Top 30 Security Interview Questions and Answers
30 multiple-choice questions on Security, drawn from 30 bites out of the 305 tagged Security on Tezvyn. Answer them here or read straight down. Every question carries the correct option, why it is correct, and a link to the bite it came from.
30 questions. Pick an answer, or open “Show the answer” to read it.
Answers are graded in your browser. Nothing is saved, and no XP or streak is earned here. The app keeps score.
Question 1 of 30
Which scenario best describes the supply-chain vulnerability WAICT is designed to prevent in encrypted web apps?
Show the answer
Answer: a · A compromised server selectively serves modified JavaScript to specific users to exfiltrate keys
The card explains that WAICT stops compromised servers from silently injecting malicious JavaScript to specific users, which breaks end-to-end encryption. Option C describes a man-in-the-middle attack that TLS already prevents, whereas WAICT closes the trust gap that TLS and SRI leave open.
Read the full bite: Mozilla WAICT Verifies Web App JavaScript in Nightly
Question 2 of 30
When an app running on Vercel requests a provider token through Vercel Connect at runtime, how does it prove its identity?
Show the answer
Answer: d · By using the OIDC identity that every Vercel deployment automatically receives
Vercel Connect uses the deployment's built-in OIDC identity to exchange for short-lived provider tokens, eliminating persistent secrets. Static env vars (C) are the legacy approach, and while per-user consent flows (A) may come later, they are not the current runtime mechanism.
Read the full bite: Vercel Connect replaces env tokens with runtime OIDC
Question 3 of 30
Mozilla's use of Claude Mythos Preview on Firefox demonstrated that modern LLMs can accomplish what traditional fuzzing alone struggled to achieve?
Show the answer
Answer: d · Identify deep architectural vulnerabilities hidden in heavily audited code for decades
Mozilla showed LLMs can uncover deep architectural bugs in heavily audited code that survived years of fuzzing. Option B describes just one specific technique from a single finding, not the broader capability, and D overstates the workflow since human triage remains essential.
Read the full bite: Claude Mythos Cracks Firefox Bugs Fuzzing Missed
Question 4 of 30
Which statement accurately describes the risk to an unpatched, publicly accessible self-managed GitLab instance?
Show the answer
Answer: b · It is vulnerable to an unauthenticated DoS attack against the Grape API JSON parsing middleware
The card states CVE-2026-7250 allows unauthenticated attackers to crash the Grape API JSON parsing middleware and explicitly warns that this DoS vector is exposed to the open internet. Option D is a tempting distractor because GitLab.com and Dedicated being patched does not protect self-managed instances, which must upgrade immediately.
Read the full bite: GitLab patches 13 CVEs including SAML account takeover flaw
Question 5 of 30
When moving from IaaS to SaaS, which responsibility shifts to the cloud provider?
Show the answer
Answer: c · Patching the guest operating system
In IaaS the customer manages the guest OS, but in SaaS the provider assumes that duty. Many beginners incorrectly think the provider also secures their data in SaaS, yet data classification and protection always remain the customer's responsibility.
Read the full bite: How does shared responsibility shift between IaaS and SaaS?
Question 6 of 30
Which scenario best describes a genuine shift-left practice rather than a common misconception?
Show the answer
Answer: b · Integrating static analysis into pull request builds so vulnerabilities are caught before merge
Integrating static analysis into pull request builds moves security feedback to the coding phase, which is the essence of shift left. Hiring more QA staff to test before release only increases test volume at the same late stage, confusing more testing with earlier feedback.
Read the full bite: What does shift left mean in CI/CD, and give two concrete examples?
Question 7 of 30
A team's current approach to keeping PII out of logs is to log full request and response bodies as usual, then run a nightly job that scans old logs and deletes lines matching an email regex. What is the main weakness of this approach?
Show the answer
Answer: d · It leaves PII sitting in logs until the nightly job runs, and regex scrubbing after the fact commonly misses fields it was not written to catch
Logging everything first leaves PII exposed in plaintext for up to a full day, and after the fact regex scrubbing routinely misses fields that do not match the pattern, so this is not equivalent to never logging it at all. The stronger control is preventing sensitive fields from being logged in the first place, not cleaning up after exposure.
Read the full bite: What is PII and how to keep it out of logs
Question 8 of 30
What is the primary distinction between a standard database view and a base table?
Show the answer
Answer: a · A view executes a predefined query against base tables each time it is accessed, without storing its own data.
A standard view stores only its query definition and executes it against the underlying base tables each time it's accessed, as explained in the 'How It Works' section. Option C describes a common misconception; views do not store their own data, unlike materialized views.
Read the full bite: Database Views: A Saved Query That Acts Like a Table
Question 9 of 30
What is the primary advantage of adopting a systematic information security management system (ISMS) for research data?
Show the answer
Answer: a · It provides a continuous, structured approach to identify and mitigate data security risks.
The card emphasizes that an ISMS treats security as a "living system" and a "continuous process" for "systematically reducing" risks, making option A the core advantage. Option B is incorrect because the card explicitly states security is "not as a single tool like a firewall" and involves a holistic system of policies, procedures, and technical controls, not just technical tools.
Read the full bite: Securing Research Data with a Management System
Question 10 of 30
What is the immediate consequence when a process, protected by an active seccomp profile, attempts to execute a forbidden system call?
Show the answer
Answer: d · The kernel immediately terminates the offending process.
The card states that any attempt by a process to use a syscall not on the allowlist causes the kernel to terminate the process. Seccomp is an enforcement mechanism, not merely an audit tool that logs events.
Read the full bite: seccomp: A Kernel-Level Allowlist for Syscalls
Question 11 of 30
Under the Shared Responsibility Model, which security task is always the customer's responsibility, regardless of the cloud service model (IaaS, PaaS, or SaaS)?
Show the answer
Answer: b · Managing user access and data within the service
The card explicitly states that customers always retain responsibility for their data, accounts, and access management, which includes managing user access and data within the service. Patching the guest operating system (option A) is only the customer's responsibility in IaaS, with the provider handling it in PaaS and SaaS.
Question 12 of 30
What is the primary benefit of copying only the compiled binary into a minimal final stage of a multi-stage build?
Show the answer
Answer: d · It produces a smaller image with no toolchain or source, reducing attack surface
Discarding the compiler and source yields a small, hardened production image; multi-stage builds do not remove the kernel dependency, add encryption, or make a binary architecture-independent.
Read the full bite: Multi-stage builds for compiled languages
Question 13 of 30
After force-pushing a Git history rewritten with git-filter-repo to remove leaked credentials, why must teammates delete their local clones and re-clone rather than pull?
Show the answer
Answer: a · A pull-and-push from their stale local branch would recontaminate the remote with the old commits containing the secret
The card explicitly warns that a teammate who pulls and then pushes from a stale local clone will reintroduce the old commits containing the secret back to the remote. While reflogs retain local history, the critical blast radius is recontamination of the shared repository, not a local merge issue.
Read the full bite: How do you fully remove leaked credentials from Git history?
Question 14 of 30
After adding USER app to a Dockerfile, the container starts but the app cannot write to its own directory. What was most likely missed?
Show the answer
Answer: c · The application files were not chowned to the app user, leaving them root-owned
Switching USER without changing file ownership leaves files owned by root, so the unprivileged user cannot write them; USER belongs before CMD and non-root users can write to directories they own.
Question 15 of 30
Why is passing an NPM token via a Dockerfile ARG insecure even if you never reference it in the final stage?
Show the answer
Answer: a · The ARG value is recorded in image metadata and visible via docker history
ARG values persist in the image build history and can be inspected, so the secret leaks; BuildKit secret mounts avoid this by keeping the value in tmpfs only during a single RUN. The other claims are fabricated.
Read the full bite: Pass build-time secrets securely with BuildKit
Question 16 of 30
Which layered approach best secures a multi-channel notification templating engine?
Show the answer
Answer: b · Formal AST grammar with context-aware auto-escaping and sandboxed rendering with resource limits
Option B is correct because defense-in-depth requires an AST whitelist to prevent injection, context-aware escaping tailored to each output channel, and sandboxed execution with resource limits. Option D is tempting because formal parsing is correct, but output-side HTML sanitization alone fails for SMS or JSON contexts and lacks sandboxing against DoS.
Read the full bite: Design a secure templating engine for user notifications
Question 17 of 30
How can you serve images from object storage through a CDN while keeping the bucket itself private?
Show the answer
Answer: a · Grant the CDN read access via origin access control and deny all other bucket access
Origin access control lets only the CDN read the bucket while it stays private to everyone else. A public bucket defeats the goal, copying defeats the origin model, and signed URLs are time-limited, not permanent.
Read the full bite: Serving user images securely from object storage
Question 18 of 30
What is the primary function of a .dockerignore file in a Docker project?
Show the answer
Answer: d · To prevent specific files from being included in the build context sent to the Docker daemon.
The .dockerignore file's main role is to instruct the Docker client to omit specified files and directories from the build context before it's archived and sent to the daemon. While this can lead to smaller final images (C) if those files would have been copied, its direct and primary function is to filter the build context itself, improving build speed and security.
Read the full bite: The .dockerignore File: Keep Your Build Context Lean
Question 19 of 30
What is the main operational trade-off of using a distroless image instead of Alpine?
Show the answer
Answer: c · There is no shell or package manager, so debugging by exec is not possible
Removing the shell and package manager shrinks the attack surface but means you cannot exec a shell to debug; distroless is generally smaller, runs binaries fine, and does not require root.
Read the full bite: Distroless images: benefits and trade-offs
Question 20 of 30
When using a .env file for local development, what is the most critical step to prevent accidental exposure of sensitive information?
Show the answer
Answer: c · Ensuring the .env file is listed in your project's .gitignore
The card explicitly states that 'The biggest mistake is committing your .env file to Git, exposing all your secrets' and that your '.gitignore file must contain a line with .env to prevent committing secrets.' This makes preventing version control exposure the most critical step. Storing only non-sensitive data (D) contradicts the primary purpose of .env for secrets.
Read the full bite: Environment Variables: Config Outside Your Code
Question 21 of 30
What is the primary benefit of integrating Docker image scanning into a CI/CD pipeline?
Show the answer
Answer: c · It acts as a gate to prevent images with known security flaws from reaching deployment.
The card states that in a CI/CD pipeline, scanning acts as a gate to automatically fail builds containing critical vulnerabilities, preventing them from being deployed. Option D is incorrect because scanning identifies vulnerabilities; it does not automatically remediate or patch them.
Read the full bite: Docker Image Scanning: A Background Check for Your Code
Question 22 of 30
When integrating artifact signing into CI/CD, what is the primary security reason to move signing operations from the build runner to a remote KMS or HSM?
Show the answer
Answer: a · To ensure the private key never touches disk on ephemeral compute treated as untrusted
The card treats build runners as untrusted ephemeral infrastructure, so keeping the private key on a remote KMS or HSM prevents exfiltration if the runner is compromised. Option C is tempting but wrong because signature verification at deploy time must remain a hard gate regardless of how signing is performed.
Read the full bite: How would you integrate artifact signing into CI/CD and secure the keys?
Question 23 of 30
A FastAPI endpoint returns a UserDB model containing password_hash. Which strategy best prevents exposing the hash while keeping the API contract explicit and maintainable?
Show the answer
Answer: c · Create a separate UserOut model without password_hash and set response_model=UserOut on the endpoint.
A dedicated output model declaratively isolates the API contract from the database schema and prevents accidental leaks if new sensitive fields are added later. Option B is a tempting quick fix, but it keeps the sensitive field in the source model and hides the contract outside the type system, making it harder to maintain.
Read the full bite: How do you prevent password_hash from appearing in a FastAPI response?
Question 24 of 30
When implementing a timezone-safe offer countdown, which design prevents users from manipulating the expiry?
Show the answer
Answer: d · Let the server own the canonical UTC deadline, have the client sync via a server-time offset, and re-validate expiry at checkout.
This is the only option that keeps the canonical deadline on the server, uses a server-relative offset for display, and enforces expiry at checkout. Option A is tempting because localStorage seems like a simple way to persist state, but it allows trivial tampering with the deadline.
Read the full bite: How would you implement a timezone-safe, tamper-proof offer countdown?
Question 25 of 30
What most fundamentally keeps a database in a private subnet unreachable from the internet?
Show the answer
Answer: c · The private subnet's route table has no route to an internet gateway
Without an internet-gateway route, no inbound internet path exists to the subnet, providing network-level isolation. Security groups add a layer but routing is the structural control, and NAT only enables outbound, not encryption.
Question 26 of 30
When first adding SAST to an existing CI pipeline, which rollout strategy best prevents alert fatigue while still shifting security left?
Show the answer
Answer: b · Start in audit-only mode, tune rulesets to suppress false positives, and introduce merge-blocking gates for high and critical findings only after a calibration period
Starting in audit-only mode lets the team measure true positive rates and tune out noise before enforcing anything, which builds trust and avoids the alert fatigue that comes from blocking merges prematurely. Option C is a common trap because zero-tolerance blocking on day one creates toil and incentivizes developers to bypass the gate entirely.
Read the full bite: How would you integrate SAST into CI without alert fatigue?
Question 27 of 30
A senior Android developer chooses the Google Secrets Gradle Plugin. What is the *primary* problem this plugin solves?
Show the answer
Answer: c · It ensures API keys are never committed to version control systems while being easily accessible in BuildConfig.
The plugin's core function is to prevent API keys from being checked into version control by reading them from an untracked local file and making them available via BuildConfig. It explicitly does not protect keys from extraction from a compiled APK, making that a key limitation rather than a solved problem.
Read the full bite: How would you manage API keys in Gradle without version control?
Question 28 of 30
Which approach is recommended for managing a sensitive API key in an Android project to prevent it from being committed to version control?
Show the answer
Answer: c · Store the key in `local.properties`, use the `secrets-gradle-plugin` to read it, and access it via the `BuildConfig` class.
The correct approach uses `local.properties`, which is git-ignored by default, with the `secrets-gradle-plugin` to securely inject secrets into the build. Storing keys in `gradle.properties` is a common but incorrect practice, as this file is typically committed to version control.
Read the full bite: Managing Sensitive Information in Gradle Builds
Question 29 of 30
In FastAPI, which approach best implements a reusable current-user check that preserves OpenAPI docs integration and keeps endpoints testable?
Show the answer
Answer: a · Define a get_current_user dependency that uses OAuth2PasswordBearer, validates the token, returns a User model, and inject it into routes with Depends.
A dedicated get_current_user dependency keeps auth explicit in the signature, auto-documents security in OpenAPI, and enables test overrides via app.dependency_overrides. Middleware hides the dependency from the docs and complicates testing.
Read the full bite: How do you create a reusable current-user dependency in FastAPI?
Question 30 of 30
When configuring variant-specific API keys in Gradle, why should you keep a version-controlled defaults file alongside a gitignored properties file?
Show the answer
Answer: b · To let CI and fresh clones compile when the real secrets file is missing
The defaults file contains non-functional placeholder values so CI and fresh clones can compile without the real gitignored secrets file. Using flavor-specific source sets for keys is unsafe because those directories are version-controlled, which leaks credentials.
Read the full bite: How do you manage API keys across Gradle build variants securely?
Could you explain these out loud?
That is what an interview actually tests. Tezvyn gives you questions like these with what the interviewer is really checking, the answer that lands, and the mistake that ends the conversation, in the four minutes before your next meeting.
The iPhone app is on the way
We are building it. Until it lands, nothing here is held back from you: every interview card, your saved cards, streaks and the job board all work in Safari, plus hundreds of free practice quizzes of thirty questions each. Sign in and it all carries over to the app the day it arrives.
Want it as an icon? Tap Share at the bottom of Safari, then Add to Home Screen. It opens full screen and the cards you have read stay available offline.