資安面試問題 · Security Interview Questions
A curated, open-source collection of questions asked in interviews for security roles — with answers — to help people breaking into the security field. 這裡整理了一些在面試和準備資安相關職位時可能會問到的問題與解答，希望能幫助想踏入資安圈的人更順利地找到工作。
:octicons-mark-github-16: Contribute on GitHub{ .md-button .md-button–primary }
:material-magnify: Search the questions{ .md-button onclick=”document.querySelector(‘.md-search__input’)?.focus();return false;” }
Browse by topic
- :material-web:{ .lg .middle } __Application Security__
---
XSS, CSRF, SSRF, SQL injection, CSP, buffer overflows, and web attack defenses.
[:octicons-arrow-right-24: Open](/docs/application-security.html)
- :material-key-variant:{ .lg .middle } __Encryption & Authentication__
---
Handshakes, HMAC, Kerberos, sessions & cookies, and MFA methods.
[:octicons-arrow-right-24: Open](/docs/encryption-authentication.html)
- :material-lan:{ .lg .middle } __Network & Network Security__
---
OSI model, TCP/UDP, DNS, firewalls, TLS, traceroute, and Nmap.
[:octicons-arrow-right-24: Open](/docs/network-security.html)
- :material-lock:{ .lg .middle } __Cryptography__
---
Symmetric vs asymmetric, TLS, cipher modes, IVs, forward secrecy, HSM/TPM.
[:octicons-arrow-right-24: Open](/docs/cryptography.html)
- :material-shield-alert:{ .lg .middle } __Security & Risk Management__
---
Risk vs vulnerability, quantifying risk, risk appetite, and chain of custody.
[:octicons-arrow-right-24: Open](/docs/risk-management.html)
- :material-radar:{ .lg .middle } __Security Ops & Incident Response__
---
Detection, IoCs, forensics, investigation methodology, and DevOps tooling.
[:octicons-arrow-right-24: Open](/docs/secops-incident-response.html)
- :material-bug:{ .lg .middle } __Penetration Testing__
---
Attack surfaces, remote control, spoofing, tooling, and malware reversing.
[:octicons-arrow-right-24: Open](/docs/penetration-testing.html)
- :material-sitemap:{ .lg .middle } __Threat Modeling__
---
STRIDE, DREAD, and worked threat-modeling exercises.
[:octicons-arrow-right-24: Open](/docs/threat-modeling.html)
- :material-console:{ .lg .middle } __System Admin__
---
Windows & *nix internals, hardening, cloud IaaS/PaaS/SaaS.
[:octicons-arrow-right-24: Open](/docs/system-admin.html)
- :material-code-braces:{ .lg .middle } __Security-Related Coding__
---
Data structures, algorithms, and security-themed coding challenges.
[:octicons-arrow-right-24: Open](/docs/security-coding.html)
- :material-account-voice:{ .lg .middle } __Behavioral Questions__
---
Behavioral prompts mapped to Amazon's Leadership Principles.
[:octicons-arrow-right-24: Open](/docs/behavioral.html)
- :material-lightbulb-on:{ .lg .middle } __Interview & Study Tips__
---
How to prepare, what to say, and how to study — from Grace Nolan.
[:octicons-arrow-right-24: Open](/docs/interview-tips.html)
Contributing 一起貢獻
!!! tip “Help make this better”
- Add a question or answer — open a Pull Request in the matching topic. 有想分享的面試問題或補充答案，歡迎直接建 Pull Request。
- Spot a mistake — open an Issue if a classification, question, or answer is wrong. 分類、題目或答案有錯，歡迎建 Issue。
- Suggest better structure — start a Discussion. 如果覺得分類有誤或能更好地分類，歡迎在 Discussions 討論。
Most content is in English and based on experience with US security roles — translations into Mandarin and other languages are very welcome.
License & credits
Great thanks to Grace Nolan for sharing her Interview Study Notes and allowing their integration here.
Content on this site is licensed under CC BY-SA 4.0.