Fundamentals and Coding Questions
Systems and Memory
- Design a parser for an untrusted length-prefixed binary format.
- Explain stack, heap, virtual memory, page tables, and copy-on-write during
fork. - Compare buffer overflow, use-after-free, integer overflow, race, and logic flaw.
- What must be true for a crash to become a security boundary violation?
- Review an
unsafeRust FFI wrapper. Which invariants belong in the safe API? - Explain a syscall from user call site through kernel dispatch and return.
- Compare ELF, PE, and Mach-O security-relevant metadata.
- How would you handle untrusted decompression without memory or CPU exhaustion?
Coding Exercises
- Parse CIDR ranges and test overlap and containment.
- Implement a bounded worker pool with cancellation and per-target timeout.
- Validate and normalize a security finding JSON schema.
- Implement constant-time byte comparison and explain when it matters.
- Build an authorization function from subject, action, resource, tenant, and context.
- Parse a simplified audit log and reconstruct sessions.
- Implement an LRU replay cache with expiry.
- Write a safe archive extraction planner that rejects traversal and collisions.
For every solution discuss malformed input, resource limits, races, error handling, secrets, logs, test strategy, and what belongs in a mature library instead.
Network, Identity, and Crypto
- Trace a browser request from DNS to an authorized database operation.
- What does TLS protect, and what remains exposed or trusted?
- Explain OAuth authorization code with PKCE and the purpose of state and nonce.
- A JWT signature validates. What else must the resource server check?
- Compare browser session cookies and bearer tokens.
- Design service identity and certificate rotation for 10,000 workloads.
- Compare RBAC, ABAC, and ReBAC for a document-sharing product.
- Explain envelope encryption and how to rotate data and wrapping keys.
- How do SSRF controls differ at application, network, identity, and metadata layers?
- Design abuse prevention for an expensive public API.
Review Prompts
- A file-upload handler trusts MIME type and stores under the original name.
- An admin endpoint checks a UI role but not the API caller.
- A CI job runs pull-request code with production deployment credentials.
- A Go scanner launches one goroutine per host with no timeout.
- An Android activity is exported and trusts an intent extra.
For each: establish reachability and impact, propose the smallest durable fix, add a regression test, identify detection, and avoid overstating severity.