Would you consider it an issue if you detected that a user had logged in as root to perform basic functions? If so, what actions would you take to prevent this?

The interviewer is asking for your opinion about whether this is a problem or not. Even though this format provides you with options when responding to the question, the interviewer probably has a specific answer in mind. When faced with a question like this, the best strategy is to choose the more conservative answer. This tells the interviewer that you are primarily concerned about the organization's information security. You can note that there may be exceptions to this primary responsibility as dictated by the company's information security policies and protocols.

"I believe the best practice is to only provide root access to qualified and approved systems administrators and information security personnel. Keeping the list of these users short ensures that no unauthorized root access will occur and that the systems will be safe and secure. If an unauthorized user gained root access, I would first deauthorize the access and kick them off the system. I would investigate how they were able to gain root access and patch any security vulnerabilities I discovered. On occasion, it may be appropriate to provide temporary root access, but only if the user is closely supervised."