Application Deployment and Security
Deployment models and the security baseline
Deployment questions contrast virtual machines (each with a full guest OS on a hypervisor) against containers (share the host kernel, start fast, package app plus dependencies as image layers). Docker builds and runs containers; Kubernetes orchestrates them into pods, services, and deployments with declarative manifests. Deployment strategies: blue-green keeps two identical environments and flips traffic at once (fast rollback, double cost); canary shifts a small percentage of traffic first (early signal, slower rollout). The 12-factor app advises config in environment variables, stateless processes, and disposability.
Security content draws on the OWASP categories: injection (SQL/command), broken authentication and access control, sensitive data exposure, XML external entities, security misconfiguration, cross-site scripting, insecure deserialization, vulnerable dependencies, and insufficient logging. Know that XSS runs attacker script in the victim's browser, CSRF abuses the victim's existing session, and SQL injection is defeated by parameterized queries.
Cryptography basics: hashing (SHA-256) is one-way and salted for passwords; encryption is reversible (symmetric for bulk data, asymmetric for key exchange and signatures); TLS protects data in transit only. CORS is enforced by browsers, not servers. Never hard-code secrets - use a vault or environment injection, and base64 is encoding, not protection.
Rule of thumb: encrypt data at rest with a managed key service, protect it in transit with TLS, and hash (never encrypt) passwords.