Security engineer role-specific interview questions

As asked

Your product is adding a feature where users can upload arbitrary files to share with other users. Threat model it.

Sample answer outline

Use STRIDE or a similar framework. Spoofing: who can upload, is auth required, is the user-id on the upload trusted. Tampering: file type lying about MIME (sniff the content, do not trust the header), filename traversal, content-disposition tricks. Repudiation: audit log of uploads. Information disclosure: are files private by default, signed URLs with expiry. Denial of service: max file size, rate limits, virus scanning. Elevation of privilege: stored XSS via uploaded HTML, malware delivery, hosting attacker-controlled JS. Concrete mitigations: serve user content from a separate origin, force download for unknown types, scan async, signed URLs.

Expect these follow-ups

• How do you serve user-uploaded images without enabling stored XSS?
• What is your virus scanning policy and what do you do on a positive hit?
• How would you handle the same feature for a regulated industry (healthcare, finance)?

As asked

An engineer commits an AWS access key to a public GitHub repo. Walk me through what you do in the next hour.

Sample answer outline

Treat the key as compromised. Rotate immediately, do not wait. Revoke the old key, generate a new one, push it via the secret manager so dependent services pick it up. Check CloudTrail for any usage of the key in the window between commit and rotation, especially from unfamiliar IPs. Remove the key from history (git filter-repo or BFG) but understand that GitHub may have already cached it and bots scrape new commits within seconds, so rotation is what matters, not rewriting history. Talk to the engineer without blame, and add pre-commit hooks (gitleaks, trufflehog) so it does not happen again.

Expect these follow-ups

• Why is rewriting history less important than rotating?
• How would you scan all current repos for past leaks?
• What is your policy for repeat offenders?

As asked

Walk me through exactly what happens during a TLS 1.3 handshake, from the initial ClientHello to when application data starts flowing. What changed compared to TLS 1.2 and why do those changes matter?

Sample answer outline

A strong answer covers the 1-RTT handshake in TLS 1.3, key exchange via ECDHE in the first flight, removal of RSA key exchange and static DH, the encrypted EncryptedExtensions and Certificate messages, and the introduction of 0-RTT resumption with its replay risks. The candidate should explain why forward secrecy is now mandatory and how the removal of legacy cipher suites reduces the attack surface.

Expect these follow-ups

• What are the security implications of 0-RTT resumption and when would you disable it?
• How does certificate pinning interact with TLS 1.3?

As asked

Given an OAuth 2.0 authorization code flow where the resource server validates JWTs locally using a cached public key, walk me through your threat model. What are the concrete attack surfaces and how would you mitigate each?

Sample answer outline

A strong answer covers authorization code interception and PKCE as the mitigation, JWT algorithm confusion attacks (e.g. alg:none, RS256-to-HS256 swap), key rotation lag allowing forged tokens during a compromise, token replay across audience boundaries, and the absence of server-side revocation with local validation. The candidate should mention short expiry windows, strict aud/iss validation, and JWKS refresh hygiene.

Expect these follow-ups

• How would you handle a situation where a signing key is compromised and you need to revoke all existing tokens immediately?

As asked

Compare DOM-based XSS to reflected XSS. How does the exploitation differ, why is DOM-based XSS harder to detect with traditional scanners, and what would you look for in a code review to find DOM sinks?

Sample answer outline

A strong answer explains that reflected XSS travels through the server and back in the HTTP response, making it detectable via HTTP response scanning, while DOM-based XSS never touches the server because the payload stays in the browser's DOM processing. The candidate should name dangerous sinks like innerHTML, eval, and location.href assignment, and contrast with dangerous sources like location.hash, document.referrer, and postMessage data. Manual code review and browser-based dynamic scanners are needed for DOM XSS.

Expect these follow-ups

• How would you implement a Content Security Policy to mitigate XSS and what are its common bypasses?

As asked

An application fetches a URL supplied by the user to generate a preview. Walk me through how you would exploit SSRF in an AWS environment to steal credentials from the instance metadata service, and then describe every layer of defense you would put in place.

Sample answer outline

A strong answer covers requesting http://169.254.169.254/latest/meta-data/iam/security-credentials/ to retrieve temporary role credentials, then using those to call AWS APIs. Defenses include IMDSv2 enforcement (requiring a PUT-based token before any metadata access), blocking private IP ranges in the URL fetcher at the application level, running the service on a dedicated IAM role with minimal permissions, and using AWS PrivateLink to prevent lateral movement. The candidate should also mention egress filtering at the network layer.

Expect these follow-ups

• How does IMDSv2 prevent SSRF compared to IMDSv1 and what request-header trick does it rely on?

As asked

Describe how you would integrate security scanning into a CI/CD pipeline in a way that blocks on real high-severity issues but does not become a bottleneck that developers learn to ignore or bypass. What tools would you use at each stage?

Sample answer outline

A strong answer places secret scanning (e.g. truffleHog, Gitleaks) and SAST (e.g. Semgrep, CodeQL) in the pre-merge check, SCA/dependency scanning (Dependabot, Snyk) in the PR check with severity thresholds, DAST (OWASP ZAP, Burp Suite CI mode) in the post-deploy staging check, and container image scanning (Trivy, Grype) in the build step. The candidate should address triage runbooks to reduce developer toil, suppression workflows for accepted risk, and dashboard visibility to prioritize backlog findings separately from blocking gates.

Expect these follow-ups

• How would you handle a situation where a critical CVE is found in a transitive dependency that has no fix available yet?

As asked

During a penetration test of a REST API, you suspect insecure direct object references. Walk me through how you would test for IDOR systematically across the API, and describe the most impactful exploitation scenario you would look for.

Sample answer outline

A strong answer covers creating two test accounts (A and B), authenticating as A, capturing resource IDs returned in A's responses, then attempting to access or modify those resources as B using B's session token. The candidate should describe testing across all HTTP verbs (GET, PUT, DELETE, PATCH), horizontal vs vertical privilege escalation, testing UUID predictability, and checking indirect object references in query parameters, path segments, request bodies, and JWT claims. The highest impact scenario is typically accessing other users' private data or modifying account-level objects.

Expect these follow-ups

• How would you implement server-side access control to prevent IDOR in a Node.js Express API?

As asked

You have 30 services running in one AWS account. Design an IAM strategy that gives each service least privilege and keeps the policies maintainable.

Sample answer outline

One IAM role per service, assumed via the workload identity (IRSA for EKS, instance profile for EC2, task role for ECS). Policies generated from infrastructure code, not hand-edited. Use IAM Access Analyzer to flag overly permissive policies and unused permissions. Avoid wildcard resource ARNs. Separate the prod and non-prod accounts to remove the worst blast-radius failure modes. Service control policies at the org level for guardrails like 'no public S3'. Rotate credentials never used (CIS benchmarks). Treat IAM as code with review.

Reference implementation (json)

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ReadOwnConfigOnly",
      "Effect": "Allow",
      "Action": ["s3:GetObject"],
      "Resource": "arn:aws:s3:::prod-config/api/*"
    },
    {
      "Sid": "PublishToOwnTopic",
      "Effect": "Allow",
      "Action": ["sns:Publish"],
      "Resource": "arn:aws:sns:eu-west-2:123456789012:api-events"
    },
    {
      "Sid": "DenyAllOtherS3",
      "Effect": "Deny",
      "NotAction": ["s3:GetObject"],
      "Resource": "*"
    }
  ]
}

Expect these follow-ups

• How do you handle a service that needs cross-account access?
• What is your strategy for human access (engineers) to production?
• How would you scope a policy down from a wildcard that someone shipped 3 years ago?

As asked

An alert fires: a user account logged in from a new country, then immediately created a new API key. Walk me through your investigation.

Sample answer outline

First, contain: kill the active session and rotate the API key while investigating. Then verify: contact the user through an out-of-band channel to confirm if it was them. Look at the login: IP, device fingerprint, prior history for the user. Look at the broader pattern: are other users from the same IP, is there a credential stuffing burst, does the IP appear in threat feeds. Check what the API key was used for in the window between creation and detection. Document the timeline. If confirmed compromise: full account recovery flow, audit of data the attacker could have read, notify the user and (depending on data) regulators.

Expect these follow-ups

• How would you have detected this earlier?
• What is your policy for password resets after a confirmed compromise?
• What changes if this is an internal employee account?

As asked

Design and implement a rate-limiting strategy on a login endpoint that mitigates credential stuffing without locking out legitimate users.

Sample answer outline

Multiple keys, not just IP. Rate-limit per username (slows stuffing against a single account), per IP (slows distributed attempts from a single source), and globally on failure rate (signals an attack in progress). Use exponential backoff per username after consecutive failures. Add a CAPTCHA after N failures, do not lock out (lockout is itself a denial-of-service vector). Watchlist credential dumps with HaveIBeenPwned-style hash prefix checks and force a password reset for known-compromised passwords. Discuss residential proxy networks that defeat per-IP rate limits and why per-username matters more.

Reference implementation (typescript)

import { Redis } from "ioredis";

export async function checkLoginAttempt(
  redis: Redis,
  username: string,
  ip: string,
): Promise<{ allowed: boolean; backoffMs: number }> {
  const userKey = `login:user:${username}`;
  const ipKey = `login:ip:${ip}`;
  const [userFails, ipFails] = await Promise.all([
    redis.incr(userKey),
    redis.incr(ipKey),
  ]);
  await Promise.all([redis.expire(userKey, 900), redis.expire(ipKey, 900)]);
  if (userFails > 10 || ipFails > 50) {
    const backoffMs = Math.min(60_000, 2 ** Math.min(userFails, 10) * 100);
    return { allowed: false, backoffMs };
  }
  return { allowed: true, backoffMs: 0 };
}

Expect these follow-ups

• What if attackers come from a botnet with 100k unique IPs?
• When would you reach for device fingerprinting?
• What is the false positive rate of locking based on geo?

As asked

Explain what second-order SQL injection is, give me a concrete scenario where it would appear in a web application, and describe how you would detect it in a codebase during a security review.

Sample answer outline

A strong answer explains that input is stored safely (e.g. parameterized insert) but later retrieved and used unsafely in a subsequent query without re-sanitizing. A classic example is a username with a SQL payload stored at registration and later concatenated into a password-change query. The candidate should describe grepping for string concatenation in database calls, tracing data flows from storage to retrieval, and using tools like Semgrep or CodeQL taint analysis to catch these patterns at scale.

Expect these follow-ups

• How would you write a Semgrep rule to catch dynamic SQL construction from user-controlled input in a Python codebase?

As asked

SameSite=Lax is now the browser default. In what scenarios can a CSRF attack still succeed against an application that relies solely on SameSite=Lax for CSRF protection?

Sample answer outline

A strong answer identifies top-level navigations with GET requests (e.g. GET endpoints that mutate state), same-site subdomain attacks if a subdomain is compromised, and the 2-minute Lax exception window in Chrome for cookies set without SameSite during the grace period. The candidate should mention that CSRF tokens or the Origin/Referer header check remain necessary for state-changing non-GET endpoints, and should flag situations where the site and attacker share a registrable domain.

Expect these follow-ups

• How does the origin header differ from the referer header and which is more reliable for CSRF defense?

As asked

I give you an IAM role with iam:AttachUserPolicy and iam:CreateAccessKey permissions but no admin access. Walk me through how you would escalate to full administrator access and what detective controls should catch it.

Sample answer outline

A strong answer covers attaching the AdministratorAccess managed policy to yourself via iam:AttachUserPolicy, or creating access keys for an existing high-privileged user via iam:CreateAccessKey. Detective controls include CloudTrail alerts on iam:AttachUserPolicy events outside a change window, GuardDuty anomaly detection, and SCPs that deny AdministratorAccess attachment for non-break-glass roles. The candidate should mention tools like PMapper and Cloudsplaining for automated IAM graph analysis.

Expect these follow-ups

• How would you design a least-privilege IAM architecture for a CI/CD pipeline that needs to deploy Lambda functions?

As asked

Explain how Certificate Transparency works and describe a scenario where an attacker has obtained a fraudulently issued TLS certificate for your domain. How would CT help you detect it and what is your response process?

Sample answer outline

A strong answer covers SCTs (signed certificate timestamps) being embedded in certificates or delivered via OCSP stapling or TLS extension, the append-only Merkle tree structure of CT logs, and browser enforcement of SCT requirements. Detection involves monitoring CT logs via tools like crt.sh or Facebook CT Monitor for unexpected certificates on your domains. The response includes contacting the CA for revocation, adding or tightening CAA records to prevent future misissuance by unauthorized CAs, and updating DNS security monitoring. The candidate should note that HPKP was removed from all major browsers by 2019 and should not be recommended as a mitigation.

Expect these follow-ups

• What are CAA DNS records and how do they complement Certificate Transparency?

As asked

You need to write a detection rule in your SIEM for credential stuffing attacks against a login endpoint. Walk me through how you would structure the logic, what signals you would use, and how you would tune the threshold to minimize false positives while catching real attacks.

Sample answer outline

A strong answer groups failed logins by source IP and distinct username count over a sliding time window, sets a threshold (e.g. more than 5 distinct usernames with failed auth from one IP in 10 minutes), and adds a second signal for success after prior failures to catch slow distributed attacks. The candidate should discuss normalizing on ASN rather than single IP to catch attacks spread across a botnet, using device fingerprinting as a secondary signal, and baselining legitimate bulk-login sources like monitoring systems to reduce false positives.

Expect these follow-ups

• How would your detection change if the attacker distributes the requests across thousands of residential proxies?

As asked

Your team stores database credentials, API keys, and encryption keys in a secrets management system like HashiCorp Vault. Walk me through how you would design a key rotation strategy that is zero-downtime, auditable, and handles failure partway through rotation.

Sample answer outline

A strong answer covers Vault's Transit secrets engine for envelope encryption and its built-in key versioning, describes a dual-read window where both old and new keys decrypt during rotation, explains atomic metadata updates to switch writers to the new key after all readers are confirmed migrated, and covers rollback paths if rotation fails midway. Audit logging should record every key access with caller identity and purpose, and rotation schedules should be enforced via policy rather than manual process.

Expect these follow-ups

• How would you handle rotation of a symmetric key that was used to encrypt a billion rows in a database?

As asked

Name at least three realistic container escape techniques and explain what misconfiguration enables each one. Then describe the defense-in-depth controls you would put in place at the container runtime and host level.

Sample answer outline

A strong answer covers privileged container breakout via mounting the host filesystem, Docker socket mount allowing arbitrary host container creation, kernel exploit via an unpatched CVE accessible from within the container, and writable /proc/sysrq-trigger leading to host reboot. Defenses include dropping all capabilities and adding only needed ones, seccomp profiles blocking dangerous syscalls, AppArmor/SELinux profiles, read-only root filesystems, and avoiding the Docker socket in application containers.

Expect these follow-ups

• How does gVisor or Kata Containers change the threat model for container escapes?

As asked

You get paged at 2am with reports that file servers are encrypting files and displaying ransom notes. Walk me through your technical incident response from the first five minutes through containment and recovery. What are the first actions you take and why?

Sample answer outline

A strong answer covers immediately isolating affected hosts at the network layer (VLAN change or firewall rule, not shutdown which could destroy volatile memory evidence), preserving memory dumps and disk images for forensic analysis, identifying patient zero via EDR telemetry and lateral movement artifacts in Windows Event Logs, and activating the incident response plan to notify legal and communications. Recovery involves restoring from immutable backups (S3 Object Lock, tape) rather than paying ransom, and rebuilding from known-good images.

Expect these follow-ups

• How do you determine whether attackers still have a foothold after you think you have contained the incident?

As asked

You are responsible for the network security of a three-tier web application: a public-facing load balancer, application servers, and a database cluster. Walk me through how you would segment the network, what firewall rules you would apply, and how you would handle outbound internet access for the application tier.

Sample answer outline

A strong answer creates three separate security groups or subnets: a DMZ for the load balancer accepting 443/80 from anywhere, an application tier accepting only from the load balancer SG on the app port, and a database tier accepting only from the application SG on the DB port. Outbound internet from the app tier should route through a NAT Gateway or a proxy with allowlisted destinations to prevent SSRF-to-internet and C2 callbacks. The candidate should discuss VPC flow logs and DNS query logging for detection.

Expect these follow-ups

• How does microsegmentation differ from this approach and when is it worth the added complexity?

As asked

A code review shows a password comparison using a standard string equality operator. Explain why this is a timing oracle, how an attacker would exploit it in practice, and what the correct fix is at both the language and protocol level.

Sample answer outline

A strong answer explains that early-exit string comparison leaks the length of the common prefix through response time differences, allowing character-by-character brute force with enough requests. The fix is a constant-time comparison like Python's hmac.compare_digest or Node's crypto.timingSafeEqual. At the protocol level, rate limiting and account lockout reduce the window for exploitation, and hashing the password server-side (bcrypt, Argon2) means the comparison is on fixed-length digests anyway.

Expect these follow-ups

• How would you measure the timing difference in a network context given variable network jitter?

As asked

Walk me through the Log4Shell (CVE-2021-44228) exploitation chain step by step, from the attacker sending an HTTP request to achieving remote code execution. What made it so widespread and what did the correct remediation involve?

Sample answer outline

A strong answer covers the attacker injecting a JNDI lookup string (for example in a User-Agent or X-Forwarded-For header) that Log4j processes during logging, Log4j performing an outbound JNDI lookup to the attacker-controlled LDAP server, the LDAP response returning a reference to a remote Java class, and Log4j deserializing and executing that class to achieve RCE. Widespread impact came from Log4j being a transitive dependency in thousands of Java projects and from logged input being attacker-controlled almost everywhere. Remediation required upgrading to Log4j 2.16.0 as the primary RCE fix (2.16.0 disabled JNDI by default, not just message lookups). The earlier workaround of setting log4j2.formatMsgNoLookups=true was found to be bypassable via Thread Context Map values in certain configurations and is not sufficient on its own. Blocking outbound LDAP, LDAP/S, RMI, and DNS at the egress firewall also limited exploit impact for unpatched systems.

Expect these follow-ups

• How would a WAF rule have helped or not helped in this case, and why did many WAF bypass techniques work?

As asked

Walk me through how a supply chain attack like the SolarWinds or XZ Utils compromise could affect your organization's software delivery pipeline, and describe the concrete controls you would implement to detect and prevent it.

Sample answer outline

A strong answer covers dependency confusion attacks, typosquatting, and malicious maintainer scenarios. Controls include pinning dependencies to digests (not tags), verifying package signatures with Sigstore/cosign, using a private artifact registry with approved packages, enforcing SLSA provenance on build artifacts, and restricting CI/CD jobs to only use dependencies from the approved registry. The candidate should mention reproducible builds as an audit mechanism and binary authorization in Kubernetes.

Expect these follow-ups

• How does SLSA level 3 differ from level 1 and what engineering investment does it require?

As asked

Your company has employees working from home, in the office, and from managed and unmanaged devices. Walk me through how you would design a zero-trust access model, what signals you would use for continuous authorization, and how you would handle legacy on-premise applications.

Sample answer outline

A strong answer covers identity-centric policy (MFA, SSO), device trust signals from MDM (Intune, Jamf) combined with certificate-based device attestation, per-request authorization using a policy engine like Open Policy Agent, and network-layer enforcement via a cloud access proxy (BeyondCorp-style). Legacy apps are wrapped in an identity-aware proxy or accessed via PAM with just-in-time access provisioning. The candidate should discuss graceful degradation when a device goes offline and how to handle contractor/BYOD scenarios.

Expect these follow-ups

• How do you handle service-to-service authentication in a zero-trust model within a Kubernetes cluster?

As asked

Apply the STRIDE threat model to a payment processing microservice that receives card data via REST, calls a downstream card tokenization service, and stores transaction records in a PostgreSQL database. List the threats you would identify in each STRIDE category and rank your top three by risk.

Sample answer outline

A strong answer methodically works through Spoofing (attacker impersonating the tokenization service), Tampering (man-in-the-middle modification of transaction amounts in transit), Repudiation (missing audit logs for card data access), Information Disclosure (card data in logs or error responses), Denial of Service (payment endpoint flood disrupting checkout), and Elevation of Privilege (SQL injection granting admin DB access). Top risks by likelihood and impact would typically be Spoofing of downstream services without mTLS and Information Disclosure via logging of card numbers.

Expect these follow-ups

• How does STRIDE differ from PASTA as a threat modeling framework and when would you choose one over the other?