Security interview questions
50 Security interview questions with answers, from junior to mid level.
Foundations
- What are the three goals of information security, known as the CIA triad?
- In security, what is a vulnerability?
- What is malware?
- What does a firewall do?
- Why should you install software updates and security patches quickly?
- What is PII?
- What is OWASP and what is its Top 10?
- Which habit best protects your online accounts?
Core
- Which is the correct primary defense against SQL injection?
- How should user passwords be stored?
- Hashing vs encryption?
- The principle of least privilege means…
- You accidentally pushed an API key to a public GitHub repo, then deleted the commit. What must you do?
- Authentication vs authorization?
- What is multi-factor authentication (MFA)?
- An email that looks like it comes from your bank asks you to 'verify your account' on a link. This is typically…
- Your form checks the email format in JavaScript before sending. Is server-side validation still needed?
- Which is a property of a cryptographic hash function like SHA-256?
- Where should an application's database password or API keys be kept?
- A library your app uses has a published vulnerability (a CVE). What is the right response?
- A website shows the HTTPS padlock. What does that guarantee?
- An attacker tries thousands of passwords per minute on one account. Which control helps most directly?
- What do SAST, DAST and SCA tools do?
Intermediate
- A comment containing
<script>is saved and later shown to other users, running in their browsers. This is… - CSRF attacks work because…
- What is the purpose of a salt in password hashing?
- TLS (HTTPS) provides which guarantees?
- Symmetric vs asymmetric cryptography?
- In both the 2021 and 2025 OWASP Top 10, which category is ranked #1?
- Changing
/api/orders/1001to/api/orders/1002shows another customer's order. This vulnerability is… - Is CORS a security control that protects your API from attackers?
- Attackers try leaked email/password pairs from other breaches against your login. Strongest mitigation?
- For input validation, which approach is safer?
- A request to
/download?file=../../etc/passwdreturns the system file. This is… - You find a vulnerability in production code. What do you do?
- Log4Shell (2021) taught the industry which main lesson?
- What does "defense in depth" mean?
- What is threat modeling and the STRIDE categories?
- What is the difference between encryption in transit and encryption at rest?
- Why is
@Validon request bodies plus parameterized queries part of secure coding in Spring? - What software security techniques should a backend developer know?
Advanced
- Your 'fetch image from URL' feature lets an attacker request
http://169.254.169.254/latest/meta-data/. This is… - Why must a JWT verifier explicitly specify allowed algorithms?
- Which HTTP header is a strong defense-in-depth layer against XSS?
- What does the
Strict-Transport-Security(HSTS) header do? - Why is
pickle.loads()on data from users dangerous? - Session fixation is prevented by…
- Explain at a high level what happens in a TLS handshake.
- Why is Java deserialization of untrusted data dangerous?
- Which practice best prevents secrets leaking into source code in a Java/Spring project?