[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"me":3,"catalog:en:security\u002Fsecurity-authn-authz":4,"config":233},null,{"field_key":5,"field_name":6,"seniority":7,"topic_key":8,"topic_name":9,"spec_key":7,"spec_name":7,"locale":10,"cell_total":11,"field_total":12,"seniorities":13,"topics":17,"specs":130,"samples":147},"security","Security","","security-authn-authz","Security Authn Authz","en",75,2850,[14,15,16],"junior","mid","senior",[18,21,24,27,30,33,36,39,42,45,48,51,54,57,60,63,66,69,72,75,78,81,84,87,90,93,96,99,102,105,108,109,112,115,118,121,124,127],{"key":19,"name":20,"count":11},"as-access-control-idor","As Access Control Idor",{"key":22,"name":23,"count":11},"as-api-security","As Api Security",{"key":25,"name":26,"count":11},"as-authentication-session","As Authentication Session",{"key":28,"name":29,"count":11},"as-crypto-implementation-pitfalls","As Crypto Implementation Pitfalls",{"key":31,"name":32,"count":11},"as-injection-input-validation","As Injection Input Validation",{"key":34,"name":35,"count":11},"as-secure-sdlc-sast-dast","As Secure Sdlc Sast Dast",{"key":37,"name":38,"count":11},"bt-crisis-communication-management","Bt Crisis Communication Management",{"key":40,"name":41,"count":11},"bt-detection-engineering-tuning","Bt Detection Engineering Tuning",{"key":43,"name":44,"count":11},"bt-digital-forensics-fundamentals","Bt Digital Forensics Fundamentals",{"key":46,"name":47,"count":11},"bt-incident-triage-classification","Bt Incident Triage Classification",{"key":49,"name":50,"count":11},"bt-ir-playbook-execution","Bt Ir Playbook Execution",{"key":52,"name":53,"count":11},"bt-threat-intelligence-application","Bt Threat Intelligence Application",{"key":55,"name":56,"count":11},"cse-container-workload-security","Cse Container Workload Security",{"key":58,"name":59,"count":11},"cse-cspm-misconfiguration","Cse Cspm Misconfiguration",{"key":61,"name":62,"count":11},"cse-data-protection-governance","Cse Data Protection Governance",{"key":64,"name":65,"count":11},"cse-detection-incident-response","Cse Detection Incident Response",{"key":67,"name":68,"count":11},"cse-iam-privilege-escalation","Cse Iam Privilege Escalation",{"key":70,"name":71,"count":11},"cse-network-perimeter-zero-trust","Cse Network Perimeter Zero Trust",{"key":73,"name":74,"count":11},"ds-iac-policy-as-code","Ds Iac Policy As Code",{"key":76,"name":77,"count":11},"ds-pipeline-security-gates","Ds Pipeline Security Gates",{"key":79,"name":80,"count":11},"ds-secrets-pipeline-management","Ds Secrets Pipeline Management",{"key":82,"name":83,"count":11},"ds-security-metrics-blameless-culture","Ds Security Metrics Blameless Culture",{"key":85,"name":86,"count":11},"ds-shift-left-security-culture","Ds Shift Left Security Culture",{"key":88,"name":89,"count":11},"ds-software-supply-chain-pipeline","Ds Software Supply Chain Pipeline",{"key":91,"name":92,"count":11},"pt-legal-ethical-boundaries","Pt Legal Ethical Boundaries",{"key":94,"name":95,"count":11},"pt-methodology-phases","Pt Methodology Phases",{"key":97,"name":98,"count":11},"pt-red-team-engagement-management","Pt Red Team Engagement Management",{"key":100,"name":101,"count":11},"pt-reporting-remediation-prioritization","Pt Reporting Remediation Prioritization",{"key":103,"name":104,"count":11},"pt-scoping-rules-of-engagement","Pt Scoping Rules Of Engagement",{"key":106,"name":107,"count":11},"pt-vulnerability-assessment-vs-pentest","Pt Vulnerability Assessment Vs Pentest",{"key":8,"name":9,"count":11},{"key":110,"name":111,"count":11},"security-cloud-infra-security","Security Cloud Infra Security",{"key":113,"name":114,"count":11},"security-compliance-risk","Security Compliance Risk",{"key":116,"name":117,"count":11},"security-cryptography-basics","Security Cryptography Basics",{"key":119,"name":120,"count":11},"security-incident-response","Security Incident Response",{"key":122,"name":123,"count":11},"security-network-security","Security Network Security",{"key":125,"name":126,"count":11},"security-secure-sdlc","Security Secure Sdlc",{"key":128,"name":129,"count":11},"security-web-vulnerabilities","Security Web Vulnerabilities",[131,135,138,141,144],{"key":132,"name":133,"count":134},"appsec","AppSec",450,{"key":136,"name":137,"count":134},"blue-team-incident","Blue Team \u002F Incident",{"key":139,"name":140,"count":134},"cloud-security","Cloud Security",{"key":142,"name":143,"count":134},"devsecops","DevSecOps",{"key":145,"name":146,"count":134},"offensive-pentest","Offensive \u002F Pentest",[148,166,180,193,206,219],{"id":149,"topic":9,"difficulty":150,"body":151,"options":152,"correct_key":154,"explanation":165},"019f686c-5929-7eff-9980-4d2853d43f28",1,"What is the core conceptual difference between authentication and authorization?",[153,156,159,162],{"key":154,"text":155},"a","Authentication verifies who you are; authorization decides what you are allowed to do",{"key":157,"text":158},"b","Authentication decides what you are allowed to do; authorization verifies who you are",{"key":160,"text":161},"c","They are two names for the same identity-verification step",{"key":163,"text":164},"d","Authentication applies only to humans, authorization only to machine accounts","Authentication (proving identity, e.g. via credentials) and authorization (checking permissions against that established identity) are distinct steps that always happen in that order — a system must know who the caller is before it can decide what they may do.",{"id":167,"topic":9,"difficulty":168,"body":169,"options":170,"correct_key":157,"explanation":179},"019f686c-592f-7ab1-a223-0e27f918b4e2",2,"A user successfully logs in with a valid password but then tries to open another user's private order history by changing an ID in the request. The request is blocked. Which security control caught this?",[171,173,175,177],{"key":154,"text":172},"Authentication, because the password was checked again on the second request",{"key":157,"text":174},"Authorization, because the system checked permissions for the requested resource",{"key":160,"text":176},"Encryption, because the ID in the request was unreadable",{"key":163,"text":178},"Rate limiting, because too many requests were sent in a short time","The user was already authenticated (login succeeded); the block happened when the system evaluated whether that authenticated identity was permitted to access the specific resource — that check is authorization, independent of how many requests were made.",{"id":181,"topic":9,"difficulty":168,"body":182,"options":183,"correct_key":160,"explanation":192},"019f686c-5930-78af-a6ba-47a59c8a1ed4","Why can a system technically authenticate a user correctly but still make a wrong security decision?",[184,186,188,190],{"key":154,"text":185},"Because authentication and authorization always fail together",{"key":157,"text":187},"Because correct authentication automatically grants full access to every resource",{"key":160,"text":189},"Because authorization can fail independently of correct authentication",{"key":163,"text":191},"Because passwords expire faster than authorization rules","Authentication and authorization are separately implemented checks. A perfectly correct login flow says nothing about whether the code that follows correctly restricts what the now-known identity can do — that is a separate, commonly buggy layer.",{"id":194,"topic":9,"difficulty":150,"body":195,"options":196,"correct_key":157,"explanation":205},"019f686c-5931-7450-aa1a-b0c651680c1c","In session-based authentication, where does the server typically keep the authoritative record of who is logged in?",[197,199,201,203],{"key":154,"text":198},"Only inside the browser's local storage, never on the server",{"key":157,"text":200},"In server-side session state, referenced by an identifier the client holds",{"key":160,"text":202},"Inside the user's password, re-sent with every request",{"key":163,"text":204},"Nowhere — session-based authentication has no server-side state by definition","Session-based authentication keeps the authoritative login state on the server (in memory, a database, or a shared store); the client only holds an opaque session identifier used to look that state up on each request.",{"id":207,"topic":9,"difficulty":168,"body":208,"options":209,"correct_key":154,"explanation":218},"019f686c-5931-7eb2-a6d0-c8207bf65b9f","A backend team switches from session-based auth to self-contained tokens that carry identity claims and are verified without a server-side lookup. What is the main trade-off they accept?",[210,212,214,216],{"key":154,"text":211},"Easier horizontal scaling, but harder immediate revocation of an issued credential",{"key":157,"text":213},"Harder horizontal scaling, but instant revocation of any issued credential",{"key":160,"text":215},"No change in scaling or revocation, only a different wire format",{"key":163,"text":217},"Tokens eliminate the need for authentication entirely","Self-contained tokens avoid a server-side session store lookup, so any stateless server can validate them — good for scaling. The cost is that a token remains valid until it expires unless the system adds extra revocation machinery (denylist, short lifetimes, etc.), unlike a session that can be deleted server-side immediately.",{"id":220,"topic":9,"difficulty":221,"body":222,"options":223,"correct_key":163,"explanation":232},"019f686c-5932-7bdc-a789-df416c8ce241",3,"Which statement correctly compares session-based and token-based identity management?",[224,226,228,230],{"key":154,"text":225},"Session-based approaches are inherently insecure and token-based approaches are inherently secure",{"key":157,"text":227},"Token-based approaches never expire, session-based approaches always expire",{"key":160,"text":229},"Session-based approaches cannot work across multiple servers under any circumstance",{"key":163,"text":231},"Each has different trade-offs around scaling and revocation; neither is universally superior","Neither model is categorically 'more secure' — the choice is an engineering trade-off between server-side state (easy revocation, needs shared session storage to scale) and self-contained tokens (easy scaling, harder immediate revocation). Security depends on correct implementation in either case.",{"fields":234,"seniorities":407,"interview_shapes":408,"locales":413,"oauth":415,"question_count":418,"coach_enabled":419,"jd_match_enabled":419},[235,260,280,296,320,333,352,371,381,388,394,401],{"key":236,"name_tr":237,"name_en":237,"sort":150,"specializations":238},"backend","Backend",[239,242,245,248,251,254,257],{"key":240,"name":241,"field":236},"general","Genel",{"key":243,"name":244,"field":236},"go","Go",{"key":246,"name":247,"field":236},"python","Python",{"key":249,"name":250,"field":236},"java","Java",{"key":252,"name":253,"field":236},"csharp","C#\u002F.NET",{"key":255,"name":256,"field":236},"nodejs","Node.js",{"key":258,"name":259,"field":236},"php","PHP",{"key":261,"name_tr":262,"name_en":262,"sort":168,"specializations":263},"frontend","Frontend",[264,265,268,271,274,277],{"key":240,"name":241,"field":261},{"key":266,"name":267,"field":261},"javascript","JavaScript",{"key":269,"name":270,"field":261},"typescript","TypeScript",{"key":272,"name":273,"field":261},"react","React",{"key":275,"name":276,"field":261},"vue","Vue",{"key":278,"name":279,"field":261},"angular","Angular",{"key":281,"name_tr":282,"name_en":282,"sort":221,"specializations":283},"fullstack","Fullstack",[284,285,286,287,288,289,290,291,292,293,294,295],{"key":240,"name":241,"field":281},{"key":243,"name":244,"field":236},{"key":246,"name":247,"field":236},{"key":249,"name":250,"field":236},{"key":252,"name":253,"field":236},{"key":255,"name":256,"field":236},{"key":258,"name":259,"field":236},{"key":266,"name":267,"field":261},{"key":269,"name":270,"field":261},{"key":272,"name":273,"field":261},{"key":275,"name":276,"field":261},{"key":278,"name":279,"field":261},{"key":297,"name_tr":298,"name_en":298,"sort":299,"specializations":300},"devops-cloud","DevOps \u002F Cloud",4,[301,302,305,308,311,314,317],{"key":240,"name":241,"field":297},{"key":303,"name":304,"field":297},"aws","AWS",{"key":306,"name":307,"field":297},"gcp","GCP",{"key":309,"name":310,"field":297},"azure","Azure",{"key":312,"name":313,"field":297},"kubernetes","Kubernetes",{"key":315,"name":316,"field":297},"terraform","Terraform",{"key":318,"name":319,"field":297},"linux","Linux",{"key":321,"name_tr":322,"name_en":322,"sort":323,"specializations":324},"ai-engineer","AI Engineer",5,[325,326,327,330],{"key":240,"name":241,"field":321},{"key":246,"name":247,"field":321},{"key":328,"name":329,"field":321},"llm-rag","LLM\u002FRAG",{"key":331,"name":332,"field":321},"mlops","MLOps",{"key":334,"name_tr":335,"name_en":336,"sort":337,"specializations":338},"database","Veritabanı","Database",6,[339,340,343,346,349],{"key":240,"name":241,"field":334},{"key":341,"name":342,"field":334},"postgresql","PostgreSQL",{"key":344,"name":345,"field":334},"mysql","MySQL",{"key":347,"name":348,"field":334},"mongodb","MongoDB",{"key":350,"name":351,"field":334},"redis","Redis",{"key":353,"name_tr":354,"name_en":355,"sort":356,"specializations":357},"mobile","Mobil","Mobile",7,[358,359,362,365,368],{"key":240,"name":241,"field":353},{"key":360,"name":361,"field":353},"ios-swift","iOS (Swift)",{"key":363,"name":364,"field":353},"android-kotlin","Android (Kotlin)",{"key":366,"name":367,"field":353},"flutter","Flutter",{"key":369,"name":370,"field":353},"react-native","React Native",{"key":5,"name_tr":372,"name_en":6,"sort":373,"specializations":374},"Güvenlik",8,[375,376,377,378,379,380],{"key":240,"name":241,"field":5},{"key":132,"name":133,"field":5},{"key":145,"name":146,"field":5},{"key":139,"name":140,"field":5},{"key":142,"name":143,"field":5},{"key":136,"name":137,"field":5},{"key":382,"name_tr":383,"name_en":384,"sort":385,"specializations":386},"qa-test-automation","QA \u002F Test Otomasyonu","QA \u002F Test Automation",9,[387],{"key":240,"name":241,"field":382},{"key":389,"name_tr":390,"name_en":390,"sort":391,"specializations":392},"data-engineer","Data Engineer",10,[393],{"key":240,"name":241,"field":389},{"key":395,"name_tr":396,"name_en":397,"sort":398,"specializations":399},"game-dev","Oyun Geliştirme","Game Development",11,[400],{"key":240,"name":241,"field":395},{"key":402,"name_tr":403,"name_en":403,"sort":404,"specializations":405},"ml-engineer","ML Engineer",12,[406],{"key":240,"name":241,"field":402},[14,15,16],{"junior":409,"mid":411,"senior":412},{"questions":410,"median_sec":3},20,{"questions":410,"median_sec":3},{"questions":410,"median_sec":3},[414,10],"tr",[416,417],"google","github",21750,true]