This page needs a newer browser to run its tools. You can still read everything here.

Web Security (OWASP Top 10:2025) Module 15

Security testing and OWASP ZAP in CI interview questions

Interview questions on security testing and OWASP ZAP in CI: warm-ups, then what each harder question tests and how a good answer starts.

12 questions: 3 warm-ups and 9 with model answers · Levels: Fresher to staff

Warm-up questions

Short questions with short answers, each answered in full.

Fresher to mid

What is the difference between SAST and DAST, and why use both?

Answered in the lesson Security testing toolbox: SAST, DAST, SCA, secrets
Fresher to mid

What does the ZAP baseline scan do, and why does it suit a pull-request pipeline?

Answered in the lesson OWASP ZAP baseline scans in CI
Fresher to mid

What is the difference between ZAP's baseline scan and its API scan, and when do you use each?

Answered in the lesson ZAP API scans, authenticated scans and triage

Questions with model answers

What each question tests, the first step of a good answer and the follow-ups to expect.

Mid to senior

A team of five has no security testing and wants a pipeline this month. What do you add first, where does each test run, and what gates do you set so that developers do not learn to ignore them?
What it tests

Choosing tests by the question each answers, placing them by cost, and setting gates on new findings with a baseline and expiring suppressions.

First step

Ask what the team fears most, because each test answers one question. Keys in the repository and packages with known flaws are the cheapest to find, so a secret scan and a package scan come first. Then add static rules on pull requests, a test for every fixed bug, and a nightly passive scan of a test copy.
Follow-ups
- The first scan finds 300 alerts. What is the gate?
- How do you decide after a month whether a tool is worth keeping?
- Where does a scan of the live site belong, if anywhere?
From the lesson Security testing toolbox: SAST, DAST, SCA, secrets
Model answer, Pro. Model answers open with any pass; prices are in the notice on this page.
Opening the model answers with your pass…
Model answers open with any MySmartCoPilot pass.
Pro pass · 1 week₹79$2.99
30 days₹179$5.99
1 year₹1,699$45
One payment; a pass never renews. The price shown is the total you pay: no fees or charges are added at checkout.
Passes can’t be bought right now, so the model answers can’t be opened at the moment. If you have a pass, enter your licence key.
Choose a pass I have a licence key
It also opens every other in-depth part in Learn and every Pro tool. Sales are final, except where the law gives you a right to withdraw, for example in the EU and the UK (refund policy).
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Mid to senior

A static analysis tool reports 300 findings on its first run over a ten-year-old codebase. What do you do in the first week, and how do you decide which findings to fix and which to suppress?
What it tests

Setting a baseline, sampling to measure precision, triaging by reachability and impact, and suppressing with a reason, an owner and an expiry.

First step

Do not read 300 findings in order. Take a random sample of twenty, reproduce or dismiss each, and count how many were real, which is the precision of the tool on this code. Then group the rest by rule, so that one decision covers many findings.
Follow-ups
- Half of the sample is noise from two rules. What do you do?
- A finding is real but cannot be reached from the internet. Do you fix, suppress or defer it?
- How do you stop the number from growing back?
From the lesson Security testing toolbox: SAST, DAST, SCA, secrets
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Mid to senior

The first baseline scan of your service exits with 2 and lists eleven alerts, two of them informational. The team wants a gate that stops regressions without blocking everyone on the first day. What do you configure, and in what order?
What it tests

Reading exit codes and levels, recording before blocking, IGNORE with reasons, a FAIL ratchet, and what -I changes.

First step

Do not stop on warnings yet. Scan with -I so that only rules at FAIL stop the build, keep the report, set the two informational rules to IGNORE with reasons, and move a rule to FAIL once its alerts are gone.
Follow-ups
- A teammate adds a scope line that turns the scan green. How do you spot it in review?
- A month later the scan reports new alerts and nobody changed the code. What happened?
- How do you know that the gate itself still works?
From the lesson OWASP ZAP baseline scans in CI
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Mid to senior

A pull request adds a workflow that runs the ZAP baseline action on pull_request_target, with write-all permissions, against the live shop, with actions named by tag and no fail_action. What do you ask to change, and why?
What it tests

Reviewing a CI scan: trigger, token rights, pinning, who owns the target, the exit-code gate and the handling of reports.

First step

Start with the target and the trigger. The scan must hit a copy the team owns, and the code of a pull request must never run with the base repository's token. Then fix permissions, pinning and fail_action.
Follow-ups
- How does the job know that the copy is ready to be scanned?
- Where do the reports go, and who can read them?
- Which of your requests would a workflow linter catch, and which only a person?
From the lesson OWASP ZAP baseline scans in CI
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Senior to staff

A teammate's rules file ends with a line that puts every rule out of scope for every address, and the build is green. What happened, and what do you check when you review a rules file?
What it tests

Scope semantics, a gate that cannot fail, the tab format, and a reason for every IGNORE line.

First step

Read the scope lines before anything else, and ask of each pattern what it matches and what is still counted when it does. Then check the format and the reason beside every IGNORE.
Follow-ups
- How would you test a rules file so that a change like this fails the build?
- A pattern stops at the start of an address and removes nothing. Why?
- When is a scope line the right tool, and when is IGNORE?
From the lesson OWASP ZAP baseline scans in CI
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Mid to senior

You are asked to run an authenticated active ZAP scan of the staging copy of an e-commerce API every night. What do you set up so that it finds problems and does no harm?
What it tests

A least-rights test user, made-up data, excluded paths, bounds on time and threads, token handling and the schedule.

First step

Ask what the scan can change with the session you give it. Start from a dedicated test user with the fewest rights, in a copy with made-up data, and decide which paths must never be called before you choose any other setting.
Follow-ups
- The token expires during the scan. What do you change?
- The spider follows a link to a content delivery network. How do you keep the token from going there?
- Why does this scan not run on every pull request?
From the lesson ZAP API scans, authenticated scans and triage
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Mid to senior

A first active scan of your service raises a hundred alerts and the team lead wants a plan. How do you turn them into work, and how do you decide what to fix first?
What it tests

Turning a long report into a short queue: finding shared causes, checking what is real, and ordering the work by risk.

First step

Do not open a hundred tickets. Ask which alerts share a cause, set aside the ones that are not work, and reproduce a sample of the rest to learn how many are real.
Follow-ups
- Two alerts, one reflected and one DOM based, name the same parameter. One ticket or two?
- ZAP rates a SQL injection alert Low confidence. Do you fix it first, last or not at all?
- How do you keep the list from growing back?
From the lesson ZAP API scans, authenticated scans and triage
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Senior to staff

A penetration test finds that signed-in users can read each other's orders, and your nightly ZAP scans never reported it. What went wrong, and what do you change in the pipeline?
What it tests

What scanners cannot see, tests of authorisation with two users, and how to describe the limits of automated testing.

First step

Say plainly that the scan did what a scan can do: it has no rule that asks whether an order belongs to its reader. Then ask which of your own tests would have failed, and write that one first.
Follow-ups
- How do you add the missing test, and where does it run?
- What do you tell a customer who asked whether the system is scanned?
- Which other flaws would the scan also have missed?
From the lesson ZAP API scans, authenticated scans and triage
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Mid to senior

Your gate fails on new alerts of Medium risk and above. A team asks to suppress one that they call a false positive. What do you require, and who decides?
What it tests

Suppression hygiene: evidence, a reason, an owner, an expiry, review of the file, and what a file may never accept.

First step

Ask for the evidence before the suppression: the request, the response, and why the rule is wrong for this page. If they can show it, record it with a reason, an owner and an expiry. If they cannot, it is a true positive.
Follow-ups
- The alert is High. Can the same file suppress it?
- A suppression expires and nobody notices. What failed?
- How do you review a pull request that only adds suppressions?
From the lesson ZAP API scans, authenticated scans and triage
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes

All Web Security (OWASP Top 10:2025) interview questions · The Web Security (OWASP Top 10:2025) track

Warm-up questions

What is the difference between SAST and DAST, and why use both?

What does the ZAP baseline scan do, and why does it suit a pull-request pipeline?

What is the difference between ZAP's baseline scan and its API scan, and when do you use each?

Questions with model answers

A team of five has no security testing and wants a pipeline this month. What do you add first, where does each test run, and what gates do you set so that developers do not learn to ignore them?

A static analysis tool reports 300 findings on its first run over a ten-year-old codebase. What do you do in the first week, and how do you decide which findings to fix and which to suppress?

The first baseline scan of your service exits with 2 and lists eleven alerts, two of them informational. The team wants a gate that stops regressions without blocking everyone on the first day. What do you configure, and in what order?

A pull request adds a workflow that runs the ZAP baseline action on pull_request_target, with write-all permissions, against the live shop, with actions named by tag and no fail_action. What do you ask to change, and why?

A teammate's rules file ends with a line that puts every rule out of scope for every address, and the build is green. What happened, and what do you check when you review a rules file?

You are asked to run an authenticated active ZAP scan of the staging copy of an e-commerce API every night. What do you set up so that it finds problems and does no harm?

A first active scan of your service raises a hundred alerts and the team lead wants a plan. How do you turn them into work, and how do you decide what to fix first?

A penetration test finds that signed-in users can read each other's orders, and your nightly ZAP scans never reported it. What went wrong, and what do you change in the pipeline?

Your gate fails on new alerts of Medium risk and above. A team asks to suppress one that they call a false positive. What do you require, and who decides?