FreeExam

Application security

A security engineer interview on finding and fixing common web application weaknesses, from injection and access control to secrets, TLS, and working with engineering teams.

These prompts are original practice. They are not questions from a named employer or a live hiring loop.

  1. 1.In a threat model, what is a trust boundary?

  2. 2.A bike-share team is adding a feature that unlocks bikes by scanning a QR code. When is threat modeling most useful for this feature?

  3. 3.In the STRIDE model, a customer denies placing an order and the system has no way to prove otherwise. Which category does this fall under?

  4. 4.A scan of a county library website returns 40 findings. Which factor matters most when deciding what to fix first?

  5. 5.A payroll service has two open findings: reflected cross-site scripting (XSS) on an internal admin page behind VPN and single sign-on, and SQL injection on the public login page. Which do you fix first?

  6. 6.A product manager at a ferry ticketing company needs security sign-off in two days. Your review finds a medium-risk issue with no quick fix. What is the best response?

  7. 7.What is the main idea of defense in depth?

  8. 8.Who should formally accept a residual security risk that the team decides not to fix?

  9. 9.A grain co-op's reporting page builds a SQL query by joining strings with a user-supplied farm name. What is the most reliable fix?

  10. 10.Why do parameterized queries prevent SQL injection?

  11. 11.A hotel booking API lets clients choose a sort column, and that name goes into an ORDER BY clause. Placeholders cannot be used for column names. What is the safest approach?

  12. 12.A team says they are safe from SQL injection because they use an ORM, an object-relational mapper. Where should a reviewer still look?

  13. 13.A photo printing service resizes uploads by running a shell command that includes the uploaded file name. What is the best fix?

  14. 14.A username is stored safely with a parameterized insert. Later, a nightly report joins that stored username into a SQL string. What is this flaw called?

  15. 15.A read-only reporting feature might one day ship with an injection flaw. Which database setup best limits the damage?

  16. 16.What is the right role of input validation in preventing injection?

  17. 17.A dog-walking marketplace uses a document database. Its login handler passes the parsed JSON body straight into a query filter. What risk should you flag?

  18. 18.A legal forms site serves downloads by opening a file path taken from a query parameter. What is the strongest fix?

  19. 19.A recipe-sharing site displays user comments. What is the primary defense against stored cross-site scripting (XSS) there?

  20. 20.A React app for a theater inserts show descriptions as raw HTML using the prop React provides for that. The descriptions come from a partner feed. What should you recommend?

  21. 21.User data is placed inside a JavaScript string in an inline script block. Why is HTML entity encoding not enough there?

  22. 22.What does a strict Content Security Policy that disallows inline scripts add to defenses against cross-site scripting (XSS)?

  23. 23.What does the HttpOnly flag on a session cookie do?

  24. 24.A florist's site reads the URL fragment and writes it into the page with innerHTML to show a greeting. The server never sees the fragment. What kind of flaw is this?

  25. 25.A profile page lets users set a personal website, which is rendered as a link's href. Which check stops script from running through that link?

  26. 26.A tutoring marketplace adds Markdown to its messages, and the Markdown renderer passes raw HTML through. What is the safest default?

  27. 27.Why is cross-site scripting (XSS) on an admin page often rated higher than the same flaw on a public page?

  28. 28.What makes a cross-site request forgery (CSRF) attack possible?

  29. 29.A credit union's money transfer form uses cookie-based sessions. Which control best prevents cross-site request forgery (CSRF) on it?

  30. 30.What does setting SameSite=Lax on a session cookie do for cross-site request forgery (CSRF) protection?

  31. 31.A school gradebook deletes an assignment when a teacher visits a GET URL. Why is this a cross-site request forgery (CSRF) concern?

  32. 32.An API for a parking meter app authenticates only with a bearer token in the Authorization header, which its own JavaScript sets. Why is classic cross-site request forgery (CSRF) less of a concern here?

  33. 33.A developer says Cross-Origin Resource Sharing (CORS) settings will stop cross-site request forgery (CSRF) on a form endpoint. What is wrong with this reasoning?

  34. 34.A museum membership API copies any Origin header into Access-Control-Allow-Origin and also allows credentials. What is the risk?

  35. 35.A chat app's link preview feature fetches any URL a user pastes, from the server. What is the main risk to flag?

  36. 36.A freight tracking company sends customer webhooks to URLs the customers provide. Which defense against server-side request forgery (SSRF) is most robust?

  37. 37.A service checks that a user-supplied hostname resolves to a public IP address, then fetches it, which triggers a second DNS lookup. What weakness remains?

  38. 38.Why do cloud teams require session tokens for the instance metadata service?

  39. 39.A solar installer's document importer checks the first URL against server-side request forgery (SSRF) rules, but its HTTP client follows redirects. What should change?

  40. 40.On a vacation rental site, changing the number in /bookings/1042 to 1043 shows another guest's booking. What is the root cause?

  41. 41.To fix an insecure direct object reference, a team proposes switching record IDs to random UUIDs. What is your response?

  42. 42.A city permit portal hides the Approve button from users who are not staff. What should a reviewer check?

  43. 43.A fitness studio's profile update endpoint binds the whole JSON body to the user model. A user sends is_admin set to true, and it is saved. What is this flaw?

  44. 44.Which design makes access control bugs less likely in a new API?

  45. 45.In a multi-tenant invoicing app, every query must be limited to the caller's tenant. What is the most reliable way to enforce this?

  46. 46.A nightly export job at a grain co-op needs to read one storage bucket, but its cloud role can write to every bucket. What do you recommend?

  47. 47.A regular customer finds they can call an endpoint meant for support agents and issue refunds. What type of access control failure is this?

  48. 48.A bookstore's GraphQL API checks authorization on top-level queries but not on nested fields. What is the risk?

  49. 49.Every engineer at a payroll service has standing admin access to production databases. What is the best improvement?

  50. 50.What is an effective way to catch broken access control before a release?

  51. 51.Which is the best choice for storing user passwords in a new food bank volunteer app?

  52. 52.What does a unique salt for each user's password hash prevent?

  53. 53.Which password policy best matches current guidance for a consumer app?

  54. 54.A ski resort pass site sees many logins from varied IP addresses, each trying a different email and password pair, with a low success rate. What is this most likely?

  55. 55.Which control most directly blunts credential stuffing against a consumer login page?

  56. 56.Which multi-factor authentication method best resists phishing?

  57. 57.A veterinary clinic employee receives dozens of push multi-factor authentication (MFA) prompts late at night and finally taps approve. What change best reduces this risk?

  58. 58.After a successful login, an app keeps using the same session ID it issued before login. What attack does this enable?

  59. 59.A user clicks Log out in a tax prep app. What must the server do?

  60. 60.Which design for password reset tokens is sound?

  61. 61.A wedding RSVP site's password reset page replies, "No account exists with that email." Why might you flag this?

  62. 62.Which set of cookie flags fits a session cookie for an app served only over HTTPS?

  63. 63.What is a sound approach to throttling login attempts?

  64. 64.A coworking space app adds multi-factor authentication (MFA), and the support team will turn it off for anyone who calls and asks. What is the concern?

  65. 65.What is the main difference between OAuth 2.0 and OpenID Connect?

  66. 66.Why should a kayak rental mobile app use PKCE, Proof Key for Code Exchange, with the authorization code flow?

  67. 67.What does the state parameter protect against in an OAuth login flow?

  68. 68.An identity provider accepts any redirect URI that starts with the app's domain name. What is the risk?

  69. 69.Why is the OAuth implicit flow discouraged for new single-page apps?

  70. 70.An API accepts any valid ID token from the company's identity provider, without checking the audience claim. What can go wrong?

  71. 71.A newsletter tool requests full read and write access to users' mailboxes, but it only needs to send messages. What is the best advice?

  72. 72.A JSON Web Token (JWT) library accepts tokens whose header says the algorithm is none. What should the verifying service do?

  73. 73.A service verifies JSON Web Tokens (JWTs) with an RSA public key, but its library chooses the algorithm from each token's header. What is the risk?

  74. 74.A team puts a customer's home address in a signed JSON Web Token (JWT) payload, believing it is hidden from the client. What is the problem?

  75. 75.An employee is fired, but the API still accepts their JSON Web Token (JWT) access token. Why are long-lived JWT access tokens a concern here?

  76. 76.A web app wants to make browser sessions harder to steal through cross-site scripting (XSS). Where should it keep the session credential?

  77. 77.Besides the signature, which claims should an API check on every access token it receives?

  78. 78.A developer at a brewery pushes a cloud access key to a public repository, then deletes it in the next commit. What do you do first?

  79. 79.A moving company has just rotated a cloud key that was public for six hours. What is the next most important step?

  80. 80.Where should the payment provider API key for a bakery ordering app live?

  81. 81.Why do teams prefer short-lived, automatically issued credentials over long-lived static keys?

  82. 82.What is the best way to keep secrets from landing in a podcast host's code repositories?

  83. 83.A scanner finds a database password in a commit from three years ago, and that password is still in use. What is the right priority?

  84. 84.During a leaked-key incident at a transit card service, what should the incident record capture?

  85. 85.After a key leak has been contained, what follow-up is most useful for the engineering team?

  86. 86.A service prints all of its environment variables to the log at startup to help debugging. Why is this a problem?

  87. 87.What does TLS provide for an HTTPS connection to a water utility's billing site?

  88. 88.To fix a connection error, a service at an insurance claims processor turns off certificate verification for calls to a partner API. What is the risk?

  89. 89.What does HTTP Strict Transport Security (HSTS) do?

  90. 90.A farmers market app went offline because its TLS certificate expired. What is the best prevention?

  91. 91.What does mutual TLS add to calls between two internal services?

  92. 92.The private key for an orchestra ticketing site's TLS certificate was found in a leaked backup. What should you do?

  93. 93.A critical flaw is announced in a popular logging library. What do you need first to find out where your company is affected?

  94. 94.Why should a youth soccer league app commit its dependency lockfile?

  95. 95.A pull request adds a package whose name is one letter off from a popular package, and it has very few downloads. What do you suspect?

  96. 96.A company uses internal package names, and its build tool checks both the private registry and the public one. What risk should be fixed?

  97. 97.A scanner flags a high-severity flaw in a library function that your hardware store app never calls. How should you rank it?

  98. 98.Which practice best limits supply-chain risk in continuous integration (CI) build pipelines?

  99. 99.When a developer asks to add a new third-party package, what should the review consider?

  100. 100.What should a login service log to help detect attacks?

  101. 101.A hospital lab results portal puts session tokens in URL query strings. Why is this a logging concern?

  102. 102.What is the most dependable way to keep secrets out of application logs?

  103. 103.Which event is most worth a real-time security alert for an e-signature service?

  104. 104.Why should security logs be shipped to a separate system where the app hosts cannot change them?

  105. 105.You are reviewing a new photo upload feature for a real estate listings site. Which set of checks matters most?

  106. 106.You have limited time to review a large pull request for security. Where should you look first?

  107. 107.Engineers at a crowdfunding site treat security findings as noise and rarely fix them. What change most improves fix rates?

  108. 108.The same class of bug keeps showing up across many services. How can a security team stop it most effectively?

  109. 109.A team lead disputes your finding and says it cannot be exploited. What is the best next step?

  110. 110.An outside researcher reports a valid insecure direct object reference in a language-learning app. What should you do first?