REVATURE INTERVIEW CERTIFICATION
EVALUATION TEST PAPER QUESTIONS
AND SOLUTIONS VERIFIED COMPLETE
●● Walk me through defense in depth for LLM security.
Answer: Defense in depth means layering multiple, independent security
techniques rather than relying on any single one — because no single
technique for LLM security is sufficient on its own. For example, you'd
combine instruction/data separation, least-privilege restrictions on what
the agent can actually do, input/output filtering, and sandboxing all
together. If an attacker slips past one layer, the others still contain the
damage. I'd also stress that organizations need to actually test this stack
— red-teaming their own systems rather than assuming the layers work.
●● Explain the difference between input validation and input
sanitization.
Answer: Validation is a gate: you check whether input conforms to
expected characteristics — length, format, structure — and if it doesn't
pass, you reject or flag it rather than processing it. Sanitization is
different — instead of rejecting bad input outright, you actively clean or
neutralize the harmful parts of it before processing. With LLMs this is
trickier than traditional software because the 'input' is often open-ended
natural language, so you can't validate against a rigid schema the way
you'd validate an email address.
,●● Why are allow-lists generally considered more secure than deny-
lists?
Answer: An allow-list defines the small set of things that ARE
permitted, and rejects everything else by default. A deny-list tries to
enumerate everything that's forbidden, which means you're always
playing catch-up — an attacker just needs to find the one bad input you
forgot to list. Allow-lists flip that burden: you don't need to anticipate
every attack, you just need to know what legitimate input actually looks
like, which is usually a much smaller, more knowable set.
●● What is an internal/system prompt, and what are the two main goals
when strengthening one?
Answer: An internal prompt is the persistent instruction set defining an
LLM app's behavior, persona, and rules — invisible to the end user, and
often containing business logic worth protecting. The two goals are
resistance to override, meaning user input or external content can't talk
the model out of its instructions, and resistance to leakage, meaning the
model won't reveal the contents of that prompt even if asked cleverly or
repeatedly.
●● What's the 'sandwiching' technique in prompt security?
Answer: Sandwiching means placing your critical instructions both
before AND after the user-provided content in the prompt, rather than
just once at the top. The idea is that the model re-reads the important
rule again right after it's processed potentially adversarial input, which
makes it harder for that input to quietly override the instruction through
sheer distance or dilution in the prompt.
,●● What does 'security through obscurity' mean, and why is it
considered fragile?
Answer: It's the idea that a system is safe primarily because an attacker
doesn't know how it works internally. It's fragile because that secrecy is
a single point of failure — prompts and system logic can leak through
direct requests, clever rephrasing, or indirect extraction, and once it's
out, a system that relied purely on obscurity has nothing left protecting
it. The better standard is designing a system that stays reasonably secure
even if its system prompt became fully public.
●● What are the three categories of PII, and how do they differ?
Answer: Direct identifiers are things that identify someone on their own
— name, SSN, email, phone number. Quasi-identifiers, or indirect
identifiers, aren't identifying alone but can become identifying when
combined — things like date of birth, ZIP code, or job title. Sensitive PII
is a heightened category — health information, financial details,
biometric data — that usually carries stricter legal protection
requirements on top of everything else.
●● Name a few PII masking techniques and how they differ.
Answer: Redaction just removes the PII entirely and replaces it with a
placeholder like [NAME] — simple, but you lose the information for
good. Tokenization swaps PII for a consistent substitute token, so 'John
Smith' always becomes 'Person_A' within a document, which preserves
relationships without exposing the real value. Generalization reduces
precision instead of removing data outright — an exact birthdate
, becomes just a birth year. I'd pick the technique based on whether
downstream logic still needs to reason about the entity consistently.
●● Explain the nested relationship between AI, ML, Deep Learning, and
Generative AI.
Answer: It's a set of nested subsets, each one narrower than the last. AI
is the broad field of building systems that perform tasks requiring
human-like intelligence. Machine Learning is the subset of AI where
systems learn patterns from data instead of being explicitly programmed.
Deep Learning is the subset of ML that uses layered neural networks.
And Generative AI is the subset of Deep Learning specifically focused
on creating new content — text, images, code — rather than classifying
or predicting from existing data. Claude and ChatGPT sit at that
innermost layer.
●● What are the three 'levels' of AI, and which ones actually exist
today?
Answer: Narrow AI, General AI, and Superintelligence. Narrow AI is
built for one specific task — and this is the only level that actually exists
and is in wide use today, including every LLM currently deployed.
General AI would be human-level reasoning across any task, and
Superintelligence would surpass human intelligence broadly — both are
still hypothetical or purely theoretical. I'd push back on marketing
language that implies otherwise; even the most capable LLMs today are
Narrow AI.
EVALUATION TEST PAPER QUESTIONS
AND SOLUTIONS VERIFIED COMPLETE
●● Walk me through defense in depth for LLM security.
Answer: Defense in depth means layering multiple, independent security
techniques rather than relying on any single one — because no single
technique for LLM security is sufficient on its own. For example, you'd
combine instruction/data separation, least-privilege restrictions on what
the agent can actually do, input/output filtering, and sandboxing all
together. If an attacker slips past one layer, the others still contain the
damage. I'd also stress that organizations need to actually test this stack
— red-teaming their own systems rather than assuming the layers work.
●● Explain the difference between input validation and input
sanitization.
Answer: Validation is a gate: you check whether input conforms to
expected characteristics — length, format, structure — and if it doesn't
pass, you reject or flag it rather than processing it. Sanitization is
different — instead of rejecting bad input outright, you actively clean or
neutralize the harmful parts of it before processing. With LLMs this is
trickier than traditional software because the 'input' is often open-ended
natural language, so you can't validate against a rigid schema the way
you'd validate an email address.
,●● Why are allow-lists generally considered more secure than deny-
lists?
Answer: An allow-list defines the small set of things that ARE
permitted, and rejects everything else by default. A deny-list tries to
enumerate everything that's forbidden, which means you're always
playing catch-up — an attacker just needs to find the one bad input you
forgot to list. Allow-lists flip that burden: you don't need to anticipate
every attack, you just need to know what legitimate input actually looks
like, which is usually a much smaller, more knowable set.
●● What is an internal/system prompt, and what are the two main goals
when strengthening one?
Answer: An internal prompt is the persistent instruction set defining an
LLM app's behavior, persona, and rules — invisible to the end user, and
often containing business logic worth protecting. The two goals are
resistance to override, meaning user input or external content can't talk
the model out of its instructions, and resistance to leakage, meaning the
model won't reveal the contents of that prompt even if asked cleverly or
repeatedly.
●● What's the 'sandwiching' technique in prompt security?
Answer: Sandwiching means placing your critical instructions both
before AND after the user-provided content in the prompt, rather than
just once at the top. The idea is that the model re-reads the important
rule again right after it's processed potentially adversarial input, which
makes it harder for that input to quietly override the instruction through
sheer distance or dilution in the prompt.
,●● What does 'security through obscurity' mean, and why is it
considered fragile?
Answer: It's the idea that a system is safe primarily because an attacker
doesn't know how it works internally. It's fragile because that secrecy is
a single point of failure — prompts and system logic can leak through
direct requests, clever rephrasing, or indirect extraction, and once it's
out, a system that relied purely on obscurity has nothing left protecting
it. The better standard is designing a system that stays reasonably secure
even if its system prompt became fully public.
●● What are the three categories of PII, and how do they differ?
Answer: Direct identifiers are things that identify someone on their own
— name, SSN, email, phone number. Quasi-identifiers, or indirect
identifiers, aren't identifying alone but can become identifying when
combined — things like date of birth, ZIP code, or job title. Sensitive PII
is a heightened category — health information, financial details,
biometric data — that usually carries stricter legal protection
requirements on top of everything else.
●● Name a few PII masking techniques and how they differ.
Answer: Redaction just removes the PII entirely and replaces it with a
placeholder like [NAME] — simple, but you lose the information for
good. Tokenization swaps PII for a consistent substitute token, so 'John
Smith' always becomes 'Person_A' within a document, which preserves
relationships without exposing the real value. Generalization reduces
precision instead of removing data outright — an exact birthdate
, becomes just a birth year. I'd pick the technique based on whether
downstream logic still needs to reason about the entity consistently.
●● Explain the nested relationship between AI, ML, Deep Learning, and
Generative AI.
Answer: It's a set of nested subsets, each one narrower than the last. AI
is the broad field of building systems that perform tasks requiring
human-like intelligence. Machine Learning is the subset of AI where
systems learn patterns from data instead of being explicitly programmed.
Deep Learning is the subset of ML that uses layered neural networks.
And Generative AI is the subset of Deep Learning specifically focused
on creating new content — text, images, code — rather than classifying
or predicting from existing data. Claude and ChatGPT sit at that
innermost layer.
●● What are the three 'levels' of AI, and which ones actually exist
today?
Answer: Narrow AI, General AI, and Superintelligence. Narrow AI is
built for one specific task — and this is the only level that actually exists
and is in wide use today, including every LLM currently deployed.
General AI would be human-level reasoning across any task, and
Superintelligence would surpass human intelligence broadly — both are
still hypothetical or purely theoretical. I'd push back on marketing
language that implies otherwise; even the most capable LLMs today are
Narrow AI.
