These are not IS questions, they are ITS questions. There is a very serious difference between the two.<p>ITS without IS governance, policy, and management is worthless. It is chasing <i>ménaces du jour</i>, not actually managing security.<p>Were I interviewing someone for a serious and senior IS role, I would start with social questions, asking them to describe what organizations they consider to be the most threatening in general and to businesses in my country and field specifically, and why.<p>I would describe (hypothetically, without saying so) an organization like mine (but different enough to give away little), its flaws and concerns, and ask them how they would address those flaws.<p>Were I to hire that senior IS person, I would let them build an IS organization, which would include an ITS component.<p>Without policy, governance, and management, you do not have security, you have techno farce - and your organization will remain perpetually reactive, never really knowing how secure it is, never really being able to assess risk reasonably.