Security Interview Questions

What security testing can an SDET automate in the pipeline?

Which OWASP Top 10 risks can a tester realistically cover?

Broken access control, injection, authentication failures, security misconfiguration, sensitive data exposure and vulnerable dependencies are all testable in a normal QA pipeline.

How do you test for IDOR and broken object-level authorisation?

Create two accounts, then use account A's token against account B's resource ids and assert 403/404 for read, update and delete — never just the UI hiding the link.

How do you add security scanning to a pipeline?

Dependency scanning and secret scanning on every commit, SAST on PRs, and a ZAP baseline scan against a deployed environment nightly — fail on new high findings only.

What token and session flaws do you test for?

Expired and tampered tokens, wrong audience or issuer, missing scope, algorithm confusion (alg: none), token reuse after logout, and refresh-token rotation.

What is authentication testing, and why does it matter in Security?

authentication testing is a core Security concept used to make testing decisions more accurate, repeatable, and aligned with product risk.

How would you apply authentication testing in a production Security project?

Apply authentication testing through an explicit, repeatable design: define the expected behavior, automate the highest-risk path, capture useful diagnostics, and verify the result against a stable oracle.

What is authorization testing, and why does it matter in Security?

authorization testing is a core Security concept used to make testing decisions more accurate, repeatable, and aligned with product risk.

How would you apply authorization testing in a production Security project?

Apply authorization testing through an explicit, repeatable design: define the expected behavior, automate the highest-risk path, capture useful diagnostics, and verify the result against a stable oracle.

What is least privilege, and why does it matter in Security?

least privilege is a core Security concept used to make testing decisions more accurate, repeatable, and aligned with product risk.

How would you apply least privilege in a production Security project?

Apply least privilege through an explicit, repeatable design: define the expected behavior, automate the highest-risk path, capture useful diagnostics, and verify the result against a stable oracle.

What is OWASP Top 10, and why does it matter in Security?

OWASP Top 10 is a core Security concept used to make testing decisions more accurate, repeatable, and aligned with product risk.

How would you apply OWASP Top 10 in a production Security project?

Apply OWASP Top 10 through an explicit, repeatable design: define the expected behavior, automate the highest-risk path, capture useful diagnostics, and verify the result against a stable oracle.

What is injection, and why does it matter in Security?

injection is a core Security concept used to make testing decisions more accurate, repeatable, and aligned with product risk.

How would you apply injection in a production Security project?

Apply injection through an explicit, repeatable design: define the expected behavior, automate the highest-risk path, capture useful diagnostics, and verify the result against a stable oracle.

What is cross-site scripting, and why does it matter in Security?

cross-site scripting is a core Security concept used to make testing decisions more accurate, repeatable, and aligned with product risk.

How would you apply cross-site scripting in a production Security project?

Apply cross-site scripting through an explicit, repeatable design: define the expected behavior, automate the highest-risk path, capture useful diagnostics, and verify the result against a stable oracle.

What is CSRF, and why does it matter in Security?

CSRF is a core Security concept used to make testing decisions more accurate, repeatable, and aligned with product risk.

How would you apply CSRF in a production Security project?

Apply CSRF through an explicit, repeatable design: define the expected behavior, automate the highest-risk path, capture useful diagnostics, and verify the result against a stable oracle.

What is broken access control, and why does it matter in Security?

broken access control is a core Security concept used to make testing decisions more accurate, repeatable, and aligned with product risk.

How would you apply broken access control in a production Security project?

Apply broken access control through an explicit, repeatable design: define the expected behavior, automate the highest-risk path, capture useful diagnostics, and verify the result against a stable oracle.

What is session management, and why does it matter in Security?

session management is a core Security concept used to make testing decisions more accurate, repeatable, and aligned with product risk.

How would you apply session management in a production Security project?

Apply session management through an explicit, repeatable design: define the expected behavior, automate the highest-risk path, capture useful diagnostics, and verify the result against a stable oracle.

What is password policies, and why does it matter in Security?

password policies is a core Security concept used to make testing decisions more accurate, repeatable, and aligned with product risk.

How would you apply password policies in a production Security project?

Apply password policies through an explicit, repeatable design: define the expected behavior, automate the highest-risk path, capture useful diagnostics, and verify the result against a stable oracle.

What is multi-factor authentication, and why does it matter in Security?

multi-factor authentication is a core Security concept used to make testing decisions more accurate, repeatable, and aligned with product risk.

How would you apply multi-factor authentication in a production Security project?

Apply multi-factor authentication through an explicit, repeatable design: define the expected behavior, automate the highest-risk path, capture useful diagnostics, and verify the result against a stable oracle.

What is API security, and why does it matter in Security?

API security is a core Security concept used to make testing decisions more accurate, repeatable, and aligned with product risk.

How would you apply API security in a production Security project?

Apply API security through an explicit, repeatable design: define the expected behavior, automate the highest-risk path, capture useful diagnostics, and verify the result against a stable oracle.

What is rate limiting, and why does it matter in Security?

rate limiting is a core Security concept used to make testing decisions more accurate, repeatable, and aligned with product risk.

How would you apply rate limiting in a production Security project?

Apply rate limiting through an explicit, repeatable design: define the expected behavior, automate the highest-risk path, capture useful diagnostics, and verify the result against a stable oracle.

What is sensitive data exposure, and why does it matter in Security?

sensitive data exposure is a core Security concept used to make testing decisions more accurate, repeatable, and aligned with product risk.

How would you apply sensitive data exposure in a production Security project?

Apply sensitive data exposure through an explicit, repeatable design: define the expected behavior, automate the highest-risk path, capture useful diagnostics, and verify the result against a stable oracle.

What is TLS validation, and why does it matter in Security?

TLS validation is a core Security concept used to make testing decisions more accurate, repeatable, and aligned with product risk.

How would you apply TLS validation in a production Security project?

Apply TLS validation through an explicit, repeatable design: define the expected behavior, automate the highest-risk path, capture useful diagnostics, and verify the result against a stable oracle.

What is security headers, and why does it matter in Security?

security headers is a core Security concept used to make testing decisions more accurate, repeatable, and aligned with product risk.

How would you apply security headers in a production Security project?

Apply security headers through an explicit, repeatable design: define the expected behavior, automate the highest-risk path, capture useful diagnostics, and verify the result against a stable oracle.

What is dependency scanning, and why does it matter in Security?

dependency scanning is a core Security concept used to make testing decisions more accurate, repeatable, and aligned with product risk.

How would you apply dependency scanning in a production Security project?

Apply dependency scanning through an explicit, repeatable design: define the expected behavior, automate the highest-risk path, capture useful diagnostics, and verify the result against a stable oracle.

What is static analysis, and why does it matter in Security?

static analysis is a core Security concept used to make testing decisions more accurate, repeatable, and aligned with product risk.

How would you apply static analysis in a production Security project?

Apply static analysis through an explicit, repeatable design: define the expected behavior, automate the highest-risk path, capture useful diagnostics, and verify the result against a stable oracle.

What is dynamic analysis, and why does it matter in Security?

dynamic analysis is a core Security concept used to make testing decisions more accurate, repeatable, and aligned with product risk.

How would you apply dynamic analysis in a production Security project?

Apply dynamic analysis through an explicit, repeatable design: define the expected behavior, automate the highest-risk path, capture useful diagnostics, and verify the result against a stable oracle.

What is secret scanning, and why does it matter in Security?

secret scanning is a core Security concept used to make testing decisions more accurate, repeatable, and aligned with product risk.

How would you apply secret scanning in a production Security project?

Apply secret scanning through an explicit, repeatable design: define the expected behavior, automate the highest-risk path, capture useful diagnostics, and verify the result against a stable oracle.

What is threat modeling, and why does it matter in Security?

threat modeling is a core Security concept used to make testing decisions more accurate, repeatable, and aligned with product risk.

How would you apply threat modeling in a production Security project?

Apply threat modeling through an explicit, repeatable design: define the expected behavior, automate the highest-risk path, capture useful diagnostics, and verify the result against a stable oracle.

What is audit logging, and why does it matter in Security?

audit logging is a core Security concept used to make testing decisions more accurate, repeatable, and aligned with product risk.

How would you apply audit logging in a production Security project?

Apply audit logging through an explicit, repeatable design: define the expected behavior, automate the highest-risk path, capture useful diagnostics, and verify the result against a stable oracle.

What is penetration-test triage, and why does it matter in Security?

penetration-test triage is a core Security concept used to make testing decisions more accurate, repeatable, and aligned with product risk.

How would you apply penetration-test triage in a production Security project?

Apply penetration-test triage through an explicit, repeatable design: define the expected behavior, automate the highest-risk path, capture useful diagnostics, and verify the result against a stable oracle.