OWASP, authentication, JWTs, CSRF, and secret handling. The security questions every senior engineer is expected to field.
Scenario-based rather than trivia: you're picking the defensible default for a real situation, and the tempting wrong answers are the ones that ship in production. Explanations cover the attack the control actually prevents. Cards are drawn with spaced repetition, so the ones you miss come back sooner and the ones you know back off. Progress is kept in your browser.