Security

• An AI assistant can create tickets, issue refunds, or change accounts on a user's behalf. A refund request times out, and the system cannot tell whether it completed; retrying may issue a second refund. How would you check the outcome, control retries, and ensure actions stay within the user's authorization?AI engineering
• Your company wants an internal knowledge assistant, and document permissions change as people move around. How would you make it answer with evidence while keeping it from exposing what a user should not see?AI engineering
• You ask an AI to review a configuration or generate a piece of code. How do you decide whether it can go live?AI engineering
• Enterprise knowledge documents may change, be withdrawn, or become restricted, yet users still receive answers citing old content. How would you propagate changes from source documents through chunks, indexes, caches, and existing citations, and prove that an update or deletion took effect?AI engineering
• Production answers contain incorrect citations or degrade in quality, but prompts and retrieval context may include sensitive data and cannot be logged by default. What telemetry would help distinguish retrieval, model, and tool failures while controlling data exposure?AI engineering
• A multi-step agent reads project permissions at startup. Before step three, the user is removed from the project, but the task still holds a tool token. How would you design authorization checks and cancellation semantics?AI engineering
• A repository accepts external contributions, and CI runs build scripts, reuses caches, reads test credentials, and produces release artifacts. How would you separate untrusted execution, credential permissions, and cache boundaries so code cannot read secrets or poison trusted artifacts?Engineering systems
• A long-lived credential is shared by several services. Security requires prompt rotation, but all dependents cannot be stopped at once. How would you proceed?Quality, security, and safety
• Several pages share server data and framework caching reduces requests, but stale results appear after users switch accounts. How would you design cache keys and invalidation boundaries?Coding and abstraction
• A user edits offline and queues several changes. When connectivity returns, the token has expired and some requests may already have reached the server. How would you design reauthentication, idempotency, and conflict handling?System design
• Two usernames that look identical are treated as different, or distinct spellings are treated as the same. How would you analyze Unicode normalization and identity comparison?Computer-science foundations
• A user requests deletion of personal data, but some records have reached backups, analytics warehouses, and downstream systems. How would you design a verifiable deletion process?Quality, security, and safety
• A widely used dependency is disclosed as critically vulnerable, but upgrading may introduce compatibility issues. How would you sequence the response?Quality, security, and safety
• A new external service will access user data and trigger internal actions. How would you perform a lightweight but effective threat model?Quality, security, and safety
• The system uses pre-signed URLs for private downloads, but links can be forwarded or retained for a long time. How would you design authorization and expiry boundaries?System design
• How should the permission system of a large operations back office be designed? How do you organize roles, data scope, approvals, and audit, and how do you keep it from getting out of control as permissions multiply?System design
• When the business operates across several countries and regions and user data must flow across borders, how do you solve data compliance in systems and processes, and how do you judge and decide in gray areas where the rules are unclear?System design
• How would you design an invitation-based viral marketing campaign? How do you design invitation relationships, reward payout, abuse prevention, and effect evaluation?System design
• How would you design a real-time risk control system? How do rules, features, models, and manual review work together, and how do you trade false blocks against misses?System design
• You need to sample production AI conversations for emerging risks, but they contain personal or commercial data. How would you design the review?AI evaluation and governance
• A third-party model provider changes its training, retention, or cross-border terms. When should calls pause or receive renewed approval?AI evaluation and governance
• An AI assistant can call internal tools, but tasks require different permissions. How would you design authorization and audit?AI evaluation and governance
• An admin console must retain operation records that cannot be casually altered, support queries by actor and object, and handle years of growth. How would you design writes, indexes, and retention?System design
• A user opens a protected order-detail page from an external link. How would you design route parsing, login return, and authorization so the deep link cannot bypass in-app controls?System design
• Hundreds of repositories pin different third-party versions, and security teams struggle to identify exposure when a severe vulnerability appears. How would you establish dependency updates and risk handling?Engineering systems
• Several services read feature flags and audience rules on request paths. How would you design the control plane and local evaluation so behavior remains predictable when the control service fails?System design
• A global service must enable different features and retention rules by region while headquarters still needs an overall operational view. How would you divide configuration, enforcement, and aggregation?System design
• Several teams copy de-identified data into development, staging, and performance environments with different refresh schedules. How would you design access, lifecycle, and reproducibility?Quality, security, and safety
• A team discovers that a model may have seen some internal evaluation prompts in public corpora or fine-tuning data. How would you determine what offline scores still mean and rebuild a trustworthy evaluation?AI engineering
• A team fine-tunes on user feedback, human labels, and synthetic samples, then receives a request to delete some source data. How would you trace impact and decide the scope of retraining?AI engineering
• Several tenants share an asynchronous job platform, and some submit many long-running tasks. How would you design scheduling, isolation, quotas, and use logs, metrics, and call records to understand queue behavior?System design
• Some objects become hot, degrading reads while writes must remain ordered. How would you divide caching, partitioning, and write coordination?System design
• The business needs every state change to be traceable and safely replayable, but some old events lack fields. How would you design event versions, retention, and replay boundaries?System design
• A multi-region service must preserve critical functions during a regional outage, but some data cannot tolerate conflicting overwrites. How would you choose degradation, replication, and recovery policies?System design
• A real-time collaboration service has many long-lived connections, and slow clients accumulate updates. How would you choose between dropping, combining, limiting updates to slow clients, and resynchronizing?System design
• Teams share a repository but release at different cadences; shared package changes often block unrelated teams. How would you design boundaries, impact analysis, and release agreements?Engineering systems
• The same release behaves differently across clusters, and configuration changes are not fully audited. How would you establish configuration sources, drift detection, and rollback?Engineering systems
• Offline evaluations keep improving while a specific user segment regresses online. Which data leakage, slice coverage, and deployment differences would you investigate?AI engineering
• An AI assistant retrieves documents from several business systems, where users have different permissions in each. How would you ensure retrieval, caching, summaries, and citations follow source permissions, including after access is revoked?AI engineering
• A production dependency has a different artifact hash from the build associated with its repository tag, and the team cannot confirm it passed the expected CI. How would you establish build traceability, artifact verification, and release authorization?Engineering systems
• An analytics assistant converts natural language into SQL against business data; a request may induce it to read sensitive columns or run an expensive query. How would you design read-only permissions, query validation, resource limits, and result redaction?AI engineering
• An AI assistant reads user-uploaded documents that may tell it to ignore existing rules and call external tools. How would you distinguish data from instructions, constrain tool permissions, and verify the safeguards?AI engineering
• Users can upload archives for processing, and a past incident showed that malicious files could exhaust resources or access paths without authorization. How would you design isolation, extraction limits, content checks, and safe failure behavior?Quality, security, and safety

No questions in this section match your target. Change target · View all questions

• A user consented to product analytics, then withdrew consent. Derived metrics already reached reports, experiments, and model-training data. How would you model consent state, purpose scope, and propagation?Data model
• A user asks to have personal data deleted, while finance must retain transaction records for audit. How would you define the boundary among deletion, anonymization, and traceability?Data model
• A critical dataset is reused by several products and reports, but no one can explain its sources, owners, or sensitive fields. How would you improve governance without blocking current use?Data model
• A company buys 100 seats used across subsidiaries. Headquarters signs the contract, but some subsidiaries want separate invoices and permission administrators. How would you distinguish customer, contract, organization, account, member, and seat so access and billing stay consistent?Data model
• Some transaction details must be retained for years under policy, while product analytics wants to use them for user segmentation and experiments. How would you model purpose authorization, retention, and access views?Data model
• An employee creates a project space and later hands it to another owner; the department manager still approves its budget, while audit requires the original creator to remain visible. How would you separate resource ownership, operational responsibility, authorization, and historical attribution?Product and project model

No questions in this section match your target. Change target · View all questions

• When managing a large platform ecosystem, gray areas such as fake orders, abusive bonus hunting, and borderline content often appear. How do you build a governance mechanism that does not harm the healthy ecosystem, and how do you build the defense together with risk control, legal, and technology teams?Operational execution

No questions in this section match your target. Change target · View all questions