Security Interview Guide
Every question uses the same frame: what it tests, progressively stronger answers, green flags, red flags, follow-up and a practical scenario. Strong candidates reason from assets, boundaries and failure—not slogans.
Authentication vs Authorizationbeginner
What is the difference between authentication and authorization?
Tests: Identity versus permission · Resource-level checks
Password Storagebeginner
How should passwords be stored?
Tests: Dedicated password hashing · Salt and work factor · Recovery
Changed Resource IDbeginner
A user changes /users/123 to /users/124 and reads another person’s data. What failed?
Tests: Object/resource authorization
User-Supplied Image URLadvanced
Your API downloads an image from a URL supplied by a user. What risks should you consider?
Tests: Server network position · Destination validation · Egress
Agent with Email and File Deletionadvanced
An AI agent can send emails and delete files. How would you reduce risk?
Tests: Capability separation · Deterministic policy · Approval and audit