How do internal packages work? Give an example of an allowed and a forbidden import.

The compiler enforces this rule: a package whose path contains an internal element can be imported only by code rooted at the parent of that internal directory. It is the main tool for keeping a module's public API small.

example.com/app/
├── internal/db/           // importable by anything under example.com/app/...
├── api/
│   ├── internal/auth/     // importable only under example.com/app/api/...
│   └── handler.go         // OK: imports app/api/internal/auth
└── cmd/server/main.go     // OK: imports app/internal/db
                           // ERROR: imports app/api/internal/auth
// another module: import "example.com/app/internal/db"
//   => use of internal package not allowed

What the interviewer is looking for: you understand that everything outside internal/ in a published module is public API covered by semver, so helpers should be placed in internal/ by default and promoted later. Mention that the rule works on import paths, so it applies across modules too. Note also that vendor/ and testdata/ are special directories (testdata is ignored by the go tool). A top-level pkg/ directory is only a convention and has no enforced meaning.