[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"me":3,"catalog:en:security\u002Fsenior":4,"config":232},null,{"field_key":5,"field_name":6,"seniority":7,"topic_key":8,"topic_name":8,"spec_key":8,"spec_name":8,"locale":9,"cell_total":10,"field_total":11,"seniorities":12,"topics":15,"specs":131,"samples":148},"security","Security","senior","","en",1831,2850,[13,14,7],"junior","mid",[16,20,23,26,29,32,35,38,41,44,47,50,53,56,59,62,65,68,71,74,77,80,83,86,89,92,95,98,101,104,107,110,113,116,119,122,125,128],{"key":17,"name":18,"count":19},"as-access-control-idor","As Access Control Idor",75,{"key":21,"name":22,"count":19},"as-api-security","As Api Security",{"key":24,"name":25,"count":19},"as-authentication-session","As Authentication Session",{"key":27,"name":28,"count":19},"as-crypto-implementation-pitfalls","As Crypto Implementation Pitfalls",{"key":30,"name":31,"count":19},"as-injection-input-validation","As Injection Input Validation",{"key":33,"name":34,"count":19},"as-secure-sdlc-sast-dast","As Secure Sdlc Sast Dast",{"key":36,"name":37,"count":19},"bt-crisis-communication-management","Bt Crisis Communication Management",{"key":39,"name":40,"count":19},"bt-detection-engineering-tuning","Bt Detection Engineering Tuning",{"key":42,"name":43,"count":19},"bt-digital-forensics-fundamentals","Bt Digital Forensics Fundamentals",{"key":45,"name":46,"count":19},"bt-incident-triage-classification","Bt Incident Triage Classification",{"key":48,"name":49,"count":19},"bt-ir-playbook-execution","Bt Ir Playbook Execution",{"key":51,"name":52,"count":19},"bt-threat-intelligence-application","Bt Threat Intelligence Application",{"key":54,"name":55,"count":19},"cse-container-workload-security","Cse Container Workload Security",{"key":57,"name":58,"count":19},"cse-cspm-misconfiguration","Cse Cspm Misconfiguration",{"key":60,"name":61,"count":19},"cse-data-protection-governance","Cse Data Protection Governance",{"key":63,"name":64,"count":19},"cse-detection-incident-response","Cse Detection Incident Response",{"key":66,"name":67,"count":19},"cse-iam-privilege-escalation","Cse Iam Privilege Escalation",{"key":69,"name":70,"count":19},"cse-network-perimeter-zero-trust","Cse Network Perimeter Zero Trust",{"key":72,"name":73,"count":19},"ds-iac-policy-as-code","Ds Iac Policy As Code",{"key":75,"name":76,"count":19},"ds-pipeline-security-gates","Ds Pipeline Security Gates",{"key":78,"name":79,"count":19},"ds-secrets-pipeline-management","Ds Secrets Pipeline Management",{"key":81,"name":82,"count":19},"ds-security-metrics-blameless-culture","Ds Security Metrics Blameless Culture",{"key":84,"name":85,"count":19},"ds-shift-left-security-culture","Ds Shift Left Security Culture",{"key":87,"name":88,"count":19},"ds-software-supply-chain-pipeline","Ds Software Supply Chain Pipeline",{"key":90,"name":91,"count":19},"pt-legal-ethical-boundaries","Pt Legal Ethical Boundaries",{"key":93,"name":94,"count":19},"pt-methodology-phases","Pt Methodology Phases",{"key":96,"name":97,"count":19},"pt-red-team-engagement-management","Pt Red Team Engagement Management",{"key":99,"name":100,"count":19},"pt-reporting-remediation-prioritization","Pt Reporting Remediation Prioritization",{"key":102,"name":103,"count":19},"pt-scoping-rules-of-engagement","Pt Scoping Rules Of Engagement",{"key":105,"name":106,"count":19},"pt-vulnerability-assessment-vs-pentest","Pt Vulnerability Assessment Vs Pentest",{"key":108,"name":109,"count":19},"security-authn-authz","Security Authn Authz",{"key":111,"name":112,"count":19},"security-cloud-infra-security","Security Cloud Infra Security",{"key":114,"name":115,"count":19},"security-compliance-risk","Security Compliance Risk",{"key":117,"name":118,"count":19},"security-cryptography-basics","Security Cryptography Basics",{"key":120,"name":121,"count":19},"security-incident-response","Security Incident Response",{"key":123,"name":124,"count":19},"security-network-security","Security Network Security",{"key":126,"name":127,"count":19},"security-secure-sdlc","Security Secure Sdlc",{"key":129,"name":130,"count":19},"security-web-vulnerabilities","Security Web Vulnerabilities",[132,136,139,142,145],{"key":133,"name":134,"count":135},"appsec","AppSec",450,{"key":137,"name":138,"count":135},"blue-team-incident","Blue Team \u002F Incident",{"key":140,"name":141,"count":135},"cloud-security","Cloud Security",{"key":143,"name":144,"count":135},"devsecops","DevSecOps",{"key":146,"name":147,"count":135},"offensive-pentest","Offensive \u002F Pentest",[149,167,180,193,206,219],{"id":150,"topic":109,"difficulty":151,"body":152,"options":153,"correct_key":164,"explanation":166},"019f686c-5932-7bdc-a789-df416c8ce241",3,"Which statement correctly compares session-based and token-based identity management?",[154,157,160,163],{"key":155,"text":156},"a","Session-based approaches are inherently insecure and token-based approaches are inherently secure",{"key":158,"text":159},"b","Token-based approaches never expire, session-based approaches always expire",{"key":161,"text":162},"c","Session-based approaches cannot work across multiple servers under any circumstance",{"key":164,"text":165},"d","Each has different trade-offs around scaling and revocation; neither is universally superior","Neither model is categorically 'more secure' — the choice is an engineering trade-off between server-side state (easy revocation, needs shared session storage to scale) and self-contained tokens (easy scaling, harder immediate revocation). Security depends on correct implementation in either case.",{"id":168,"topic":109,"difficulty":151,"body":169,"options":170,"correct_key":158,"explanation":179},"019f686c-5936-7508-98d5-41bf56120954","A developer computes `stored_value = fast_generic_hash(password)` with no salt, reasoning 'it's hashed, so it's safe.' What is the strongest objection?",[171,173,175,177],{"key":155,"text":172},"Hashing is never appropriate for passwords under any configuration",{"key":158,"text":174},"Without salt, identical passwords hash identically and crack fast",{"key":161,"text":176},"The objection is invalid — any hash function makes passwords fully safe",{"key":164,"text":178},"The only fix needed is to hash the value twice with the same function","Password hashing needs both a unique salt (to defeat precomputed\u002Frainbow tables and cross-user comparison) and a deliberately slow, memory-hard algorithm (to make brute-forcing expensive) — a fast generic hash with no salt provides little real protection.",{"id":181,"topic":109,"difficulty":151,"body":182,"options":183,"correct_key":164,"explanation":192},"019f686c-5939-7602-9b7e-a3ea5024fc54","A token has a fixed 30-day expiration and the system has no way to invalidate a token before that. A support agent's laptop with an active token is stolen on day 2. What is the practical consequence?",[184,186,188,190],{"key":155,"text":185},"None, because tokens automatically detect the change of device",{"key":158,"text":187},"The token becomes invalid the moment it is used from a new IP address",{"key":161,"text":189},"The system will silently re-authenticate the thief with MFA",{"key":164,"text":191},"The stolen token remains usable for up to 28 more days unless another control exists","Without a revocation mechanism, a stateless token's only invalidation path is its expiration timestamp — if that is 30 days out and nothing else checks a denylist or forces re-authentication, a stolen token stays valid for the remainder of its lifetime, which is exactly why long-lived unrevocable tokens are risky.",{"id":194,"topic":109,"difficulty":151,"body":195,"options":196,"correct_key":161,"explanation":205},"019f686c-593a-7ee1-8f75-722f48e68214","A low-privilege service account is found to have write access to a configuration file that a high-privilege process reads and executes logic from. Why is this a privilege escalation risk even without any password being stolen?",[197,199,201,203],{"key":155,"text":198},"It is not a risk, since no credentials were involved",{"key":158,"text":200},"It only matters if the file is stored unencrypted on disk",{"key":161,"text":202},"It can influence high-privilege process behavior",{"key":164,"text":204},"Configuration files are never a security concern","Escalation does not require stealing credentials directly; if a lower-privileged identity can influence data or configuration that a higher-privileged process trusts and acts on, that write access becomes an indirect path to higher-privilege behavior — a common real-world escalation pattern.",{"id":207,"topic":109,"difficulty":151,"body":208,"options":209,"correct_key":158,"explanation":218},"019f686c-593c-7dd1-9057-ca68fe62ceb4","An application integrates SSO but keeps its own separate `is_admin` flag in its local database, set manually and never synced with the identity provider's group membership. What risk does this create?",[210,212,214,216],{"key":155,"text":211},"None — local flags are always safer than identity-provider-managed groups",{"key":158,"text":213},"The local flag can drift out of sync with the real identity elsewhere",{"key":161,"text":215},"This guarantees the application is immune to SSO-related compromises",{"key":164,"text":217},"SSO cannot be combined with local authorization data under any design","When an application layers its own authorization state on top of SSO-provided identity without keeping it synchronized, the two can diverge: someone deprovisioned or demoted at the identity-provider level may still hold stale elevated rights locally, undermining the trust boundary SSO was meant to centralize.",{"id":220,"topic":112,"difficulty":151,"body":221,"options":222,"correct_key":155,"explanation":231},"019f686c-5948-740d-81d2-9f86ea4d8f7c","An infrastructure template defines a rule allowing inbound access from `0.0.0.0\u002F0` on the management port used for administration. What does a security scan most likely flag here?",[223,225,227,229],{"key":155,"text":224},"The management port is reachable from any address on the internet.",{"key":158,"text":226},"The rule syntax is invalid and the template will fail to deploy.",{"key":161,"text":228},"The rule only affects internal network traffic and poses no external risk.",{"key":164,"text":230},"The rule is flagged only because of formatting, not because of the access it grants.","Leaving a management port fully open to the internet lets attackers reach it directly to brute-force authentication or try known weaknesses; access should be restricted to only the resources that actually need it.",{"fields":233,"seniorities":408,"interview_shapes":409,"locales":414,"oauth":416,"question_count":419,"coach_enabled":420,"jd_match_enabled":420},[234,260,281,297,321,334,353,372,382,389,395,402],{"key":235,"name_tr":236,"name_en":236,"sort":237,"specializations":238},"backend","Backend",1,[239,242,245,248,251,254,257],{"key":240,"name":241,"field":235},"general","Genel",{"key":243,"name":244,"field":235},"go","Go",{"key":246,"name":247,"field":235},"python","Python",{"key":249,"name":250,"field":235},"java","Java",{"key":252,"name":253,"field":235},"csharp","C#\u002F.NET",{"key":255,"name":256,"field":235},"nodejs","Node.js",{"key":258,"name":259,"field":235},"php","PHP",{"key":261,"name_tr":262,"name_en":262,"sort":263,"specializations":264},"frontend","Frontend",2,[265,266,269,272,275,278],{"key":240,"name":241,"field":261},{"key":267,"name":268,"field":261},"javascript","JavaScript",{"key":270,"name":271,"field":261},"typescript","TypeScript",{"key":273,"name":274,"field":261},"react","React",{"key":276,"name":277,"field":261},"vue","Vue",{"key":279,"name":280,"field":261},"angular","Angular",{"key":282,"name_tr":283,"name_en":283,"sort":151,"specializations":284},"fullstack","Fullstack",[285,286,287,288,289,290,291,292,293,294,295,296],{"key":240,"name":241,"field":282},{"key":243,"name":244,"field":235},{"key":246,"name":247,"field":235},{"key":249,"name":250,"field":235},{"key":252,"name":253,"field":235},{"key":255,"name":256,"field":235},{"key":258,"name":259,"field":235},{"key":267,"name":268,"field":261},{"key":270,"name":271,"field":261},{"key":273,"name":274,"field":261},{"key":276,"name":277,"field":261},{"key":279,"name":280,"field":261},{"key":298,"name_tr":299,"name_en":299,"sort":300,"specializations":301},"devops-cloud","DevOps \u002F Cloud",4,[302,303,306,309,312,315,318],{"key":240,"name":241,"field":298},{"key":304,"name":305,"field":298},"aws","AWS",{"key":307,"name":308,"field":298},"gcp","GCP",{"key":310,"name":311,"field":298},"azure","Azure",{"key":313,"name":314,"field":298},"kubernetes","Kubernetes",{"key":316,"name":317,"field":298},"terraform","Terraform",{"key":319,"name":320,"field":298},"linux","Linux",{"key":322,"name_tr":323,"name_en":323,"sort":324,"specializations":325},"ai-engineer","AI Engineer",5,[326,327,328,331],{"key":240,"name":241,"field":322},{"key":246,"name":247,"field":322},{"key":329,"name":330,"field":322},"llm-rag","LLM\u002FRAG",{"key":332,"name":333,"field":322},"mlops","MLOps",{"key":335,"name_tr":336,"name_en":337,"sort":338,"specializations":339},"database","Veritabanı","Database",6,[340,341,344,347,350],{"key":240,"name":241,"field":335},{"key":342,"name":343,"field":335},"postgresql","PostgreSQL",{"key":345,"name":346,"field":335},"mysql","MySQL",{"key":348,"name":349,"field":335},"mongodb","MongoDB",{"key":351,"name":352,"field":335},"redis","Redis",{"key":354,"name_tr":355,"name_en":356,"sort":357,"specializations":358},"mobile","Mobil","Mobile",7,[359,360,363,366,369],{"key":240,"name":241,"field":354},{"key":361,"name":362,"field":354},"ios-swift","iOS (Swift)",{"key":364,"name":365,"field":354},"android-kotlin","Android (Kotlin)",{"key":367,"name":368,"field":354},"flutter","Flutter",{"key":370,"name":371,"field":354},"react-native","React Native",{"key":5,"name_tr":373,"name_en":6,"sort":374,"specializations":375},"Güvenlik",8,[376,377,378,379,380,381],{"key":240,"name":241,"field":5},{"key":133,"name":134,"field":5},{"key":146,"name":147,"field":5},{"key":140,"name":141,"field":5},{"key":143,"name":144,"field":5},{"key":137,"name":138,"field":5},{"key":383,"name_tr":384,"name_en":385,"sort":386,"specializations":387},"qa-test-automation","QA \u002F Test Otomasyonu","QA \u002F Test Automation",9,[388],{"key":240,"name":241,"field":383},{"key":390,"name_tr":391,"name_en":391,"sort":392,"specializations":393},"data-engineer","Data Engineer",10,[394],{"key":240,"name":241,"field":390},{"key":396,"name_tr":397,"name_en":398,"sort":399,"specializations":400},"game-dev","Oyun Geliştirme","Game Development",11,[401],{"key":240,"name":241,"field":396},{"key":403,"name_tr":404,"name_en":404,"sort":405,"specializations":406},"ml-engineer","ML Engineer",12,[407],{"key":240,"name":241,"field":403},[13,14,7],{"junior":410,"mid":412,"senior":413},{"questions":411,"median_sec":3},20,{"questions":411,"median_sec":3},{"questions":411,"median_sec":3},[415,9],"tr",[417,418],"google","github",21750,true]