Q1. What is the difference between an S3 bucket policy and an IAM policy?
Both are JSON documents that grant permissions, but they attach to different things. - IAM policies are attached to identities (users, groups, roles) and define what thos...
Technical Question Bank · Peer-Reviewed
Job Interview Questions and Answers Directory
Search and filter frequently asked interview questions across technical, programming, and behavioral domains. Tailor your interview preparation by difficulty for freshers or experienced developers (19 available).
Active:
Tag: security ×
Q2. Explain Linux file permissions and chmod.
Linux permissions have three classes (user, group, other) and three bits each: read (4), write (2), and execute (1). - ls -l shows them as rwxr-xr--. The leading characte...
Q3. Explain IAM roles and service accounts in GCP.
GCP IAM binds principals to roles on resources. A service account is a special identity for workloads rather than humans. - Principals: users, groups, service accounts, d...
Q4. Explain Microsoft Entra ID and how it differs from on-premises Active Directory.
Microsoft Entra ID, formerly Azure AD, is a cloud identity provider using modern protocols such as OAuth 2.0, OpenID Connect, and SAML. On-premises Active Directory Domai...
Q5. What is the difference between a security group and a network ACL?
Both control traffic in a VPC, but at different layers. - Security groups are stateful and attached to ENIs or instances. Return traffic is automatically allowed. Rules a...
Q6. How do you prevent SQL injection in PHP?
Never concatenate user input into SQL. Use prepared statements with bound parameters, which separate code from data. ```php $stmt = $pdo->prepare('SELECT * FROM users WHE...
Q7. Explain PHP session handling and common security concerns.
Sessions persist state across stateless HTTP requests. session_start() creates or resumes a session identified by a cookie (PHPSESSID) and stores data server-side. Securi...
Q8. How does IAM role assumption work?
A role is an identity with permission policies but no permanent credentials. A trusted principal calls AWS STS AssumeRole and receives temporary credentials. Flow: 1. The...
Q9. How do you secure a Kubernetes or cloud deployment?
Defence in depth: - Identity: least-privilege IAM roles, workload identity, no long-lived static keys, and RBAC scoped per namespace. - Network: private subnets, security...
Q10. How do you secure a CI/CD pipeline?
Treat the pipeline as production infrastructure with its own threat model. - Secrets: never hardcode them. Use a secrets manager or OIDC federation so the pipeline gets s...