Why bother asking about crypto at all?
* What’s the difference between symmetric and public-key cryptography
* In public-key cryptography you have a public and a private key, and you often perform both encryption and signing functions. Which key is used for which function?
* Cryptographically speaking, what is the main method of building a shared secret over a public medium?
* What’s the difference between Diffie-Hellman and RSA?
* What kind of attack is a standard Diffie-Hellman exchange vulnerable to?
* What’s the difference between encoding, encryption, and hashing?
Here's my issue: if these are the questions you're asking, you're clearly never going to actually work with cryptography in your job. You may indeed end up deploying some appliance that uses "standard Diffie Hellman" somewhere, but you'll have no more control over that than you would over the LZW variant it uses to compress.
And that's fine! I think fewer people should deal with crypto, because people invariably get it wrong. But it's my suspicion that these questions are really just shibboleths; they're trivia meant to establish whether you're in the club or not.
In contrast:
* Where do you get your security news from: you will somehow have to keep abreast of security news (although, be honest, this is really just a question designed to bolster the club of security bloggers).
* What’s the difference between HTTP and HTML? Presumably if your candidate doesn't know how computers work, they won't do well at infosec.
* How does HTTP handle state? This is a fine question, although I don't understand why he calls cookies a "non-native" hack, since they're standardized as "HTTP's State Tracking Mechanism".
* What exactly is Cross Site Scripting? Sure, this is a great example of the kind of vulnerabilities corp infosec people routinely stumble across...
* What’s the difference between stored and reflected XSS? ... and if you've read anything about XSS, you know the OWASP-y taxonomy (although I might ask a corp infosec person to recite the OWASP top 10 instead)...
* What are the common defenses against XSS? ... and sure, you should know how to spot a bad fix to XSS, like trying to filter the <script> tag.
* What kind of network do you have at home? I have a Macbook. And an access point. I think the access point might be a 2wire? I guess I'm out the door.
* What is Cross-Site Request Forgery? As with XSS, a reasonable appsec thing for infosec generalists to know.
* How does one defend against CSRF? A little less reasonable but still germane (he appears to get this one wrong).
* What port does ping work over? This is the oldest trick question in the book (I think Cambridge Technology Partners made it up), but, sure, you're going to have to be able to firewall ICMP in your job.
* How exactly does traceroute/tracert work at the protocol level? One of my favorite interview question for developers is "how would you speed up normal traceroute" so I'm biased.
These are all reasonable questions, some I like better than others, that all have something to do with the actual job of being in infosec.