Search the practice set
275 questions, 991 terms and 600 topics in 30 areas.
60 results for “Frontend Security”
Content Security Policy
A response header declaring which sources of script, style and other resources the browser may load, which turns a script injection from a compromise into a blocked request.
Backend for Frontend
A separate, narrow backend per client experience, which aggregates and reshapes downstream services for exactly that client's needs.
Hardware Security Module
A tamper-resistant device that generates and stores keys and performs cryptographic operations without the key material ever being extractable.
Security Group
A stateful, instance-level firewall that allows specified traffic and denies everything else by default.
Security vs Usability
A trade-off that is usually resolved by varying the control with the value of the action, rather than by choosing a uniform level of friction.
Shift-Left Security
Moving security checks earlier so findings arrive while the author still has context, on the condition that the signal-to-noise ratio justifies it.
Ambassador Pattern
A helper process that handles outbound network communication on behalf of an application, adding retries, routing, security and telemetry without changing it.
Artifact Signing
Cryptographically signing build outputs so that deployment can verify what is being run was produced by the expected pipeline from the expected source.
Attack Surface
The complete set of points where an untrusted actor can interact with a system — and the quantity that reduction genuinely reduces risk.
Auditability
The ability to reconstruct who did what, to which resource, when, and from where — reliably enough to be relied upon after the fact.
Authentication
Establishing who a principal is, to a defined level of confidence.
Authorization
Deciding whether an authenticated principal may perform a specific action on a specific resource.
Blast Radius
The set of things that break, or become reachable, when one component fails or is compromised.
Blast Radius Reduction
The set of deliberate partitions — accounts, regions, zones, cells, tenants, deployment stages — that bound how far any single failure or compromise can reach.
Cache Penetration
Repeated lookups for keys that do not exist, which miss the cache every time by definition and pass straight through to the store.
Client Runtime Constraint
The properties of the browser or device you do not control — CPU, network, version, extensions — which make the client a distributed system component rather than a rendering surface.
Client-Specific Aggregation
A dedicated backend per client type that shapes and combines downstream data for that client's needs, owned by the client team.
Compliance Framework
A published set of control requirements an organisation is assessed against, which turns security posture into evidence somebody else will check.
Security requires default-deny egress across the estate. Engineering says it will cause constant outages. How do you deliver it?
Why security is right Inbound is default deny nearly everywhere. Outbound is usually wide open, on the reasoning that traffic originating inside is trusted. Tha
Security wants mandatory hardware keys for every login; the business says it will cost conversions. How do you resolve it architecturally rather than by picking a side?
What the interviewer is testing Whether you treat security as a fixed dial to be turned up, or as a risk proportionate design variable. Both stated positions ar
You must roll out MFA to 40,000 employees. Security wants hardware keys; the service desk fears the call volume. Design the rollout.
The framing that resolves the argument Not every identity carries the same risk, so not every identity needs the same factor. A uniform mandate is what creates
Your JWT-based auth means a fired employee keeps access for 15 minutes after their account is disabled. Security says that is unacceptable. What are the options?
Why the gap exists A signed JWT is validated locally from its signature. That is the whole benefit — no network call, no shared session store, resource servers
Your organisation is preparing for its first SOC 2 audit. The security team is asking engineers for screenshots of configurations. What would you change, and what is the architectural argument?
What is wrong with screenshots Three things, and each is worth naming separately. They evidence a moment , not a period. The auditor is assessing whether contro
Your services currently trust anything inside the VPC. A security review says move to zero trust. What changes, and what will it cost you?
What the interviewer is testing Whether "zero trust" is a concrete set of changes to you, or a slogan. What actually changes Workload identity. Every service ge
A critical CVE is announced in a widely-used library. Walk me through the first four hours.
Hour 1 — determine exposure Query the SBOMs across the estate , including transitive dependencies. This is the moment that justifies having them: without, this
A front-end lead proposes micro-frontends so four teams can deploy independently. The application is a single React SPA. What is your assessment?
Test the premise first The stated goal is independent deployment. Ask what currently prevents it, because the answer is frequently not the architecture. If the
A front-end team wants to replace their global state library because "state management is unmanageable". How do you evaluate the request?
Ask what is actually in the store The complaint almost always resolves to one distinction not having been made: server state versus UI state . Server state is d
A marketing site is a client-rendered single-page application. Organic traffic is poor and the team blames the search engine. What is your assessment?
The rendering choice is the problem A marketing page is identical for every visitor and highly cacheable. Rendering it in the browser pays for personalisation t
A team is about to launch a public GraphQL API. What must be in place before it goes live?
Query cost control — the security requirement An arbitrary query language exposed publicly means a client can construct a query that consumes unbounded resource
Anomalous access to a customer database is detected. Walk me through the first day, and say what determines whether you can answer the regulator.
The first hours Declare an incident and assign command. Named commander who does not debug, operations lead, communications lead, scribe. Security incidents add
Frontend Security
CSP, XSS, CSRF, token storage, and the trust boundary that ends at the browser.
Backend for Frontend
A narrow backend per client experience, owned by that client's team.
Edge Security & Attestation
Secure boot, hardware roots of trust, and proving what is running on a device.
Firewalls & Security Groups
Default-deny, stateful rules, and restricting egress as well as ingress.
Frontend & Experience Architecture
General material on architecting the surface the user actually touches.
Network Security
Segmentation, egress control and limiting lateral movement.
Row & Column-Level Security
Restricting slices of a table rather than the whole table, and where it is enforced.
Security Architecture
General material on securing an architecture.
Security Design Review
Reviewing an architecture for security while changing it is still cheap.
Security Incident Response
Detection, scoping, containment and notification clocks.
Security Testing in the Pipeline
SAST, DAST, dependency and secret scanning, and what to do with the findings.
Security vs Usability
Varying control by the value of the action rather than uniformly.
Supply Chain Security
Dependencies, SBOMs, build provenance and artefact signing.
API Shapes for UI
REST, GraphQL and RPC judged by over-fetching, round trips and client coupling.
Accessibility Architecture
Semantics, focus management and announcements designed in rather than audited in.
Auditability
Tamper-evident, attributed records that survive async boundaries.
Authentication
Establishing who a principal is, and how strong that claim needs to be.
Authorization
RBAC, ABAC and ReBAC, and centralising the decision but not the enforcement.
BFF for Experience
One backend per experience, shaped by the screen rather than by the domain.
Client Caching & Data Layer
Stale-while-revalidate, invalidation and optimistic updates on the client.
Client Feature Flags
Flag evaluation on a device you do not control, and the flicker and staleness it brings.
Client State Architecture
Server state, UI state and derived state, and why conflating them causes most bugs.
Cloud Governance
Preventive policy, tagging, quotas and cost and security guardrails.
Compliance Frameworks
SOC 2, ISO 27001, PCI DSS — scope as an architectural lever.
Component Contracts
Props, slots and events as an interface, and the breaking change hidden in a style.
Frontend & Experience Architecture
The client as a distributed system component with its own state, cache and failure modes.
Security Architecture
Think in threats and trust boundaries rather than in security products.
AI-Era Architecture
AI workloads meeting security, data, networking, reliability and cost.