Security
305 bites tagged Security — interview questions with model answers, and 60-second explainers.
Explain SPF, DKIM, and DMARC roles and implementation tasks
SPF authorizes IPs, DKIM signs content, DMARC aligns both to the From domain and enforces policy plus reporting. Your grasp of layered email auth and operational deployment.
How would you programmatically populate an HTML email template?
Pick a template engine, bind the user object as context, render HTML, and send via a mailer. Clean separation of data and presentation plus safe rendering.
Design a secure templating engine for user notifications
Tests balancing creator flexibility with defense-in-depth security and i18n. Strong answers cover context-aware auto-escaping, a restricted AST grammar, ICU MessageFormat for pluralization, and sandboxed execution.
How does shared responsibility shift between IaaS and SaaS?
Tests your understanding of security ownership across cloud stacks. Strong answer: in IaaS you own OS, apps, and network controls; in SaaS you only own data, identities, endpoints, and accounts while the provider manages the rest.
IAM: The Gatekeeper Framework
IAM is the framework that decides who gets through the door and what they can touch inside your systems. It governs every employee transition, from onboarding to departure. The trap is treating IAM as a one-time setup rather than an ongoing lifecycle process.
GitLab patches 13 CVEs including SAML account takeover flaw
GitLab 19.0.2, 18.11.5, and 18.10.8 patch 13 security flaws, including four High-severity CVEs like SAML account takeover (CVSS 8.7) and unauthenticated API DoS. Self-managed instances must upgrade immediately; GitLab.com is already patched.
Design a workflow for managing security scanner vulnerabilities
This tests scaling security without developer noise fatigue. A strong answer covers centralized ingestion, severity SLAs with exploitability, auto-triage rules, and CI gates on critical findings only. A red flag is forcing manual review of all scanner output.
What strategies reduce DAST scan time while maintaining security coverage?
It tests balancing security depth with CI velocity through DAST tuning. A strong answer covers incremental scans, parallel workers, scoped targets, and shift-left complements.
Explain .gitignore and its impact on faster, reliable, secure CI builds
Exclude build artifacts to shrink clones and stabilize cache keys; block secrets from runners. whether you see VCS hygiene as a CI speed, reliability, and security control. dismissing it as local convenience.
How do you implement security policies as code across CI pipelines?
This tests operationalizing Policy as Code for security scanners at scale. Strong answers cover centralized version-controlled rules consumed by CI pipelines with automated gates and exception workflows. Red flag: teams maintaining independent scanner configs.
How would you architect deployment capabilities for multiple disparate environments?
This tests platform design for secure multi-environment orchestration. A strong answer proposes a declarative control plane, environment-local agents with short-lived credentials, and templating for consistency.
Design a secure multi-tenant CI/CD runner on Kubernetes
Apply namespaces, NetworkPolicies, Pod Security Standards; cap resources with ResourceQuotas and LimitRanges; schedule to dedicated or sandboxed nodes. Hard multi-tenancy for untrusted CI. Labels or RBAC alone suffice.
How do you manage secrets for hundreds of services in centralized CI/CD?
It tests secret sprawl prevention and least privilege in CI/CD. Answer: use a secrets manager with RBAC, short-lived credentials, runtime injection, and audit logs. Red flag: secrets in Git, plain env vars, or one shared master key.
How do you secure secrets in a GitOps repository?
Tests whether you treat Git as source of truth while excluding plaintext credentials. A strong answer covers encrypting at rest with SOPS or Sealed Secrets, external stores like Vault, and operator workflows.
How would you use a Kubernetes Admission Controller as CI/CD security gate?
Tests pre-deployment enforcement via admission webhooks. Strong answers: ValidatingAdmissionWebhooks blocking bad manifests, Pod Security Standards restricted profiles, and OPA/Gatekeeper for image signatures. Red flag: confusing with RBAC or runtime scanning.
How would you integrate automated security scanning for Terraform in CI/CD?
Run Checkov or TFLint in CI to block builds; catch open security groups, missing encryption, secrets in code, and bad IAM. Shift-left security and IaC misconfig detection in CI.
Committed an API key to Git. Describe two automated CI/CD prevention methods.
This tests layered secret protection in Git workflows. A strong answer names pre-commit scanning and server-side push protection or pipeline scanning. Mention rotating that key. A weak answer only suggests manual review without automated gates.
Compare Kubernetes Secrets versus environment variables for Pod credentials
Tests Kubernetes credential threat model across etcd and Git. Plain env vars leak into manifests and process lists; Secrets enable RBAC but are base64 by default and visible to nodes and authorized readers. Red flag: claiming Secrets are encrypted by default.
How does your app authenticate with secrets management and solve secret zero?
This tests platform trust chains and the bootstrap credential problem. A strong answer names IAM, Kubernetes, or AppRole auth, explains platform attestation, and uses short-lived tokens.
Describe secure secret injection into Kubernetes containers during CI/CD
Tests production secret injection hygiene in Kubernetes CI/CD. Strong answers: external secret store at deploy time, volume mounts over env vars, etcd encryption, RBAC least privilege, and rotation.
How do you manage environment-specific connection strings and why is hardcoding bad?
Tests config separation and secrets hygiene. Outline: inject via environment variables or a secret store, keep per-environment configs credential-free, and prefer managed identities.
How do you manage secrets within IaC configurations?
This tests secret injection and the security-complexity tradeoff in IaC. A strong answer contrasts a cloud secret manager with encrypted files or env vars, covering rotation and blast radius. A red flag is plaintext secrets in Git or state files.
Discuss security implications of developer-defined PaC pipelines
It tests balancing CI/CD flexibility with defense-in-depth against secret exfiltration. Cover scoped build identities, branch policies, approval gates, and sandboxed fork builds. Red flag: shared service connections or unrestricted pipeline admin rights.
How should you manage sensitive data in a committed pipeline file?
Tests that committed pipeline YAML must never store secrets. Answer: fetch at runtime via native secrets manager integrations; if needed, use masked, hidden, protected CI/CD variables; use typed CI/CD inputs for parameters.
Get Security bites daily.
Five a day, five minutes, offline. With quizzes so it sticks.
Open testing — you’ll join as an early tester.