Google Security Engineer Interview Questions

I would define the normal baseline first, then look for anomalies such as repeated failures, unusual access patterns, privilege escalation attempts, and unexpected data transfers. Detection works best when it is tied to concrete attacker techniques, not just generic noise. A strong answer includes both signal quality and response readiness.

Forward secrecy means that compromise of a long-term key does not automatically expose past session data. I would want it because it limits the damage from a key compromise and protects historical communications. It is an important property in secure transport protocols.

I would combine traffic filtering, rate limiting, autoscaling, caching, and upstream protection services to absorb or block abusive traffic. The right response depends on whether the attack is volumetric, protocol-based, or application-layer. Good mitigation plans also include observability so operators can see what is actually happening.

A virus typically attaches itself to a host program or file and spreads when that host is executed, while a worm is self-propagating and can spread across networks without needing a host program. The distinction matters because the containment and detection strategy can differ. A strong answer focuses on propagation behavior.

A honeypot is a decoy system designed to attract suspicious activity so defenders can observe attacker behavior. It is useful for research, detection, and incident response because it can reveal techniques that might not be obvious in normal production traffic. The key is to deploy it safely and monitor it carefully.