Blog Archives

10 Encryption and Decryption interview Q&As

Q1. What do you understand by the terms encryption and decryption? A1. Encryption is the process of converting clear data (e.g. database password, credit card number, etc) to incomprehensible cyberyext like “š£”Œz_fÓe©ˆ»[” by applying mathematical transformations. These transformations are known as encryption algorithms and require an encryption key.


12 Kerberos interview Q&As

Q1. What is kerberos? A1. Kerberos is a network authentication protocol designed to provide strong authentication for client/server applications by means of secret-key cryptography. Kerberos ensures the highest level of security to network resources. Q2. What are the 3 key components of Kerberos? A2. Kerberos in greek mythology means 3…

15 Security key area interview Q&A for Java developers

Q1. Can you provide a high level overview of the “access control security” in a recent application you had worked? A1. As shown below, SiteMinder is configured to intercept the calls to authenticate the user. Once the user is authenticated, a HTTP header “SM_USER” is added with the authenticated user…


6 Authentication Protocols Interview Q&As – LDAP, Kerberos, OAuth2 & SAML

Q1. Why are there so many security terminologies & standards compared to tradional security systems? A1. In traditional authentication (i.e. identify yourself) / authorisation (i.e. do you have access to a specific resource?), each application had its own separate database to store authentication credentials like user names, groups, etc and…

6 LDAP Interview Q&As

Q1. What is an LDAP server? And what is it used for in an enterprise environment? A1. LDAP stands for Lightweight Directory Access Protocol. This is an extensible open network protocol standard that provides access to distributed directory services. LDAP is an Internet standard for directory services that run on…

AWS Web Application Security Q&As

Below questions are based on the above diagram, and extends AWS Q&As on VPC, Subnets, Availability Zones, VPN, Route tables, NACLs & Security Groups & 15+ AWS Services overview interview Q&As. Q1. What is the purpose WAF in AWS? A1. The purpose of AWS WAF (i.e. Web Application Firewall) is…

Connecting DBeaver to Databases with Kerberos security & SSL

DBeaver is a universal tool to access any database or cloud application that has an ODBC or JDBC Driver such as MySQL, Oracle, Salesforce, Hive, Impala, Teradata, Redshift, Snowflake, etc. SQL Databases like Impala & Hive are secured with Kerberos & SSL. This post discusses how you can access an Impala or Hive database that is secured with Kerberos & SQL security from DBeaver.

Q. What SQL tool do you use to access an SQL database & analyse data as a Data or software Engineer?
A. DBeaver, DBVisualizer, Hue, Oracle SQL Developer, MySQL Workbench, Teradata SQL Assistant, etc.

Step 1:

Debugging Certificates do not conform to algorithm constraints

Why? You may have a certificate with SHA1RSA key size less than 1024 bits or you have a certificate in your chain that uses MD2RSA.

Explanation? MD2 was widely recognized as insecure and thus disabled in Java in version JDK 7 onwards. If you check the “” file under “$JAVA_HOME/jre/lib/security”, you will see a line as shown below. This means disable MD2 for all and RSA for certs with key size less than 1024 bits.

So, if you have a …

Debugging SSL issues in Java & tools to debug

Q1. What are some of the issues you encounter with SSL handshake? A1. Some of the issues you try to debug are Presence of a valid certificate in trust store Incorrect certificate chains in the client or server truststore Invalid key algorithm used for private keys Expired certificate Incorrect passwords…

HTTP Basic Authentication Interview Q&A for Java developers & architects

Q1. What do you understand by the term “HTTP Basic Authentication”? A1. HTTP Basic authentication is the simplest “access controls” technique for web resources like RESTful web service call. It doesn’t require cookies, session identifier and login pages. You need to pass just username and password to the resource. If…

Injection attack prevention Q&A

Q1. What are the different types of injection security vulnerabilities? A1. SQL Injection, Log Injection, HTTP Response Splitting, XPath Query injection, and LDAP injection. Q2. What is an SQL injection vulnerability, and how will you go about preventing it? A2. SQL injection attack is a security threat where the database…

Preventing XSS attacks in Java

Cross Site Scripting (XSS) is one of the most common security problems in today’s web applications, and the second most common is the SQL injection attack. Both account for ~ 70% to 80% of the security threats of which XSS attacks are accountable for ~ 50% to 60%. Q1. What…

Security holes & how to fix them interview Q&A

Security is of paramount importance to any application or website. Applications with security vulnerabilities can not only tarnish the reputation of a company, but also can adversely impact the bottom-line of that organization. So, it really pays for the organizations to have the right people who can identity potential security…


Session Hijacking prevention Questions & Answers

Q1. Does the following code pose any security risk? if yes, how will you fix it?

A1. The above code is a security risk. Never store sensitive data in a cookie. Instead, save it in the session on the server side, and …

Spring security tutorial

Spring security pre-authentication scenario assumes that a valid authenticated user is available via  either Single Sign On (SSO) applications like Siteminder, Tivoli, etc or a X509 certification based authentication. The Spring security in this scenario will only be used for authorization.

The example shown below retrieves the user name via the HTTP headers.

Step 1:  The dependency jars that are required.

SSL and truststore vs keystore for Java developers

Q. What do you understand by the terms trusstores and keystores in Java? A. You generally need a truststore that points to a file containing trusted certificates, no matter whether you are implementing the server or the client side. You may or may not need a keystore. The keystore points…

SSL in Java with Keytool to generate public-private key pair

Step 1: Create public-private key pair: Using keytool utility, which is packaged in %JAVA_HOME%/bin/keytool.exe you can create “public-private” key-pair. This means the public and private keys are mathematically related so that encrypting with one key can be decrypted with the other key, and vice versa. “RSA” is the algorithm used.

Used “changeit” as the password. You need to answer the questions when propmpted . For example:

Understanding service and socket timeouts in Java enterprise applications

Q. Why is it important to set proper timeout values in your applications?
A. Security and performance.

Security reason: it is often necessary to control how long a Web Service client or other valuable clients invoking valuable resources like database connections, transaction management, etc waits for a response after sending a request. Not setting proper timeouts can be a potential candidate for DoS attacks, especially via web service calls. This is why the application servers provide various timeout configurations to prevent DoS (Denial of Service) attacks. For example, in application servers

  • The RequestReadTimeout allows to limit the time

300+ Java & Big Data FAQs - Quick Prep

Java & Big Data Tutorials