Zerodha Cybersecurity Engineer Interview Preparation

Authentication establishes identity, not permission for every object. Enforce resource-level authorization on each path that accesses the record, including exports and background actions. Default to denial when the policy cannot establish access and keep sensitive detail out of error responses.

Check your understanding: Use account A to request account B’s record through each available endpoint.

Common trap: Relying on unguessable IDs as the only authorization control.

Concept reference: OWASP: authorization checks

Identify its actual operations and required resources, then reduce privileges to that scope. Check normal, failure and maintenance paths so a narrowed policy remains operable. Record how credentials are rotated and how unexpected access is detected, without exposing credentials in logs.

Check your understanding: Attempt an operation outside the documented scope and verify denial.

Common trap: Keeping administrator access because setup was easier.

Concept reference: OWASP: authorization checks

Test the policy matrix: identities, resource ownership, actions and entry points. Verify that forbidden mutations caused no side effect, and that allowed actions still succeed. Run tests after role or permission changes so a security patch does not accidentally disable legitimate workflows.

Check your understanding: Assert both the HTTP outcome and the unchanged protected record.

Common trap: Checking status codes without checking state.

Concept reference: Playwright: reliable browser tests

First, identify technical constraints and define measurable service objectives. Next, explain how configuration becomes a monitored, recoverable production change. Contrast architectural trade-offs across simplicity, correctness, maintainability and scale, explicitly mitigate the risk of logs show symptoms but not the triggering request path, and confirm system stability using a trace, a minimal reproduction and a regression test.

Common trap: Reaching for a specific library or framework before defining constraints, failure envelopes, and automated verification criteria.

Prioritise the failure mode exhibiting the highest user blast radius and lowest observability. Formulate an explicit containment boundary, implement idempotent retries with jitter, and establish an automated rollback threshold. Verify resilience through separate identity and network limits plus an abuse-simulation report.

Common trap: Relying on passive monitoring dashboards without defining explicit error-budget alerts, rollback triggers, and verified recovery procedures.

Structure the response using Context-Decision-Tradeoff-Result: articulate the business and technical constraints, compare viable alternatives, explain the implementation (explain how configuration becomes a monitored, recoverable production change), and document the accepted trade-off. Provide concrete proof: a project example, measured result and repeatable verification step.

Common trap: Speaking only in high-level abstractions or team accomplishments without detailing your direct implementation decisions, trade-offs, and measured results.

Formulate a falsifiable hypothesis from observable telemetry before altering configurations. Then inspect policy changes, deployment events, saturation signals and retry amplification. Isolate the defect to the smallest reproducible boundary, validate root cause with evidence, and confirm full resolution using a compatibility contract, expand-and-contract rollout and rollback rehearsal.

Common trap: Applying speculative fixes or restarting services blindly without establishing an observable signal connected to a falsifiable hypothesis.

Produce a least-privilege policy diff with a canary metric and recovery drill. Document baseline assumptions, technical mechanism (explain how configuration becomes a monitored, recoverable production change), rejected alternatives, bounded failure envelopes, and deterministic pass criteria. Supply reproducible verification via an accessibility audit, keyboard trace and corrected acceptance test.

Common trap: Presenting architecture diagrams or slides lacking automated unit/integration tests, observable metrics, or automated rollback configurations.