Web Security Interview Questions and Answers

Sample questions

A few questions from each level with the correct answer and an explanation.

Web Security · Junior

1. What does the CIA triad in information security stand for?

   Correct answer: Confidentiality, Integrity, Availability

   Confidentiality means only the right people see the data, integrity means it isn't changed without permission, and availability means the system works when needed. Most attacks hit at least one of the three.

2. A form checks in JavaScript that the age field is a number from 18 to 120. Is that enough to protect the server?

   Correct answer: No: an attacker can skip the page and send any request directly, so the server must validate too

   Client-side validation is for user experience. Anyone can send a request with curl or DevTools, so every rule that matters must be checked again on the server.

3. What is the OWASP Top 10?

   Correct answer: A regularly updated list of the most critical security risks for web applications

   OWASP (Open Worldwide Application Security Project) publishes the Top 10 as an awareness document. Broken access control, injection and security misconfiguration are among the entries.

4. What does the principle of least privilege mean?

   Correct answer: Each user, service or token gets only the permissions it needs for its job, nothing more

   If an account or key with minimal rights is compromised, the damage is limited. A database user for a read-only report, for example, shouldn't be able to drop tables.

Web Security · Middle

1. A value is HTML-escaped and then placed into an inline script: <script>var q = '{{value}}';</script>. Why is this still unsafe?

   Correct answer: HTML escaping doesn't protect a JavaScript string context; the value needs JS-specific encoding or should be passed another way

   Each context has its own escaping rules. The safest option is to avoid it: put data in a data- attribute or a JSON block and read it from your script.

2. Which of these is a DOM XSS sink?

   Correct answer: element.insertAdjacentHTML()

   Sinks parse strings as HTML or code: innerHTML, outerHTML, insertAdjacentHTML, document.write, eval, setTimeout(string) and URL properties that accept javascript:.

3. Which of these is a typical DOM XSS source?

   Correct answer: location.hash

   Sources are values an attacker can control: the URL (location, hash, search), document.referrer, postMessage data and stored values from other users.

4. Why is eval(userInput) or new Function(userInput) always dangerous?

   Correct answer: It runs any string as code with the page's privileges

   If any part of the string comes from users, they control the code. Strict CSP also blocks these calls unless 'unsafe-eval' is set.

Web Security · Senior

1. What does the STRIDE model help you do?

   Correct answer: Find threats by category: spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege

   Going through each category for every component and data flow makes it less likely that a whole class of threats is missed.

2. When is threat modeling most useful?

   Correct answer: During design, before the architecture is fixed, and again when it changes significantly

   Design flaws like trusting a client-side role are cheap to fix on a whiteboard and expensive in production.

3. What is the core idea of zero trust architecture?

   Correct answer: No implicit trust based on network location: every request is authenticated and authorized

   Being inside the VPN or cluster doesn't make a call trusted. Services check identity and permissions on each request.

4. What is OWASP ASVS used for?

   Correct answer: A detailed list of verifiable security requirements, grouped by level, for designing and testing applications

   The Top 10 raises awareness; ASVS is a checklist you can build requirements and test plans from.

Combined quizzes with this topic

Questions from several topics at once - just like an interview for a specific role.