Tools / Application Security Interview Questions
1. In Information Security, CIA stands for what?
CIA stands for confidentiality, integrity, and availability.
2. Mention some of the goals of Application security.
Application Security works to improve the software development process to minimize the number of security flaws available to an attacker.
3. Which ISO standard sets a baseline for application security?
ISO/IEC 27034 offers guidance on information security to those specifying, designing, and programming or procuring, implementing, and using application systems.
4. What is clickjacking?
Clickjacking is an attack that tricks a user into clicking a webpage element that is invisible or disguised as another element. This can cause users to unwittingly download malware, visit malicious web pages, provide credentials or sensitive information, transfer money, or purchase products online.
5. What is OWASP?
The Open Worldwide Application Security Project (OWASP) is a nonprofit foundation that works to improve the security of software. Through community-led open-source software projects, hundreds of local chapters worldwide, tens of thousands of members, and leading educational and training conferenc...
6. How do you mitigate Sensitive Data Exposure?
Sensitive Data Exposure can be mitigated in a number of ways. Encrypting data is the easiest and most obvious way to safeguard it against cyberattacks. Sensitive information ought to be deleted as soon as feasible rather than being stored incorrectly or pointlessly. Creating a threat model for th...
7. Describe IPSEC.
IPSec is a set of communication rules or protocols for setting up secure connections over a network. Internet Protocol (IP) is the common standard that determines how data travels over the internet. IPSec adds encryption and authentication to make the protocol more secure. For example, it scrambl...
8. Explain OWASP WebGoat and WebScarab.
OWASP WebGoat is a deliberately insecure application that allows interested developers just like you to test vulnerabilities commonly found in Java-based applications that use common and popular open-source components. OWASP WebScarab is a framework for evaluating HTTP/HTTPS traffic. It performs ...
9. What does OSI stand for?
The open systems interconnection (OSI) model is a conceptual model created by the International Organization for Standardization which enables diverse communication systems to communicate using standard protocols. In plain English, the OSI provides a standard for different computer systems to be ...
10. What is bug bounty?
A bug bounty program is a deal offered by many websites, organizations, and software developers by which individuals can receive recognition and compensation for reporting bugs, especially those pertaining to security exploits and vulnerabilities.
11. What is ESAPI?
ESAPI (The OWASP Enterprise Security API) is a free, open-source, web application security control library that makes it easier for programmers to write lower-risk applications. The ESAPI libraries are designed to make it easier for programmers to retrofit security into existing applications. The...
12. What are SAST, DAST and SCA?
SAST (Static Application Security Testing) is the automated analysis of written code (compiled or uncompiled) for security vulnerabilities. DAST (Dynamic Application Security Testing) is interaction with your running application with the purpose of finding and managing vulnerabilities it may have...
13. What is system hardening?
System hardening is a process to secure a computer system or server by eliminating the risks of cyberattacks. The process involves removing or disabling system applications, user accounts, and other features that cyber attackers can infiltrate to gain access to your network. These features, somet...
