[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"me":3,"catalog:en:security\u002Fas-crypto-implementation-pitfalls":4,"config":232},null,{"field_key":5,"field_name":6,"seniority":7,"topic_key":8,"topic_name":9,"spec_key":7,"spec_name":7,"locale":10,"cell_total":11,"field_total":12,"seniorities":13,"topics":17,"specs":130,"samples":147},"security","Security","","as-crypto-implementation-pitfalls","As Crypto Implementation Pitfalls","en",75,2850,[14,15,16],"junior","mid","senior",[18,21,24,27,28,31,34,37,40,43,46,49,52,55,58,61,64,67,70,73,76,79,82,85,88,91,94,97,100,103,106,109,112,115,118,121,124,127],{"key":19,"name":20,"count":11},"as-access-control-idor","As Access Control Idor",{"key":22,"name":23,"count":11},"as-api-security","As Api Security",{"key":25,"name":26,"count":11},"as-authentication-session","As Authentication Session",{"key":8,"name":9,"count":11},{"key":29,"name":30,"count":11},"as-injection-input-validation","As Injection Input Validation",{"key":32,"name":33,"count":11},"as-secure-sdlc-sast-dast","As Secure Sdlc Sast Dast",{"key":35,"name":36,"count":11},"bt-crisis-communication-management","Bt Crisis Communication Management",{"key":38,"name":39,"count":11},"bt-detection-engineering-tuning","Bt Detection Engineering Tuning",{"key":41,"name":42,"count":11},"bt-digital-forensics-fundamentals","Bt Digital Forensics Fundamentals",{"key":44,"name":45,"count":11},"bt-incident-triage-classification","Bt Incident Triage Classification",{"key":47,"name":48,"count":11},"bt-ir-playbook-execution","Bt Ir Playbook Execution",{"key":50,"name":51,"count":11},"bt-threat-intelligence-application","Bt Threat Intelligence Application",{"key":53,"name":54,"count":11},"cse-container-workload-security","Cse Container Workload Security",{"key":56,"name":57,"count":11},"cse-cspm-misconfiguration","Cse Cspm Misconfiguration",{"key":59,"name":60,"count":11},"cse-data-protection-governance","Cse Data Protection Governance",{"key":62,"name":63,"count":11},"cse-detection-incident-response","Cse Detection Incident Response",{"key":65,"name":66,"count":11},"cse-iam-privilege-escalation","Cse Iam Privilege Escalation",{"key":68,"name":69,"count":11},"cse-network-perimeter-zero-trust","Cse Network Perimeter Zero Trust",{"key":71,"name":72,"count":11},"ds-iac-policy-as-code","Ds Iac Policy As Code",{"key":74,"name":75,"count":11},"ds-pipeline-security-gates","Ds Pipeline Security Gates",{"key":77,"name":78,"count":11},"ds-secrets-pipeline-management","Ds Secrets Pipeline Management",{"key":80,"name":81,"count":11},"ds-security-metrics-blameless-culture","Ds Security Metrics Blameless Culture",{"key":83,"name":84,"count":11},"ds-shift-left-security-culture","Ds Shift Left Security Culture",{"key":86,"name":87,"count":11},"ds-software-supply-chain-pipeline","Ds Software Supply Chain Pipeline",{"key":89,"name":90,"count":11},"pt-legal-ethical-boundaries","Pt Legal Ethical Boundaries",{"key":92,"name":93,"count":11},"pt-methodology-phases","Pt Methodology Phases",{"key":95,"name":96,"count":11},"pt-red-team-engagement-management","Pt Red Team Engagement Management",{"key":98,"name":99,"count":11},"pt-reporting-remediation-prioritization","Pt Reporting Remediation Prioritization",{"key":101,"name":102,"count":11},"pt-scoping-rules-of-engagement","Pt Scoping Rules Of Engagement",{"key":104,"name":105,"count":11},"pt-vulnerability-assessment-vs-pentest","Pt Vulnerability Assessment Vs Pentest",{"key":107,"name":108,"count":11},"security-authn-authz","Security Authn Authz",{"key":110,"name":111,"count":11},"security-cloud-infra-security","Security Cloud Infra Security",{"key":113,"name":114,"count":11},"security-compliance-risk","Security Compliance Risk",{"key":116,"name":117,"count":11},"security-cryptography-basics","Security Cryptography Basics",{"key":119,"name":120,"count":11},"security-incident-response","Security Incident Response",{"key":122,"name":123,"count":11},"security-network-security","Security Network Security",{"key":125,"name":126,"count":11},"security-secure-sdlc","Security Secure Sdlc",{"key":128,"name":129,"count":11},"security-web-vulnerabilities","Security Web Vulnerabilities",[131,135,138,141,144],{"key":132,"name":133,"count":134},"appsec","AppSec",450,{"key":136,"name":137,"count":134},"blue-team-incident","Blue Team \u002F Incident",{"key":139,"name":140,"count":134},"cloud-security","Cloud Security",{"key":142,"name":143,"count":134},"devsecops","DevSecOps",{"key":145,"name":146,"count":134},"offensive-pentest","Offensive \u002F Pentest",[148,166,179,192,205,219],{"id":149,"topic":9,"difficulty":150,"body":151,"options":152,"correct_key":163,"explanation":165},"019faa33-108b-75b1-991d-c1789825d3ae",1,"Why is reusing the same IV (initialization vector) with the same key in CBC mode a security problem?",[153,156,159,162],{"key":154,"text":155},"a","It slows down encryption because the cipher has to recompute the key schedule",{"key":157,"text":158},"b","It causes the ciphertext to be shorter than the plaintext, breaking the format",{"key":160,"text":161},"c","It only affects decryption speed, not confidentiality",{"key":163,"text":164},"d","Identical plaintext blocks encrypted under the same key\u002FIV pair produce identical ciphertext blocks, leaking structure","The IV is meant to randomize the first block's input so that identical plaintexts encrypt differently each time. Reusing the same IV with the same key removes that randomization, so an attacker who sees two ciphertexts produced under the same key\u002FIV pair can detect when the underlying plaintext blocks matched.",{"id":167,"topic":9,"difficulty":150,"body":168,"options":169,"correct_key":157,"explanation":178},"019faa33-108c-7058-8017-0c7627156f94","Why is ECB (Electronic Codebook) mode considered unsafe for encrypting most real-world data?",[170,172,174,176],{"key":154,"text":171},"ECB mode requires a separate key for every block, making key management unmanageable",{"key":157,"text":173},"Each plaintext block is encrypted independently, so identical blocks always produce identical ciphertext, revealing patterns",{"key":160,"text":175},"ECB mode cannot be implemented with AES, only with legacy ciphers like DES",{"key":163,"text":177},"ECB mode always doubles the size of the output ciphertext compared to the input","ECB encrypts each fixed-size block independently with no chaining or randomization, so identical plaintext blocks always map to identical ciphertext blocks. This lets an attacker who only sees ciphertext infer structural patterns in the original data, which is why the classic 'encrypted image still shows the outline' example illustrates the flaw.",{"id":180,"topic":9,"difficulty":150,"body":181,"options":182,"correct_key":157,"explanation":191},"019faa33-108c-7850-a455-4ab047a87c0c","A developer hardcodes an AES encryption key as a string literal directly in the application source code. What is the main risk?",[183,185,187,189],{"key":154,"text":184},"AES keys stored as string literals are automatically truncated by most compilers",{"key":157,"text":186},"Anyone with access to the source code or compiled binary can extract the key and decrypt all protected data",{"key":160,"text":188},"Hardcoded keys make the encryption algorithm run slower than reading from a config file",{"key":163,"text":190},"The application will fail to compile because encryption keys cannot be represented as strings, and most languages reserve string literals exclusively for user-facing text.","A key embedded in source code is not a secret — it ships with every copy of the code or binary, is visible in version control history, and can be extracted by anyone who can read or decompile the artifact. Keys belong in a secrets manager or KMS, not in source.",{"id":193,"topic":9,"difficulty":150,"body":194,"options":195,"correct_key":154,"explanation":204},"019faa33-108d-70d5-888d-dad82c89d8d7","A team encodes sensitive data with Base64 before storing it and calls this 'encrypting' the data. What is wrong with this claim?",[196,198,200,202],{"key":154,"text":197},"Base64 is a reversible encoding with no secret key involved, so anyone can decode it back to plaintext without needing a key",{"key":157,"text":199},"Base64 output cannot be stored in a text-based database column",{"key":160,"text":201},"Base64 is only reversible if the original data was already encrypted first",{"key":163,"text":203},"Base64 changes the byte length of the data, which technically counts as encryption","Base64 is an encoding scheme for representing binary data as text — it has no key and no confidentiality goal. Anyone who sees Base64 text can decode it in one line, so it provides zero protection against disclosure, unlike encryption which requires a secret key to reverse.",{"id":206,"topic":9,"difficulty":207,"body":208,"options":209,"correct_key":154,"explanation":218},"019faa33-108d-784c-a80f-1047225f1632",2,"Why should encryption keys and session tokens be generated using a cryptographically secure pseudo-random number generator (CSPRNG) instead of a standard library random function like `Math.random()`?",[210,212,214,216],{"key":154,"text":211},"Standard PRNGs optimize for statistical distribution, not unpredictability, so attackers can sometimes predict their output.",{"key":157,"text":213},"CSPRNGs always produce shorter output than standard PRNGs, saving storage",{"key":160,"text":215},"Standard library random functions cannot generate numbers larger than 32 bits",{"key":163,"text":217},"CSPRNGs are required by law in most countries for any application handling user data","General-purpose PRNGs like `Math.random()` optimize for speed and statistical distribution, not for resistance to prediction. Some are seeded or implemented such that observing enough output (or the seed) lets an attacker predict future values, which is catastrophic if that output becomes a session token or key. CSPRNGs are specifically designed so past output gives no advantage in predicting future output.",{"id":220,"topic":9,"difficulty":207,"body":221,"options":222,"correct_key":163,"explanation":231},"019faa33-108e-7179-ba3b-f1522aedef87","Two parties need to establish a shared symmetric key over an untrusted network without ever having met in person. Which approach solves this securely?",[223,225,227,229],{"key":154,"text":224},"One party picks a symmetric key and sends it in plaintext, relying on the network being 'probably safe'",{"key":157,"text":226},"Encode the key with Base64 before transmitting it so only technical staff can read it",{"key":160,"text":228},"Both parties independently generate the same key by hashing the current date, since both clocks are synchronized",{"key":163,"text":230},"Use asymmetric cryptography to encrypt the symmetric key with the recipient's public key, or perform a key-exchange protocol like Diffie-Hellman","Because asymmetric encryption only requires the recipient's public key (which can be shared openly), it lets a sender protect a symmetric key in transit without a prior shared secret. Key-exchange protocols like Diffie-Hellman achieve the same goal by letting both sides derive a shared secret without ever transmitting it directly.",{"fields":233,"seniorities":410,"interview_shapes":411,"locales":416,"oauth":418,"question_count":421,"coach_enabled":422,"jd_match_enabled":422},[234,259,279,296,320,333,352,371,381,391,397,404],{"key":235,"name_tr":236,"name_en":236,"sort":150,"specializations":237},"backend","Backend",[238,241,244,247,250,253,256],{"key":239,"name":240,"field":235},"general","Genel",{"key":242,"name":243,"field":235},"go","Go",{"key":245,"name":246,"field":235},"python","Python",{"key":248,"name":249,"field":235},"java","Java",{"key":251,"name":252,"field":235},"csharp","C#\u002F.NET",{"key":254,"name":255,"field":235},"nodejs","Node.js",{"key":257,"name":258,"field":235},"php","PHP",{"key":260,"name_tr":261,"name_en":261,"sort":207,"specializations":262},"frontend","Frontend",[263,264,267,270,273,276],{"key":239,"name":240,"field":260},{"key":265,"name":266,"field":260},"javascript","JavaScript",{"key":268,"name":269,"field":260},"typescript","TypeScript",{"key":271,"name":272,"field":260},"react","React",{"key":274,"name":275,"field":260},"vue","Vue",{"key":277,"name":278,"field":260},"angular","Angular",{"key":280,"name_tr":281,"name_en":281,"sort":282,"specializations":283},"fullstack","Fullstack",3,[284,285,286,287,288,289,290,291,292,293,294,295],{"key":239,"name":240,"field":280},{"key":242,"name":243,"field":235},{"key":245,"name":246,"field":235},{"key":248,"name":249,"field":235},{"key":251,"name":252,"field":235},{"key":254,"name":255,"field":235},{"key":257,"name":258,"field":235},{"key":265,"name":266,"field":260},{"key":268,"name":269,"field":260},{"key":271,"name":272,"field":260},{"key":274,"name":275,"field":260},{"key":277,"name":278,"field":260},{"key":297,"name_tr":298,"name_en":298,"sort":299,"specializations":300},"devops-cloud","DevOps \u002F Cloud",4,[301,302,305,308,311,314,317],{"key":239,"name":240,"field":297},{"key":303,"name":304,"field":297},"aws","AWS",{"key":306,"name":307,"field":297},"gcp","GCP",{"key":309,"name":310,"field":297},"azure","Azure",{"key":312,"name":313,"field":297},"kubernetes","Kubernetes",{"key":315,"name":316,"field":297},"terraform","Terraform",{"key":318,"name":319,"field":297},"linux","Linux",{"key":321,"name_tr":322,"name_en":322,"sort":323,"specializations":324},"ai-engineer","AI Engineer",5,[325,326,327,330],{"key":239,"name":240,"field":321},{"key":245,"name":246,"field":321},{"key":328,"name":329,"field":321},"llm-rag","LLM\u002FRAG",{"key":331,"name":332,"field":321},"mlops","MLOps",{"key":334,"name_tr":335,"name_en":336,"sort":337,"specializations":338},"database","Veritabanı","Database",6,[339,340,343,346,349],{"key":239,"name":240,"field":334},{"key":341,"name":342,"field":334},"postgresql","PostgreSQL",{"key":344,"name":345,"field":334},"mysql","MySQL",{"key":347,"name":348,"field":334},"mongodb","MongoDB",{"key":350,"name":351,"field":334},"redis","Redis",{"key":353,"name_tr":354,"name_en":355,"sort":356,"specializations":357},"mobile","Mobil","Mobile",7,[358,359,362,365,368],{"key":239,"name":240,"field":353},{"key":360,"name":361,"field":353},"ios-swift","iOS (Swift)",{"key":363,"name":364,"field":353},"android-kotlin","Android (Kotlin)",{"key":366,"name":367,"field":353},"flutter","Flutter",{"key":369,"name":370,"field":353},"react-native","React Native",{"key":5,"name_tr":372,"name_en":6,"sort":373,"specializations":374},"Güvenlik",8,[375,376,377,378,379,380],{"key":239,"name":240,"field":5},{"key":132,"name":133,"field":5},{"key":145,"name":146,"field":5},{"key":139,"name":140,"field":5},{"key":142,"name":143,"field":5},{"key":136,"name":137,"field":5},{"key":382,"name_tr":383,"name_en":384,"sort":385,"specializations":386},"qa-test-automation","QA \u002F Test Otomasyonu","QA \u002F Test Automation",9,[387,388],{"key":239,"name":240,"field":382},{"key":389,"name":390,"field":382},"test-automation","Test Automation",{"key":392,"name_tr":393,"name_en":393,"sort":394,"specializations":395},"data-engineer","Data Engineer",10,[396],{"key":239,"name":240,"field":392},{"key":398,"name_tr":399,"name_en":400,"sort":401,"specializations":402},"game-dev","Oyun Geliştirme","Game Development",11,[403],{"key":239,"name":240,"field":398},{"key":405,"name_tr":406,"name_en":406,"sort":407,"specializations":408},"ml-engineer","ML Engineer",12,[409],{"key":239,"name":240,"field":405},[14,15,16],{"junior":412,"mid":414,"senior":415},{"questions":413,"median_sec":3},20,{"questions":413,"median_sec":3},{"questions":413,"median_sec":3},[417,10],"tr",[419,420],"google","github",22200,true]