Senior Auth & Security Interview Questions (50 MCQs)

Question 1

In a JWT algorithm confusion attack, the attacker signs with `HS256` while the server expects `RS256`. Why might it succeed?

Accepted Answer

The library uses the (public) RSA public key as the HMAC secret

Answer

Because HS256 and RS256 produce identical output

Answer

Because the attacker downloads the private key from JWKS

Answer

Because RS256 doesn't check signatures

Question 2

Which risk is associated with the `kid` or `jku` JWT header?

Accepted Answer

If the server loads keys from the given path or URL without an allowlist, the attacker can supply their own key

Answer

`kid` prevents the payload from being encrypted

Answer

`jku` disables expiration

Answer

`kid` is only allowed with HS256

Question 3

For a single-domain monolith web app needing instant logout and quick permission changes, which choice is more sensible?

Accepted Answer

Server-side sessions with an `HttpOnly` cookie; instant revocation and centralized state

Answer

A 30-day JWT in localStorage

Answer

A JWT without `exp` for simplicity

Answer

Basic Auth on every request

Question 4

What security benefit does the Backend-for-Frontend (BFF) pattern give SPAs using OAuth?

Accepted Answer

Tokens stay on the BFF server and the browser only holds an `HttpOnly` cookie

Answer

It removes the need for HTTPS

Answer

It makes CSRF impossible without any other measures

Answer

It puts the access token in the URL for caching

Question 5

If the session cookie is `HttpOnly`, what can a successful XSS still do?

Accepted Answer

Make arbitrary authenticated API requests as the user and read the data

Answer

Nothing; `HttpOnly` neutralizes all XSS impact

Answer

Only change the page's appearance

Answer

Only read other sites' cookies

Question 6

Per the OAuth Security BCP, what must refresh tokens issued to public clients (like SPAs) have?

Accepted Answer

Be either sender-constrained (DPoP/mTLS) or rotated as single-use

Answer

Have unlimited lifetime for better UX

Answer

Be sent in the query string

Answer

Be signed with a client secret embedded in the JS bundle

Question 7

What problem with bearer tokens does DPoP (Demonstrating Proof-of-Possession) solve?

Accepted Answer

A stolen token is unusable without the client's private key

Answer

It removes the need for an authorization server

Answer

It makes tokens shorter and lighter

Answer

It allows sending tokens over plain HTTP

Question 8

In a microservice chain, why is forwarding the user's same access token to all downstream services risky?

Accepted Answer

Any compromised service can replay the powerful token everywhere; token exchange with narrowed audience is better

Answer

Because JWTs expire after one hop

Answer

Because downstream services can't read headers

Answer

No risk; it's best practice

Question 9

Which architectural strategy systematically reduces BOLA/IDOR in a large API?

Accepted Answer

Centralizing authorization in a policy layer and scoping queries to tenant/owner by default

Answer

Switching all numeric IDs to UUIDs

Answer

Hiding the API documentation

Answer

Adding CAPTCHA to every endpoint

Question 10

What's the benefit of PostgreSQL Row-Level Security in a multi-tenant SaaS?

Accepted Answer

Even if app code forgets the `tenant_id` filter, the DB won't return other tenants' rows

Answer

It automatically encrypts each tenant's data

Answer

It multiplies query speed

Answer

It removes the need for authentication

Question 11

A server resolves the hostname, checks the IP is public, then requests by hostname. What's the weakness of this SSRF defense?

Accepted Answer

DNS rebinding (TOCTOU); the second resolution can return an internal IP

Answer

None; it's complete

Answer

It just doesn't work on IPv6

Answer

It causes XSS

Question 12

How does AWS IMDSv2 mitigate SSRF against the metadata endpoint?

Accepted Answer

It requires a session token from a `PUT` with a special header, which simple GET-based SSRF can't produce

Answer

It removes the metadata endpoint entirely

Answer

It hides credentials with Base64

Answer

It's reachable only over IPv6

Question 13

What operational risk does Argon2id with high memory parameters create on a login endpoint, and how is it controlled?

Accepted Answer

DoS via floods of login requests; control with rate limiting before hashing and bounded concurrency

Answer

Password leakage in memory; fix by disabling salt

Answer

Hashes become reversible; fix with Base64

Answer

None, since Argon2 is lightweight

Question 14

Login errors are identical, but nonexistent emails respond in 5ms and existing ones in 300ms. What's the issue and fix?

Accepted Answer

Timing-based enumeration; verify against a dummy hash for nonexistent users too

Answer

No issue since messages are identical

Answer

Set bcrypt cost to zero

Answer

Cache responses for existing users

Question 15

A credential stuffing attack comes from thousands of distributed residential IPs, defeating per-IP rate limits. Which defense combination is most effective?

Accepted Answer

Breached-password checks (e.g. HIBP k-anonymity), MFA/passkeys, device fingerprinting, and risk-based challenges

Answer

Raising minimum password length to 8

Answer

Blocking all foreign IPs

Answer

Changing the login URL monthly

Question 16

Against MFA fatigue (push bombing) attacks, which measure is most effective?

Accepted Answer

Number matching in push prompts and limiting push count, or moving to FIDO2

Answer

Sending more pushes so users get used to them

Answer

Removing MFA entirely

Answer

Replacing push with a security question

Question 17

In adversary-in-the-middle phishing (e.g. Evilginx), which MFA method stays secure?

Accepted Answer

WebAuthn/FIDO2, because the signature is bound to the real origin

Answer

TOTP, because it changes every 30 seconds

Answer

SMS OTP, because it uses a separate channel

Answer

Push notifications without number matching

Question 18

After a session cookie is stolen by infostealer malware, which mechanism limits the damage?

Accepted Answer

Re-authentication for sensitive actions, bounded session lifetime, and device binding (e.g. DBSC)

Answer

The `HttpOnly` flag on the cookie

Answer

`SameSite=Strict`

Answer

Longer session IDs

Question 19

What weakness does XML Signature Wrapping (XSW) against SAML exploit?

Accepted Answer

The SP verifies the signature on one element but reads identity from another injected element

Answer

XML can't carry digital signatures

Answer

SAML doesn't use HTTPS

Answer

The IdP puts the password in the assertion

Question 20

In a client that works with multiple authorization servers, what prevents the mix-up attack?

Accepted Answer

Checking the `iss` parameter in the authorization response against the expected AS

Answer

Using one shared client_secret for all ASes

Answer

Disabling PKCE

Answer

Using the Implicit flow

Question 21

What's the correct way to rotate a JWT signing key without abruptly invalidating active tokens?

Accepted Answer

Publish the new key with a new `kid` in JWKS, switch signing to it, keep the old key until tokens expire

Answer

Replace the key and log everyone out

Answer

Manually edit `exp` in all tokens

Answer

Put the new key only in client code

Question 22

How does envelope encryption with a KMS work and what's its benefit?

Accepted Answer

Data is encrypted with a local data key, which is encrypted by a KMS master key; easier rotation and access control

Answer

Data is encrypted twice with the same key for extra security

Answer

All data is sent to the KMS for encryption

Answer

The master key is stored next to the data in the DB

Question 23

In AES-GCM, what happens if a nonce is reused with the same key?

Accepted Answer

The XOR of plaintexts leaks and the attacker can forge authentication tags

Answer

Only performance drops slightly

Answer

Decryption becomes impossible but security holds

Answer

No effect, since GCM generates its own nonce

Question 24

Database disk encryption (TDE) is on. Why might national ID numbers still need application-level encryption?

Accepted Answer

TDE doesn't protect against SQL injection, DBAs, or logical backups because data is decrypted for any valid query

Answer

Because TDE stores data as Base64

Answer

Because TDE only works on numeric columns

Answer

It's not needed; TDE covers every threat

Question 25

What does forward secrecy in TLS guarantee?

Accepted Answer

Later compromise of the server's private key doesn't decrypt previously recorded traffic

Answer

The server certificate never expires

Answer

Messages can't be decrypted by the server in the future

Answer

The client doesn't need to verify the certificate

Question 26

Before submitting a domain to the HSTS preload list with `includeSubDomains`, what risk must be assessed?

Accepted Answer

Every subdomain (even internal and legacy) must support HTTPS, and removal takes months

Answer

Preloading disables cookies

Answer

Preloading halves site speed

Answer

Preloading only affects Firefox

Question 27

Which measure is effective against dependency confusion attacks?

Accepted Answer

Using an organization scope (like `@acme/`) and pinning the registry for that scope

Answer

Removing the lockfile from the repo

Answer

Installing all packages with `--force`

Answer

Using `latest` for all versions

Question 28

What value do SBOMs and build provenance (like SLSA or `npm publish --provenance`) provide?

Accepted Answer

An exact component inventory and verifiable proof of which source and pipeline built an artifact

Answer

Automatic source code encryption

Answer

Removing the need for code review

Answer

Faster builds

Question 29

In the STRIDE model, which control addresses the 'Repudiation' threat?

Accepted Answer

Tamper-evident audit logs and digital signatures on actions

Answer

Rate limiting

Answer

Encryption in transit with TLS

Answer

CSP

Question 30

In a zero trust architecture, why shouldn't internal services trust each other merely for being in the same VPC?

Accepted Answer

Compromising one service (e.g. via SSRF or RCE) grants free lateral movement across the network

Answer

Because VPCs don't encrypt traffic, which is always illegal

Answer

Because internal services can't use DNS

Answer

Trusting the internal network is fully safe

Question 31

An AWS access key was accidentally pushed to a public GitHub repo. What's the correct first action?

Accepted Answer

Immediately revoke/rotate the key, then review CloudTrail for unauthorized use

Answer

Delete the commit with `git push --force` and you're done

Answer

Make the repo private

Answer

Wait to see whether it gets abused

Question 32

For deploying from GitHub Actions to AWS, what's safer than storing a long-lived access key in secrets?

Accepted Answer

OIDC federation that issues short-lived credentials with a scoped role per job

Answer

Storing the key in an encrypted file in the repo

Answer

Using the account root key

Answer

Putting the key in a public workflow variable

Question 33

A recursive deep merge runs on user JSON. What does the payload `{"__proto__":{"isAdmin":true}}` do?

Accepted Answer

Prototype pollution; `isAdmin` lands on `Object.prototype` and all objects inherit it

Answer

It just adds a key named `__proto__` to the object

Answer

`JSON.parse` throws an error

Answer

No effect, since JSON has no prototype

Question 34

What is second-order SQL injection?

Accepted Answer

The payload is stored safely first, then later used unparameterized in another query and executed

Answer

Injection that only runs on replica databases

Answer

Injection requiring two simultaneous requests

Answer

Injection into a table's second column

Question 35

When is using an ORM still vulnerable to SQL injection?

Accepted Answer

When using raw queries with string concatenation or passing column/sort names from user input

Answer

Never; ORMs cover every case

Answer

Only when the database is MySQL

Answer

Only when using transactions

Question 36

How does the Zip Slip vulnerability occur when extracting an uploaded archive?

Accepted Answer

An entry named `../../app/config.js` gets written outside the target directory

Answer

The zip is too large and fills memory

Answer

The zip is encrypted and unreadable

Answer

File names contain Unicode

Question 37

Which combination is safest for storing and serving user-uploaded files?

Accepted Answer

Store in object storage with random names, serve from a separate domain with `Content-Disposition: attachment` and `nosniff`

Answer

Store in the web server's public folder under the original filename

Answer

Only check the `.jpg` extension in the filename

Answer

Trust the client-sent `Content-Type` header

Question 38

What problem does the regex `^(a+)+$` cause on input `'aaaaaaaaaaaaaaaaaaaaaaaa!'` in Node.js?

Accepted Answer

ReDoS; exponential backtracking blocks the event loop for a long time

Answer

The regex throws a syntax error

Answer

It immediately returns true

Answer

It uses little memory and is fine

Question 39

How does an XXE attack on XML input work and what's the main defense?

Accepted Answer

An external entity in the DOCTYPE reads local files or internal URLs; disable DTDs and external entities in the parser

Answer

XML runs JavaScript in the browser; add CSP

Answer

XML is large; enable gzip

Answer

XML is unsigned; use JWT instead

Question 40

A single-use coupon gets applied multiple times via 20 concurrent requests. What's the root cause and fix?

Accepted Answer

A check-then-act race; use atomic operations like `UPDATE ... WHERE used = false` or a unique constraint

Answer

XSS in the coupon form; fix with escaping

Answer

CSRF; fix with SameSite

Answer

Browser caching; fix with `Cache-Control`

Question 41

What's the trade-off of embedding all of a user's fine-grained permissions in a JWT?

Accepted Answer

Permission changes don't apply until expiry and tokens bloat; prefer coarse claims with fine-grained checks in the service

Answer

No trade-off; it's the best approach

Answer

Permissions in a JWT are encrypted and unreadable by APIs

Answer

JWTs support only one claim

Question 42

What's the confused deputy problem in a file-processing service that reads from S3 with its own IAM role?

Accepted Answer

A user can supply another bucket path and the service reads it with its own broad privileges

Answer

The service can't read any files

Answer

S3 doesn't decrypt files

Answer

The service forgets its IAM role

Question 43

Why is a domain-allowlist CSP (like `script-src https://cdn.example.com https://www.google.com`) often bypassable?

Accepted Answer

Allowed domains often host JSONP endpoints or libraries like old AngularJS enabling arbitrary code execution

Answer

Because browsers ignore allowlists

Answer

Because CSP only applies to images

Answer

Because allowlists don't require HTTPS

Question 44

How do Trusted Types help eliminate DOM-based XSS in a large codebase?

Accepted Answer

Dangerous sinks like `innerHTML` accept only objects created by vetted policies, not raw strings

Answer

It Base64-encodes all strings automatically

Answer

It disables JavaScript in the browser

Answer

It only runs on the server

Question 45

Why is allowlisting the `null` origin in CORS (`Access-Control-Allow-Origin: null`) dangerous?

Accepted Answer

An attacker can send requests with origin `null` from sandboxed iframes or `data:` pages

Answer

Because `null` is only for localhost

Answer

Because browsers convert `null` to `*`

Answer

No danger, since no site has a null origin

Question 46

Your app lets customers register arbitrary webhook URLs. Which risks must be managed?

Accepted Answer

SSRF into the internal network, and HMAC signatures with timestamps so receivers can verify authenticity and replay

Answer

Only XSS in the customer dashboard

Answer

Only bandwidth consumption

Answer

No risk, since requests come from your server

Question 47

An org mandates passkeys for login, but account recovery works via an unconditional email link. What's the right security assessment?

Accepted Answer

Real security equals the weakest path, email; recovery must be as strict as login

Answer

Passkeys secure everything and recovery doesn't matter

Answer

Email is more secure than passkeys

Answer

Account recovery should be removed entirely

Question 48

Why might rate limiting by HTTP request count be insufficient for a GraphQL API?

Accepted Answer

Aliases or batching can pack hundreds of mutations (e.g. login or OTP attempts) into one request

Answer

Because GraphQL doesn't support HTTPS

Answer

Because GraphQL caches every request

Answer

Because GraphQL only uses GET

Question 49

After enabling a CDN, users sometimes see another user's account dashboard. What's the most likely cause?

Accepted Answer

Personalized responses lacking `Cache-Control: private` or `no-store` were stored in the shared cache

Answer

The CDN decrypted passwords

Answer

Users' JWTs collided

Answer

HSTS swapped sessions

Question 50

How can audit logs be made resistant to tampering by an attacker who compromised the app server?

Accepted Answer

Ship immediately to separate write-once storage (e.g. S3 Object Lock) and hash-chain the records

Answer

Store logs in a local file with `777` permissions

Answer

Store logs in the app's own database

Answer

Compress logs with gzip