Security in a Senior interview
Our security questions are about where a control is enforced and what it checks there. They are set on AWS, Google Cloud and Azure, Kubernetes, networks, browsers, Python and Node services, and agents that act on untrusted input, and they ask who a request runs as, which check it passes, and what an attacker can still reach.
An axis of our Senior backend and Senior fullstack targets.
The check comes with every pass and covers all the competencies of the target you choose: 8 for Senior backend (about 16 minutes) and 10 for Senior fullstack (about 20 minutes). It reports each one as Ready, Borderline or a Gap for this level. It never predicts a pass.
Patterns our questions are designed to test at Senior
These are the distinctions the questions on this axis are written to separate — our judgement from writing them and having them reviewed, not a measurement of candidates. We have run no study, so nothing here is a statistic and none of it is phrased as one.
- 1.
Revoking the person instead of the credential
A Cloud Storage signed URL lets anyone who holds it perform the one operation it was signed for, with the authority of the service account that signed it, so removing the contractor who holds it from every role changes nothing: the URL works until it expires or the signing key is rotated. Ending a leaked Azure account SAS means rotating the account key that signed it, and with it every other token signed with that key. Our questions ask what a credential is checked against when it is used, and what ending it costs.
- 2.
Instructions in the data, controls in the wrong place
A bug report that asks a triage agent to add an SSH key to the deploy configuration is untrusted content the model reads, and it can change what the agent writes. A rule in the system prompt lowers the odds; what stops the key is a check outside the model, such as a person reviewing the pull request before it merges. A read-only GitHub token limits the API calls an agent can make and does nothing about a
.envfile in the checkout it already has on disk. Our questions ask which control an agent's action actually has to pass. - 3.
Isolation at one layer taken for isolation at all of them
One namespace per customer, with RBAC, a default-deny NetworkPolicy and quotas, separates customers in the Kubernetes API and on the network; on a shared node pool their containers still share a kernel, so a container escape lands beside another customer's workloads. Two peered Google Cloud VPC networks exchange routes and nothing else, so a firewall rule in one that admits a network tag never matches an instance in the other. Our questions ask at which layer a boundary is drawn, and what it leaves shared.
- 4.
A fix that closes the reported path
Starting Node with
--disable-proto=deleteremovesObject.prototype.__proto__, so a__proto__key in a recursive merge no longer reaches the prototype, and aconstructor.prototypepath still does. In CPython, a prefix check afteros.path.normpathblocks../and absolute paths, and a symbolic link inside the tenant's folder still leads out of it, becausenormpathworks on the text of the path and never looks at the disk. Our questions ask whether a fix closes the class of bug or only the input in the report.
What a strong answer sounds like: A strong answer names the identity a request runs as and the place the decision is made, then says what that check does not cover.
How the check measures it
3 questions drawn on this axis alone — 2 medium and 1 hard for a Senior target, because the bar is the level. Hard counts for one and a half times a medium, which is what makes the verdict relative:
| Medium right | Hard right | Verdict |
|---|---|---|
| 2 of 2 | 1 of 1 | Ready |
| 1 of 2 | 1 of 1 | Ready |
| 2 of 2 | 0 of 1 | Borderline |
| 0 of 2 | 1 of 1 | Borderline |
| 1 of 2 | 0 of 1 | Gap |
| 0 of 2 | 0 of 1 | Gap |
Three questions is coarse and the report says so beside every verdict. It is enough to separate this axis from the others in your target, which is what the check is for — there is no total, no percentage and no single number anywhere in the report.
What there is to practise
Questions here most often also test cloud architecture, technical judgment: decisions and trade-offs, ai agents & tooling and networking. Few questions on this axis test it alone, which is why the check reports every competency separately rather than averaging them.
One of them, in full
A question from the free demo, not written for this page. A demo quiz opens with it; the answer, the explanation and the source come when you submit — no account needed.
Answer it on the demoOne axis is not the loop
This axis is one of 8 in our Senior backend target and one of 10 in Senior fullstack, and being strong here says nothing about the others. The check covers all of them in one sitting and reports each separately, so what comes back is a profile rather than a score.