├── .gitignore ├── Cloud_Security_Engineer_Scenario_Questions.md ├── README.md ├── Security_Architect_Scenario_Questions.md ├── Senior AI Pentester_Interview.md ├── ai-security-interview-questions.md ├── api-security-interview-questions.md ├── application-security-interview-questions.md ├── aws-security-interview-questions.md ├── common-security-interview-questions.md ├── container-security-interview-questions.md ├── cybersecurity-interview-questions.png ├── devsecops-interview-questions.md ├── gcp-security-interview-questions.md ├── grc-interview-questions.md ├── network-security-interview-questions.md ├── soc-interview-questions.md └── web-security-interview-questions.md /.gitignore: -------------------------------------------------------------------------------- 1 | .idea 2 | .idea/* 3 | -------------------------------------------------------------------------------- /Cloud_Security_Engineer_Scenario_Questions.md: -------------------------------------------------------------------------------- 1 | 2 | # Cloud Security Engineer Scenario Based Interview Questions 3 | 4 | ## Scenario 1: Securing AWS Deployment 5 | 6 | **Question**: Your team is deploying a new application on AWS. What steps would you take to secure this deployment? 7 | 8 | ### Answer: 9 | 10 | - **IAM Configuration**: Configure IAM roles and policies to enforce least privilege. 11 | - Tools: AWS IAM, AWS Organizations. 12 | - Practices: Define granular permissions, use service-linked roles. 13 | 14 | - **Network Security**: Set up network security groups and VPCs. 15 | - Tools: AWS VPC, Security Groups, NACLs. 16 | - Practices: Implement VPC peering, enable flow logs, use private subnets. 17 | 18 | - **DDoS Protection**: Use AWS Shield and WAF for DDoS protection. 19 | - Tools: AWS Shield, AWS WAF. 20 | - Practices: Configure WAF rules to filter malicious traffic. 21 | 22 | - **Monitoring and Logging**: Enable CloudTrail and CloudWatch for monitoring. 23 | - Tools: AWS CloudTrail, AWS CloudWatch. 24 | - Practices: Set up alarms and notifications, monitor logs for suspicious activity. 25 | 26 | - **Data Encryption**: Ensure encryption for data at rest and in transit. 27 | - Tools: AWS KMS, S3 encryption, TLS/SSL. 28 | - Practices: Use KMS to manage keys, enable bucket-level encryption. 29 | 30 | ## Scenario 2: Multi-Cloud Security Management 31 | 32 | **Question**: How would you handle the security of multi-cloud environments, considering the different security models of each provider? 33 | 34 | ### Answer: 35 | 36 | - **Unified Security Policy**: Develop a unified security policy for all environments. 37 | - Practices: Define common security controls, standardize policies across clouds. 38 | 39 | - **Centralized IAM**: Use a centralized identity provider for consistent IAM. 40 | - Tools: Okta, Azure AD, Google Cloud IAM. 41 | - Practices: Implement SSO, MFA, and centralized user management. 42 | 43 | - **Network Security**: Implement consistent network security controls. 44 | - Tools: Cloud-native firewalls, SDN solutions. 45 | - Practices: Use network segmentation, apply consistent security group rules. 46 | 47 | - **Continuous Monitoring**: Set up centralized logging and monitoring. 48 | - Tools: SIEM solutions like Splunk, ELK Stack. 49 | - Practices: Aggregate logs, configure cross-cloud monitoring dashboards. 50 | 51 | - **Compliance and Auditing**: Ensure compliance across all cloud environments. 52 | - Tools: Compliance management tools like AWS Config, Azure Policy. 53 | - Practices: Regular audits, compliance checks, automated remediation. 54 | 55 | ## Scenario 3: Implementing Cloud Security Automation 56 | 57 | **Question**: How would you integrate security into CI/CD pipelines for cloud deployments? 58 | 59 | ### Answer: 60 | 61 | - **Static Analysis**: Integrate static code analysis in the CI pipeline. 62 | - Tools: SonarQube, Checkmarx. 63 | - Practices: Automate code scanning, enforce code quality gates. 64 | 65 | - **Dynamic Analysis**: Perform dynamic application security testing (DAST). 66 | - Tools: OWASP ZAP, Burp Suite. 67 | - Practices: Automate DAST scans, integrate with CI/CD pipeline. 68 | 69 | - **Infrastructure as Code (IaC) Security**: Scan IaC templates for vulnerabilities. 70 | - Tools: Terraform, AWS CloudFormation, Checkov. 71 | - Practices: Automate IaC security checks, enforce security policies in IaC. 72 | 73 | - **Container Security**: Implement container security scanning. 74 | - Tools: Docker Bench, Aqua Security. 75 | - Practices: Automate container scans, enforce secure container images. 76 | 77 | - **Continuous Compliance**: Ensure continuous compliance checks. 78 | - Tools: AWS Config, Azure Policy. 79 | - Practices: Automate compliance scans, integrate compliance checks in CI/CD. 80 | 81 | ## Scenario 4: Responding to Cloud Security Incidents 82 | 83 | **Question**: How would you respond to a security incident in a cloud environment? 84 | 85 | ### Answer: 86 | 87 | - **Detection and Analysis**: Detect and analyze the incident. 88 | - Tools: Cloud-native monitoring tools like CloudWatch, Azure Monitor. 89 | - Practices: Set up alerts, analyze logs, and identify the root cause. 90 | 91 | - **Containment and Mitigation**: Contain the incident to prevent further damage. 92 | - Practices: Isolate affected resources, apply temporary controls, disable compromised accounts. 93 | 94 | - **Eradication and Recovery**: Eradicate the root cause and recover affected systems. 95 | - Practices: Apply patches, clean affected systems, restore data from backups. 96 | 97 | - **Post-Incident Review**: Conduct a post-incident review to improve processes. 98 | - Practices: Document the incident, identify lessons learned, update incident response plan. 99 | 100 | - **Communication**: Communicate with stakeholders throughout the incident. 101 | - Practices: Provide regular updates, coordinate with legal and compliance teams, inform affected users. 102 | 103 | ## Scenario 5: Securing Cloud-Based APIs 104 | 105 | **Question**: How would you secure APIs deployed in a cloud environment? 106 | 107 | ### Answer: 108 | 109 | - **Authentication and Authorization**: Implement strong authentication and authorization. 110 | - Tools: OAuth 2.0, OpenID Connect, API Gateway. 111 | - Practices: Enforce MFA, use access tokens, apply RBAC. 112 | 113 | - **Rate Limiting and Throttling**: Implement rate limiting to prevent abuse. 114 | - Tools: API Gateway features. 115 | - Practices: Define rate limits, implement throttling policies. 116 | 117 | - **Input Validation and Sanitization**: Validate and sanitize all inputs. 118 | - Practices: Apply input validation rules, sanitize user inputs to prevent injection attacks. 119 | 120 | - **Logging and Monitoring**: Enable logging and monitoring for APIs. 121 | - Tools: API Gateway logs, CloudWatch, Azure Monitor. 122 | - Practices: Monitor API usage, set up alerts for suspicious activities. 123 | 124 | - **Encryption**: Ensure data encryption for APIs. 125 | - Practices: Use TLS for data in transit, encrypt sensitive data at rest. 126 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # Cybersecurity Interview Questions Collections 2 | **Security interview questions for different security skills with possible explanations.** 3 | 4 |  5 | 6 | This GitHub repo is for security professionals who want to prepare for various security roles with different skill sets, such as AppSec, DevSecOps, cloud security, etc. 7 | 8 | _Feel free to contribute to different security interview pages based on your interview experience._ 9 | I am adding interview questions based on my experience and different network conversations on the same topic(s). 10 | 11 | ## ToC 12 | 1. [Common Security Interview Questions](common-security-interview-questions.md) 13 | 2. [Web Security/ Penetration testing Interview Quesitons](web-security-interview-questions.md) 14 | 3. [Application Security Interview Questions](application-security-interview-questions.md) 15 | 4. [API Security Interview Questions](api-security-interview-questions.md) 16 | 5. [Network Security Interview Questions](network-security-interview-questions.md) 17 | 6. [AWS Security Interview Questions](aws-security-interview-questions.md) 18 | 7. [GCP Security Interview Questions](gcp-security-interview-questions.md) 19 | 8. [DevSecOps Interview Questions](devsecops-interview-questions.md) 20 | 9. [Container Interview Questions](container-security-interview-questions.md) 21 | 10. [SOC Interview Questions](soc-interview-questions.md) 22 | 11. [GRC Interview Questions](grc-interview-questions.md) 23 | -------------------------------------------------------------------------------- /Security_Architect_Scenario_Questions.md: -------------------------------------------------------------------------------- 1 | 2 | # Security Architect Scenario Based Interview Questions 3 | 4 | ## Scenario 1: Hybrid Cloud Migration 5 | 6 | **Question**: Your company is migrating critical services to a hybrid cloud environment. How would you ensure data security and compliance during this migration? 7 | 8 | ### Answer: 9 | 10 | - **Risk Assessment**: Start with a comprehensive risk assessment to identify potential vulnerabilities in the current and new environments. 11 | - Tools: Use tools like NIST Cybersecurity Framework, and CIS Controls. 12 | - Output: Document potential risks and corresponding mitigations. 13 | 14 | - **Data Encryption**: Implement encryption for data at rest and in transit. 15 | - Tools: Use encryption tools like AWS KMS, Azure Key Vault, or Google Cloud KMS. 16 | - Techniques: Apply AES-256 for data encryption and TLS 1.2/1.3 for data in transit. 17 | 18 | - **Compliance**: Ensure adherence to relevant regulations (e.g., GDPR, HIPAA). 19 | - Steps: Regular audits, data classification, and applying specific security controls. 20 | - Documentation: Maintain an updated compliance matrix. 21 | 22 | - **IAM Policies**: Establish robust Identity and Access Management policies. 23 | - Tools: AWS IAM, Azure AD, Google IAM. 24 | - Practices: Implement MFA, RBAC, and least privilege access. 25 | 26 | - **Monitoring and Logging**: Implement continuous monitoring and logging. 27 | - Tools: AWS CloudTrail, Azure Monitor, Google Cloud Operations Suite. 28 | - Setup: Configure alerts for unusual activities and regularly review logs. 29 | 30 | ## Scenario 2: Vulnerability Response 31 | 32 | **Question**: A new vulnerability has been discovered in a critical application used by your organization. As a Security Architect, how would you handle this situation? 33 | 34 | ### Answer: 35 | 36 | - **Assessment and Prioritization**: Assess the severity and impact of the vulnerability. 37 | - Tools: CVSS scoring, vulnerability management tools like Qualys or Nessus. 38 | - Output: Determine the urgency based on business impact. 39 | 40 | - **Coordination**: Coordinate with development and operations teams for patching. 41 | - Steps: Schedule patching during maintenance windows to minimize disruption. 42 | - Tools: Patch management tools like WSUS, SCCM. 43 | 44 | - **Mitigation**: Apply temporary mitigations if immediate patching is not possible. 45 | - Techniques: Network segmentation, application firewalls, disabling vulnerable features. 46 | 47 | - **Communication**: Inform stakeholders and provide updates on the remediation process. 48 | - Steps: Regular status meetings, email updates, incident tracking systems. 49 | 50 | - **Post-Incident Review**: Conduct a post-incident review to identify gaps. 51 | - Tools: RCA (Root Cause Analysis) tools. 52 | - Output: Implement lessons learned and update security practices. 53 | 54 | ## Scenario 3: Designing a Secure Application 55 | 56 | **Question**: You are tasked with designing a new web application with security as a priority. What steps would you take? 57 | 58 | ### Answer: 59 | 60 | - **Security Requirements Gathering**: Identify and document security requirements. 61 | - Techniques: Threat modeling, stakeholder interviews. 62 | - Output: A comprehensive security requirements document. 63 | 64 | - **Secure Development Practices**: Incorporate secure coding practices. 65 | - Techniques: OWASP Secure Coding Practices. 66 | - Tools: Static code analysis tools like SonarQube, Checkmarx. 67 | 68 | - **Authentication and Authorization**: Implement strong authentication and authorization mechanisms. 69 | - Tools: OAuth 2.0, OpenID Connect, JWT for session management. 70 | - Practices: Enforce MFA, use RBAC. 71 | 72 | - **Data Protection**: Ensure data is protected at rest and in transit. 73 | - Techniques: AES-256 encryption, TLS for data in transit. 74 | - Tools: Database encryption features, key management systems. 75 | 76 | - **Regular Security Testing**: Conduct regular security testing throughout the development lifecycle. 77 | - Tools: SAST, DAST tools like OWASP ZAP, Burp Suite. 78 | - Practices: Continuous integration of security testing in CI/CD pipelines. 79 | 80 | ## Scenario 4: Implementing Zero Trust Architecture 81 | 82 | **Question**: Your organization wants to move to a Zero Trust Architecture. How would you approach this transformation? 83 | 84 | ### Answer: 85 | 86 | - **Assessment and Planning**: Conduct a current state assessment and plan the Zero Trust implementation. 87 | - Techniques: Gap analysis, defining clear goals and objectives. 88 | - Output: Zero Trust roadmap. 89 | 90 | - **Identity and Access Management**: Strengthen IAM policies. 91 | - Tools: Identity providers like Okta, Azure AD. 92 | - Practices: Enforce MFA, context-aware access controls. 93 | 94 | - **Network Segmentation**: Implement micro-segmentation to isolate resources. 95 | - Tools: SDN solutions like VMware NSX, Cisco ACI. 96 | - Practices: Define granular network policies. 97 | 98 | - **Continuous Monitoring**: Establish continuous monitoring and analytics. 99 | - Tools: SIEM solutions like Splunk, ELK Stack. 100 | - Practices: Real-time monitoring, anomaly detection. 101 | 102 | - **Least Privilege**: Apply the principle of least privilege across the organization. 103 | - Tools: PAM solutions like CyberArk, BeyondTrust. 104 | - Practices: Regularly review and adjust access permissions. 105 | 106 | ## Scenario 5: Securing a Remote Workforce 107 | 108 | **Question**: With a significant portion of the workforce now remote, how would you ensure security and compliance? 109 | 110 | ### Answer: 111 | 112 | - **Secure Remote Access**: Implement secure remote access solutions. 113 | - Tools: VPNs, Zero Trust Network Access (ZTNA) solutions like Zscaler, Perimeter 81. 114 | - Practices: Use split-tunneling, enforce MFA. 115 | 116 | - **Endpoint Security**: Ensure all remote endpoints are secure. 117 | - Tools: EDR solutions like CrowdStrike, Carbon Black. 118 | - Practices: Regularly update and patch systems, use disk encryption. 119 | 120 | - **Data Protection**: Protect sensitive data accessed remotely. 121 | - Tools: DLP solutions, encryption tools. 122 | - Practices: Enforce data classification, restrict data sharing. 123 | 124 | - **User Awareness Training**: Conduct regular security awareness training. 125 | - Topics: Phishing, secure password practices, remote work security tips. 126 | - Tools: Training platforms like KnowBe4, SANS Security Awareness. 127 | 128 | - **Monitoring and Compliance**: Continuously monitor and ensure compliance. 129 | - Tools: SIEM solutions, compliance management tools. 130 | - Practices: Regular audits, real-time monitoring of remote access logs. 131 | -------------------------------------------------------------------------------- /Senior AI Pentester_Interview.md: -------------------------------------------------------------------------------- 1 | # AI Pentester Scenario-Based Interview Questions 2 | 3 | ## Scenario 1: AI Model Security Assessment 4 | 5 | **Question**: You are tasked with assessing the security of an AI model used for critical decision-making. What steps would you take? 6 | 7 | **Answer**: 8 | 9 | - **Understanding the Model**: 10 | - Start by understanding the AI model’s architecture. 11 | - **Techniques**: Review documentation, understand data inputs and outputs. 12 | - **Tools**: Model interpretability tools like LIME, SHAP. 13 | 14 | - **Adversarial Testing**: 15 | - Perform adversarial testing to identify vulnerabilities. 16 | - **Techniques**: Generate adversarial examples, test model robustness. 17 | - **Tools**: CleverHans, Foolbox. 18 | 19 | - **Data Pipeline Security**: 20 | - Evaluate the data pipeline for vulnerabilities. 21 | - **Practices**: Ensure data sanitization, secure data storage. 22 | - **Tools**: Data validation libraries. 23 | 24 | - **Compliance Review**: 25 | - Ensure the model complies with relevant security standards. 26 | - **Practices**: Review compliance with GDPR, HIPAA, etc. 27 | - **Tools**: Compliance checklists, audit tools. 28 | 29 | - **Reporting**: 30 | - Provide a comprehensive report detailing vulnerabilities and recommendations. 31 | - **Practices**: Document findings, suggest mitigations, and improvements. 32 | 33 | --- 34 | 35 | ## Scenario 2: Model Poisoning Attack 36 | 37 | **Question**: During a pentest, you discover that an AI system is vulnerable to model poisoning attacks. How would you address this issue? 38 | 39 | **Answer**: 40 | 41 | - **Immediate Alert**: 42 | - Alert stakeholders about the vulnerability. 43 | - **Practices**: Immediate communication with relevant teams. 44 | 45 | - **Data Validation**: 46 | - Implement stricter controls on data input sources. 47 | - **Techniques**: Data validation, anomaly detection. 48 | - **Tools**: Data validation libraries, anomaly detection tools. 49 | 50 | - **Monitoring**: 51 | - Set up continuous monitoring for suspicious activities. 52 | - **Tools**: Monitoring tools, anomaly detection systems. 53 | - **Practices**: Real-time monitoring, alerting for unusual patterns. 54 | 55 | - **Model Retraining**: 56 | - Retrain the model with clean, verified data. 57 | - **Practices**: Use a clean dataset, apply data augmentation techniques. 58 | - **Tools**: Machine learning platforms for retraining. 59 | 60 | - **Post-Mortem Analysis**: 61 | - Conduct a post-mortem analysis to improve security. 62 | - **Practices**: Document the attack, analyze the root cause, implement lessons learned. 63 | 64 | --- 65 | 66 | ## Scenario 3: Privacy in AI Models 67 | 68 | **Question**: How would you ensure that an AI model adheres to privacy regulations like GDPR? 69 | 70 | **Answer**: 71 | 72 | - **Data Minimization**: 73 | - Ensure only necessary data is collected and used. 74 | - **Practices**: Implement data minimization principles. 75 | - **Tools**: Data anonymization and pseudonymization tools. 76 | 77 | - **User Consent**: 78 | - Ensure explicit user consent for data usage. 79 | - **Practices**: Implement consent management, user agreements. 80 | - **Tools**: Consent management platforms. 81 | 82 | - **Data Access Control**: 83 | - Restrict access to sensitive data. 84 | - **Practices**: Use RBAC, least privilege access. 85 | - **Tools**: IAM solutions, data access control tools. 86 | 87 | - **Data Anonymization**: 88 | - Anonymize data to protect user identities. 89 | - **Practices**: Apply anonymization techniques, ensure irreversibility. 90 | - **Tools**: Anonymization libraries and tools. 91 | 92 | - **Compliance Audits**: 93 | - Conduct regular compliance audits. 94 | - **Practices**: Schedule regular audits, maintain compliance documentation. 95 | - **Tools**: Compliance management tools, audit frameworks. 96 | 97 | --- 98 | 99 | ## Scenario 4: AI Model Bias and Fairness 100 | 101 | **Question**: You are asked to assess an AI model for bias and fairness. What steps would you take? 102 | 103 | **Answer**: 104 | 105 | - **Data Review**: 106 | - Review the training data for bias. 107 | - **Practices**: Analyze data distribution, identify potential biases. 108 | - **Tools**: Data analysis tools like pandas, NumPy. 109 | 110 | - **Model Evaluation**: 111 | - Evaluate the model’s performance across different demographics. 112 | - **Practices**: Perform fairness testing, analyze model outputs. 113 | - **Tools**: Fairness tools like IBM AI Fairness 360, Google’s What-If Tool. 114 | 115 | - **Bias Mitigation**: 116 | - Implement techniques to mitigate bias. 117 | - **Practices**: Use techniques like re-sampling, re-weighting, or adversarial debiasing. 118 | - **Tools**: Bias mitigation libraries and frameworks. 119 | 120 | - **Continuous Monitoring**: 121 | - Continuously monitor the model for bias. 122 | - **Practices**: Set up regular evaluations, monitor for performance drifts. 123 | - **Tools**: Monitoring tools, model evaluation scripts. 124 | 125 | - **Stakeholder Communication**: 126 | - Communicate findings and mitigation strategies to stakeholders. 127 | - **Practices**: Regular reports, stakeholder meetings. 128 | - **Output**: Documentation of bias mitigation strategies and their effectiveness. 129 | 130 | --- 131 | 132 | ## Scenario 5: Securing AI APIs 133 | 134 | **Question**: How would you secure APIs that expose AI model functionalities? 135 | 136 | **Answer**: 137 | 138 | - **Authentication and Authorization**: 139 | - Implement strong authentication and authorization mechanisms. 140 | - **Tools**: OAuth 2.0, OpenID Connect. 141 | - **Practices**: Enforce MFA, use access tokens, and implement RBAC. 142 | 143 | - **Rate Limiting**: 144 | - Implement rate limiting to prevent abuse. 145 | - **Tools**: API Gateway features. 146 | - **Practices**: Define and enforce rate limits. 147 | 148 | - **Input Validation**: 149 | - Ensure inputs are validated and sanitized. 150 | - **Practices**: Implement input validation rules, sanitize user inputs to prevent injection attacks. 151 | 152 | - **Logging and Monitoring**: 153 | - Enable logging and monitoring for API usage. 154 | - **Tools**: API Gateway logs, CloudWatch, Azure Monitor. 155 | - **Practices**: Monitor API usage, set up alerts for suspicious activities. 156 | 157 | - **Encryption**: 158 | - Ensure data encryption for APIs. 159 | - **Practices**: Use TLS for data in transit, encrypt sensitive data at rest. 160 | -------------------------------------------------------------------------------- /ai-security-interview-questions.md: -------------------------------------------------------------------------------- 1 | # AI Security Interview Questions 2 | -------------------------------------------------------------------------------- /api-security-interview-questions.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jassics/security-interview-questions/6fa8ab4a17032023622bc174fa37ccd0b0f067a2/api-security-interview-questions.md -------------------------------------------------------------------------------- /application-security-interview-questions.md: -------------------------------------------------------------------------------- 1 | # Application Security Interview Questions 2 | 3 | ## Setting up the context 4 | You can assess yourself by checking how many of these application security interview questions are easy for you, how many need finetuning and how many are yet to learn and master. Remember, every one of us is learning and a question is easy for you doesn’t mean it’s the same for everyone. However, it depends upon the role, and expectations set by the hiring manager and the interviewer. 5 | 6 | The question might look straightforward but your answer speaks more about your experience and hands-on in this domain. Try to analyze the question and answer honestly. 7 | 8 | Many questions might not be for your experience or role as I am sharing mixed questions asked for various roles in the Application Security domain. 9 | 10 | Also, I am not sharing questions on any programming language-specific or even programming-based security questions. That can possibly be another series of questions in my next release. 11 | 12 | ### First thing first 13 | This interview question set is mostly for defensive roles as compared to offensive roles which are mainly called “Penetration Testing or Web Security (sometimes it’s used interchangeably) ”. I will concentrate more on how an application is developed, maintained, and deployed and how as a security engineer you would help an engineering team to overcome security challenges. 14 | 15 | 16 | ### Second important note 17 | I am listing questions based on a few criteria: 18 | 19 | 1. Common to everyone who is in this domain or trying to enter this domain. 20 | 2. Some questions would be theoretical and you can consider those questions as a starting point to check the candidate’s overall knowledge 21 | 3. Some questions are for senior professionals 22 | 4. Some questions may have different answers depending on seniority level 23 | 5. Some questions can be to check your domain and leadership skills in this domain 24 | 25 | **_One more thing_** 26 | 27 | If you are new to this domain or planning to make a career in cybersecurity. You should see the study plan before delving into interview questions. 28 | 29 | __They are:__ 30 | 31 | 1. [Common Skills Study Plan](https://jassics.medium.com/study-plan-to-learn-common-skills-in-cybersecurity-865d15e28c46) that you can finish within 3 months 32 | 2. [20 Essential books that you should read from security world](https://jassics.medium.com/20-essential-books-for-every-security-pros-journey-cfba7033bb1c) 33 | 3. [Application Security Study Plan](https://github.com/jassics/security-study-plan/blob/main/application-security-study-plan.md) (You must go through it before trying for appsec interviews) 34 | 4. You can’t ignore API security at present. So, here is your [API Security Study Plan](https://github.com/jassics/security-study-plan/blob/main/api-security-study-plan.md) 35 | 5. Knowledge of Pentest will be an added advantage for you. Check this out: [Web Pentest Study Plan](https://github.com/jassics/security-study-plan/blob/main/web-pentest-study-plan.md) 36 | 6. You can star or bookmark [Security Study Plan](https://github.com/jassics/security-study-plan) which will give you an insight into what to study for various security domains. 37 | 38 | ## This space will focus more on: 39 | 40 | 1. Secure Code Review 41 | 2. Threat Modeling 42 | 3. Secure Coding 43 | 4. Secure Development 44 | 5. And anything that is defensive in nature and developer centric. For everything else related to [web security we have another page](web-security-interview-questions.md). 45 | 46 | If you are interviewing someone for Application Security Engineer role, could be juinor, senior or architect level. 47 | You can always start questions based on the person's experience in AppSec. However, below questions can be always interesting and will help you to understand the candidate better technically. 48 | Soft skills, team player, presentation skills, communication skills are out of the scope of this space. 49 | 50 | ### Application Security Basics Questions 51 | 1. Explain your top 3 favorite OWASP Top 10 vulnerabilities and why 52 | 2. How does TCP 3-way handshake work? 53 | 3. Why is TLS important in cybersecurity and can you [explain the use of TLS in detail](https://kartik-chauhan.medium.com/demystifying-tls-f049b46eb2b3) for a website? 54 | 4. How SSL/TLS makes my content secured over the internet? 55 | 5. [What happens when you type google.com in your browser?](https://kevinkiruri.medium.com/what-happens-when-you-type-google-com-in-your-browser-and-press-enter-979955e31baf) 56 | 6. What’s the difference between SAST and SCA? 57 | 7. What is SQLi and how would you prevent/mitigate it? 58 | 8. Explain XSS with a few examples and how it can be avoided in the current software world. 59 | 9. How to avoid brute-force attacks on an application. Let’s say the login page. Explain everything that comes to your mind. 60 | 10. Tell us about a time when you had to learn something new really quickly and how did you go about it? 61 | 62 | ### Application Security Role-based questions 63 | 1. [Explain CORS, SOP, and CSP from security point of view](https://medium.com/@zhaojunemail/sop-cors-csrf-and-xss-simply-explained-with-examples-af6119156726) 64 | 2. How is CSRF dangerous for an application and what must be done to prevent CSRF in an application? 65 | 3. Explain the concept of input validation and why it is crucial for secure coding. Provide examples. 66 | 4. How do you approach secure error handling and logging in an application? 67 | 5. Discuss the role of encryption in secure coding and some best practices for implementing it. 68 | 6. What are some best practices for managing secrets and sensitive information in code? 69 | 7. How do you ensure the security of third-party libraries and dependencies in your code? 70 | 8. What are the key differences between manual code review and automated static analysis? 71 | 9. Describe your approach to conducting a secure code review. What do you look for first? 72 | 10. Can you give an example of a security vulnerability you discovered during a code review and how you addressed it? 73 | 11. Which secure coding standards do you follow during a code review (e.g., OWASP, CERT)? 74 | 12. How do you balance between finding security issues and maintaining development velocity during a secure code review? 75 | 13. Describe the STRIDE threat modeling methodology and provide examples of each threat type. 76 | 14. How do you prioritize threats identified during a threat modeling exercise? 77 | 15. How would you integrate threat modeling into an Agile development process? 78 | 79 | ### Overall Application Security Assessment-based Questions 80 | 1. Where do we need [security in the SDLC phase](https://www.wiz.io/academy/secure-sdlc)? 81 | 2. What would you suggest for input sanitization? 82 | 3. What should a developer do for secrets management? 83 | 4. What are some strategies for ensuring secure session management in web applications? 84 | 5. How do you handle security misconfigurations in development and production environments? 85 | 6. Discuss the importance of least privilege and role-based access control in application security. 86 | 7. How do you ensure that logging and monitoring are implemented securely and do not expose sensitive information? 87 | 8. What are the challenges of implementing SDL in a fast-paced development environment, and how do you overcome them? 88 | 9. Describe the various phases of SDL and the security activities involved in each phase. 89 | 10. How can an attacker exploit SSRF and what an application developer must do to prevent SSRF? [This medium article might help you to understand](https://vickieli.medium.com/bypassing-ssrf-protection-e111ae70727b) how to bypass SSRF protection. 90 | 91 | ### Some common “test your problem-solving skills” Application Security questions (mostly for senior roles) 92 | 1. What step would you plan to ensure developers follow secure coding practices? 93 | 2. How would you make developers aware and involved in secure code development? 94 | 3. How do you handle typical developer and security clash situations? 95 | 4. What were your interesting findings in the secure code review? 96 | 5. What are the common vulnerabilities you have experienced so far? 97 | 6. How would you approach identifying and mitigating security risks in a large, legacy codebase that hasn’t been regularly maintained for security? 98 | 7. Describe a strategy to ensure secure coding practices in a multi-team development environment, especially when teams are working on interdependent components. 99 | 8. How would you implement and enforce a secure coding standard in a globally distributed development team? 100 | 9. How would you design a security strategy to protect a microservices architecture from both external and internal threats? What are the challenges you might face while designing and implementing it? 101 | 10. Describe how you would conduct threat modeling for a cloud-native application. What specific security concerns are most critical in any cloud native application? 102 | 11. Can you provide an example of how you have implemented SDL in a past project? 103 | 12. What are some key metrics you would track to measure the effectiveness of an SDL program? 104 | 105 | ### Application Security Scenario-based interview questions 106 | Consider this section as the toughest one and mainly for senior appsec professional. 107 | 108 | 1. How would you design a safe and secure password mechanism? 109 | 2. Can you explain the password hashing function and the importance of salt? Also, how salting and hashing passwords are used in this domain? 110 | 3. You use the SCA tool to find vulnerabilities in 3rd party libraries. How would you mitigate those vulnerabilities found and risks associated with third-party libraries and frameworks? 111 | 4. Your company is developing a new financial application that handles sensitive customer data, including banking information. Describe how you would approach threat modeling for this application. What specific threats would you consider, and how would you prioritize and mitigate them? 112 | 5. You are tasked with performing a secure code review for a web application that has been recently developed. During the review, you find several instances where user inputs are directly concatenated into SQL queries. Explain how you would address this issue and guide the development team to implement a secure solution. 113 | 6. A development team is working on a new feature that requires handling and storing user passwords. They plan to use a simple hash function (e.g., MD5) to store these passwords. As a security architect, how would you advise them on securely handling and storing passwords? Provide a detailed explanation of best practices. 114 | 7. During a code review, you discover that the application does not properly handle errors and exceptions. For example, stack traces are exposed to end users, which could potentially reveal sensitive information. Describe how you would rectify this situation and implement secure error handling and logging practices. 115 | 8. A critical vulnerability is discovered in a third-party library used extensively in your company’s application. Explain the process you would follow to assess the impact, communicate with stakeholders, and implement a fix. How would you prevent similar issues in the future? 116 | 9. You are designing the architecture for a new e-commerce platform that includes a web application, mobile application, and backend APIs. Outline the security architecture you would propose, including key components and technologies to ensure robust security across all layers. 117 | 10. How would you review an architecture to prevent an automated brute force attack or dictionary attack (think of different brute force attack techniques)? 118 | 119 | ### Secure Code Review round with code snippets 120 | Many companies won’t have this round, but I feel one should involve a few code snippets in an interview to check the candidate’s indirect coding knowledge from security point of view, at least for a senior role like a lead or staff role. 121 | 122 | Insecure code snippets can be on a tougher note. However, I am adding a few easy ones for practice and to give an idea of how this round can be prepared well as per the JD. 123 | 124 | I would give you a hint for your practice, but in an interview, you won’t be given any hint. 125 | 126 | 1. Identify the security issue in this code snippet and explain how you would fix it. [Hint: Can you spot the CSRF issue here?] 127 | ```php 128 | if ($_SERVER['REQUEST_METHOD'] === 'POST') { 129 | $userId = $_POST['userId']; 130 | $newEmail = $_POST['newEmail']; 131 | updateEmail($userId, $newEmail); 132 | } 133 | ``` 134 | 135 | 2. Identify the security issue in this code snippet and explain how you would fix it. [Hint: Insecure desrialization] 136 | 137 | ```java 138 | ObjectInputStream in = new ObjectInputStream(new FileInputStream("data.ser")); 139 | Object obj = in.readObject(); 140 | in.close(); 141 | ``` 142 | 3. Identify the security issue in this code snippet and explain how you would fix it. [Hint: password hashing issue] 143 | 144 | ```python 145 | import hashlib 146 | def store_password(password): 147 | hashed_password = hashlib.md5(password.encode()).hexdigest() 148 | save_to_database(hashed_password) 149 | ``` 150 | 4. Which security issue it can cause? [Hint: XSS] 151 | 152 | ```typescript 153 | const userInput = request.query.userInput; 154 | const output = "