Security Fundamentals interview questions

OWASP categories, cryptography basics, hashing versus encryption, and secure-by-default habits.

3 questions in CS Fundamentals.

Computer Science FundamentalsA 22-minute read on how the topic fits together, before the questions.CS fundamentals59 short answers on one page, for revising rather than studying.

medium3

mediumConcept

You are told the application is safe from injection because all user input is escaped as it comes in. What is wrong with that?

Escaping is meaningless without a destination, and at the point input arrives you do not know which parser will consume it. Injection is a property of the sink, so the defence belongs at each sink — bound parameters, an argument vector rather than a shell string, encoding chosen by output context — not at the edge. It also connects input validation to the point an interviewer is testing.

5 minmid, senior, staff

mediumConcept

How does HTTPS establish trust, and what does a certificate prove?

A certificate binds a public key to a domain name and is signed by a chain ending at a root already in your device's trust store. It proves that whoever holds the matching private key controlled that name at issuance - nothing about the operator's honesty - and revoking it early barely works.

5 minmid, senior, staff

mediumConcept

Why do we hash passwords instead of encrypting them, and what makes a password hash different from SHA-256?

Password hashing vs encryption comes down to reversibility: encrypted passwords can be recovered with a key, while hashes are verified one way. Password storage needs salts and slow memory-hard algorithms such as Argon2, bcrypt or scrypt, not fast SHA-256.

5 minentry, mid, senior