Security Engineer
Why is multi-factor authentication important, and which kinds of second factor are stronger than others?
What the interviewer is looking for
- This question tests identity & access control. Covers phishing-resistant authentication, least privilege, just-in-time access, and protection of keys and service accounts.
- Strong answers: Stops stolen passwords alone from working; text codes are weaker, app prompts can be fatigued, hardware keys and passkeys resist phishing best.
- Likely follow-up: How would you roll out stronger authentication to staff who resist it?
Another way it may be asked: If someone steals an employee's password, how does a second login step help, and which methods are hardest to trick?
A structure to follow: Answer, explain, example, limits
- Step 1
Answer
Give your direct answer in the first sentence so the interviewer knows where you are going.
- Step 2
Explain
Say how it works or why you would do it that way, in plain words before jargon.
- Step 3
Example
Anchor it in something you have actually done or seen, with the detail that shows hands-on experience.
- Step 4
Limits
Say when your approach would not be the right one. It shows judgement.
This is guidance on shape, not a script. Use your own real experience and facts; never invent details to fill a gap. See the STAR guide and answer frameworks.
Common slips
- Reciting a definition without showing you have applied it.
- Using terms you cannot explain if asked a level deeper.
- Claiming experience beyond what you can discuss in detail.
How to practise it
Say the answer in 90 seconds, then answer the follow-up as if it were a new question.
Related questions
- How would you design secure access to production for engineers, so nobody has standing admin rights but on-call work still gets done quickly?
- What is SQL injection, how does it happen, and how would you prevent it in a web application?
- You notice a user account logging in from two countries an hour apart. What would you check, and what would you do?
- A scanner reports three thousand vulnerabilities across your systems. How do you decide what to fix first?
- Walk me through how you would threat model a new feature that lets users upload files to share with others.