Interview questions / Quality Engineering
Security questions for QA cover the OWASP Top 10, authentication flaws and how to fold basic security checks into a regular test strategy.
4 questions · 1 beginner· 2 intermediate· 1 advanced
beginner 0–2 yrs
The OWASP Top 10 is a periodically updated awareness list of critical web app security risks; the 2025 edition runs from broken access control to supply chain failures and mishandled exceptional conditions. QA covers a useful slice with negative tests on authorization, input, auth flows, error handling and headers.
Full answer with examplesintermediate 2–5 yrs
Broken access control means the server fails to enforce what an authenticated user may do. IDOR is the classic case: changing an ID in a request returns another user's data. Test it with two or more users and roles, swapping identifiers and tokens across every endpoint, and automate those checks as a matrix.
Full answer with examplesintermediate 2–5 yrs
Both happen when untrusted input is interpreted as code. For SQL injection, probe inputs with quotes and boolean or time-based payloads and watch for errors or changes. For XSS, inject markup in every input and check it is encoded where it is rendered. Back this with scanners, code review and parameterized queries.
Full answer with examplesadvanced 5+ yrs
Layer fast checks early and slower ones later: secrets scanning and SAST on every pull request, dependency (SCA) and container image scanning on build, DAST against a deployed environment, plus automated authorization tests. Gate on new high-severity findings and baseline the rest so the gate stays trusted.
Full answer with examples