| 1 | What is the purpose of the helmet middleware package for an Express application, and what specific security headers does it set? Node.js › Express & Middleware | Node.js | Express & Middleware | Intermediate |
| 2 | How do you set security related HTTP headers, such as Content Security Policy, in a Next.js application? Next.js › Security Best Practices in Next.js | Next.js | Security Best Practices in Next.js | Intermediate |
| 3 | What is HSTS (HTTP Strict Transport Security), and how does UseHsts() in ASP.NET Core implement it? ASP.NET Core › HTTPS, Certificates & Transport Security | ASP.NET Core | HTTPS, Certificates & Transport Security | Intermediate |
| 4 | What is certificate pinning, and why is it generally discouraged for typical web API scenarios despite its security benefits? ASP.NET Core › HTTPS, Certificates & Transport Security | ASP.NET Core | HTTPS, Certificates & Transport Security | Intermediate |
| 5 | How do you enforce that all HTTP requests to an ASP.NET Core application are redirected to HTTPS? ASP.NET Core › HTTPS, Certificates & Transport Security | ASP.NET Core | HTTPS, Certificates & Transport Security | Beginner |
| 6 | What is the difference between a certificate's public key and private key, and why must the private key never be exposed or committed to source control? ASP.NET Core › HTTPS, Certificates & Transport Security | ASP.NET Core | HTTPS, Certificates & Transport Security | Beginner |
| 7 | What TLS protocol versions and cipher suites should a modern ASP.NET Core application support, and how do you configure Kestrel to enforce a minimum acceptable TLS version? ASP.NET Core › HTTPS, Certificates & Transport Security | ASP.NET Core | HTTPS, Certificates & Transport Security | Intermediate |
| 8 | Why is it important to validate a server's TLS certificate when making outbound HttpClient calls to external services, and what's the risk of disabling certificate validation? ASP.NET Core › HTTPS, Certificates & Transport Security | ASP.NET Core | HTTPS, Certificates & Transport Security | Intermediate |
| 9 | What is the parent delegation model in Java class loading, and why is it important for security and consistency? Java › Class Loading & Bytecode Verification | Java | Class Loading & Bytecode Verification | Intermediate |
| 10 | How would you configure a Maven or Gradle build to produce a reproducible build (bit-for-bit identical output given the same source), and why does this matter for supply chain security? Java › Build Tools: Maven & Gradle | Java | Build Tools: Maven & Gradle | Advanced |
| 11 | Why has Java's built-in serialization (ObjectInputStream.readObject()) been widely criticized as a security risk, and what specific attack does deserializing untrusted data enable? Java › I/O & NIO | Java | I/O & NIO | Advanced |
| 12 | How does Java's String immutability, combined with the string pool, interact with security-sensitive code (like handling passwords), and why is char[] generally recommended over String for storing sensitive data temporarily in memory? Java › Java Fundamentals: Syntax, Data Types & Operators | Java | Java Fundamentals: Syntax, Data Types & Operators | Advanced |
| 13 | How would you configure HttpClient to trust a custom or self-signed SSL/TLS certificate for testing against an internal service, and what security risks does disabling certificate validation entirely introduce? Java › Java Networking & HTTP Client | Java | Java Networking & HTTP Client | Advanced |
| 14 | How do you set custom response headers, such as CORS headers, in a route handler to allow requests from a different domain? Next.js › Route Handlers (API Route.js) | Next.js | Route Handlers (API Route.js) | Advanced |
| 15 | What is the difference between Kestrel's ListenAnyIP and Listen methods for binding to network addresses? ASP.NET Core › Hosting Models: Kestrel, IIS & Reverse Proxies | ASP.NET Core | Hosting Models: Kestrel, IIS & Reverse Proxies | Beginner |
| 16 | What is the difference between CORS and CSRF protection, and why doesn't a strict CORS policy alone fully protect a cookie-authenticated endpoint? ASP.NET Core › CORS (Cross-Origin Resource Sharing) | ASP.NET Core | CORS (Cross-Origin Resource Sharing) | Intermediate |
| 17 | How do you validate an uploaded file's actual content type (not just its client-supplied extension or Content-Type header) to prevent malicious file uploads? ASP.NET Core › File Uploads & Streaming Large Files | ASP.NET Core | File Uploads & Streaming Large Files | Intermediate |
| 18 | What is the difference between temporary file storage (during processing) and permanent storage for uploaded files, and why should uploads generally not be saved directly to their final destination? ASP.NET Core › File Uploads & Streaming Large Files | ASP.NET Core | File Uploads & Streaming Large Files | Intermediate |
| 19 | Why should the detailed /health endpoint (with full dependency status breakdown) generally not be exposed publicly on the internet, and how do you restrict access to it? ASP.NET Core › Health Checks | ASP.NET Core | Health Checks | Intermediate |
| 20 | How does ASP.NET Core determine the original client IP address and scheme (HTTP/HTTPS) when running behind a reverse proxy that terminates TLS and forwards requests, given the app only sees the proxy's connection? ASP.NET Core › Hosting Models: Kestrel, IIS & Reverse Proxies | ASP.NET Core | Hosting Models: Kestrel, IIS & Reverse Proxies | Intermediate |
| 21 | How do you resolve a dependency version conflict manually in Maven using exclusions, and when would this be necessary despite the automatic nearest-wins resolution? Java › Build Tools: Maven & Gradle | Java | Build Tools: Maven & Gradle | Intermediate |
| 22 | What is the purpose of the -Xverify:none (or newer -noverify) JVM flag, and why is disabling bytecode verification generally discouraged? Java › Class Loading & Bytecode Verification | Java | Class Loading & Bytecode Verification | Intermediate |
| 23 | How would you implement object serialization using ObjectOutputStream/ObjectInputStream, and what does the Serializable marker interface and serialVersionUID actually do? Java › I/O & NIO | Java | I/O & NIO | Intermediate |
| 24 | How would you use InetAddress to perform DNS resolution (converting a hostname to an IP address) programmatically, and what's the difference between InetAddress.getByName() and getAllByName()? Java › Java Networking & HTTP Client | Java | Java Networking & HTTP Client | Intermediate |
| 25 | How does HttpClient handle automatic following of HTTP redirects (3xx responses), and how would you configure or disable this behavior? Java › Java Networking & HTTP Client | Java | Java Networking & HTTP Client | Intermediate |
| 26 | How would you implement direct-to-cloud-storage uploads (bypassing your API server entirely) using pre-signed URLs, and why is this approach preferred for very large files? ASP.NET Core › File Uploads & Streaming Large Files | ASP.NET Core | File Uploads & Streaming Large Files | Advanced |
| 27 | How would you implement virus/malware scanning for uploaded files before they're made available for download by other users? ASP.NET Core › File Uploads & Streaming Large Files | ASP.NET Core | File Uploads & Streaming Large Files | Advanced |
| 28 | What is bytecode verification, and what specific categories of invalid or unsafe bytecode does the JVM's verifier reject before allowing a class to run? Java › Class Loading & Bytecode Verification | Java | Class Loading & Bytecode Verification | Advanced |
| 29 | How does HashMap's internal implementation work (hashing, bucket array, treeification), and how did its collision-handling strategy change in Java 8? Java › Collections Framework | Java | Collections Framework | Advanced |
| 30 | How would you use Lombok's @EqualsAndHashCode and @ToString annotations to eliminate equals()/hashCode()/toString() boilerplate, and what specific configuration options handle inheritance and field exclusion correctly? Java › equals(), hashCode() & toString() Contracts | Java | equals(), hashCode() & toString() Contracts | Advanced |