Fundamentals and Coding Questions

Systems and Memory

  1. Design a parser for an untrusted length-prefixed binary format.
  2. Explain stack, heap, virtual memory, page tables, and copy-on-write during fork.
  3. Compare buffer overflow, use-after-free, integer overflow, race, and logic flaw.
  4. What must be true for a crash to become a security boundary violation?
  5. Review an unsafe Rust FFI wrapper. Which invariants belong in the safe API?
  6. Explain a syscall from user call site through kernel dispatch and return.
  7. Compare ELF, PE, and Mach-O security-relevant metadata.
  8. How would you handle untrusted decompression without memory or CPU exhaustion?

Coding Exercises

  1. Parse CIDR ranges and test overlap and containment.
  2. Implement a bounded worker pool with cancellation and per-target timeout.
  3. Validate and normalize a security finding JSON schema.
  4. Implement constant-time byte comparison and explain when it matters.
  5. Build an authorization function from subject, action, resource, tenant, and context.
  6. Parse a simplified audit log and reconstruct sessions.
  7. Implement an LRU replay cache with expiry.
  8. Write a safe archive extraction planner that rejects traversal and collisions.

For every solution discuss malformed input, resource limits, races, error handling, secrets, logs, test strategy, and what belongs in a mature library instead.

Network, Identity, and Crypto

  1. Trace a browser request from DNS to an authorized database operation.
  2. What does TLS protect, and what remains exposed or trusted?
  3. Explain OAuth authorization code with PKCE and the purpose of state and nonce.
  4. A JWT signature validates. What else must the resource server check?
  5. Compare browser session cookies and bearer tokens.
  6. Design service identity and certificate rotation for 10,000 workloads.
  7. Compare RBAC, ABAC, and ReBAC for a document-sharing product.
  8. Explain envelope encryption and how to rotate data and wrapping keys.
  9. How do SSRF controls differ at application, network, identity, and metadata layers?
  10. Design abuse prevention for an expensive public API.

Review Prompts

  • A file-upload handler trusts MIME type and stores under the original name.
  • An admin endpoint checks a UI role but not the API caller.
  • A CI job runs pull-request code with production deployment credentials.
  • A Go scanner launches one goroutine per host with no timeout.
  • An Android activity is exported and trusts an intent extra.

For each: establish reachability and impact, propose the smallest durable fix, add a regression test, identify detection, and avoid overstating severity.