Pick a focused question that fits your time, stack, and interview goal.
How much time do you have?
Show one-drill sessions you can finish now.
121 results across 1 active filter
Page 3 of 6
Designs an invitation workflow with token security, expiry, membership creation, email delivery, and replay-safe onboarding.
Maps an HTTP ETag precondition to EF Core rowversion and returns 412 when the representation is stale.
Explains what CORS controls, what it does not protect, and why APIs still need authentication and authorization.
Explains why cached authorization decisions are risky and how to bound or invalidate permission-related cache safely.
Separates caller cancellation from a dependency timeout and maps expected downstream outcomes safely.
Explains logout semantics for token-based APIs, revoking refresh tokens, device/session records, and short-lived access-token limits.
Explains what happens when roles or tenant membership change while access tokens still contain old claims.
Separates authentication orchestration, mechanism-specific verification, and username-based user lookup.
Explains contextual sanitization and treats bypass APIs as narrow security-review decisions rather than general encoding helpers.
Traces a Servlet request through the security proxy, selected filter chain, authentication, context, authorization, and exception handling.
Explains how App Service can resolve Key Vault references through managed identity and what to watch during rotation and environment setup.
Explains first-match chain selection, rule matching inside a chain, ordering, fallback coverage, and accidental unprotected paths.
Treats GrantedAuthority as the common representation while explaining role prefixes, scope mapping, and domain permission design.
Separates authentication challenge from denied authorization and traces the selected entry point, denied handler, and matched rule.
Keeps server and client output compatible while isolating browser APIs, user state, and post-render integration.
Uses Resource Server and JwtDecoder to validate signature, issuer, audience, time, algorithms, key rotation, and authority mapping.
Covers App Service app settings, environment-specific configuration, restarts, slot settings, and avoiding hard-coded production values.
Stores salted adaptive password hashes, supports algorithm migration, and separates password verification from encryption.
Covers using managed identity and Microsoft Entra authentication for Azure SQL access from a .NET API.
Creates queryable structured events with trace correlation, stable fields, useful context, and deliberate redaction.
Combines safe bindings, AOT, dependency discipline, CSP, Trusted Types, and reporting without treating one control as a complete defense.
Uses thread dumps, heap dumps, logger changes, mappings, and configuration evidence through a tightly controlled operator path.
Uses Actuator for operational visibility while controlling endpoint exposure, access, detail, and network reachability.
Validates size and signature, writes under a generated storage key, and keeps untrusted files outside the public web root.