Skip to content
Preptima
Search questions

Security Fundamentals interview questions

OWASP categories, cryptography basics, hashing versus encryption, and secure-by-default habits.

4 questions in CS Fundamentals.

Computer Science FundamentalsA 22-minute read on how the topic fits together, before the questions.CS fundamentals59 short answers on one page, for revising rather than studying.

medium4

mediumConceptCoding

You need a random number from 1 to 6 and you wrote rand() % 6. What is wrong with that, and when does it stop being merely wrong and become a vulnerability?

rand() % 6 yields 0 to 5, and because RAND_MAX + 1 is not a multiple of 6 it shows modulo bias towards 0 and 1. Rejection sampling fixes the bias. It becomes a vulnerability when an attacker benefits from predicting the value, as with tokens, keys or nonces, because rand() is predictable. Those need a CSPRNG.

4 minentry, mid, senior
mediumConcept

You are told the application is safe from injection because all user input is escaped as it comes in. What is wrong with that?

Escaping is meaningless without a destination, and at the point input arrives you do not know which parser will consume it. Injection is a property of the sink, so the defence belongs at each sink — bound parameters, an argument vector rather than a shell string, encoding chosen by output context — not at the edge. It also connects input validation to the point an interviewer is testing.

5 minmid, senior, staff
mediumConcept

How does HTTPS establish trust, and what does a certificate prove?

A certificate binds a public key to a domain name and is signed by a chain ending at a root already in your device's trust store. It proves that whoever holds the matching private key controlled that name at issuance - nothing about the operator's honesty - and revoking it early barely works.

5 minmid, senior, staff