Your estate has 1,200 repositories, 9 scanners, and 420,000 raw findings per day; design an ASPM ingestion platform that makes new critical findings queryable within 10 minutes without losing scanner evidence.

I would use event-driven normalization with immutable raw evidence and a versioned Finding schema. - Connectors write signed ScannerObservation events to Kafka with tool, rule, repository, commit, scan ID, timestamps, and the original SARIF URI. - Flink maps observations into Finding v3 records; invalid payloads enter a dead-letter queue with a 30-minute connector-owner SLA. - ClickHouse serves fleet analytics and PostgreSQL owns finding state, so replay cannot overwrite triage or exception decisions. - Canaries from all 9 scanners measure the 10-minute freshness SLO, event loss, schema rejection, and connector lag.

Forty services evaluate 120,000 tenant-authored formulas per second with a 50 ms p99 budget; design the expression parser and runtime against code injection and resource exhaustion.

I would expose a small typed expression language and execute its AST in a bounded interpreter rather than pass text to a host-language evaluator. - A versioned grammar rejects ambiguous encodings, more than 10,000 tokens, nesting above 64 levels, and identifiers outside the tenant schema. - Type checking permits 24 pure functions and produces an immutable AST with no reflection, filesystem, network, dynamic import, or host object access. - Each evaluation receives 5 ms of CPU, 16 MB of memory, an instruction counter, and a tenant quota, so one formula cannot exhaust a worker. - One million generated, mutation, and cross-language parser cases gate releases while canaries keep p99 below 50 ms at 120,000 evaluations per second.

An organization has 1,800 repositories, 2,300 deployable services, and 14% of critical findings lack an owner; design ownership resolution with a 4-hour routing SLA and a named OwnershipRecord artifact.

I would resolve ownership from deployment identity first and record every decision as a versioned OwnershipRecord. - The resolver joins Backstage, CODEOWNERS, workload labels, cloud accounts, and on-call schedules by repository and artifact digest. - OwnershipRecord stores service, team, escalation team, evidence, confidence, effective time, and catalog revision for audit. - Conflicts route to the production operator; confidence below 0.8 goes to a 12-person platform queue instead of guessing. - Reconciliation targets 99% owned tier-1 findings and 95% of all new findings routed within the 4-hour SLA.

One hundred eighty product teams create 320 material design changes per month, but only 54% have a current threat model; how would you reach 90% effective coverage in 2 quarters without counting empty templates?

I would define coverage as a reviewed model tied to the deployed change and automate evidence around that definition. - ThreatModelManifest names DFD revision, changed boundaries, assets, abuse cases, mitigations, owner, reviewer, and release digest. - Backstage routes authentication, payments, tenant isolation, uploads, and external integrations to review; proven low-risk patterns use preapproved models. - A model counts only when its 3 highest risks have tests or tracked mitigations and its digest appears in release evidence. - Weekly metrics target 90% coverage and a 3-day p95 while showing stale models and escaped design flaws.

Sixty-five Spring, ASP.NET, and Rails APIs process 18,000 write requests per second; design framework controls that prevent clients from mass-assigning tenant, role, price, or approval fields with under 2 ms p99 overhead.

I would generate action-specific input models and make server-owned fields impossible to bind from request data. - OpenAPI extensions declare writable fields per create, update, and admin action, then generate separate DTOs for all 65 APIs instead of reusing persistence models. - Spring, ASP.NET, and Rails adapters reject unknown and duplicate keys before binding, including nested objects and alternate field aliases. - Tenant, actor, role, price authority, and approval state come from authenticated context or server lookup after binding and overwrite no client-controlled value. - A 25,000-case cross-framework corpus gates adapter releases, while benchmarks enforce under 2 ms p99 at 18,000 writes per second.

Seven scanners update the same defect asynchronously across 1,100 repositories, and audit requires 5-year history; how would you model finding state so rescans cannot erase remediation evidence?

I would separate immutable observations from an append-only DefectDecision log and derive current state as a projection. - ScannerObservation records each result, while DefectIdentity holds the stable root-cause fingerprint independent of tool status. - DefectDecision events cover triaged, duplicate, fixed, accepted, false-positive, reopened, and expired with actor, reason, evidence, and policy version. - A clean rescan closes a defect only when the fixed commit reaches all production deployments; one tool cannot overwrite the decision. - PostgreSQL serves projections, S3 Object Lock retains 5-year history, and replay tests verify state from 10 million events.

Your platform depends on 11 SaaS scanner APIs with limits from 60 to 5,000 calls per minute; design connector resilience so a 6-hour vendor outage does not breach a 24-hour critical-finding SLA.

I would isolate every vendor behind a checkpointed connector with explicit freshness and completeness contracts. - Each connector keeps encrypted cursor state, idempotency keys, vendor request IDs, and response hashes so retries cannot skip observations. - Token buckets honor all 11 limits, backoff handles throttling, and priority queues fetch critical projects before historical reconciliation. - A 6-hour outage serves last-known state with a stale flag, then replays webhooks and performs a bounded full diff. - Dashboards alert at 2 hours of lag and reserve 18 hours for catch-up, preserving the 24-hour SLA.

A portfolio receives 18,000 pull requests per month across 6 languages, including 240 authentication, cryptography, parser, and tenant-boundary modules; design secure code review that keeps p95 assignment below 30 minutes with only 8 specialist reviewers.

I would route semantic changes to reviewers through a maintained map of security boundaries, not file extensions or repository labels. - A SecurityBoundaryManifest names the 240 modules, protected symbols, invariants, language owners, fallback owners, and required review depth. - A diff service expands changed symbols through generated-code origins and one call edge, then creates a ReviewPacket with tests, data-flow deltas, and the exact commit. - Changes to authentication, key use, parsers, or tenant filters require one code owner and 1 of 8 specialists; mechanical changes use owner review plus sampled audit. - Queue balancing and a 30-minute escalation target keep assignment p95 below 30 minutes, while 200 seeded risky diffs measure misses across all 6 languages.

A 2,000-repository estate must migrate from 4 scanner dashboards to one ASPM platform in 16 weeks while 700 open critical findings retain status and evidence; how would you design the cutover?

I would run a reversible migration with a signed FindingMigrationManifest for every imported defect. - The manifest maps old ID, scanner, fingerprint, status, owner, exception, evidence URI, timestamps, and new DefectID. - Fifty repositories run dual ingestion for 3 weeks, comparing counts, severity, ownership, and state before 200-repository waves. - Legacy dashboards become read-only after 99.5% reconciliation and zero unexplained loss among the 700 critical findings. - Old connectors remain available for rollback for 30 days while reports track errors, duplicates, freshness, and developer tickets.

After an acquisition, 620 repositories in 5 languages must enter the AppSec platform within 30 days, but 40% have no catalog entry; design onboarding with a 95% inventory-completeness target.

I would discover the estate independently, then require an ApplicationDescriptor before enforcing risk-tier gates. - Git hosts, registries, deployment platforms, DNS, and cloud tags feed an AssetGraph keyed by repository, artifact digest, and runtime service. - ApplicationDescriptor records owner, language, build system, exposure, data class, deployment, and business tier with explicit unknowns. - Ownerless repositories receive nonblocking secrets and dependency scans; internet-facing artifacts enter a 24-hour ownership queue. - Daily reconciliation targets 95% completeness by day 30 across known repositories, deployed artifacts, descriptors, and orphans.

A shared-schema SaaS serves 12,000 tenants through 140 services and runs 30,000 asynchronous jobs per minute; design tenant isolation from browser request to job worker with a 99.99% SLA.

I would make TenantContext a signed, non-user-controlled value across every synchronous and asynchronous boundary. - The BFF maps the session to tenant and user, then emits a 5-minute internal token with tenant, subject, audience, and authorization epoch. - APIs derive database RLS context from that token, and an OutboxEnvelope atomically copies tenant, actor, operation, and policy version into jobs. - Workers verify audience and tenant against the object before work, while cache and object keys include tenant and authorization version. - Property tests exercise 100,000 cross-tenant request and job combinations, with zero isolation-canary violations under the 99.99% SLA.

A marketplace processes 4,000 split-payment operations per second among buyers, sellers, and Stripe Connect, with refunds allowed for 180 days; design the application data flow and authorization boundaries.

I would separate payment intent, ledger authority, and provider execution through idempotent, append-only workflows. - Stripe-hosted fields send card data directly to Stripe, while the browser sends cart and idempotency key to checkout. - Checkout writes Order and PaymentCommand atomically, and an orchestrator calls Stripe Connect using a restricted account context. - Signed Stripe events enter a raw webhook store before an idempotent consumer updates the double-entry ledger. - Refunds reauthorize actor, order, seller share, and the 180-day window, while reconciliation covers all 4,000 operations per second.

A collaboration app accepts 8 GB Office, PDF, and HTML files from 60,000 tenants and must produce previews within 90 seconds; design the upload-to-preview flow against active content and parser risk.

I would admit uploads only with reserved isolated capacity and produce a bounded attested preview for every accepted clean file within 90 seconds. - Before issuing a 10-minute upload URL, a fair scheduler reserves a size-class slot in prewarmed pools sized for 2 times p99 arrival rate; the 90-second deadline starts at upload completion. - The gateway streams 64 MB chunks through digest, type, antivirus, archive-depth, and decompression-ratio checks during upload, so finalization does not wait for a second 8 GB read. - Networkless Firecracker workers with no credentials parse page or sheet shards under CPU, memory, syscall, and wall-clock limits and write only to a separate preview bucket. - The deadline scheduler emits an attested PDF or thumbnail set capped at 20 representative pages by 90 seconds; unsafe files are rejected, never replaced by a processing status.

A SaaS product sends 25,000 outbound webhooks per second to 18,000 tenant-configured URLs and retries for 48 hours; design delivery without creating SSRF or cross-tenant signing risk.

I would send each attempt through an isolated egress dialer that makes a fresh, connection-bound destination decision. - Registration proves tenant ownership and HTTPS configuration, but stores no DNS answer as trusted input for later delivery. - Immediately before the initial delivery, every retry, and every redirect hop, the dialer canonicalizes the URL, resolves all A and AAAA answers, and rejects the destination if any answer violates public-range policy. - It connects directly to one checked IP while preserving the URL hostname in HTTP Host and TLS SNI, validates the certificate for that hostname, and disables proxy or resolver fallback. - A 3-redirect cap, 3-second timeout, tenant-specific HMAC key version, durable 48-hour queue, and per-destination limits sustain 25,000 deliveries per second without cross-tenant key reuse.

A federated GraphQL API serves 2,000 subscriptions per second over WebSocket across 90 subgraphs, with authorization changes effective within 60 seconds; design the subscription data flow.

I would authorize connection, subscription, and every emitted object as separate decisions tied to policy version. - The BFF exchanges the browser session for a 5-minute gateway token containing tenant, subject, audience, and connection ID. - Persisted operations cap cost, while Apollo Router creates a SubscriptionGrant with resource scope and authorization epoch. - Subgraphs publish typed events without trusting client filters; the gateway rechecks object relationships and tenant before sending. - Revocation invalidates grants within 60 seconds, and load tests verify 2,000 subscriptions per second without cross-tenant cache reuse.

A plugin marketplace runs 6,000 third-party plugins for 40,000 tenants, each invocation limited to 500 ms and 64 MB; design capability and data boundaries for the runtime.

I would execute signed WebAssembly plugins with explicit per-installation capabilities rather than ambient application access. - PluginManifest records digest, publisher, host functions, outbound domains, data classes, version, and tenant approval. - Each invocation gets 64 MB, 500 ms, no filesystem, and tenant-scoped opaque handles instead of database credentials. - Network calls pass through an egress broker enforcing the manifest and stripping platform headers without logging secrets. - Grants expire on version change, and 200 cross-tenant, exhaustion, and confused-deputy tests run before publication.

A browser dashboard shows regulated records to 3 million monthly users and must keep access tokens out of JavaScript while supporting 12 backend APIs with a 250 ms p99; design the flow.

I would use a same-origin BFF that owns the browser session and exchanges it for audience-specific service tokens. - After OIDC with PKCE, the BFF stores tokens server-side and sets a Secure, HttpOnly, SameSite=Lax cookie with a 30-minute idle timeout. - Mutations require same-origin checks and a CSRF token, while nonce CSP and Trusted Types reduce script abuse. - The BFF validates object scope, then obtains a 5-minute token for exactly 1 of 12 API audiences. - Exchange and authorization consume at most 25 ms of the 250 ms p99, with revocation through a session epoch within 60 seconds.

A service API exports up to 50 million customer rows to 300 enterprise clients, with jobs lasting 4 hours and download links valid for 15 minutes; design delegated authorization across the flow.

I would bind every step to a narrow ExportGrant and immutable manifest. - The API evaluates client, tenant, row filters, fields, purpose, and size, then issues a grant valid for one job. - ExportManifest stores grant ID, policy revision, query digest, tenant, field set, requester, and expiry before workers read through a scoped role. - Workers write encrypted chunks and a final digest; delivery creates a 15-minute single-use URL after rechecking client status. - Four-hour jobs stop on revocation, while reconciliation proves row counts and fields match the manifest for all 300 clients.

A reporting SaaS generates 120,000 PDF exports per day containing 4 data classes and retains them for 7 days; design storage and download boundaries with a 2-second acknowledgment SLA.

I would acknowledge an authorized export job quickly while keeping generated files private and bound to source policy. - The API atomically writes ExportRequest and OutboxEvent within 2 seconds with tenant, requester, field policy, locale, and query digest. - A sandboxed renderer reads a purpose-built snapshot, has no internet, and emits PDF plus ExportAttestation to a private bucket. - Metadata carries tenant, data class, retention date, source digest, and encryption context; lifecycle deletes every version after 7 days. - Download requires fresh authorization and a 60-second single-use URL, with daily reconciliation of all 120,000 requests.

A passwordless SaaS supports 8 million accounts, 2 passkeys per user, and assisted recovery completed within 24 hours; design recovery so support cannot directly take over an account.

I would separate proof collection, approval, and credential enrollment through a time-bound RecoveryCase. - Normal recovery uses a second passkey or 1 of 10 single-use codes stored only as Argon2id-derived verifiers. - Support may attach verified email, device, billing, and risk evidence but cannot approve or set a credential. - Two independent approvers unlock a 20-minute WebAuthn enrollment after a 12-hour notification delay, with sensitive actions frozen for 24 hours. - Recovery revokes sessions and alerts all channels, targeting 24-hour completion and under 0.01% confirmed takeover.

Application Security Engineer interview questions

100 real questions with model answers and explanations for Senior candidates.

See a Application Security Engineer resume example →

Practice with flashcards

Spaced repetition · Hunter Pass

Questions

queriesdesignaspm

I would use event-driven normalization with immutable raw evidence and a versioned Finding schema.

Connectors write signed ScannerObservation events to Kafka with tool, rule, repository, commit, scan ID, timestamps, and the original SARIF URI.
Flink maps observations into Finding v3 records; invalid payloads enter a dead-letter queue with a 30-minute connector-owner SLA.
ClickHouse serves fleet analytics and PostgreSQL owns finding state, so replay cannot overwrite triage or exception decisions.
Canaries from all 9 scanners measure the 10-minute freshness SLO, event loss, schema rejection, and connector lag.

Why interviewers ask this: The interviewer is testing whether the candidate can separate immutable scanner evidence, normalized state, and operational freshness at enterprise scale.

decision-makinginjectiondesign

I would expose a small typed expression language and execute its AST in a bounded interpreter rather than pass text to a host-language evaluator.

A versioned grammar rejects ambiguous encodings, more than 10,000 tokens, nesting above 64 levels, and identifiers outside the tenant schema.
Type checking permits 24 pure functions and produces an immutable AST with no reflection, filesystem, network, dynamic import, or host object access.
Each evaluation receives 5 ms of CPU, 16 MB of memory, an instruction counter, and a tenant quota, so one formula cannot exhaust a worker.
One million generated, mutation, and cross-language parser cases gate releases while canaries keep p99 below 50 ms at 120,000 evaluations per second.

Why interviewers ask this: The interviewer is evaluating whether untrusted application syntax is reduced to a deterministic, capability-free language with measurable parser and runtime limits.

deploymentartifactsdesign

I would resolve ownership from deployment identity first and record every decision as a versioned OwnershipRecord.

The resolver joins Backstage, CODEOWNERS, workload labels, cloud accounts, and on-call schedules by repository and artifact digest.
OwnershipRecord stores service, team, escalation team, evidence, confidence, effective time, and catalog revision for audit.
Conflicts route to the production operator; confidence below 0.8 goes to a 12-person platform queue instead of guessing.
Reconciliation targets 99% owned tier-1 findings and 95% of all new findings routed within the 4-hour SLA.

Why interviewers ask this: The interviewer is testing whether ownership is derived from production evidence, auditable, and operated with explicit confidence and SLOs.

threat-modelingdesigncoverage

I would define coverage as a reviewed model tied to the deployed change and automate evidence around that definition.

ThreatModelManifest names DFD revision, changed boundaries, assets, abuse cases, mitigations, owner, reviewer, and release digest.
Backstage routes authentication, payments, tenant isolation, uploads, and external integrations to review; proven low-risk patterns use preapproved models.
A model counts only when its 3 highest risks have tests or tracked mitigations and its digest appears in release evidence.
Weekly metrics target 90% coverage and a 3-day p95 while showing stale models and escaped design flaws.

Why interviewers ask this: The interviewer is evaluating whether threat-model coverage measures effective design assurance rather than document creation.

designapiconcurrency

I would generate action-specific input models and make server-owned fields impossible to bind from request data.

OpenAPI extensions declare writable fields per create, update, and admin action, then generate separate DTOs for all 65 APIs instead of reusing persistence models.
Spring, ASP.NET, and Rails adapters reject unknown and duplicate keys before binding, including nested objects and alternate field aliases.
Tenant, actor, role, price authority, and approval state come from authenticated context or server lookup after binding and overwrite no client-controlled value.
A 25,000-case cross-framework corpus gates adapter releases, while benchmarks enforce under 2 ms p99 at 18,000 writes per second.

Why interviewers ask this: The interviewer is testing whether mass-assignment prevention is encoded in framework primitives and generated contracts rather than developer discipline.

defectsasync

I would separate immutable observations from an append-only DefectDecision log and derive current state as a projection.

ScannerObservation records each result, while DefectIdentity holds the stable root-cause fingerprint independent of tool status.
DefectDecision events cover triaged, duplicate, fixed, accepted, false-positive, reopened, and expired with actor, reason, evidence, and policy version.
A clean rescan closes a defect only when the fixed commit reaches all production deployments; one tool cannot overwrite the decision.
PostgreSQL serves projections, S3 Object Lock retains 5-year history, and replay tests verify state from 10 million events.

Why interviewers ask this: The interviewer is evaluating event semantics and auditability when multiple scanners disagree over time.

procurementdesignapi

I would isolate every vendor behind a checkpointed connector with explicit freshness and completeness contracts.

Each connector keeps encrypted cursor state, idempotency keys, vendor request IDs, and response hashes so retries cannot skip observations.
Token buckets honor all 11 limits, backoff handles throttling, and priority queues fetch critical projects before historical reconciliation.
A 6-hour outage serves last-known state with a stale flag, then replays webhooks and performs a bounded full diff.
Dashboards alert at 2 hours of lag and reserve 18 hours for catch-up, preserving the 24-hour SLA.

Why interviewers ask this: The interviewer is testing connector correctness and degraded behavior rather than assuming third-party APIs are reliable.

code-reviewauthidentity-access

I would route semantic changes to reviewers through a maintained map of security boundaries, not file extensions or repository labels.

A SecurityBoundaryManifest names the 240 modules, protected symbols, invariants, language owners, fallback owners, and required review depth.
A diff service expands changed symbols through generated-code origins and one call edge, then creates a ReviewPacket with tests, data-flow deltas, and the exact commit.
Changes to authentication, key use, parsers, or tenant filters require one code owner and 1 of 8 specialists; mechanical changes use owner review plus sampled audit.
Queue balancing and a 30-minute escalation target keep assignment p95 below 30 minutes, while 200 seeded risky diffs measure misses across all 6 languages.

Why interviewers ask this: The interviewer is evaluating a code-aware review architecture that focuses scarce specialists on changed security invariants without turning review into scanner correlation.

designaspm

I would run a reversible migration with a signed FindingMigrationManifest for every imported defect.

The manifest maps old ID, scanner, fingerprint, status, owner, exception, evidence URI, timestamps, and new DefectID.
Fifty repositories run dual ingestion for 3 weeks, comparing counts, severity, ownership, and state before 200-repository waves.
Legacy dashboards become read-only after 99.5% reconciliation and zero unexplained loss among the 700 critical findings.
Old connectors remain available for rollback for 30 days while reports track errors, duplicates, freshness, and developer tickets.

Why interviewers ask this: The interviewer is testing whether a platform migration preserves security decisions and evidence instead of merely moving scanner feeds.

onboardingdesign

I would discover the estate independently, then require an ApplicationDescriptor before enforcing risk-tier gates.

Git hosts, registries, deployment platforms, DNS, and cloud tags feed an AssetGraph keyed by repository, artifact digest, and runtime service.
ApplicationDescriptor records owner, language, build system, exposure, data class, deployment, and business tier with explicit unknowns.
Ownerless repositories receive nonblocking secrets and dependency scans; internet-facing artifacts enter a 24-hour ownership queue.
Daily reconciliation targets 95% completeness by day 30 across known repositories, deployed artifacts, descriptors, and orphans.

Why interviewers ask this: The interviewer is evaluating controlled AppSec onboarding when inventory and ownership data are incomplete.

schemadesignasync

I would make TenantContext a signed, non-user-controlled value across every synchronous and asynchronous boundary.

The BFF maps the session to tenant and user, then emits a 5-minute internal token with tenant, subject, audience, and authorization epoch.
APIs derive database RLS context from that token, and an OutboxEnvelope atomically copies tenant, actor, operation, and policy version into jobs.
Workers verify audience and tenant against the object before work, while cache and object keys include tenant and authorization version.
Property tests exercise 100,000 cross-tenant request and job combinations, with zero isolation-canary violations under the 99.99% SLA.

Why interviewers ask this: The interviewer is testing whether tenant identity survives explicit data flows and asynchronous boundaries without trusting client fields.

authidentity-accessdesign

I would separate payment intent, ledger authority, and provider execution through idempotent, append-only workflows.

Stripe-hosted fields send card data directly to Stripe, while the browser sends cart and idempotency key to checkout.
Checkout writes Order and PaymentCommand atomically, and an orchestrator calls Stripe Connect using a restricted account context.
Signed Stripe events enter a raw webhook store before an idempotent consumer updates the double-entry ledger.
Refunds reauthorize actor, order, seller share, and the 180-day window, while reconciliation covers all 4,000 operations per second.

Why interviewers ask this: The interviewer is evaluating trust boundaries and correctness across browser, payment provider, asynchronous events, and long-lived refunds.

htmldesignrisk-management

I would admit uploads only with reserved isolated capacity and produce a bounded attested preview for every accepted clean file within 90 seconds.

Before issuing a 10-minute upload URL, a fair scheduler reserves a size-class slot in prewarmed pools sized for 2 times p99 arrival rate; the 90-second deadline starts at upload completion.
The gateway streams 64 MB chunks through digest, type, antivirus, archive-depth, and decompression-ratio checks during upload, so finalization does not wait for a second 8 GB read.
Networkless Firecracker workers with no credentials parse page or sheet shards under CPU, memory, syscall, and wall-clock limits and write only to a separate preview bucket.
The deadline scheduler emits an attested PDF or thumbnail set capped at 20 representative pages by 90 seconds; unsafe files are rejected, never replaced by a processing status.

Why interviewers ask this: The interviewer is testing whether mandatory preview latency is backed by admission control, streaming checks, reserved sandbox capacity, and a real bounded output.

risk-managementssrfconfig

I would send each attempt through an isolated egress dialer that makes a fresh, connection-bound destination decision.

Registration proves tenant ownership and HTTPS configuration, but stores no DNS answer as trusted input for later delivery.
Immediately before the initial delivery, every retry, and every redirect hop, the dialer canonicalizes the URL, resolves all A and AAAA answers, and rejects the destination if any answer violates public-range policy.
It connects directly to one checked IP while preserving the URL hostname in HTTP Host and TLS SNI, validates the certificate for that hostname, and disables proxy or resolver fallback.
A 3-redirect cap, 3-second timeout, tenant-specific HMAC key version, durable 48-hour queue, and per-destination limits sustain 25,000 deliveries per second without cross-tenant key reuse.

Why interviewers ask this: The interviewer is evaluating DNS-rebinding-safe connection pinning on every attempt and hop together with tenant-isolated signing and retry controls.

graphqlwebsocketsgraphql-authorization

I would authorize connection, subscription, and every emitted object as separate decisions tied to policy version.

The BFF exchanges the browser session for a 5-minute gateway token containing tenant, subject, audience, and connection ID.
Persisted operations cap cost, while Apollo Router creates a SubscriptionGrant with resource scope and authorization epoch.
Subgraphs publish typed events without trusting client filters; the gateway rechecks object relationships and tenant before sending.
Revocation invalidates grants within 60 seconds, and load tests verify 2,000 subscriptions per second without cross-tenant cache reuse.

Why interviewers ask this: The interviewer is testing whether long-lived GraphQL channels preserve object authorization after the initial handshake.

designdependencies

I would execute signed WebAssembly plugins with explicit per-installation capabilities rather than ambient application access.

PluginManifest records digest, publisher, host functions, outbound domains, data classes, version, and tenant approval.
Each invocation gets 64 MB, 500 ms, no filesystem, and tenant-scoped opaque handles instead of database credentials.
Network calls pass through an egress broker enforcing the manifest and stripping platform headers without logging secrets.
Grants expire on version change, and 200 cross-tenant, exhaustion, and confused-deputy tests run before publication.

Why interviewers ask this: The interviewer is evaluating whether plugin isolation is enforced by capabilities, runtime limits, and versioned approval.

tokensdesignapi

I would use a same-origin BFF that owns the browser session and exchanges it for audience-specific service tokens.

After OIDC with PKCE, the BFF stores tokens server-side and sets a Secure, HttpOnly, SameSite=Lax cookie with a 30-minute idle timeout.
Mutations require same-origin checks and a CSRF token, while nonce CSP and Trusted Types reduce script abuse.
The BFF validates object scope, then obtains a 5-minute token for exactly 1 of 12 API audiences.
Exchange and authorization consume at most 25 ms of the 250 ms p99, with revocation through a session epoch within 60 seconds.

Why interviewers ask this: The interviewer is testing browser security, token confinement, and downstream audience separation in one explicit flow.

authidentity-accessapi

I would bind every step to a narrow ExportGrant and immutable manifest.

The API evaluates client, tenant, row filters, fields, purpose, and size, then issues a grant valid for one job.
ExportManifest stores grant ID, policy revision, query digest, tenant, field set, requester, and expiry before workers read through a scoped role.
Workers write encrypted chunks and a final digest; delivery creates a 15-minute single-use URL after rechecking client status.
Four-hour jobs stop on revocation, while reconciliation proves row counts and fields match the manifest for all 300 clients.

Why interviewers ask this: The interviewer is evaluating authorization continuity across long-running jobs, storage, and eventual delivery.

designcloud

I would acknowledge an authorized export job quickly while keeping generated files private and bound to source policy.

The API atomically writes ExportRequest and OutboxEvent within 2 seconds with tenant, requester, field policy, locale, and query digest.
A sandboxed renderer reads a purpose-built snapshot, has no internet, and emits PDF plus ExportAttestation to a private bucket.
Metadata carries tenant, data class, retention date, source digest, and encryption context; lifecycle deletes every version after 7 days.
Download requires fresh authorization and a 60-second single-use URL, with daily reconciliation of all 120,000 requests.

Why interviewers ask this: The interviewer is testing secure asynchronous document generation, data minimization, and lifecycle enforcement.

passwordsdesigncloud

I would separate proof collection, approval, and credential enrollment through a time-bound RecoveryCase.

Normal recovery uses a second passkey or 1 of 10 single-use codes stored only as Argon2id-derived verifiers.
Support may attach verified email, device, billing, and risk evidence but cannot approve or set a credential.
Two independent approvers unlock a 20-minute WebAuthn enrollment after a 12-hour notification delay, with sensitive actions frozen for 24 hours.
Recovery revokes sessions and alerts all channels, targeting 24-hour completion and under 0.01% confirmed takeover.

Why interviewers ask this: The interviewer is evaluating separation of duties and user-verifiable recovery in a high-scale passwordless application.

Locked questions

21
One hundred forty Java, Go, and Node.js services execute 90,000 database queries per second; design prevention for SQL, NoSQL, and template injection with under 5 ms p99 overhead.
sqlnosqldatabase
22
A rich-text product renders 60,000 user documents per minute in web and email clients; design stored-XSS prevention with CSP false blocks below 0.1%.
xssdesign
23
Eighty-five Node.js APIs merge 70,000 tenant configuration objects per second; design prototype-pollution prevention for __proto__, constructor.prototype, and downstream gadgets with under 4 ms p99 overhead.
designprototypesapi
24
Three hundred Java services consume 700,000 Kafka messages per second from 40 schemas; design deserialization prevention without breaking rolling upgrades or adding more than 3 ms p99.
kafkadesignschema
25
A CDN, Envoy gateway, and Node.js fleet handle 180,000 requests per second; design request-smuggling prevention across HTTP/1.1 and HTTP/2 with a 0.05% error-budget limit.
designgatewayhttp
26
A consumer SaaS has 8 million active sessions, a 30-day remembered-login option, and a 5-minute revocation SLA; design server-side sessions under 25 ms p99.
sessionsdesigncloud
27
Three hundred services accept JWTs from 6 issuers at 120,000 requests per second, and key rotation must propagate within 2 minutes; design validation against algorithm and issuer confusion.
validationdesignalgorithms
28
A browser shell loads 120 partner widgets for 4 million daily sessions; each widget needs at most 6 product capabilities, but must not read DOM data, cookies, or access tokens, and broker overhead must stay below 40 ms p99.
tokenssessionscookies
29
A bulk API updates 100,000 records per request across 4 authorization domains; design authorization with explicit partial success and policy evaluation below 100 ms p99.
authidentity-accessapi
30
A banking SPA performs 15 million state-changing requests per day through OAuth and cookies, with 20 legacy cross-site integrations; design CSRF and login-CSRF prevention.
oauthcsrfcookies
31
Two thousand repositories in 8 languages open 30,000 pull requests per month, and security feedback for the exact pull-request commit must arrive within 7 minutes p95; design the SAST execution architecture.
feedbackcode-reviewarchitecture
32
A CodeQL program maintains 160 custom queries for 5 languages across 900 repositories; design a rule lifecycle with 90% precision before blocking and a 14-day urgent-rule SLA.
queriesdesigncodeql
33
Forty Semgrep rules protect authentication code in 1,400 repositories, but framework APIs change quarterly; design maintenance with under 5% false positives and safe autofix.
authidentity-accessdetection-tuning
34
A platform exposes 3,500 OpenAPI operations across 260 staging services and releases every 20 minutes; design DAST that tests changed routes within 12 minutes without corrupting data.
dastdesignopenapi
35
A messaging platform sends 900 million email action links per month from 12 regions, with 15-minute expiry and verifiers in 5 languages; design token bytes and canonicalization so every verifier makes the same decision.
design-systemdesigntokens
36
An estate has 2.4 million SCA findings across 1,700 repositories, including 9,000 critical baseline items; design CI gates that stop new reachable risk without freezing delivery for 18 months.
risk-managementdesignsca
37
A company pushes 48,000 commits per month across 600 repositories and uses credentials from 12 cloud and SaaS providers; design secret scanning that revokes a leaked production credential within 10 minutes without retaining its value in central logs.
secretscloud-securitydesign
38
A bug-bounty program validates 4,500 reports per year across 300 repositories and promises a critical fix within 72 hours; design the code-owner remediation workflow without exposing reporter identity or embargoed exploit details.
validationattacksdesign
39
A payments product claims OWASP ASVS Level 2 for 85 services and releases 400 times per month; design verification evidence that remains current for every artifact.
owaspasvsdesign
40
An organization retains 3,200 confirmed exploit cases for 900 services and needs security patch verification against the exact release artifact within 20 minutes; design an exploitability regression harness.
attacksdesignartifacts
41
A company consumes 75,000 npm, Maven, PyPI, and Go modules across 2,000 repositories; design an application dependency firewall that decides on new packages within 10 minutes.
dependenciesnpmdesign
42
Two hundred twenty services in 6 languages emit 2 million application log events per second; design telemetry that prevents access tokens and 4 regulated data classes from reaching logs while keeping false redaction below 0.5%.
tokensdesign
43
A federated GraphQL API executes 80,000 operations per second across 90 subgraphs, and one aliased query can trigger 12,000 resolver calls; design cost enforcement below 15 ms p99 without blocking approved enterprise reports.
graphqlgraphql-authorizationqueries
44
Teams add 1,200 new npm and PyPI packages per month, and 30% are younger than 7 days; design trust scoring that catches typosquatting and account takeover within 30 minutes.
dependency-confusiondesignnpm
45
A desktop application ships 300 third-party libraries to 4 million clients and must answer a new critical CVE within 2 hours; design SBOM, VEX, and provenance for dependencies.
dependenciessbomvex
46
A bug-bounty program receives 9,000 HackerOne reports per year, with 55% duplicates and a 24-hour critical acknowledgment SLA; design intake and correlation.
correlationdesign
47
Researchers need cross-tenant testing for a SaaS with 20,000 customers, but production testing must expose no real data; design a bounty sandbox provisioned under 10 minutes.
designtestingcloud
48
A 2,400-engineer organization wants 120 security champions across 60 teams, each allocated 4 hours monthly; design a program that improves controls within 2 quarters.
design
49
Eighty product teams complete 22,000 pull requests per quarter, but only 31% of security findings are fixed before merge; design enablement that reaches 60% in 6 months with cycle time under 8% higher.
code-reviewdesign
50
A mobile and web portfolio produces 600 releases per month from 500 repositories; design ApplicationReleasePolicy verifying dependencies, provenance, and secret-free builds under 90 seconds.
secretsdesigndependencies
51
Checkout error rates rise from 0.2% to 7.4% after 1,840 requests contain UNION SELECT, and database logs show 63 unauthorized customer rows returned in 11 minutes; do you disable checkout or isolate the search parameter, and what is your decision?
databaseunion
52
A MongoDB login endpoint receives 26,000 requests using {"$ne": null}, 418 sessions are created without valid passwords, and 31 accounts access billing data; do you stop all login or reject object-valued credentials, and what is your decision?
mongodbnosql-injectionpasswords
53
An image conversion endpoint processes 9,000 jobs per hour, and 17 filenames containing shell metacharacters trigger outbound curl commands from 6 workers; do you pause all media processing or only the converter, and what is your decision?
http-toolsendpointsconcurrency
54
A notification preview renders 2.6 million templates per day, and 84 requests using {{constructor.constructor}} execute code in 3 production pods for 7 minutes; do you disable all notifications or only custom previews, and what is your decision?
55
A stored comment payload executes for 12,400 dashboard views, 96 support agents expose session tokens, and CSP reports show script execution for 38 minutes; do you take the dashboard offline or render comments as plain text, and what is your decision?
tokenssessions
56
A customer-data API reflects 37 Origin values with Access-Control-Allow-Credentials, and browser telemetry shows 8,600 authenticated responses read by 214 sessions in 22 minutes; do you disable the SPA or credentialed CORS on the affected API, and what is your decision?
corssessions
57
A PDF statement renderer processes 18,000 documents per hour, and during a 10% canary, 37 customer templates read environment variables and make 12 outbound requests from 3 workers; do you roll back the entire statement release or disable customer-authored templates, and what is your decision?
configrollbackconcurrency
58
A CDN forwards a Content-Length body, but a bodyless origin route treats those bytes as the next request on a reused connection, so 740 CL.0 probes yield 91 cross-user responses in 13 minutes while the API serves 36,000 requests per second; do you bypass the CDN or close origin keep-alive, and what is your decision?
api
59
An unkeyed X-Forwarded-Host header poisons 6,200 password-reset pages across 14 CDN points for 21 minutes, and 48 users follow attacker links; do you purge the whole CDN or only reset objects, and what is your decision?
passwords
60
A document upload service accepts 65,000 files per day, and 11 crafted DOCX files make LibreOffice write outside its workspace on 4 workers; do you stop all uploads or quarantine office previews, and what is your decision?
61
An OAuth authorization server omits PKCE checks for 7% of mobile exchanges, and 286 codes are redeemed from a second device within 3 hours; do you disable mobile login for 1.4 million users or reject only unbound exchanges, and what is your decision?
authoauthidentity-access
62
An OIDC callback accepts tokens with a valid signature but the wrong audience, creating 1,120 admin-portal sessions in 26 minutes; do you block the whole identity provider or quarantine the portal, and what is your decision?
tokenssessionscallbacks
63
A JWT verifier accepts an unsigned alg:none token on 3 of 95 APIs, and 64 forged requests change customer email addresses over 8 minutes; do you revoke every platform token or isolate the 3 APIs, and what is your decision?
jwttokensapi
64
A session store keeps authenticated sessions valid for 24 hours after password change, and 173 old sessions perform 39 sensitive actions in 6 hours; do you invalidate all 8 million sessions or only affected users, and what is your decision?
passwordssessions
65
Password-reset tokens remain reusable for 30 minutes, and 92 tokens are redeemed twice to take over 17 accounts; do you disable self-service reset for 600,000 monthly users or make consumption atomic, and what is your decision?
passwordstokensconcurrency
66
An OAuth callback accepts valid authorization codes without binding them to the browser that started login, so 146 callback URLs opened on other devices create 39 sessions under attacker-owned accounts and 11 users upload 74 private documents; do you disable all login or only the unbound OAuth callback, and what is your decision?
authoauthsessions
67
A profile PATCH endpoint documents 43 fields but binds 71 model properties, and 286 requests set billingAdmin directly, causing 74 unauthorized role changes across 19 organizations; do you disable all profile operations or only updates, and what is your decision?
endpoints
68
A viewer role can call an undocumented /admin/reindex function, and 14 users trigger 96 reindexes that cause 43 minutes of degraded search; do you remove all viewer API access or block the function, and what is your decision?
api
69
A GraphQL resolver checks authorization on Query.account but not on nested Account.payments, exposing 4,320 payments to 76 users across 9 tenants; do you disable GraphQL or remove the nested field, and what is your decision?
authidentity-accessgraphql
70
A webhook handler verifies HMAC after JSON parsing and accepts duplicate keys differently from the sender, causing 312 fraudulent refunds worth $184,000 in 27 minutes; do you stop all refunds or only webhook-driven refunds, and what is your decision?
webhooks
71
An SCA reachability service marks a WebSocket compression CVE unreachable in 84 services, but 14 gateways load the native addon dynamically, 27 crafted frames crash 6 pods, and 2 canaries record out-of-bounds writes; do you block all 84 services or isolate the 14 gateways, and what is your decision?
vuln-managementwebsocketsgateway
72
A pnpm lockfile pins version 6.4.2 with an integrity hash, but 43 Docker release builds run npm install and resolve 6.5.0 plus 73 different transitive packages; 11 artifacts reach 22% of traffic, so do you roll them back or trust passing tests, and what is your decision?
dockerpnpmnpm
73
An internal package named @corp/payments has no public reservation, and 68 developer builds resolve a higher public version over 4 hours; do you disable external npm access for 900 engineers or block the namespace, and what is your decision?
npmkubernetes
74
A mobile app ships a production analytics secret in 2.3 million installs, and the secret can submit trusted purchase events worth $420,000 per day; do you force an app update or revoke the secret immediately, and what is your decision?
secrets
75
An SCA alert marks Log4j critical in 460 services, CodeQL shows the vulnerable lookup reachable in 12, and only 7 are internet-facing; do you block all 460 releases or the reachable set, and what is your decision?
alertingcodeqlsca
76
A transitive image parser has a public RCE, 96 of 310 services include it, runtime evidence shows 18 load the class, and patching adds 11% CPU; do you accept the overhead or disable parsing, and what is your decision?
77
In-toto provenance for 24 web bundles omits the npm lockfile, 7 bundles contain a package version absent from their SBOM, and they reach 30% of traffic; do you quarantine all 24 or trust the approved builder, and what is your decision?
npmpackagingdependency-resolution
78
A customer-support SDK update sends 14 MB per hour of form fields to an undocumented endpoint from 42% of browser sessions; do you remove the SDK immediately or wait for the vendor's 24-hour review, and what is your decision?
procurementendpointssessions
79
A lockfile regeneration changes 1,840 transitive packages in one pull request, 27 hashes lack prior review, and release is due in 3 hours; do you approve the diff or delay release, and what is your decision?
packagingdependency-resolutioncode-review
80
A 5-year-old XML library has no maintainer, parses 280 partner feeds per minute, and a working XXE exploit reads 6 application secrets; do you fork and patch it or replace it over 6 weeks, and what is your decision?
secretsattacksxxe
81
Semgrep reports zero issues on a release that later exposes 2,100 rows through SQL injection, and the query is assembled by a generated repository layer used in 48 services; do you block releases on a new broad rule or patch the generator first, and what is your decision?
sqlqueriessql-injection
82
DAST scans 320 APIs nightly but misses a BOLA flaw that exposes 8,700 objects because the scanner uses one account; do you expand crawling immediately or block releases until two-user tests exist, and what is your decision?
object-authorizationtestingdast
83
IAST adds 19% p95 latency to 60 staging services and creates 4,800 duplicate findings per week, but it uniquely catches 3 deserialization paths; do you remove it or narrow deployment, and what is your decision?
latencydeployment
84
ASPM merges 11 SAST findings and one reachable SCA finding into a low-risk cluster, and a payment RCE reaches production for 9 days; do you disable correlation or fix the cluster logic, and what is your decision?
sastscaaspm
85
CodeQL autobuild for fork pull requests executes modified Gradle scripts on 6 shared runners, 2,400 outbound calls use a repository-write token, and 18 repositories receive unauthorized tags in 11 minutes; do you disable all SAST or isolate untrusted builds, and what is your decision?
tokenssastcodeql
86
A baseline import suppresses 420 historical SAST findings, including 6 internet-reachable command injections that remain open for 74 days; do you invalidate the entire baseline or reopen only reachable findings, and what is your decision?
injectionsast
87
A bug-bounty researcher chains an open redirect with OAuth code leakage to take over 12 test accounts in 18 minutes and requests a $35,000 critical payout; do you dispute severity because each bug is medium alone, and what is your decision?
oauthidentity-accessseverity-priority
88
Two researchers report the same SSRF 47 minutes apart, the first lacks impact proof, the second retrieves 3 metadata credentials, and policy offers $20,000 for criticals; do you mark the second as duplicate, and what is your decision?
ssrf
89
A patch for template injection blocks {{...}} but 9 of 2,400 bypass payloads execute through <%...%>, and release is scheduled to reach 100% traffic in 40 minutes; do you stop rollout or add another filter, and what is your decision?
injection
90
A fixed BOLA endpoint regresses 3 releases later and exposes 560 records because its 24 security tests ran only on the old API version; do you freeze all API releases or add a version-wide gate, and what is your decision?
endpointsobject-authorizationtesting
91
A threat model for a payment link covered 14 STRIDE threats but missed link forwarding, and 3,800 links expose $620,000 in invoices over 5 days; do you disable all links or require recipient binding, and what is your decision?
threat-modelingstride
92
A design review assumes a third-party Markdown renderer is safe, but 62 crafted documents trigger HTML execution in 18% of editor sessions; engineering wants a CSP-only fix for a release in 2 days, so do you approve it, and what is your decision?
htmldesignsessions
93
A senior developer argues that service-to-service calls are trusted and wants to remove tenant checks to save 14 ms p99 across 42 APIs; tests show 7 confused-deputy paths, so do you accept the optimization, and what is your decision?
fan-outoptimizationapi
94
A junior AppSec engineer labels 180 scanner findings critical, developers close 72% as false positives, and triage takes 46 hours per week; do you remove them from review or mentor through a measured rotation, and what is your decision?
mentoringdetection-tuning
95
A staff reviewer approves user-defined regex search because requests time out after 50 ms, but a junior reviewer reproduces 28-second CPU stalls on 32 of 80 workers with 14 payloads and release is due in 3 hours; do you uphold the approval or reopen review, and what is your decision?
regex
96
A checkout team wants a 30-day waiver for a reachable deserialization RCE because disabling the feature costs $90,000 per day, while a sandbox can ship in 18 hours; do you approve the waiver, and what is your decision?
97
Security champions propose blocking every high SAST finding, but a 200-pull-request pilot shows 38% false positives and adds 17 minutes p95; do you roll out to 72 teams or narrow the gate, and what is your decision?
sastdetection-tuning
98
A product vice president asks to launch account delegation to 25,000 users before the threat model is complete, and review already found 4 unresolved privilege-escalation paths; do you allow a 5% rollout, and what is your decision?
threat-modelingdelegationescalation
99
After 3 months, a secure-coding workshop reached 420 engineers but repeat injection defects fell only from 14 to 12 per month; do you fund another workshop or move effort into framework guardrails, and what is your decision?
guardrailsinjectiondefects
100
A staged authorization-library rollout covers 18 of 120 services, cuts policy defects by 82%, but adds 6 ms p99 and causes 2 rollback events; do you mandate it company-wide or continue staged adoption, and what is your decision?
authidentity-accessdecision-making

Questions

1Your estate has 1,200 repositories, 9 scanners, and 420,000 raw findings per day; design an ASPM ingestion platform that makes new critical findings queryable within 10 minutes without losing scanner evidence.

2Forty services evaluate 120,000 tenant-authored formulas per second with a 50 ms p99 budget; design the expression parser and runtime against code injection and resource exhaustion.

3An organization has 1,800 repositories, 2,300 deployable services, and 14% of critical findings lack an owner; design ownership resolution with a 4-hour routing SLA and a named OwnershipRecord artifact.

4One hundred eighty product teams create 320 material design changes per month, but only 54% have a current threat model; how would you reach 90% effective coverage in 2 quarters without counting empty templates?

5Sixty-five Spring, ASP.NET, and Rails APIs process 18,000 write requests per second; design framework controls that prevent clients from mass-assigning tenant, role, price, or approval fields with under 2 ms p99 overhead.

6Seven scanners update the same defect asynchronously across 1,100 repositories, and audit requires 5-year history; how would you model finding state so rescans cannot erase remediation evidence?

7Your platform depends on 11 SaaS scanner APIs with limits from 60 to 5,000 calls per minute; design connector resilience so a 6-hour vendor outage does not breach a 24-hour critical-finding SLA.

8A portfolio receives 18,000 pull requests per month across 6 languages, including 240 authentication, cryptography, parser, and tenant-boundary modules; design secure code review that keeps p95 assignment below 30 minutes with only 8 specialist reviewers.

9A 2,000-repository estate must migrate from 4 scanner dashboards to one ASPM platform in 16 weeks while 700 open critical findings retain status and evidence; how would you design the cutover?

10After an acquisition, 620 repositories in 5 languages must enter the AppSec platform within 30 days, but 40% have no catalog entry; design onboarding with a 95% inventory-completeness target.

11A shared-schema SaaS serves 12,000 tenants through 140 services and runs 30,000 asynchronous jobs per minute; design tenant isolation from browser request to job worker with a 99.99% SLA.

12A marketplace processes 4,000 split-payment operations per second among buyers, sellers, and Stripe Connect, with refunds allowed for 180 days; design the application data flow and authorization boundaries.

13A collaboration app accepts 8 GB Office, PDF, and HTML files from 60,000 tenants and must produce previews within 90 seconds; design the upload-to-preview flow against active content and parser risk.

14A SaaS product sends 25,000 outbound webhooks per second to 18,000 tenant-configured URLs and retries for 48 hours; design delivery without creating SSRF or cross-tenant signing risk.

15A federated GraphQL API serves 2,000 subscriptions per second over WebSocket across 90 subgraphs, with authorization changes effective within 60 seconds; design the subscription data flow.

16A plugin marketplace runs 6,000 third-party plugins for 40,000 tenants, each invocation limited to 500 ms and 64 MB; design capability and data boundaries for the runtime.

17A browser dashboard shows regulated records to 3 million monthly users and must keep access tokens out of JavaScript while supporting 12 backend APIs with a 250 ms p99; design the flow.

18A service API exports up to 50 million customer rows to 300 enterprise clients, with jobs lasting 4 hours and download links valid for 15 minutes; design delegated authorization across the flow.

19A reporting SaaS generates 120,000 PDF exports per day containing 4 data classes and retains them for 7 days; design storage and download boundaries with a 2-second acknowledgment SLA.

20A passwordless SaaS supports 8 million accounts, 2 passkeys per user, and assisted recovery completed within 24 hours; design recovery so support cannot directly take over an account.

Locked questions