Salesforce Forward Deployed Engineer interview questions

Two questions bundled as one: what do you ship first, and how do you make a stochastic system behave. The answer that lands: shrink the autonomy, not just the feature list, and define the MVP by the workflow it completes, not the agent it contains.

The verbatim Salesforce Agentforce FDE question. Strong answers name Topics, Actions, and grounding sources specifically, and refuse the word 'replace' without saying no. The component-by-component build with the staged-autonomy rollout.

Sounds like a softball; it's a filter. 'I read newsletters and follow people on X' is the answer that loses. Interviewers are listening for a system with a build loop, here's one you can describe and actually run.

The portfolio probe that opens Salesforce's Agentforce FDE loop and most 2026 screens. Interviewers are smelling for weekend wrappers, the scoring is on evals, users, and production scars, not project count.

A definition question wearing an experience question's clothes. Most candidates answer the resume half and flunk the hidden half: proving they know the operational difference between generation and agency. Here's the two-part frame.

The capability isn't real, the ink is dry, and the customer found out from you, not your AE. Throwing sales under the bus and quietly building vaporware both fail. Here's how to reset the expectation without breaking the account or the internal relationship.

OWASP made system prompt leakage its own category (LLM07) because teams keep treating prompts as secrets. The strong answer flips the premise: design so extraction doesn't matter.

OWASP LLM06 is where AI security stops being novel and becomes a least-privilege problem, which is exactly why interviewers love it. The control list is short; knowing which control to lead with is the test.

A verbatim AI-security interview question with a built-in trap: candidates who promise to stop extraction fail, and candidates who shrug 'it's unpreventable' also fail. The winning answer is a layered containment design.

MCP turned 'install a plugin' into 'inject text into every conversation.' Interviewers ask this to see if you understand why tool descriptions are an attack surface, and what a least-privilege agent runtime looks like.

An Anthropic-style system design axis: architectural safety. The answer is a pipeline diagram in words, five checkpoints, what each catches, what each costs in latency, and the streaming complication most candidates forget.

An architecture question with a defensible right answer, and interviewers are tired of 'it depends.' Here's the split that survives both the platform team's consistency argument and the app team's context argument.

HIPAA-with-LLMs questions test whether you know the three things that gate the deal: the BAA, the minimum-necessary standard, and audit controls. Engineers who can name 45 CFR obligations in design terms win these rooms.

SOC 2 fluency is the price of admission to enterprise deals, and interviewers check it with two traps: what a SOC 2 report actually proves, and what it doesn't. Engineers who can read one are rarer than you'd think.

The AI Act question is a classification exercise in disguise: interviewers give you a use case and watch whether you can tier it, name the obligations, and know whose job each one is, provider or deployer.

Four frameworks, one product, mostly one set of evidence, the answer interviewers want is the deduplication map. Plus the one thing ISO 42001 covers that nothing else does, and why the labs raced to get it.

A Snowflake solutions-loop classic that generalizes to every AI deployment: why masking retrofits fail, what a role hierarchy actually looks like, and the policy-attachment model that makes governance survive schema growth.

A real customer ask from the field, and a layered design question in disguise: attribution, budgets, anomaly detection, and enforcement, plus the attribution problem that decides whether any of it works.

The LLM billing round has three trapdoors: retries double-charging customers, metering latency leaking into inference, and month-end numbers that don't match the provider invoice. The design that survives all three is the answer.

When the agent does something expensive, 'what happened and why' must be answerable in minutes, to an auditor, from records they trust. Most logging designs answer 'what'; the AI-specific work is 'why', and tamper-evidence is what makes it count.

The capstone governance round: AI incidents break standard IR playbooks in three specific places, containment without rollback, blast-radius over probabilistic systems, and root cause for nondeterministic behavior. Interviewers grade you on knowing which three.

The agent has real money authority and a write path into the system of record, which is the exact shape attackers want. The strong answer is layered enforcement outside the model, with the spend cap and the chain rule in code, not in the prompt.

Authentication is not isolation: a request can be fully authenticated to tenant A and still touch tenant B through a shared index, a semantic cache, or a fine-tuned model. The strong answer names every shared surface and how you stamp tenant identity through all of them.

One backdoored MCP server can BCC every email an agent drafts, and a clean server can rug-pull its tool definitions a week after approval. This is a software supply-chain program for dependencies that talk, not a one-time review.

When agents call agents, one agent's output is another's untrusted input, and a single injected instruction can propagate across the whole graph with accumulated privileges. The strong answer treats every inter-agent edge as a trust boundary and bounds privilege per agent, not per system.

The warm-up that quietly filters out candidates who only know LLMs as a magic API. Nail the two-phase inference picture and you set up every later answer about latency, cost, and hallucinations.

Everyone can define it; few candidates know why 'advertised context' and 'usable context' aren't the same thing. The cost, latency, and attention caveats that make this answer stand out.

The warm-up that filters out tutorial-level candidates. Interviewers aren't grading the diagram, they're grading whether you know the three places real pipelines fail and how you'd see it happening.

Modern LLMs share one architectural skeleton. Learn the five components and you can read almost any model card cold, plus the single distinction that proves to an interviewer you actually understand it rather than the buzzwords.

Everyone says '500 tokens with overlap.' The candidates who get hired explain why chunk boundaries are a recall problem, name three strategies, and describe the experiment that picks between them.

Tokens drive your customer's bill, their latency, and the weird failures like botched arithmetic. The rough numbers every FDE should rattle off, plus the trap answers interviewers listen for.

Every FDE will face an angry customer asking this. The mechanistic explanation interviewers want (why hallucination is the default behavior, not a bug) plus the framing that defuses customer escalations.

Every queue, webhook, and retry loop you'll ever deploy at a customer hides this distinction. Interviewers use it to separate people who've shipped from people who've read about shipping.