Name some of the most common web application vulnerabilities (OWASP Top 10) and how you defend against them.
What they are really testing: Whether you know the real-world attack classes and the concrete mitigations, not just buzzwords. A cloud engineer needs to recognize these even if they are not writing the app.
A real interview question
Name some of the most common web application vulnerabilities (OWASP Top 10) and how you defend against them.
What most people say
drag me
“Things like SQL injection and XSS, you defend against them by validating user input.”
It names two and reduces every defense to "validate input". Different vulns need different mitigations (parameterized queries, output encoding, server-side authZ, patching), and broken access control, the most common class, is missing.
The follow-ups they ask next
Why is "validate input" not a sufficient defense against SQL injection?
Validation can be bypassed and is easy to get wrong. The robust fix is parameterized queries, which separate code from data so input is never interpreted as SQL, regardless of its content.
What makes broken access control so common and so dangerous?
It is logic that is easy to forget on some endpoints (especially object-level checks). Attackers just change an ID or call an unguarded route. Enforce authZ server-side, default deny, and test it.
What the interviewer is listening for
- Names multiple distinct classes incl. broken access control
- Gives the right mitigation per class
- Knows input validation alone is insufficient
What sinks the answer
- Only SQLi/XSS
- Reduces everything to "validate input"
- Misses access control / misconfig
If you genuinely do not know
Say this instead of freezing. Reasoning out loud from what you do know beats silence every single time, and a good interviewer is listening for exactly that.
“Common classes: [injection (fix: parameterized queries), broken access control (fix: server-side authZ, default deny), XSS (fix: output encoding + CSP), misconfig/stale components (fix: hardened defaults, patching, SCA), SSRF (fix: egress controls + metadata protection)]. The theme: [each class needs its own mitigation, input validation alone is not enough].”
Keep going with security
Foundation
Explain the shared responsibility model. Where does the cloud provider's job end and yours begin?
Foundation
What is the CIA triad, and why is it a useful way to think about security?
Foundation
What is the difference between authentication and authorization?
Junior
What is the difference between encryption at rest and in transit, and why do you need both?
Junior
How should an application running in the cloud get credentials to call other cloud services? Why avoid long-lived access keys?
Junior
What is the difference between symmetric and asymmetric encryption, and where is each used?
Knowing the answer is not the same as recalling it under pressure
Sign in to send the questions you fumble to spaced recall, so they come back right before you would forget them, and learn the concepts behind them with hands-on labs.
Start free