[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"me":3,"catalog:en:security\u002Fmid":4,"config":233},null,{"field_key":5,"field_name":6,"seniority":7,"topic_key":8,"topic_name":8,"spec_key":8,"spec_name":8,"locale":9,"cell_total":10,"field_total":11,"seniorities":12,"topics":15,"specs":131,"samples":148},"security","Security","mid","","en",2325,2850,[13,7,14],"junior","senior",[16,20,23,26,29,32,35,38,41,44,47,50,53,56,59,62,65,68,71,74,77,80,83,86,89,92,95,98,101,104,107,110,113,116,119,122,125,128],{"key":17,"name":18,"count":19},"as-access-control-idor","As Access Control Idor",75,{"key":21,"name":22,"count":19},"as-api-security","As Api Security",{"key":24,"name":25,"count":19},"as-authentication-session","As Authentication Session",{"key":27,"name":28,"count":19},"as-crypto-implementation-pitfalls","As Crypto Implementation Pitfalls",{"key":30,"name":31,"count":19},"as-injection-input-validation","As Injection Input Validation",{"key":33,"name":34,"count":19},"as-secure-sdlc-sast-dast","As Secure Sdlc Sast Dast",{"key":36,"name":37,"count":19},"bt-crisis-communication-management","Bt Crisis Communication Management",{"key":39,"name":40,"count":19},"bt-detection-engineering-tuning","Bt Detection Engineering Tuning",{"key":42,"name":43,"count":19},"bt-digital-forensics-fundamentals","Bt Digital Forensics Fundamentals",{"key":45,"name":46,"count":19},"bt-incident-triage-classification","Bt Incident Triage Classification",{"key":48,"name":49,"count":19},"bt-ir-playbook-execution","Bt Ir Playbook Execution",{"key":51,"name":52,"count":19},"bt-threat-intelligence-application","Bt Threat Intelligence Application",{"key":54,"name":55,"count":19},"cse-container-workload-security","Cse Container Workload Security",{"key":57,"name":58,"count":19},"cse-cspm-misconfiguration","Cse Cspm Misconfiguration",{"key":60,"name":61,"count":19},"cse-data-protection-governance","Cse Data Protection Governance",{"key":63,"name":64,"count":19},"cse-detection-incident-response","Cse Detection Incident Response",{"key":66,"name":67,"count":19},"cse-iam-privilege-escalation","Cse Iam Privilege Escalation",{"key":69,"name":70,"count":19},"cse-network-perimeter-zero-trust","Cse Network Perimeter Zero Trust",{"key":72,"name":73,"count":19},"ds-iac-policy-as-code","Ds Iac Policy As Code",{"key":75,"name":76,"count":19},"ds-pipeline-security-gates","Ds Pipeline Security Gates",{"key":78,"name":79,"count":19},"ds-secrets-pipeline-management","Ds Secrets Pipeline Management",{"key":81,"name":82,"count":19},"ds-security-metrics-blameless-culture","Ds Security Metrics Blameless Culture",{"key":84,"name":85,"count":19},"ds-shift-left-security-culture","Ds Shift Left Security Culture",{"key":87,"name":88,"count":19},"ds-software-supply-chain-pipeline","Ds Software Supply Chain Pipeline",{"key":90,"name":91,"count":19},"pt-legal-ethical-boundaries","Pt Legal Ethical Boundaries",{"key":93,"name":94,"count":19},"pt-methodology-phases","Pt Methodology Phases",{"key":96,"name":97,"count":19},"pt-red-team-engagement-management","Pt Red Team Engagement Management",{"key":99,"name":100,"count":19},"pt-reporting-remediation-prioritization","Pt Reporting Remediation Prioritization",{"key":102,"name":103,"count":19},"pt-scoping-rules-of-engagement","Pt Scoping Rules Of Engagement",{"key":105,"name":106,"count":19},"pt-vulnerability-assessment-vs-pentest","Pt Vulnerability Assessment Vs Pentest",{"key":108,"name":109,"count":19},"security-authn-authz","Security Authn Authz",{"key":111,"name":112,"count":19},"security-cloud-infra-security","Security Cloud Infra Security",{"key":114,"name":115,"count":19},"security-compliance-risk","Security Compliance Risk",{"key":117,"name":118,"count":19},"security-cryptography-basics","Security Cryptography Basics",{"key":120,"name":121,"count":19},"security-incident-response","Security Incident Response",{"key":123,"name":124,"count":19},"security-network-security","Security Network Security",{"key":126,"name":127,"count":19},"security-secure-sdlc","Security Secure Sdlc",{"key":129,"name":130,"count":19},"security-web-vulnerabilities","Security Web Vulnerabilities",[132,136,139,142,145],{"key":133,"name":134,"count":135},"appsec","AppSec",450,{"key":137,"name":138,"count":135},"blue-team-incident","Blue Team \u002F Incident",{"key":140,"name":141,"count":135},"cloud-security","Cloud Security",{"key":143,"name":144,"count":135},"devsecops","DevSecOps",{"key":146,"name":147,"count":135},"offensive-pentest","Offensive \u002F Pentest",[149,167,180,193,207,220],{"id":150,"topic":109,"difficulty":151,"body":152,"options":153,"correct_key":158,"explanation":166},"019f686c-592f-7ab1-a223-0e27f918b4e2",2,"A user successfully logs in with a valid password but then tries to open another user's private order history by changing an ID in the request. The request is blocked. Which security control caught this?",[154,157,160,163],{"key":155,"text":156},"a","Authentication, because the password was checked again on the second request",{"key":158,"text":159},"b","Authorization, because the system checked permissions for the requested resource",{"key":161,"text":162},"c","Encryption, because the ID in the request was unreadable",{"key":164,"text":165},"d","Rate limiting, because too many requests were sent in a short time","The user was already authenticated (login succeeded); the block happened when the system evaluated whether that authenticated identity was permitted to access the specific resource — that check is authorization, independent of how many requests were made.",{"id":168,"topic":109,"difficulty":151,"body":169,"options":170,"correct_key":161,"explanation":179},"019f686c-5930-78af-a6ba-47a59c8a1ed4","Why can a system technically authenticate a user correctly but still make a wrong security decision?",[171,173,175,177],{"key":155,"text":172},"Because authentication and authorization always fail together",{"key":158,"text":174},"Because correct authentication automatically grants full access to every resource",{"key":161,"text":176},"Because authorization can fail independently of correct authentication",{"key":164,"text":178},"Because passwords expire faster than authorization rules","Authentication and authorization are separately implemented checks. A perfectly correct login flow says nothing about whether the code that follows correctly restricts what the now-known identity can do — that is a separate, commonly buggy layer.",{"id":181,"topic":109,"difficulty":151,"body":182,"options":183,"correct_key":155,"explanation":192},"019f686c-5931-7eb2-a6d0-c8207bf65b9f","A backend team switches from session-based auth to self-contained tokens that carry identity claims and are verified without a server-side lookup. What is the main trade-off they accept?",[184,186,188,190],{"key":155,"text":185},"Easier horizontal scaling, but harder immediate revocation of an issued credential",{"key":158,"text":187},"Harder horizontal scaling, but instant revocation of any issued credential",{"key":161,"text":189},"No change in scaling or revocation, only a different wire format",{"key":164,"text":191},"Tokens eliminate the need for authentication entirely","Self-contained tokens avoid a server-side session store lookup, so any stateless server can validate them — good for scaling. The cost is that a token remains valid until it expires unless the system adds extra revocation machinery (denylist, short lifetimes, etc.), unlike a session that can be deleted server-side immediately.",{"id":194,"topic":109,"difficulty":195,"body":196,"options":197,"correct_key":164,"explanation":206},"019f686c-5932-7bdc-a789-df416c8ce241",3,"Which statement correctly compares session-based and token-based identity management?",[198,200,202,204],{"key":155,"text":199},"Session-based approaches are inherently insecure and token-based approaches are inherently secure",{"key":158,"text":201},"Token-based approaches never expire, session-based approaches always expire",{"key":161,"text":203},"Session-based approaches cannot work across multiple servers under any circumstance",{"key":164,"text":205},"Each has different trade-offs around scaling and revocation; neither is universally superior","Neither model is categorically 'more secure' — the choice is an engineering trade-off between server-side state (easy revocation, needs shared session storage to scale) and self-contained tokens (easy scaling, harder immediate revocation). Security depends on correct implementation in either case.",{"id":208,"topic":109,"difficulty":151,"body":209,"options":210,"correct_key":158,"explanation":219},"019f686c-5933-7cd6-9e86-9384fdeb4b77","An attacker steals a user's password through a phishing page and then also convinces the user, via a fake support call, to read out a one-time code from their MFA app. What does this scenario illustrate about MFA?",[211,213,215,217],{"key":155,"text":212},"MFA is useless because passwords can be phished",{"key":158,"text":214},"MFA reduces risk but is not immune to social engineering targeting the human factor",{"key":161,"text":216},"MFA only fails when the second factor is a hardware device",{"key":164,"text":218},"This scenario is impossible because MFA codes cannot be shared verbally","MFA meaningfully raises the bar against automated or password-only attacks, but it is not immune to social-engineering that targets the human handling the second factor (e.g. tricking someone into revealing a one-time code); it shifts the weak point rather than removing it entirely.",{"id":221,"topic":109,"difficulty":151,"body":222,"options":223,"correct_key":155,"explanation":232},"019f686c-5934-779c-ae64-cda158ff10b9","A login endpoint checks the password, and if correct, sets `mfa_verified = true` in the session immediately without asking for the second factor. What weakness does this introduce?",[224,226,228,230],{"key":155,"text":225},"The MFA step is effectively bypassed by trusting the flag before verification",{"key":158,"text":227},"None — setting the flag right after password check is the standard correct pattern",{"key":161,"text":229},"This only matters if the password is also weak",{"key":164,"text":231},"This is safe as long as the session cookie is marked secure","If the session is marked as MFA-verified before the second factor is actually confirmed, downstream code that trusts that flag treats the login as fully multi-factor when only the password check has happened — a logic bug that silently defeats the purpose of MFA.",{"fields":234,"seniorities":408,"interview_shapes":409,"locales":414,"oauth":416,"question_count":419,"coach_enabled":420,"jd_match_enabled":420},[235,261,281,297,321,334,353,372,382,389,395,402],{"key":236,"name_tr":237,"name_en":237,"sort":238,"specializations":239},"backend","Backend",1,[240,243,246,249,252,255,258],{"key":241,"name":242,"field":236},"general","Genel",{"key":244,"name":245,"field":236},"go","Go",{"key":247,"name":248,"field":236},"python","Python",{"key":250,"name":251,"field":236},"java","Java",{"key":253,"name":254,"field":236},"csharp","C#\u002F.NET",{"key":256,"name":257,"field":236},"nodejs","Node.js",{"key":259,"name":260,"field":236},"php","PHP",{"key":262,"name_tr":263,"name_en":263,"sort":151,"specializations":264},"frontend","Frontend",[265,266,269,272,275,278],{"key":241,"name":242,"field":262},{"key":267,"name":268,"field":262},"javascript","JavaScript",{"key":270,"name":271,"field":262},"typescript","TypeScript",{"key":273,"name":274,"field":262},"react","React",{"key":276,"name":277,"field":262},"vue","Vue",{"key":279,"name":280,"field":262},"angular","Angular",{"key":282,"name_tr":283,"name_en":283,"sort":195,"specializations":284},"fullstack","Fullstack",[285,286,287,288,289,290,291,292,293,294,295,296],{"key":241,"name":242,"field":282},{"key":244,"name":245,"field":236},{"key":247,"name":248,"field":236},{"key":250,"name":251,"field":236},{"key":253,"name":254,"field":236},{"key":256,"name":257,"field":236},{"key":259,"name":260,"field":236},{"key":267,"name":268,"field":262},{"key":270,"name":271,"field":262},{"key":273,"name":274,"field":262},{"key":276,"name":277,"field":262},{"key":279,"name":280,"field":262},{"key":298,"name_tr":299,"name_en":299,"sort":300,"specializations":301},"devops-cloud","DevOps \u002F Cloud",4,[302,303,306,309,312,315,318],{"key":241,"name":242,"field":298},{"key":304,"name":305,"field":298},"aws","AWS",{"key":307,"name":308,"field":298},"gcp","GCP",{"key":310,"name":311,"field":298},"azure","Azure",{"key":313,"name":314,"field":298},"kubernetes","Kubernetes",{"key":316,"name":317,"field":298},"terraform","Terraform",{"key":319,"name":320,"field":298},"linux","Linux",{"key":322,"name_tr":323,"name_en":323,"sort":324,"specializations":325},"ai-engineer","AI Engineer",5,[326,327,328,331],{"key":241,"name":242,"field":322},{"key":247,"name":248,"field":322},{"key":329,"name":330,"field":322},"llm-rag","LLM\u002FRAG",{"key":332,"name":333,"field":322},"mlops","MLOps",{"key":335,"name_tr":336,"name_en":337,"sort":338,"specializations":339},"database","Veritabanı","Database",6,[340,341,344,347,350],{"key":241,"name":242,"field":335},{"key":342,"name":343,"field":335},"postgresql","PostgreSQL",{"key":345,"name":346,"field":335},"mysql","MySQL",{"key":348,"name":349,"field":335},"mongodb","MongoDB",{"key":351,"name":352,"field":335},"redis","Redis",{"key":354,"name_tr":355,"name_en":356,"sort":357,"specializations":358},"mobile","Mobil","Mobile",7,[359,360,363,366,369],{"key":241,"name":242,"field":354},{"key":361,"name":362,"field":354},"ios-swift","iOS (Swift)",{"key":364,"name":365,"field":354},"android-kotlin","Android (Kotlin)",{"key":367,"name":368,"field":354},"flutter","Flutter",{"key":370,"name":371,"field":354},"react-native","React Native",{"key":5,"name_tr":373,"name_en":6,"sort":374,"specializations":375},"Güvenlik",8,[376,377,378,379,380,381],{"key":241,"name":242,"field":5},{"key":133,"name":134,"field":5},{"key":146,"name":147,"field":5},{"key":140,"name":141,"field":5},{"key":143,"name":144,"field":5},{"key":137,"name":138,"field":5},{"key":383,"name_tr":384,"name_en":385,"sort":386,"specializations":387},"qa-test-automation","QA \u002F Test Otomasyonu","QA \u002F Test Automation",9,[388],{"key":241,"name":242,"field":383},{"key":390,"name_tr":391,"name_en":391,"sort":392,"specializations":393},"data-engineer","Data Engineer",10,[394],{"key":241,"name":242,"field":390},{"key":396,"name_tr":397,"name_en":398,"sort":399,"specializations":400},"game-dev","Oyun Geliştirme","Game Development",11,[401],{"key":241,"name":242,"field":396},{"key":403,"name_tr":404,"name_en":404,"sort":405,"specializations":406},"ml-engineer","ML Engineer",12,[407],{"key":241,"name":242,"field":403},[13,7,14],{"junior":410,"mid":412,"senior":413},{"questions":411,"median_sec":3},20,{"questions":411,"median_sec":3},{"questions":411,"median_sec":3},[415,9],"tr",[417,418],"google","github",21750,true]