Google Security Engineer Interview Questions

I would look for user-controlled inputs that reach database queries and then test whether special characters or crafted payloads change query behavior. I would also verify whether parameterized queries, escaping, and access controls are in place. The best answer shows both offensive understanding and defensive mitigation.

I would check whether user input is reflected into HTML, JavaScript, or DOM contexts without proper encoding or sanitization. Then I would confirm whether content security policies, output encoding, and safe templating prevent execution. A strong answer covers stored, reflected, and DOM-based XSS at a high level.

CSRF is an attack where a victim’s authenticated browser is tricked into sending an unintended request. I would prevent it with anti-CSRF tokens, SameSite cookies where appropriate, origin checks, and safer request methods for state-changing actions. The core idea is to make forged requests fail even if the browser is already logged in.

SSRF happens when an attacker causes a server to make requests to unintended destinations. It is dangerous because it can reach internal services, cloud metadata endpoints, or other sensitive network targets that are not exposed publicly. I would mitigate it with allowlists, network restrictions, URL validation, and tight egress controls.

The same-origin policy restricts how web pages interact across origins, while CORS defines controlled exceptions for cross-origin access. I would use CORS carefully because it is not a security feature by itself; it is a policy mechanism that must be configured to match the trust model. Misconfiguration can expose sensitive browser data unexpectedly.