| 1 | What is HSTS (HTTP Strict Transport Security), and how does UseHsts() in ASP.NET Core implement it? ASP.NET Core › HTTPS, Certificates & Transport Security | ASP.NET Core | HTTPS, Certificates & Transport Security | Intermediate |
| 2 | What is certificate pinning, and why is it generally discouraged for typical web API scenarios despite its security benefits? ASP.NET Core › HTTPS, Certificates & Transport Security | ASP.NET Core | HTTPS, Certificates & Transport Security | Intermediate |
| 3 | How would you implement Server Name Indication (SNI)-based certificate selection in Kestrel, serving different TLS certificates for different hostnames on the same IP/port? ASP.NET Core › HTTPS, Certificates & Transport Security | ASP.NET Core | HTTPS, Certificates & Transport Security | Advanced |
| 4 | How do you enforce that all HTTP requests to an ASP.NET Core application are redirected to HTTPS? ASP.NET Core › HTTPS, Certificates & Transport Security | ASP.NET Core | HTTPS, Certificates & Transport Security | Beginner |
| 5 | What is the difference between a certificate's public key and private key, and why must the private key never be exposed or committed to source control? ASP.NET Core › HTTPS, Certificates & Transport Security | ASP.NET Core | HTTPS, Certificates & Transport Security | Beginner |
| 6 | What TLS protocol versions and cipher suites should a modern ASP.NET Core application support, and how do you configure Kestrel to enforce a minimum acceptable TLS version? ASP.NET Core › HTTPS, Certificates & Transport Security | ASP.NET Core | HTTPS, Certificates & Transport Security | Intermediate |
| 7 | Why is it important to validate a server's TLS certificate when making outbound HttpClient calls to external services, and what's the risk of disabling certificate validation? ASP.NET Core › HTTPS, Certificates & Transport Security | ASP.NET Core | HTTPS, Certificates & Transport Security | Intermediate |
| 8 | What is a self-signed certificate, and why is the ASP.NET Core development HTTPS certificate (dotnet dev-certs) not suitable for production use? ASP.NET Core › HTTPS, Certificates & Transport Security | ASP.NET Core | HTTPS, Certificates & Transport Security | Intermediate |
| 9 | How would you test and verify that an ASP.NET Core application's HTTPS configuration (certificate validity, protocol versions, HSTS header) is correctly configured before or after a production deployment? ASP.NET Core › HTTPS, Certificates & Transport Security | ASP.NET Core | HTTPS, Certificates & Transport Security | Intermediate |
| 10 | How does the UseHttpsRedirection() middleware determine which port to redirect to, and how do you explicitly configure it when the HTTPS port isn't on the default 443? ASP.NET Core › HTTPS, Certificates & Transport Security | ASP.NET Core | HTTPS, Certificates & Transport Security | Intermediate |
| 11 | How would you configure Kestrel to use a specific X.509 certificate for HTTPS, and what are the different ways to supply that certificate (file-based, certificate store, Azure Key Vault)? ASP.NET Core › HTTPS, Certificates & Transport Security | ASP.NET Core | HTTPS, Certificates & Transport Security | Advanced |
| 12 | How would you implement mutual TLS (mTLS) authentication in ASP.NET Core, where the server also validates a client-presented certificate? ASP.NET Core › HTTPS, Certificates & Transport Security | ASP.NET Core | HTTPS, Certificates & Transport Security | Advanced |
| 13 | How would you implement automated, zero-downtime certificate renewal using Let's Encrypt (ACME protocol) for a production ASP.NET Core deployment? ASP.NET Core › HTTPS, Certificates & Transport Security | ASP.NET Core | HTTPS, Certificates & Transport Security | Advanced |
| 14 | How would you configure OCSP stapling or handle certificate revocation checking to ensure a compromised certificate is rejected even if it hasn't yet expired? ASP.NET Core › HTTPS, Certificates & Transport Security | ASP.NET Core | HTTPS, Certificates & Transport Security | Advanced |
| 15 | How would you design a certificate rotation strategy that achieves zero downtime, avoiding the risk of an expired certificate causing an outage? ASP.NET Core › HTTPS, Certificates & Transport Security | ASP.NET Core | HTTPS, Certificates & Transport Security | Advanced |
| 16 | How would you configure HttpClient to trust a custom or self-signed SSL/TLS certificate for testing against an internal service, and what security risks does disabling certificate validation entirely introduce? Java › Java Networking & HTTP Client | Java | Java Networking & HTTP Client | Advanced |
| 17 | What is Kestrel, and how does its role in ASP.NET Core hosting differ from a traditional web server like IIS? ASP.NET Core › Hosting Models: Kestrel, IIS & Reverse Proxies | ASP.NET Core | Hosting Models: Kestrel, IIS & Reverse Proxies | Beginner |
| 18 | How do you configure Kestrel to listen on multiple endpoints (different ports, or both HTTP and HTTPS simultaneously)? ASP.NET Core › Hosting Models: Kestrel, IIS & Reverse Proxies | ASP.NET Core | Hosting Models: Kestrel, IIS & Reverse Proxies | Intermediate |
| 19 | How does hosting an ASP.NET Core application in a Docker container change considerations around Kestrel configuration and reverse proxying compared to traditional VM or bare-metal hosting? ASP.NET Core › Hosting Models: Kestrel, IIS & Reverse Proxies | ASP.NET Core | Hosting Models: Kestrel, IIS & Reverse Proxies | Intermediate |
| 20 | What role does a reverse proxy play in TLS/SSL termination, and why is this pattern common in production deployments? ASP.NET Core › Hosting Models: Kestrel, IIS & Reverse Proxies | ASP.NET Core | Hosting Models: Kestrel, IIS & Reverse Proxies | Intermediate |
| 21 | How does HttpClient handle automatic following of HTTP redirects (3xx responses), and how would you configure or disable this behavior? Java › Java Networking & HTTP Client | Java | Java Networking & HTTP Client | Intermediate |
| 22 | How would you configure Kestrel to be production-ready when running standalone (without IIS or another reverse proxy in front of it), and what risks does this expose you to? ASP.NET Core › Hosting Models: Kestrel, IIS & Reverse Proxies | ASP.NET Core | Hosting Models: Kestrel, IIS & Reverse Proxies | Advanced |