing can be abused through social engineering the AI. Conversation history introduces cross-session leakage risk. I would organize the assessment around the OWASP LLM Top 10 -- prompt injection, insecure output handling, sensitive information disclosure, excessive agency, and insecure plugin design are the top concerns for this use case."

Question 2

Prompt: A product manager tells you that AI security testing is unnecessary because the model provider (OpenAI, Anthropic) already builds safety into the model. How do you respond? What a strong answer should cover:

• The distinction between model-level safety and application-level security
• That the provider secures the model but not your system prompt, tools, data access, or output handling
• That prompt injection targets the application layer, not the model layer
• Concrete examples of application-level vulnerabilities the provider cannot prevent Example answer:
• "Model providers build safety guardrails into the base model -- they prevent the model from generating certain types of harmful content. But application security is our responsibility. The provider cannot prevent prompt injection that targets our system prompt. They cannot enforce our access control when the LLM calls our internal APIs. They cannot prevent data leakage from our RAG pipeline. These are application-layer vulnerabilities that exist regardless of how safe the underlying model is."

Question 3

Prompt: You need to prioritize security testing for a new AI feature with a tight deadline. You can only implement three security controls before launch. Which three do you choose and why? What a strong answer should cover:

• A clear prioritization framework based on likelihood and impact
• Prompt injection testing as the top priority (most common, most impactful)
• Output validation/sanitization as second (prevents downstream injection)
• Rate limiting and cost controls as third (prevents DoS and financial damage)
• Acknowledgment that the remaining controls should follow post-launch Example answer:
• "First, prompt injection testing with at least 20 payloads -- it is the most critical and most common AI vulnerability. Second, output sanitization for any downstream use of LLM output in SQL, HTML, or shell commands -- this prevents the LLM from becoming an injection vector into our own systems. Third, rate limiting and max_tokens enforcement to prevent cost-based denial of service. Everything else -- jailbreak testing, data leakage scanning, compliance -- I would schedule for the first sprint after launch with a clear timeline communicated to stakeholders."

Question 4

Prompt: Explain the difference between prompt injection and jailbreaking to a non-technical stakeholder. What a strong answer should cover:

• A clear, jargon-free distinction
• Prompt injection: making the AI do something unintended (functionality attack)
• Jailbreaking: making the AI say something it should refuse (safety attack)
• A concrete analogy or example for each Example answer:
• "Prompt injection is when an attacker tricks our AI into doing something it was not supposed to do -- like revealing our internal instructions, accessing another customer's data, or processing an unauthorized refund. Jailbreaking is when an attacker tries to make the AI say something it was trained to refuse -- like generating harmful content or offensive material. Both are important to test for, but prompt injection is the bigger business risk because it can lead to data breaches and unauthorized actions, while jailbreaking is primarily a reputational risk."