Skip to content

Tracks Drills Topics Technologies Tech stacks Skill areas

Tracks Drills Topics

Loading

Aporeon

Technical interview practice, from one developer to another.

About Privacy Terms

Drills

Pick a focused question that fits your time, stack, and interview goal.

How much time do you have?

Show one-drill sessions you can finish now.

Search

Track

Practice style

Level

More filters

Topic

Technology

Tech stack

Skill area

24 results across 1 active filter

Page 1 of 1

Concept questionMedium~7 min

Apply rate limits and abuse throttles to APIs

Explains rate-limit identity, endpoint cost, login and suggestion throttles, Redis counters, user experience, and observability.

.NETASP.NET CoreJWTRedis

Concept questionMedium

~7 min

ASP.NET Core authentication schemes, challenge, and forbid

Explains how ASP.NET Core schemes select handlers and why authenticate, challenge, and forbid produce different security behavior.

.NETASP.NET Core

Practice drill

Concept questionMedium~7 min

Audit privileged admin actions

Explains why sensitive admin actions need authorization, reason capture, before/after context, and tamper-resistant audit records.

.NETASP.NET CoreJWT

Concept questionMedium~7 min

Authenticate service-to-service API calls

Explains API keys, client credentials, managed identity, mTLS, scopes, rotation, and per-client observability.

.NETASP.NET CoreAzureJWTOAuth2+1

Concept questionHard~9 min

Authorize tenant-scoped API requests

Explains trusted tenant context, membership checks, tenant-scoped queries, cache keys, and background job propagation.

.NETASP.NET CoreJWT

Comparison questionMedium~7 min

Compare access tokens and refresh tokens

Explains short-lived access tokens, refresh-token rotation, revocation, storage choices, and replay detection.

.NETASP.NET CoreJWTOAuth2OpenID Connect

Comparison questionMedium~7 min

Compare CSRF risk for cookies and bearer tokens

Explains when CSRF matters, how cookies change browser behavior, and what mitigations fit API clients.

.NETASP.NET CoreJWT

Comparison questionMedium~7 min

Compare roles, permissions, and capabilities

Explains how roles group permissions while API policies enforce specific capabilities and resource rules.

.NETASP.NET CoreJWT

Concept questionMedium~7 min

Design a safe password reset flow

Explains reset-token generation, hashing, expiration, generic responses, session revocation, and abuse controls.

.NETASP.NET CoreJWT

Concept questionMedium~7 min

Design a secure password login flow

Explains password verification, hashing, throttling, generic errors, lockout, and safe login telemetry.

.NETASP.NET CoreJWT

Concept questionEasy~5 min

Explain why CORS is not API authorization

Explains what CORS controls, what it does not protect, and why APIs still need authentication and authorization.

.NETASP.NET CoreJWT

Concept questionMedium~7 min

Handle logout, device revocation, and active sessions

Explains logout semantics for token-based APIs, revoking refresh tokens, device/session records, and short-lived access-token limits.

.NETASP.NET CoreJWT

Concept questionHard~9 min

Handle stale token claims after permission changes

Explains what happens when roles or tenant membership change while access tokens still contain old claims.

.NETASP.NET CoreJWT

Comparison questionMedium~7 min

OAuth 2.0, OpenID Connect, and authorization code with PKCE

Separates OAuth authorization from OpenID Connect authentication and explains why modern interactive clients use authorization code with PKCE.

.NETASP.NET CoreOAuth2OpenID Connect

Concept questionMedium~7 min

Prevent IDOR with resource ownership checks

Explains insecure direct object reference risks and how APIs enforce ownership, tenant scope, and authorization per resource.

.NETASP.NET CoreJWT

Concept questionMedium~7 min

Prevent overposting and mass assignment

Explains why request DTOs should expose only allowed fields and how server-owned fields stay protected.

.NETASP.NET CoreJWT

Architecture scenarioHard~12 min

Prevent SSRF when an API fetches user-controlled URLs

Secures webhooks, previews, imports, and remote-file fetches with destination policy, DNS and redirect defenses, egress controls, limits, and observability.

.NETASP.NET Core

Concept questionMedium~7 min

Protect secrets and tokens in API systems

Explains where secrets and tokens should live, what not to log, how rotation works, and how client storage changes risk.

.NETASP.NET CoreAzure Key VaultJWT

Concept questionEasy~5 min

Return safe API errors without leaking security details

Explains safe error responses for auth failures, validation failures, server errors, and sensitive resource access.

.NETASP.NET CoreJWT

Comparison questionEasy~5 min

Separate authentication and authorization in an API

Explains identity versus permission checks in API request handling and why both boundaries need server-side enforcement.

.NETASP.NET CoreJWT

Concept questionMedium~7 min

Use an external identity provider without losing app authorization

Explains the boundary between OAuth/OIDC identity, application users, claims mapping, roles, and app-specific permissions.

.NETASP.NET CoreJWTOAuth2OpenID Connect

Concept questionMedium~7 min

Use ASP.NET Core policies for authorization

Explains policy-based authorization, requirements, handlers, claims, capabilities, and resource-aware checks.

.NETASP.NET CoreJWT

Concept questionMedium~7 min

Use security headers, TLS, and cookie flags correctly

Explains HTTPS, HSTS, secure cookies, HttpOnly, SameSite, no-store, and practical API/browser security hardening.

.NETASP.NET CoreJWT

Concept questionMedium~7 min

Validate JWTs and trust claims carefully

Explains JWT validation, trusted issuers, audiences, expiration, signing keys, claims, and server-side authorization boundaries.

.NETASP.NET CoreJWT