Agentic AI interview questions and answers

An agent uses a language model to decide what to do next in a loop: it plans, calls tools (search, code, APIs), observes the results and continues until the goal is met. A plain chatbot answers each message from its prompt. Agents act on the world through tools and adapt their steps; that power also needs limits, approvals and monitoring.

A workflow follows steps you define in code, with models used inside fixed paths (prompt chaining, routing, parallel steps). An agent decides the path itself. Workflows are cheaper, faster and more predictable, so use them when the steps are known; use agents for open-ended tasks where the steps depend on what is found. Start simple and add autonomy only where it pays.

Least-privilege tools with permissions enforced in code, human approval for irreversible or costly actions, input and output guardrails, sandboxed code execution, limits on steps, time and spend, protection against prompt injection (treat tool results and user content as data), full tracing and audit logs, and evaluation before every release.

Measure task success on a realistic dataset, plus the path: tool choice accuracy, number of steps, errors, cost and latency. Use code checks where outcomes are verifiable, LLM-as-judge with rubrics for quality, and human review on samples. Run several trials per task because outputs vary, and monitor online after release.

Start with the simplest option: a single prompt, then a fixed workflow. Use an agent only when the steps cannot be known in advance, the task benefits from tool use and iteration, and the value justifies extra cost, latency and risk. Measure whether the agent actually beats the simpler baseline.

Return clear error messages to the model so it can fix arguments, retry transient failures with backoff in the tool layer, cap attempts, fall back to a human or a safe default after repeated failure, and make write tools idempotent so retries never duplicate actions.

Least privilege: give each agent only the tools and scopes it needs, use the end user's identity and permissions rather than a super-user account, separate read and write tools, require approval for irreversible actions, and log every action for audit.

Looping or giving up early, choosing the wrong tool or bad arguments, hallucinating results instead of calling tools, losing track of the goal in long contexts, following injected instructions from data, and excessive cost. Evaluations and traces should look for each of these.

ReAct (reason, act, observe in a loop), plan-and-execute (make a plan, then run steps, re-planning when needed), reflection (critique and revise its own output), routing (send inputs to specialised handlers), orchestrator-workers (a lead agent splits work among sub-agents), and evaluator-optimiser (one model generates, another grades until good enough).

Short-term memory is the context window and conversation state for the current task. Long-term memory stores facts across sessions: semantic (facts about the user), episodic (past interactions) and procedural (learned instructions), usually in a database or vector store and retrieved when relevant. Memory needs rules for what to save, update and forget.

Instructions hidden in content the agent reads (a web page, an email, a document) that try to make it ignore its rules, leak data or misuse tools. Defences: never give tools more permission than the task needs, keep sensitive actions behind approvals, separate untrusted content from instructions, filter outputs, limit where data can be sent, and test with adversarial examples. No defence is complete, so limit the blast radius.

An open standard for connecting AI applications to tools and data. An MCP server exposes tools, resources and prompts; any MCP client (Claude, IDEs, agent frameworks) can use them. It replaces one-off integrations per app with one reusable server, running locally over stdio or remotely over HTTP with authentication.

Few, distinct tools with clear names and descriptions, typed arguments with examples, outputs that are concise and relevant (not huge raw dumps), helpful error messages the model can act on, idempotent writes, and permission checks in the tool itself. Test tool selection in evaluations.

When a task splits into specialised roles with different tools or context, when parallel exploration helps (research across many sources), or when one context window cannot hold everything. Multi-agent systems cost more tokens and are harder to debug, so use them when measurements show a single agent struggles.

Ask it to write a plan before acting, keep the plan in state, check off steps, and re-plan when observations change. Plan-and-execute patterns use a planner model and executor steps; reflection steps review results before finishing.

After producing a result, the agent (or a separate critic) reviews it against the goal or criteria and revises. It improves quality for writing, code and analysis, but costs extra calls and can loop, so cap the rounds.

Summarise or trim old messages, store large tool outputs outside the context and reference them, retrieve only relevant memories, use sub-agents with their own clean context for sub-tasks, and keep instructions stable at the top for caching.

The model receives screenshots or an accessibility tree of a screen and returns actions such as click, type or scroll, which a harness executes; the loop repeats. They can automate apps without APIs, but are slower and more error-prone, so sandbox them and require confirmation for sensitive steps.

Trace every step: prompts, model outputs, tool calls with arguments and results, latency, tokens and cost. Attach IDs for users and sessions, record final outcomes and feedback, and review samples of traces regularly.

Build a suite of realistic tasks with success criteria, run each several times, score outcomes and trajectories with code checks and LLM judges, include adversarial cases such as prompt injection, and compare against the previous version before deploying.

Use smaller models for simple steps, cap steps and tokens, cache repeated calls and prompt prefixes, trim and summarise context, return compact tool outputs, run independent steps in parallel, and track cost per task in traces.

Deciding exactly what goes into the model's context at each step: instructions, relevant retrieved knowledge, tool definitions, memory and recent history, while leaving out noise. Good context engineering (selection, compression, ordering and isolation between sub-agents) often matters more than prompt wording for agent quality.

Humans set goals and limits, approve risky actions, review uncertain outputs, handle escalations and give feedback that becomes evaluation data. Interfaces should show what the agent did and why, and make it easy to correct or stop it.

Deterministic routing uses rules or classifiers you control to pick a path; model routing lets the LLM choose. Deterministic routes are cheaper and predictable; model routing handles fuzzier cases. Many systems combine them.

The agent writes code (Python, SQL) and runs it in a sandbox to calculate, transform data or call APIs, then reads the output. It is powerful for precise work but needs isolation, time and resource limits, and no access to secrets.

Specialised agents called by a main agent for a focused task, each with its own instructions, tools and fresh context. They keep the main context small and allow parallel work, at the cost of more calls and coordination.

Limit the data tools can return, redact personal data, filter outputs, block tools that send data externally unless approved, and avoid putting secrets in prompts. Treat every tool result as untrusted input.

The code around the model that runs the loop: building prompts, exposing tools, executing calls, managing memory and context, enforcing limits and handling errors. Harness quality often matters as much as model choice.

Protocols such as Google's Agent2Agent let agents built by different vendors discover each other's capabilities (agent cards) and exchange tasks and results in a standard way, complementing MCP, which connects an agent to tools and data.

Track task success rate, time saved, cost per completed task, escalation rate to humans, user satisfaction and error impact, and compare against the manual or previous process.

1. AIt uses a large model
2. BThe model decides its next actions and uses tools in a loopCorrect answer
3. CIt has a chat UI
4. DIt runs on GPUs

Why: Autonomy over the steps and tool use is the defining feature.

1. AReActCorrect answer
2. BMVC
3. CCQRS
4. DMapReduce

Why: ReAct interleaves reasoning and acting.

1. ASearching internal docs
2. BReading a public web page
3. CIssuing a large refundCorrect answer
4. DSummarising a document

Why: Irreversible or costly actions need a human check.

1. ATrying a simpler prompt or workflowCorrect answer
2. BBuying more GPUs
3. CWriting a UI
4. DFine-tuning

Why: Agents add cost and risk.

1. AA super-admin account
2. BNo authentication
3. CA shared password
4. DThe end user's, with least privilegeCorrect answer

Why: Limits the blast radius.

1. ATo speed up reads
2. BTo save tokens
3. CIt is required by MCP
4. DRetries must not duplicate actionsCorrect answer

Why: Agents and networks retry.

1. AHow AI apps connect to tools and dataCorrect answer
2. BGPU drivers
3. CToken pricing
4. DModel training

Why: MCP is a protocol between clients and tool/data servers.

1. ABigger models
2. BA longer system prompt only
3. CLeast-privilege tools and approvals for risky actionsCorrect answer
4. DHigher temperature

Why: Limiting what a manipulated agent can do reduces harm.

1. AWhen the task is open-ended
2. BNever
3. COnly for images
4. DWhen steps are known in advanceCorrect answer

Why: Fixed steps are cheaper and more predictable.

1. AOutputs vary between runsCorrect answer
2. BEvals require it legally
3. CTo warm the cache
4. DTo use more credits

Why: Averaging over runs gives a reliable success rate.

1. AA review-and-revise stepCorrect answer
2. BMore tools
3. CLower cost
4. DA database

Why: Cap the rounds.

1. ATo remove logging
2. BThey are always cheaper
3. CFocused tasks with clean, separate contextCorrect answer
4. DTo avoid using tools

Why: Main context stays small.

1. AAlways pasted in full
2. BDeleted
3. CSent to the user
4. DStored outside the context and referencedCorrect answer

Why: Saves context space.

1. ASource code only
2. BScreenshots or an accessibility treeCorrect answer
3. COnly text APIs
4. DDatabase dumps

Why: It returns UI actions.

1. AWith admin rights
2. BWithout timeouts
3. CIn an isolated sandbox with limitsCorrect answer
4. DOn the production server

Why: Contain damage from bad code.

1. AStored information reused across sessionsCorrect answer
2. BThe model weights
3. CGPU memory
4. DThe current prompt

Why: It persists facts and past interactions outside the context window.

1. AExecutes every tool itself
2. BSplits the task and delegates to workersCorrect answer
3. COnly stores data
4. DTrains the workers

Why: It plans and combines the workers' results.

1. AOnly its file path
2. BNothing
3. CThe developer's name
4. DWhat it does, when to use it and its argumentsCorrect answer

Why: The model chooses tools from their descriptions.

1. AHigher temperature
2. BA maximum step or token budgetCorrect answer
3. CA bigger context window
4. DStreaming

Why: Budgets stop agents that are stuck.

1. ALonger answers
2. BBlocking outputs containing personal dataCorrect answer
3. CUsing more GPUs
4. DAdding emojis

Why: Guardrails check inputs and outputs against rules.

1. ARuns the loop, tools, memory and limitsCorrect answer
2. BTrains the model
3. CHosts the website
4. DStores images

Why: The code around the model.

1. AAnswering without calling the needed toolCorrect answer
2. BCalling a tool twice
3. CAsking for approval
4. DLogging too much

Why: Check trajectories.

1. APlanning from step executionCorrect answer
2. BFrontend from backend
3. CTraining from inference
4. DReads from writes

Why: A planner then executors.

1. ANumber of tokens
2. BNumber of tools
3. CPrompt length
4. DTask success rateCorrect answer

Why: Pair it with cost per task.

1. AAlways correct
2. BSecrets
3. CUntrusted inputCorrect answer
4. DSystem instructions

Why: They may contain injections.

1. AChosen by the model each time
2. BRandom
3. CManual only
4. DRule- or classifier-based and predictableCorrect answer

Why: Cheaper and testable.

1. AUsers to databases
2. BBrowsers to CDNs
3. CAgents to agentsCorrect answer
4. DModels to GPUs

Why: They let agents from different systems collaborate.

1. AWriting CSS
2. BNetwork routing
3. CTraining data
4. DChoosing what goes into the model's context at each stepCorrect answer

Why: The right context drives agent quality.

1. APrompt length
2. BModel size
3. CHow often tasks are handed to humansCorrect answer
4. DServer CPU

Why: A key business metric.

1. AUI themes
2. BPrompt injection attemptsCorrect answer
3. COnly happy paths
4. DEmpty files only

Why: Test the defences.