Top 30 Cyber Security
Interview Questions

Core Cybersecurity Concepts

---------------------------------------------------------------------------------

1. What is the CIA triad in cybersecurity?

   • Confidentiality: Ensures data is accessible only to authorized users.

   • Integrity: Ensures data remains accurate and unaltered.

   • Availability: Ensures systems and data are available when needed.

   • Summary: The CIA triad stands for Confidentiality, Integrity, and Availability.

2. Define the differences between vulnerability, threat, and risk.

   • Vulnerability: A weakness in a system that can be exploited.

   • Threat: A potential event or actor that can exploit a vulnerability to cause harm.

   • Risk: The potential loss or damage when a threat exploits a vulnerability.

3. What is the difference between hashing and encryption?

   • Hashing: Converts data into a fixed-length hash (one-way process). Used for integrity.

   • Encryption: Converts data into ciphertext (two-way process). Used for confidentiality.

4. How does SSL/TLS work?

   • Process:

     • Handshake to establish a secure connection.

     • Exchange of certificates for identity verification.

     • Encryption of data using symmetric and asymmetric keys.

5. What is the role of cybersecurity in an organization?

   • Cybersecurity protects systems, networks, and data from unauthorized access, ensuring business continuity and regulatory compliance.

Network Security

---------------------------------------------------------------------------------

1. What is a firewall, and what are its types?

   • A firewall monitors and controls network traffic based on security rules. Types:

     • Packet-filtering firewalls.

     • Stateful inspection firewalls.

     • Next-generation firewalls (NGFW).

     • Web application firewalls (WAF).

2. What is the difference between TCP and UDP, and how do they impact security?

   • TCP: Reliable, connection-oriented protocol with error-checking mechanisms (more secure).

   • UDP: Faster, connectionless protocol without error-checking (less secure).

3. Explain the purpose of a DMZ in network architecture.

   • A DMZ (Demilitarized Zone) acts as a buffer network separating internal networks from external ones, enhancing security for public-facing services.

4. How do you secure a Wi-Fi network?

   • Use WPA3 encryption.

   • Enable strong passwords.

   • Disable WPS.

   • Update firmware regularly.

   • Implement MAC address filtering.

5. What are the most common network attacks, and how do you defend against them?

   • DDoS attacks: Traffic filtering and rate-limiting.

   • Man-in-the-Middle attacks: Encryption (e.g., HTTPS).

   • ARP spoofing: Dynamic ARP inspection.

   • Port scanning: Firewalls and intrusion detection systems.

Authentication and Identity Management

---------------------------------------------------------------------------------

1. What is multi-factor authentication (MFA)? Provide examples.

   • Definition: MFA requires two or more verification factors to authenticate a user.

   • Examples:

     • Password + OTP (One-Time Password).

     • Password + Biometric (e.g., fingerprint).

     • Password + Security Token.

2. What is the difference between authentication and authorization?

   • Authentication: Verifies the identity of a user (e.g., entering a password).

   • Authorization: Grants or denies access to resources based on user permissions.

3. How would you secure user credentials in an enterprise environment?

   • Use hashed passwords with salts.

   • Implement MFA.

   • Enforce strong password policies.

   • Regularly audit and monitor credential usage.

4. Explain the concept of single sign-on (SSO).

   • Definition: SSO allows users to access multiple applications with one set of credentials, enhancing user experience and reducing password fatigue while centralizing authentication.

5. What are the advantages of using biometric authentication systems?

   • Difficult to replicate.

   • No need to remember passwords.

   • Provides a higher level of security.

Threats and Vulnerabilities

---------------------------------------------------------------------------------

1. What is phishing, and how can an organization prevent it?

   • Definition: A social engineering attack tricking users into providing sensitive information.

   • Prevention:

     • Conduct employee awareness training.

     • Use email filters to detect phishing attempts.

     • Implement MFA.

2. Explain the concept of social engineering and give examples.

   • Definition: Exploiting human psychology to gain unauthorized access.

   • Examples:

     • Phishing emails.

     • Pretexting (impersonating authority).

     • Baiting (leaving malware-infected USB drives).

3. What are ransomware attacks, and how can they be mitigated?

   • Definition: Ransomware encrypts data, demanding payment for decryption.

   • Mitigation:

     • Maintain regular data backups.

     • Use endpoint detection and response (EDR) tools.

     • Keep software updated.

4. What is the difference between active and passive reconnaissance?

   • Active reconnaissance: Actively probing a target (e.g., port scanning).

   • Passive reconnaissance: Gathering information without interacting with the target (e.g., social media research).

5. How do you conduct a vulnerability assessment?

   • Identify assets.

   • Scan for vulnerabilities using tools (e.g., Nessus, OpenVAS).

   • Analyze and prioritize vulnerabilities.

   • Provide remediation recommendations.

Application Security

---------------------------------------------------------------------------------

1. What is the importance of patch management?

   • Patch management ensures vulnerabilities in software and systems are fixed promptly, reducing the risk of exploitation.

2. What are some common web application vulnerabilities, and how can they be prevented?

   • SQL Injection: Use parameterized queries.

   • XSS (Cross-Site Scripting): Sanitize and validate inputs.

   • CSRF (Cross-Site Request Forgery): Use anti-CSRF tokens.

   • Broken Authentication: Use secure session management.

3. How does SQL injection work, and how do you prevent it?

   • Definition: SQL injection manipulates SQL queries by injecting malicious input.

   • Prevention:

     • Use parameterized queries or prepared statements.

     • Validate and sanitize user inputs.

4. What is cross-site request forgery (CSRF), and how can it be mitigated?

   • Definition: CSRF tricks users into performing actions they didn’t intend.

   • Mitigation:

     • Use anti-CSRF tokens.

     • Implement same-site cookies.

     • Validate user sessions.

5. Explain how secure coding practices enhance application security.

   • Secure coding ensures applications are developed to resist vulnerabilities.

   • Practices:

     • Input validation.

     • Least privilege principle.

     • Regular code reviews.

Incident Response and Forensics

---------------------------------------------------------------------------------

1. What steps would you take to respond to a data breach?

   • Identify and contain the breach.

   • Assess the impact.

   • Eradicate the threat.

   • Recover systems and data.

   • Perform post-incident analysis and reporting.

2. What is the purpose of log analysis in cybersecurity?

   • Log analysis helps identify unusual or malicious activity, aiding in threat detection, incident response, and compliance audits.

3. How do you perform a root cause analysis after a security incident?

   • Gather evidence and logs.

   • Analyze the timeline of events.

   • Identify the initial point of compromise.

   • Determine the underlying cause and recommend mitigations.

4. What tools or frameworks are commonly used for incident response?

   • SIEM Tools: Splunk, IBM QRadar.

   • Endpoint Protection Tools: CrowdStrike, Carbon Black.

   • Incident Response Frameworks: NIST, SANS.

5. How would you handle an insider threat in an organization?

   • Implement user activity monitoring.

   • Enforce least privilege and role-based access controls.

   • Conduct regular insider threat awareness training.

   • Use data loss prevention (DLP) solutions.

​