23Practical coding: parse login logs and flag a credential-stuffing pattern.▼mediumNewCrowdStrikeAmazonGoogle◆ premiumA practical round that tests clean code and detection judgement together. The scored answer parses defensively, picks a signal that separates stuffing from a forgetful user, and names what it misses.Open full answer →
34Design the login, MFA and account recovery flows for a consumer web app that attackers target with credential stuffing.▼hardNewGoogleMicrosoftMeta◆ premiumThe login form is the front door, but attackers use the side doors: reused passwords, guessable recovery, and MFA that can be phished or reset by a support agent.Open full answer →
44How does bot management decide a request is automated, and how would you protect a login or checkout from bots?▼mediumNewCloudflareAmazonShopify◆ premiumA bot can send exactly the headers a browser sends. It is much harder for it to send the same TLS handshake, run the same JavaScript and behave like a person. Bot management stacks those differences.Open full answer →