Security

Security questions at lead level are rarely trivia. They are judgment questions wearing trivia clothes: which vulnerability class actually gets exploited, how you prioritise patching when everything is critical, how you sequence a multi-year zero-trust program, and how you keep a stolen bearer token from being usable.

Two answers reliably separate staff from senior here. First, prioritising patching by CISA KEV and EPSS with exposure context rather than CVSS alone. Second, offering a STRIDE threat model for a design unprompted, which almost no candidate does.

What this chapter covers

• [done] PKCE and the authorization code flow
• [done] OAuth grants, token types, and JWT validation
• [done] RBAC to ABAC to ReBAC, with Zanzibar tuples
• [done] SSRF, cloud metadata, and workload identity
• [done] A STRIDE threat model, worked on a real system
• [done] Supply chain security, secrets, and the security pipeline
• [done] The OAuth vulnerability catalog
• [done] Revoking stateless JWTs
• [done] CVSS, EPSS and KEV
• [done] Zero trust, and the sequencing

Source: §21.