Web Security, Application Defense & OWASP Top 10 Master (50 Qs)

Give a candid introduction of your Application Security, Defensive Engineering, and Threat Modeling experience.

The CIA Triad & Defense-in-Depth: How do you design multi-layered security controls in distributed systems?

STRIDE Threat Modeling: How to systematically identify and mitigate threats in software architecture.

Least Privilege & Zero Trust Architecture: Principles, microsegmentation, and identity verification.

Session Management & Token Storage: Why localStorage is vulnerable to XSS and how to configure secure cookies.

CORS Protocol Deep-Dive: Preflight OPTIONS requests, credentialed origins, and the wildcard credential trap.

Same-Origin Policy (SOP) vs. Cross-Origin Capabilities: What SOP blocks and postMessage security.

HTTP Security Headers Suite: HSTS, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy.

Modern Password Hashing: Why MD5/SHA-256 are broken, Argon2id vs. bcrypt, and memory-hard functions.

Cryptographic Pseudo-Random Number Generators (CSPRNG): Math.random() vs. crypto.getRandomValues().

Broken Object Level Authorization (BOLA / IDOR): Why it is the #1 API vulnerability and how to prevent it.

Cross-Site Scripting (XSS): Reflected vs. Stored vs. DOM-Based XSS mechanics and cookie exfiltration.

Content Security Policy (CSP): Nonce-based architecture, strict-dynamic, and eliminating unsafe-inline.

Cross-Site Request Forgery (CSRF): SameSite cookies, Double Submit Cookie pattern, and sync tokens.

Server-Side Request Forgery (SSRF): AWS IMDSv2 protection, DNS rebinding, and egress proxies.

SQL Injection (SQLi) & Second-Order SQLi: Prepared statements, ORM vulnerabilities, and blind SQLi.

Command Injection: Child process execution pitfalls (exec vs. execFile/spawn) and argument escaping.

Broken Authentication & Credential Stuffing: Brute force defense, rate limiting, and password leak APIs.

Security Misconfiguration: Public cloud storage buckets, verbose error stack traces, and default configs.

Vulnerable & Outdated Components: Software supply chain security, typosquatting, and automated SCA.

Software & Data Integrity Failures: Insecure deserialization and Subresource Integrity (SRI).

Security Logging & Monitoring Failures: Log Injection (CRLF), PII masking, and SIEM Honeytokens.

Server-Side Template Injection (SSTI): Mechanics, template sandboxes, and remote code execution.

XML External Entity (XXE) Injection: Exploiting external DTDs, local file retrieval, and parser hardening.

Mass Assignment & Object Injection: Data Transfer Object (DTO) validation and schema enforcement.

JSON Web Token (JWT) Security & Pitfalls: Algorithm confusion (alg: none), RS256 vs. HS256, and revocation.

OAuth 2.0 & OpenID Connect (OIDC): Roles, Authorization Code Flow, and Client Credentials.

OAuth 2.0 PKCE (Proof Key for Code Exchange): Why Implicit Flow is dead and how PKCE prevents code interception.

RBAC vs. ABAC: Static roles vs. dynamic contextual attributes and Open Policy Agent (OPA).

Symmetric vs. Asymmetric Encryption: AES-256-GCM (AEAD) vs. RSA-4096 vs. ECC Curve25519.

Envelope Encryption & Key Management: Data Encryption Keys (DEK) vs. Key Encryption Keys (KEK).

Mutual TLS (mTLS) & Cryptographic Service Identity: PKI, X.509 cert validation, and SPIFFE IDs.

Multi-Factor Authentication (MFA): TOTP (RFC 6238) vs. FIDO2 / WebAuthn / Passkeys.

Enterprise Single Sign-On (SSO): SAML 2.0 vs. OpenID Connect (OIDC) federation architectures.

Cryptographic Salt, Pepper, and Nonce: Definitions, entropy rules, and preventing Rainbow Tables.

Clickjacking & Frame Busting: How transparent iframe overlays work and frame-ancestors defenses.

Subresource Integrity (SRI): Defending against compromised CDN scripts using cryptographic hashes.

Tabnabbing & Reverse Tabnabbing: Exploiting window.opener in target="_blank" links and the rel fix.

MIME Sniffing & File Content Confusion: How X-Content-Type-Options: nosniff blocks polyglot attacks.

HTTP Strict Transport Security (HSTS) & Preload List: Mitigating SSL Stripping attacks.

Permissions-Policy (Feature-Policy): Restricting browser hardware APIs (Camera, Mic, Geolocation).

Prototype Pollution in JavaScript: Recursive object merge flaws and defensive hardening techniques.

Regular Expression Denial of Service (ReDoS): Catastrophic backtracking mechanics and safe regex engines.

Web Application Firewalls (WAF): Signature matching, anomaly detection, and Layer 7 DDoS mitigation.

Secure File Upload Architecture: Extension spoofing, MIME validation, magic bytes, and S3 sandboxing.

GraphQL Security Architecture: Query depth limiting, complexity analysis, and disabling introspection.

DevSecOps & Shift-Left Security: Integrating SAST, DAST, SCA, and secret scanning into CI/CD pipelines.

Enterprise Secrets Management: Zero-Secret-Leak architectures and dynamic credentials with Vault.

Security Incident Response: Containment, forensic evidence preservation, and the GDPR 72-hour reporting rule.

How do you summarize your security philosophy and conclude an Application Security / DevSecOps Interview?