Security Interview Questions & Practice

Sample Security interview questions

• Web Vulnerabilities

  Can you explain what XSS is, and the difference between stored, reflected, and DOM-based XSS?

• Auth Authn

  Can you explain the difference between authentication and authorization, with a concrete example of each?

• Session Tokens

  Can you explain what makes a JWT different from a traditional opaque session token, and what you give up by using one?

• Injection Input

  Can you explain what SQL injection is, and why parameterized queries prevent it?

• Crypto Basics

  Can you explain the difference between hashing and encryption, and why passwords should be hashed, not encrypted?

• Transport Security

  Can you explain what TLS actually protects against, and what it doesn't protect against?

• Secure Design

  Can you explain the principle of least privilege, and give an example of applying it in a system you've built?

• Incident Response

  If you discovered a data breach in production right now, what would your first few steps be?

These are a few examples — each real session pulls 5 questions at random from a larger pool across every category above, so repeat sessions won't repeat the same set.

Frequently asked questions

Is this a live-coding Security interview?

No. Security practice on Hone is a spoken, conceptual discussion — you explain your reasoning out loud rather than writing or sharing code.

How many Security questions are there?

Each session pulls 5 questions at random from a larger pool across multiple categories, so repeat sessions don't repeat the same set.

Can I choose the difficulty?

Yes — easy, medium, or hard, chosen right before you start. It changes how hard the interviewer pushes on follow-ups and how strictly it scores your answers.

Is it free?

Yes — every account gets 5 interviews a month, any track, for free. Pro upgrades to unlimited interviews for $99/month.