Software Development Security
Core concepts
Know the SDLC phases and where security fits: requirements, design, development, testing, deployment, maintenance. Understand secure coding practices and the OWASP-style risk categories conceptually: injection, broken access control, cryptographic failures, insecure design. Know that input validation (allow-list preferred) and output encoding defend against injection and XSS. Understand SAST (static, source code) vs DAST (dynamic, running app) vs SCA (dependencies).
Models and environments
Know the maturity models concept (e.g., building security in earlier is cheaper) and that DevSecOps shifts security left. Understand environment separation (dev, test, prod) and that production data should not be used in test without masking. Know change control and code review as integrity controls, and that secrets must not be hard-coded.
Traps
A frequent trap is confusing SAST and DAST - SAST reads code without running it; DAST tests a running application. Another is assuming input validation alone stops XSS - output encoding is also required. Watch for questions where the answer is "fix in design" because remediation cost rises the later a defect is found. Also, hard-coded credentials are a recurring wrong answer.
Worked example
A web form is vulnerable to SQL injection. The primary fix is parameterized queries/prepared statements, not merely input filtering - because parameterization separates code from data at the database layer, which is the root-cause control.