Application, Cloud, Platform, and Mobile Questions

Product and Application Security

  1. Threat-model a multi-tenant export/reporting feature.
  2. Review password reset and account recovery for takeover and privacy risk.
  3. Design a secure webhook platform.
  4. A team has 5,000 dependency alerts. How do you prioritize and reduce recurrence?
  5. Place SAST, SCA, DAST, secret, IaC, container, and runtime controls in the lifecycle.
  6. Design an exception process engineers will use without making it a bypass.
  7. What metrics show that a product security program is reducing risk?
  8. Explain a critical design flaw to a product VP and provide options.

Cloud and Kubernetes

  1. Design a landing zone for a regulated multi-account organization.
  2. Trace a federated human login and workload identity to a cloud data object.
  3. Prevent and detect cross-tenant access in a Kubernetes SaaS platform.
  4. Respond to a leaked CI credential with broad cloud permissions.
  5. Secure Terraform state, plan review, deployment identity, and module supply chain.
  6. Compare namespace, cluster, gVisor, and microVM tenant boundaries.
  7. Design centralized logging that survives a compromised workload or project.
  8. Map a compliance requirement to implementation, test, owner, evidence, and frequency.
  9. Design backup and recovery for ransomware-like data corruption without teaching ransomware.
  10. Prioritize cloud findings for an executive remediation roadmap.

Android

  1. Explain app sandbox, permission, Binder caller identity, and SELinux boundaries.
  2. Review a deep link that initiates a payment or sensitive workflow.
  3. Secure a content provider shared with one partner application.
  4. Threat-model a WebView JavaScript bridge.
  5. Choose storage for offline sensitive records.
  6. Assess certificate pinning and design rotation/failure behavior.
  7. Triage a crash in a JNI image parser.
  8. Explain APK signing, Verified Boot, Keystore, and hardware attestation as separate controls.
  9. An app passes mobile tests but its API has broken object authorization. How do you report it?
  10. Plan a responsible Android research project using AOSP or an owned app.

Isolation and Endpoint

  1. Design a service that runs untrusted customer code.
  2. What remains shared in containers, gVisor-style sandboxes, and microVMs?
  3. Derive a seccomp profile and handle compatibility.
  4. Contain a fork bomb, memory consumer, filesystem probe, and metadata request.
  5. Compare Linux capabilities/LSMs, Windows tokens/integrity, and macOS sandbox/TCC.
  6. Design endpoint logging with privacy and cost constraints.