Top 9 Appsec Interview Questions
Browse 9 real-world technical and behavioral interview questions about Appsec. Review scenarios, edge cases, and architectural best practices.
You are told there is a memory-safety bug somewhere in a large C or C++ codebase, and you cannot read all of it. How do you narrow the search?
Start from where untrusted bytes enter, not from line one. Rank the parsers and decoders that turn attacker input into lengths and indices, build them with AddressSanitizer and UBSan, fuzz those entry points, and use crash reports and git history to point at the exact access that goes wrong.
You are handed 200 lines of AI-generated code in an interview and told some of it is exploitable. Where do you look first?
Start a secure code review of AI-generated code at the trust boundaries, not at line one. Find where untrusted input enters and where it reaches a query, a shell, a file path or an authorisation decision, then check what is missing between them as hard as what is present.
Walk me through applying STRIDE to the boundary where our order service calls the payments service over the network.
A STRIDE threat modeling example works best at one boundary, such as order service to payments service: test spoofing, tampering, repudiation, information disclosure, denial of service and elevation of privilege, then attach one concrete mitigation to each.
You've run a threat model and found real issues, but engineering leadership says the roadmap has no room this quarter. How do you get the fixes prioritised?
Translate each finding from security language into the same terms the roadmap is already prioritised by — a concrete failure scenario, its business cost, and the cheapest point in the system's lifecycle to fix it — rather than asking for time on the strength of the threat model alone.
What is the difference between SAST, DAST and SCA, and what kind of vulnerability does each one miss?
SAST vs DAST vs SCA compares three partial security views: SAST reviews source code, DAST tests a running app and SCA checks dependencies. Each misses business-logic flaws and each needs triage, ownership and release policy to matter.
Would you rather build a framework that is secure by default, or train developers to write secure code? Why?
Secure-by-default framework design wins because it removes the vulnerability class from the option space entirely, while training relies on every developer remembering every rule on every request; the two are not actually substitutes, since training is still needed for what the framework cannot enforce.
Your vulnerability scanner just reported four thousand findings across the codebase. How do you actually triage that?
Vulnerability scanner backlog triage should rank findings by exploitability, reachability, asset criticality and fix leverage instead of CVSS alone. Group duplicates by root cause, separate release blockers from tracked debt and assign owners.
Your WAF starts blocking legitimate checkout traffic during a sale. How do you tell an attack from a spike, live?
A WAF false positive during checkout should be debugged rule by rule, not by disabling the whole web application firewall. Compare checkout funnel shape, source spread and per-rule block counters, then move only the offending rule to log-only mode. It also connects false positives to the point an interviewer is testing.
How do you know when a threat model has gone stale, and how would you catch it before an incident does?
A threat model goes stale when architecture, trust boundaries, dependencies, data flows or abuse assumptions change. The fix is event-driven review triggers in design and delivery workflows, not a calendar reminder that ignores real system change.