[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"me":3,"catalog:en:security\u002Fcse-cspm-misconfiguration":4,"config":232},null,{"field_key":5,"field_name":6,"seniority":7,"topic_key":8,"topic_name":9,"spec_key":7,"spec_name":7,"locale":10,"cell_total":11,"field_total":12,"seniorities":13,"topics":17,"specs":130,"samples":147},"security","Security","","cse-cspm-misconfiguration","Cse Cspm Misconfiguration","en",75,2850,[14,15,16],"junior","mid","senior",[18,21,24,27,30,33,36,39,42,45,48,51,54,57,58,61,64,67,70,73,76,79,82,85,88,91,94,97,100,103,106,109,112,115,118,121,124,127],{"key":19,"name":20,"count":11},"as-access-control-idor","As Access Control Idor",{"key":22,"name":23,"count":11},"as-api-security","As Api Security",{"key":25,"name":26,"count":11},"as-authentication-session","As Authentication Session",{"key":28,"name":29,"count":11},"as-crypto-implementation-pitfalls","As Crypto Implementation Pitfalls",{"key":31,"name":32,"count":11},"as-injection-input-validation","As Injection Input Validation",{"key":34,"name":35,"count":11},"as-secure-sdlc-sast-dast","As Secure Sdlc Sast Dast",{"key":37,"name":38,"count":11},"bt-crisis-communication-management","Bt Crisis Communication Management",{"key":40,"name":41,"count":11},"bt-detection-engineering-tuning","Bt Detection Engineering Tuning",{"key":43,"name":44,"count":11},"bt-digital-forensics-fundamentals","Bt Digital Forensics Fundamentals",{"key":46,"name":47,"count":11},"bt-incident-triage-classification","Bt Incident Triage Classification",{"key":49,"name":50,"count":11},"bt-ir-playbook-execution","Bt Ir Playbook Execution",{"key":52,"name":53,"count":11},"bt-threat-intelligence-application","Bt Threat Intelligence Application",{"key":55,"name":56,"count":11},"cse-container-workload-security","Cse Container Workload Security",{"key":8,"name":9,"count":11},{"key":59,"name":60,"count":11},"cse-data-protection-governance","Cse Data Protection Governance",{"key":62,"name":63,"count":11},"cse-detection-incident-response","Cse Detection Incident Response",{"key":65,"name":66,"count":11},"cse-iam-privilege-escalation","Cse Iam Privilege Escalation",{"key":68,"name":69,"count":11},"cse-network-perimeter-zero-trust","Cse Network Perimeter Zero Trust",{"key":71,"name":72,"count":11},"ds-iac-policy-as-code","Ds Iac Policy As Code",{"key":74,"name":75,"count":11},"ds-pipeline-security-gates","Ds Pipeline Security Gates",{"key":77,"name":78,"count":11},"ds-secrets-pipeline-management","Ds Secrets Pipeline Management",{"key":80,"name":81,"count":11},"ds-security-metrics-blameless-culture","Ds Security Metrics Blameless Culture",{"key":83,"name":84,"count":11},"ds-shift-left-security-culture","Ds Shift Left Security Culture",{"key":86,"name":87,"count":11},"ds-software-supply-chain-pipeline","Ds Software Supply Chain Pipeline",{"key":89,"name":90,"count":11},"pt-legal-ethical-boundaries","Pt Legal Ethical Boundaries",{"key":92,"name":93,"count":11},"pt-methodology-phases","Pt Methodology Phases",{"key":95,"name":96,"count":11},"pt-red-team-engagement-management","Pt Red Team Engagement Management",{"key":98,"name":99,"count":11},"pt-reporting-remediation-prioritization","Pt Reporting Remediation Prioritization",{"key":101,"name":102,"count":11},"pt-scoping-rules-of-engagement","Pt Scoping Rules Of Engagement",{"key":104,"name":105,"count":11},"pt-vulnerability-assessment-vs-pentest","Pt Vulnerability Assessment Vs Pentest",{"key":107,"name":108,"count":11},"security-authn-authz","Security Authn Authz",{"key":110,"name":111,"count":11},"security-cloud-infra-security","Security Cloud Infra Security",{"key":113,"name":114,"count":11},"security-compliance-risk","Security Compliance Risk",{"key":116,"name":117,"count":11},"security-cryptography-basics","Security Cryptography Basics",{"key":119,"name":120,"count":11},"security-incident-response","Security Incident Response",{"key":122,"name":123,"count":11},"security-network-security","Security Network Security",{"key":125,"name":126,"count":11},"security-secure-sdlc","Security Secure Sdlc",{"key":128,"name":129,"count":11},"security-web-vulnerabilities","Security Web Vulnerabilities",[131,135,138,141,144],{"key":132,"name":133,"count":134},"appsec","AppSec",450,{"key":136,"name":137,"count":134},"blue-team-incident","Blue Team \u002F Incident",{"key":139,"name":140,"count":134},"cloud-security","Cloud Security",{"key":142,"name":143,"count":134},"devsecops","DevSecOps",{"key":145,"name":146,"count":134},"offensive-pentest","Offensive \u002F Pentest",[148,166,180,193,206,219],{"id":149,"topic":9,"difficulty":150,"body":151,"options":152,"correct_key":157,"explanation":165},"019fab52-a9bd-72a6-9be1-d87c9452e0d7",1,"What is the primary purpose of a Cloud Security Posture Management (CSPM) tool?",[153,156,159,162],{"key":154,"text":155},"a","To scan application source code for injection vulnerabilities before deployment.",{"key":157,"text":158},"b","To continuously check cloud configurations for misconfigurations.",{"key":160,"text":161},"c","To replace the cloud provider's billing dashboard with a cost-optimization view.",{"key":163,"text":164},"d","To generate synthetic load for performance testing of cloud workloads.","CSPM tools continuously inventory cloud resources and compare their configuration against known-good baselines (CIS benchmarks, vendor best practices) to surface misconfigurations like open storage or overly permissive rules.",{"id":167,"topic":9,"difficulty":168,"body":169,"options":170,"correct_key":154,"explanation":179},"019fab52-a9bd-7e8c-9193-0288a33f0010",2,"A CSPM scan flags a storage bucket whose access control allows requests from \"Any authenticated user\" or the public internet, with no bucket policy restricting the source. Why is this a high-severity finding?",[171,173,175,177],{"key":154,"text":172},"Anyone who finds the bucket name may read or list its contents without authorization.",{"key":157,"text":174},"It means the bucket is using an outdated storage class that costs more per gigabyte.",{"key":160,"text":176},"It only affects billing because public buckets are charged at a higher egress rate.",{"key":163,"text":178},"It is purely a naming-convention issue that linting tools flag but that carries no access risk.","Public read\u002Flist access means the bucket's contents are reachable by anyone who finds the URL or name, with no identity check — this is exactly the open-storage misconfiguration class CSPM is built to catch.",{"id":181,"topic":9,"difficulty":168,"body":182,"options":183,"correct_key":163,"explanation":192},"019fab52-a9be-7a74-862c-ca355bfbd2d5","A CSPM report shows a database snapshot marked as \"public\" (shareable with any cloud account). What is the concrete risk of this configuration?",[184,186,188,190],{"key":154,"text":185},"Public snapshots automatically get deleted after 24 hours, causing data loss.",{"key":157,"text":187},"The snapshot's storage cost increases because public sharing forces cross-region replication.",{"key":160,"text":189},"Public snapshots cannot be restored at all, so the finding is only a cosmetic warning.",{"key":163,"text":191},"Any account on the provider could copy and restore the snapshot, obtaining the data.","Marking a snapshot public means any other account on the platform can discover and copy it, then restore a full database instance from it — effectively exfiltrating all the data it contains.",{"id":194,"topic":9,"difficulty":150,"body":195,"options":196,"correct_key":157,"explanation":205},"019fab52-a9bf-740f-a99b-c7187b242ac9","Why do CSPM tools frequently flag resources left in a cloud account's \"default VPC\"?",[197,199,201,203],{"key":154,"text":198},"Default VPCs are always billed at a premium rate compared to custom VPCs.",{"key":157,"text":200},"Default VPCs typically ship with broad default routing and permissive baseline rules, so resources placed there may get more network exposure than intended.",{"key":160,"text":202},"Default VPCs are automatically deleted every 90 days regardless of what is running in them.",{"key":163,"text":204},"Default VPCs cannot host any compute resources, so the finding just means the resource is idle.","Cloud providers create a default VPC with permissive defaults (public subnets, broad default security group) to make onboarding easy; production resources left there inherit that permissiveness unless someone deliberately locks it down.",{"id":207,"topic":9,"difficulty":168,"body":208,"options":209,"correct_key":154,"explanation":218},"019fab52-a9c0-7034-a01e-0bd5914265e3","A CSPM finding lists a security group with an inbound rule allowing TCP port 22 (SSH) from source 0.0.0.0\u002F0. What does this rule actually permit?",[210,212,214,216],{"key":154,"text":211},"Any internet host can attempt an SSH connection to that security group.",{"key":157,"text":213},"Only instances inside the same VPC can attempt to connect over SSH.",{"key":160,"text":215},"Only traffic originating from the cloud provider's own management plane can reach port 22.",{"key":163,"text":217},"The rule has no effect unless a matching outbound rule is also defined.","0.0.0.0\u002F0 is the entire IPv4 address space, so an inbound rule on port 22 from that source allows any internet host to attempt an SSH connection — the instance's actual exposure then depends solely on authentication, not network filtering.",{"id":220,"topic":9,"difficulty":150,"body":221,"options":222,"correct_key":163,"explanation":231},"019fab52-a9c0-7a35-8d8b-1a12df598795","In the context of CSPM, what does a \"CIS benchmark\" provide?",[223,225,227,229],{"key":154,"text":224},"A live dashboard of current cloud spend broken down by service.",{"key":157,"text":226},"A tool that automatically writes application code to fix bugs found during testing.",{"key":160,"text":228},"A guarantee from the cloud provider that no misconfiguration can ever occur.",{"key":163,"text":230},"A vendor-neutral set of hardening recommendations for a specific platform.","CIS (Center for Internet Security) benchmarks are consensus-based configuration guidelines for a given platform (e.g., a specific cloud provider); CSPM tools use them as one of the rule sets they check resources against.",{"fields":233,"seniorities":407,"interview_shapes":408,"locales":413,"oauth":415,"question_count":418,"coach_enabled":419,"jd_match_enabled":419},[234,259,279,296,320,333,352,371,381,388,394,401],{"key":235,"name_tr":236,"name_en":236,"sort":150,"specializations":237},"backend","Backend",[238,241,244,247,250,253,256],{"key":239,"name":240,"field":235},"general","Genel",{"key":242,"name":243,"field":235},"go","Go",{"key":245,"name":246,"field":235},"python","Python",{"key":248,"name":249,"field":235},"java","Java",{"key":251,"name":252,"field":235},"csharp","C#\u002F.NET",{"key":254,"name":255,"field":235},"nodejs","Node.js",{"key":257,"name":258,"field":235},"php","PHP",{"key":260,"name_tr":261,"name_en":261,"sort":168,"specializations":262},"frontend","Frontend",[263,264,267,270,273,276],{"key":239,"name":240,"field":260},{"key":265,"name":266,"field":260},"javascript","JavaScript",{"key":268,"name":269,"field":260},"typescript","TypeScript",{"key":271,"name":272,"field":260},"react","React",{"key":274,"name":275,"field":260},"vue","Vue",{"key":277,"name":278,"field":260},"angular","Angular",{"key":280,"name_tr":281,"name_en":281,"sort":282,"specializations":283},"fullstack","Fullstack",3,[284,285,286,287,288,289,290,291,292,293,294,295],{"key":239,"name":240,"field":280},{"key":242,"name":243,"field":235},{"key":245,"name":246,"field":235},{"key":248,"name":249,"field":235},{"key":251,"name":252,"field":235},{"key":254,"name":255,"field":235},{"key":257,"name":258,"field":235},{"key":265,"name":266,"field":260},{"key":268,"name":269,"field":260},{"key":271,"name":272,"field":260},{"key":274,"name":275,"field":260},{"key":277,"name":278,"field":260},{"key":297,"name_tr":298,"name_en":298,"sort":299,"specializations":300},"devops-cloud","DevOps \u002F Cloud",4,[301,302,305,308,311,314,317],{"key":239,"name":240,"field":297},{"key":303,"name":304,"field":297},"aws","AWS",{"key":306,"name":307,"field":297},"gcp","GCP",{"key":309,"name":310,"field":297},"azure","Azure",{"key":312,"name":313,"field":297},"kubernetes","Kubernetes",{"key":315,"name":316,"field":297},"terraform","Terraform",{"key":318,"name":319,"field":297},"linux","Linux",{"key":321,"name_tr":322,"name_en":322,"sort":323,"specializations":324},"ai-engineer","AI Engineer",5,[325,326,327,330],{"key":239,"name":240,"field":321},{"key":245,"name":246,"field":321},{"key":328,"name":329,"field":321},"llm-rag","LLM\u002FRAG",{"key":331,"name":332,"field":321},"mlops","MLOps",{"key":334,"name_tr":335,"name_en":336,"sort":337,"specializations":338},"database","Veritabanı","Database",6,[339,340,343,346,349],{"key":239,"name":240,"field":334},{"key":341,"name":342,"field":334},"postgresql","PostgreSQL",{"key":344,"name":345,"field":334},"mysql","MySQL",{"key":347,"name":348,"field":334},"mongodb","MongoDB",{"key":350,"name":351,"field":334},"redis","Redis",{"key":353,"name_tr":354,"name_en":355,"sort":356,"specializations":357},"mobile","Mobil","Mobile",7,[358,359,362,365,368],{"key":239,"name":240,"field":353},{"key":360,"name":361,"field":353},"ios-swift","iOS (Swift)",{"key":363,"name":364,"field":353},"android-kotlin","Android (Kotlin)",{"key":366,"name":367,"field":353},"flutter","Flutter",{"key":369,"name":370,"field":353},"react-native","React Native",{"key":5,"name_tr":372,"name_en":6,"sort":373,"specializations":374},"Güvenlik",8,[375,376,377,378,379,380],{"key":239,"name":240,"field":5},{"key":132,"name":133,"field":5},{"key":145,"name":146,"field":5},{"key":139,"name":140,"field":5},{"key":142,"name":143,"field":5},{"key":136,"name":137,"field":5},{"key":382,"name_tr":383,"name_en":384,"sort":385,"specializations":386},"qa-test-automation","QA \u002F Test Otomasyonu","QA \u002F Test Automation",9,[387],{"key":239,"name":240,"field":382},{"key":389,"name_tr":390,"name_en":390,"sort":391,"specializations":392},"data-engineer","Data Engineer",10,[393],{"key":239,"name":240,"field":389},{"key":395,"name_tr":396,"name_en":397,"sort":398,"specializations":399},"game-dev","Oyun Geliştirme","Game Development",11,[400],{"key":239,"name":240,"field":395},{"key":402,"name_tr":403,"name_en":403,"sort":404,"specializations":405},"ml-engineer","ML Engineer",12,[406],{"key":239,"name":240,"field":402},[14,15,16],{"junior":409,"mid":411,"senior":412},{"questions":410,"median_sec":3},20,{"questions":410,"median_sec":3},{"questions":410,"median_sec":3},[414,10],"tr",[416,417],"google","github",21750,true]