Security engineer technical fundamentals interview questions

As asked

Explain the difference between symmetric and asymmetric encryption. Give a specific example of when you would use each and explain why hybrid encryption is the standard in most real-world protocols.

Sample answer outline

A strong answer explains that symmetric encryption (AES) uses the same key for encryption and decryption and is fast but requires a secure key exchange channel, while asymmetric encryption (RSA, ECDH) uses a key pair and enables key exchange over untrusted channels but is orders of magnitude slower. Hybrid encryption (used in TLS, PGP, and most encryption at rest) uses asymmetric to exchange a symmetric session key and then switches to symmetric for bulk data.

Expect these follow-ups

• Why is AES-GCM preferred over AES-CBC in modern systems and what does the G in GCM provide?

As asked

What is the difference between authentication and authorization? Give me a concrete example where each can fail independently of the other in a real application, and describe the security controls that address each failure.

Sample answer outline

A strong answer defines authentication as proving identity (password, MFA, certificate) and authorization as determining what an authenticated identity is permitted to do. An example of failed authorization with valid authentication is an IDOR where a logged-in user accesses another user's data. An example of failed authentication with correct authorization is a brute-forced account where the attacker gets the right user's permissions. Controls for authentication include MFA and credential storage best practices; authorization controls include RBAC, ABAC, and server-side access checks on every request.

Expect these follow-ups

• How does OAuth 2.0 separate the concerns of authentication and authorization, and where does OpenID Connect come in?

As asked

Explain why passwords should be hashed rather than encrypted, why MD5 and SHA-1 are insufficient for password hashing, and what properties a good password hashing function provides.

Sample answer outline

A strong answer explains that encryption is reversible (key can decrypt), making it dangerous for passwords because key compromise exposes all passwords, while hashing is one-way. MD5 and SHA-1 are general-purpose hashes optimized for speed, making GPU-accelerated cracking trivial. A good password hashing function (bcrypt, Argon2id, scrypt) includes a random salt to prevent rainbow table attacks, is computationally expensive to slow brute force, and ideally is memory-hard to defeat GPU/ASIC attacks. Argon2id is the current recommendation.

Expect these follow-ups

• What is a pepper and how does it differ from a salt in password storage?

As asked

Name the OWASP Top 10 web application security risk categories and give me a one-sentence concrete example of each. Which do you see most frequently in real code reviews?

Sample answer outline

A strong answer names all ten (Broken Access Control, Cryptographic Failures, Injection, Insecure Design, Security Misconfiguration, Vulnerable and Outdated Components, Identification and Authentication Failures, Software and Data Integrity Failures, Security Logging and Monitoring Failures, SSRF) with concrete examples. In practice, broken access control (IDOR, missing authorization checks) and injection (SQL, command) are most common in code reviews. The candidate should distinguish between the 2021 list and the prior 2017 list if they know both.

Expect these follow-ups

• Why did OWASP add Insecure Design as a new category in 2021 and how does it differ from Security Misconfiguration?

As asked

Explain how a browser decides to trust a TLS certificate presented by a web server. Walk me through the certificate chain, root CAs, and what happens when a certificate is revoked.

Sample answer outline

A strong answer covers the chain from the server certificate to an intermediate CA to a root CA whose public key is in the browser's trust store, the signature verification at each link, and validity period and subject matching checks. Revocation is handled via CRL (certificate revocation list published by the CA) or OCSP (real-time query to the CA's OCSP responder), with OCSP stapling improving performance by having the server cache the OCSP response. The candidate should mention what happens when OCSP is unavailable (soft-fail vs hard-fail policy).

Expect these follow-ups

• How does certificate pinning interact with normal PKI trust and what are its operational risks?

As asked

Explain the TCP three-way handshake, describe how a SYN flood attack exploits it, and explain what SYN cookies are and how they mitigate the attack without requiring per-connection state.

Sample answer outline

A strong answer covers SYN, SYN-ACK, ACK and the half-open connection state. A SYN flood sends many SYN packets with spoofed source IPs, filling the server's backlog with half-open connections and exhausting resources before completion. SYN cookies encode the connection parameters (IP, port, sequence number, timestamp) into a cryptographic hash used as the sequence number in the SYN-ACK, so no state is stored until the ACK completes the handshake and the server can verify the cookie.

Expect these follow-ups

• What is a reflection amplification DDoS attack and how does it differ from a SYN flood in terms of the source IP strategy?

As asked

Explain the principle of defense in depth. Give me a concrete example of applying it to a web application that handles financial transactions, naming at least five distinct layers and the threats each layer addresses.

Sample answer outline

A strong answer names layers such as: WAF blocking known exploit patterns, input validation and output encoding in the application layer, parameterized queries preventing SQL injection at the data access layer, network segmentation preventing the app server from reaching systems it does not need, encryption at rest for the database, and audit logging for forensic capability. The key insight is that no single layer is perfect, so compromise of one layer does not result in full system compromise.

Expect these follow-ups

• How do you decide how many layers are enough versus over-engineering the defenses?

As asked

Starting from a compromised low-privilege user account on a Linux system, name at least five privilege escalation techniques and explain what misconfiguration enables each one.

Sample answer outline

A strong answer covers SUID binary abuse (executable runs as root, attacker calls shell from within it), writable sudo configuration or weak sudo rules (e.g. NOPASSWD for a binary with shell escape), cron jobs running as root executing a script writable by the attacker, misconfigured file capabilities (e.g. cap_setuid on Python), and kernel exploits for unpatched CVEs. The candidate should mention tools like LinPEAS or GTFOBins for discovery.

Expect these follow-ups

• How does AppArmor or SELinux limit what a successful privilege escalation can do?

As asked

Explain how the CVSS v3.1 base score is calculated and what its limitations are when prioritizing which vulnerabilities to patch first. What additional signals would you use alongside CVSS?

Sample answer outline

A strong answer covers the CVSS base score metric groups (Attack Vector, Attack Complexity, Privileges Required, User Interaction, Scope, Confidentiality/Integrity/Availability Impact) and the resulting score range. Key limitations include that CVSS ignores whether exploits exist in the wild, the actual reachability of the vulnerability in your specific environment, and asset criticality. The candidate should mention EPSS (exploit prediction scoring) for exploit likelihood, asset criticality scores from the CMDB, and whether the vulnerable component is internet-exposed as additional signals.

Expect these follow-ups

• How would you build an internal risk score that combines CVSS, EPSS, asset criticality, and exposure to create a prioritized remediation queue?

As asked

Compare packet filtering, stateful inspection, and application-layer (next-generation) firewalls. When would each type of firewall be insufficient and what would bypass it?

Sample answer outline

A strong answer explains that packet filters inspect only header fields (IP, port, protocol) and can be bypassed by traffic on allowed ports, stateful inspection tracks connection state but still cannot inspect application-layer content, and application-layer firewalls do deep packet inspection for known protocols. A bypass example for stateful inspection is tunneling C2 traffic over port 443. NGFW or a web proxy would catch this by inspecting TLS SNI or requiring SSL inspection. The candidate should discuss the performance and privacy tradeoffs of SSL inspection.

Expect these follow-ups

• How does a web application firewall differ from a next-generation firewall in terms of what it protects against?

As asked

Explain CSRF, CORS, and CSP. What does each one protect against, and where do they overlap?

Sample answer outline

CSRF: attacker tricks a logged-in user's browser into sending an authenticated request to your site. Mitigation: SameSite cookies (Lax by default in modern browsers makes most CSRF dead), CSRF tokens for state-changing requests, or rely on the fetch+JSON path which requires CORS. CORS: governs whether a script on origin A can read responses from origin B. CORS does NOT prevent the request being sent, only restricts the response from being read. CSP: declares which sources of content are allowed; mitigates XSS by blocking inline scripts and unknown script sources. Overlap: SameSite + CSRF tokens overlap on CSRF; CORS and CSP overlap on resource loading.

Reference implementation (http)

// Session cookie defaults
Set-Cookie: session=abc123; HttpOnly; Secure; SameSite=Lax; Path=/

// CSP for a typical React SPA (no inline scripts, hashed styles)
Content-Security-Policy:
  default-src 'self';
  script-src 'self' 'sha256-...';
  style-src 'self' 'sha256-...';
  img-src 'self' data: https://cdn.example.com;
  connect-src 'self' https://api.example.com;
  frame-ancestors 'none';
  base-uri 'self';
  form-action 'self';
  report-uri /csp-report

// CORS for a same-account API (only the SPA origin is allowed)
Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET, POST, PATCH, DELETE
Access-Control-Allow-Headers: Content-Type, Authorization

Expect these follow-ups

• Why does SameSite=Lax not fully kill CSRF?
• How would you write a CSP for a React SPA that uses inline styles?
• When does CORS preflight not happen?