Tools / Cyber Security Interview Questions

A firewall is a network security device or software that monitors and filters incoming and outgoing traffic based on a defined set of rules. It sits between a trusted internal network and an untrusted external network, such as the internet, deciding what traffic is allowed through.

Firewalls inspect packets against rules covering source and destination IP addresses, ports, and protocols. Traffic that doesn't match an allow rule is dropped or logged.

• Blocks unauthorized inbound connections
• Controls outbound traffic to prevent data leaks
• Logs traffic for auditing and troubleshooting
• Segments networks into separate security zones

Firewalls can run as dedicated hardware appliances, software on a host machine, or as a managed cloud service, and are usually the first line of defense in a layered security setup.

Cybersecurity is the practice of protecting systems, networks, and programs from digital attacks. These cyberattacks are usually aimed at accessing, changing, or destroying sensitive information; extorting money from users via ransomware; or interrupting normal business processes.

Implementing effective cybersecurity measures is particularly challenging today because there are more devices than people, and attackers are becoming more innovative.

Firewalls are generally grouped by how deep they inspect traffic and where they sit in the network path.

Most enterprise networks use NGFWs since they can identify specific applications and users, not just ports, giving finer-grained control over traffic.

Cybersecurity can be categorized into 7 distinct types:

• Network Security,
• Cloud Security,
• Endpoint Security,
• Mobile Security,
• IoT Security,
• Application Security,
• and Zero Trust.

Cryptography is the practice of securing information by transforming it into a form that only authorized parties can read or verify. It underpins confidentiality, integrity, and authentication across almost every secure system.

At its core, cryptography relies on mathematical algorithms combined with keys. Encryption converts readable plaintext into unreadable ciphertext, and decryption reverses that process using the correct key.

• Symmetric cryptography uses one shared key for encryption and decryption
• Asymmetric cryptography uses a public/private key pair
• Hashing produces a fixed-size fingerprint of data for integrity checks

Cryptography is used in HTTPS, VPNs, digital signatures, password storage, and disk encryption, making it one of the foundational building blocks of cyber security.

Network security is the process of safeguarding your data from unauthorized entry through your computer networks. Network security includes software and hardware technologies and ensures your security from a variety of threats. It acts as a wall between your network and malicious activity and as an organization, you want to protect your network so you can constantly deliver services to meet the demands of your employees and customers. Generally, protecting your reputation as a business.

Types of Network Security:

Firewall acts as a barrier between your trusted internal network and external network. This can be software, hardware, or both.

Email Security prevents any incoming attacks to prevent loss of sensitive data. Emails are among the most common gateways for a security breach.

Anti-virus and anti-malware software programs scan malware upon entry, monitor files for anomalies, and remove it to fix any damage.

Application Security patches vulnerabilities in the applications you use and prevents any breach. The applications you use to run your business might contain vulnerabilities that can expose and infiltrate your network.

Data Loss Prevention (DLP) prevents users from sharing, uploading, or forwarding critical information in a risky manner. As business owners, you want to ensure your staff doesn’t send sensitive information outside of your network.

Information Security or InfoSec is the process of designing and deploying tools to safeguard your critical business information from destruction, disruption, and alteration. It is a crucial factor in cybersecurity and it is specifically designed for data security.

The main objective of InfoSec is the confidentiality, integrity, and availability (CIA) of your business data. Its objective is to guarantee that only authorized users, apps, or systems can access certain information.

Types of Information Security:

• Cloud Security. Mainly focuses on the vulnerabilities coming from Internet services and shared environments. It protects the application and Infrastructure security from cloud-connected components.
• Cryptography. This is a process of obscuring content to secure information and only the user with the correct encryption key can access the encrypted data. Cryptography retains the confidentiality and integrity of data in transit and storage.
• Vulnerability Management. This type of InfoSec is a process where it scans the environment for any weak spots, such as unpatched software. For growing businesses that are constantly adding new users, applications, or updates with infrastructure, this is an important factor to monitor potential exposures.
• Incident Response. A role where it monitors and probes possibly malicious behavior. To contain threats and ensure that your network can be restored, an incident response plan is essential. Also, this preserves evidence for possible prosecution and further prevent breaches.

Malware, short for malicious software, is any program or code intentionally designed to damage, disrupt, or gain unauthorized access to a system or data.

Unlike an ordinary software bug, malware is deliberately built by an attacker to achieve a goal such as stealing information, extorting money, spying, or hijacking system resources.

• Delivered through email attachments, malicious downloads, infected USB drives, or compromised websites
• Can run silently in the background or immediately damage files
• Ranges from simple adware to sophisticated nation-state tools

Antivirus software, endpoint detection tools, and safe browsing habits are the main defenses against malware infection.

Malware is usually classified by how it spreads and what it does once installed.

Knowing the category helps responders choose the right containment strategy, since a self-spreading worm needs a very different response than a trojan sitting on one machine.

Endpoint security is the practice of securing endpoints or entry points of end-user devices such as desktops, laptops, and mobile devices from being exploited by malicious actors and campaigns.

Endpoint security systems protect these endpoints on a network or in the cloud from cybersecurity threats. Endpoint security has evolved from traditional antivirus software to providing comprehensive protection from sophisticated malware.

Examples of endpoints include desktop computers, smartphones, tablets, laptops, and Internet of Things (IoT) devices.

Phishing is a social engineering attack where an attacker impersonates a trusted entity, usually through email, text message, or a fake website, to trick a victim into revealing credentials, financial details, or installing malware.

A typical phishing email creates urgency, such as claiming an account will be locked, and includes a link to a spoofed login page that captures whatever the victim types in.

• Spear phishing targets a specific individual using personal details
• Whaling targets senior executives
• Smishing uses SMS text messages
• Vishing uses phone calls

Because phishing relies on human trust rather than a technical flaw, awareness training and email filtering are the main controls used against it.

Ransomware is malware that encrypts a victim's files or locks them out of their system, then demands a ransom, usually in cryptocurrency, in exchange for restoring access.

Once it gains a foothold, ransomware often spreads laterally across shared drives and connected systems before triggering encryption, so one infected laptop can end up locking an entire file server.

• Delivered via phishing emails, malicious downloads, or exposed remote desktop services
• Modern variants also steal data first and threaten to leak it, known as double extortion
• Recovery relies on offline backups since paying the ransom doesn't guarantee decryption

Regular offline backups, patching, and restricting administrative privileges are the most effective defenses.

Endpoint Protection Platform (EPP) primarily focus on preventing malware and are comparable to what you'd expect from a reactive antivirus program.

Endpoint Detection and Response (EDR) offers the same features as EPPs but also has the capability to respond to active threats in real-time.

Extended Detection and Response (XDR) platform offers better protection and deeper risk analysis than an EDR. XDRs provide more visibility and rely heavily on automation to correlate and eliminate threats.

A VPN creates an encrypted tunnel between a user's device and a remote server, so traffic traveling across an untrusted network, like public Wi-Fi or the internet, can't be read or tampered with by anyone in between.

The tunnel is established using protocols such as IPSec, OpenVPN, or WireGuard, which handle key exchange and encrypt every packet before it leaves the device.

• Hides the user's real IP address from destination servers
• Protects data on untrusted networks such as public Wi-Fi
• Lets remote employees securely reach internal company resources

Organizations commonly deploy site-to-site VPNs to link offices together and remote-access VPNs so individual employees can connect to internal systems from home.

The 5 C's of cyber security are five areas that are of significant importance to all organizations: change, compliance, cost, continuity, and coverage.

Multi-Factor Authentication requires a user to prove their identity using two or more independent factors before granting access, rather than relying on a password alone.

• Something you know, like a password or PIN
• Something you have, like a phone or hardware token
• Something you are, like a fingerprint or face scan

Because a stolen password alone isn't enough to log in, MFA significantly reduces the risk of account takeover from credential theft or phishing.

Common implementations include one-time codes from an authenticator app, push notifications to a registered device, and hardware security keys such as YubiKeys.

A digital signature is a cryptographic mechanism that proves a message or document came from a specific sender and hasn't been altered since it was signed.

It works by hashing the document, then encrypting that hash with the sender's private key. The recipient decrypts the signature using the sender's public key and compares it to a fresh hash of the received document; a match confirms authenticity and integrity.

signature = encrypt(hash(document), sender_private_key)
is_valid = (decrypt(signature, sender_public_key) == hash(received_document))

Digital signatures are used in code signing, signed emails, and legal document platforms, and they provide non-repudiation, meaning the sender can't credibly deny having signed the document.

Hashing takes an input of any size and runs it through an algorithm to produce a fixed-length output, called a hash or digest, that uniquely represents that input.

A good hash function is one-way, meaning you can't reverse the digest back into the original data, and even a tiny change in the input produces a completely different hash.

hash("password123") -> "ef92b778bafe771e89245b89ecbc08a4"
hash("password124") -> "b1946ac92492d2347c6235b4d2611184"

• Storing password hashes instead of plaintext passwords
• Verifying file integrity after downloads
• Detecting tampering in digital signatures

Common algorithms include SHA-256 and SHA-3; older algorithms like MD5 and SHA-1 are considered broken for security purposes because collisions can be found.

A zero-day vulnerability is a security flaw that's unknown to the vendor and has no available patch, meaning defenders have had zero days to fix it before it can be exploited.

Attackers who discover such a flaw can build a zero-day exploit and use it before anyone else even knows the weakness exists, which makes these attacks especially hard to detect with signature-based tools.

• Discovered by researchers, attackers, or accidentally by users
• Sold on underground markets or reported responsibly to vendors
• Patched once the vendor releases a fix, after which it's no longer a zero-day

Behavioral monitoring, network segmentation, and rapid patch management are the main mitigations since signature-based defenses can't catch what they've never seen.

Social engineering is the manipulation of people, rather than machines, to get them to break normal security procedures, hand over credentials, or perform an action that benefits the attacker.

• Phishing, tricking victims through fake emails or websites
• Pretexting, inventing a believable story to extract information
• Baiting, leaving infected USB drives for someone to plug in
• Tailgating, following an employee through a secured door without a badge

Social engineering succeeds because it exploits trust, urgency, and helpfulness rather than a software bug, so security awareness training is the most effective countermeasure alongside technical controls like email filtering.

A Denial-of-Service attack overwhelms a target system, service, or network with traffic or requests until it can no longer respond to legitimate users.

Attackers typically flood a server with more connection requests or data than it can process, exhausting its CPU, memory, or bandwidth.

• SYN flood attacks exhaust connection tables with half-open TCP handshakes
• Application-layer floods overload a specific service, like a login page
• Volumetric floods saturate available network bandwidth

A basic DoS attack originates from a single source, which makes it comparatively easy to block by filtering that source's IP address.

An Intrusion Detection System monitors network or system activity for suspicious behavior and alerts administrators when it spots something matching a known attack pattern or unusual activity.

• Network-based IDS (NIDS) watches traffic flowing across a network segment
• Host-based IDS (HIDS) monitors activity on an individual machine, such as file changes or process behavior

An IDS only detects and alerts; it doesn't block traffic itself, which is the key distinction from an Intrusion Prevention System. That makes it useful for visibility and forensic investigation without risking false positives disrupting legitimate traffic.

A honeypot is a decoy system deliberately set up to look like a real, valuable target, luring attackers away from production systems while security teams observe their techniques.

Because a honeypot has no legitimate business purpose, any traffic that touches it is almost certainly malicious, which makes its alerts far more reliable than alerts from a production system full of normal user activity.

• Low-interaction honeypots simulate services just enough to log connection attempts
• High-interaction honeypots run real operating systems and applications to capture detailed attacker behavior
• Honeynets link multiple honeypots together to observe how attackers move laterally

Security teams use the intelligence gathered to update firewall rules, IDS signatures, and threat intelligence feeds.

The CIA Triad, Confidentiality, Integrity, and Availability, is the foundational model that most security controls are designed to protect.

Every security decision, from choosing an encryption algorithm to designing a backup strategy, ultimately maps back to protecting one or more of these three properties.

Two-Factor Authentication (2FA) is a specific case of MFA that requires exactly two of the three authentication factor categories, most commonly a password plus a one-time code or push notification from a device the user owns.

A common flow: the user enters their password, then a six-digit code generated by an authenticator app is required before access is granted.

• SMS codes, convenient but vulnerable to SIM-swapping attacks
• Authenticator apps, generate time-based codes offline
• Push notifications, a tap-to-approve prompt on a registered device
• Hardware tokens, physical keys that must be plugged in or tapped

2FA blocks most automated credential-stuffing attacks since a stolen password alone is no longer enough to log in.

Access control models define who can decide, and how, whether a user is allowed to reach a resource.

Most enterprise applications default to RBAC because it's easier to manage at scale than assigning permissions individually, while government systems often rely on MAC for stricter, label-based enforcement.

A SIEM system collects log and event data from across an organization's servers, network devices, applications, and endpoints, then correlates it to detect suspicious patterns in near real time.

• Centralizes logs from firewalls, servers, endpoints, and cloud services
• Applies correlation rules to flag combinations of events that look like an attack
• Provides dashboards and alerts for security analysts
• Retains historical data to support investigations and compliance audits

Popular examples include Splunk, IBM QRadar, and Microsoft Sentinel; a SIEM is typically the core tool used inside a Security Operations Center (SOC).

• Phishing: tricking users into giving up credentials
• Malware: malicious software that damages or spies on systems
• DoS/DDoS: flooding a system to make it unavailable
• Man-in-the-Middle: intercepting communication between two parties
• SQL Injection: manipulating database queries through unsanitized input
• Cross-Site Scripting (XSS): injecting malicious scripts into web pages
• Credential stuffing: reusing leaked username/password pairs across sites
• Insider threats: employees misusing their legitimate access

Most real-world breaches combine several of these, for example a phishing email that delivers malware, which then establishes a foothold for lateral movement.

PKI is the framework of policies, roles, and technology used to create, manage, distribute, and revoke digital certificates that bind public keys to identities.

• Certificate Authority (CA), issues and signs digital certificates
• Registration Authority (RA), verifies identity before a certificate is issued
• Certificate, binds a public key to an entity's identity
• Certificate Revocation List (CRL), lists certificates that are no longer trusted

PKI is what lets your browser trust that a website's public key really belongs to that website, forming the backbone of HTTPS, code signing, and email encryption.

A Man-in-the-Middle attack happens when an attacker secretly positions themselves between two communicating parties, intercepting, and potentially altering, the data exchanged without either side realizing it.

• Wi-Fi eavesdropping on unsecured public networks
• ARP spoofing to redirect local network traffic through the attacker's machine
• DNS spoofing to send victims to a fake version of a website
• SSL stripping to downgrade an HTTPS connection to plain HTTP

Strong encryption via TLS, certificate validation, and avoiding untrusted public Wi-Fi are the main defenses against MITM attacks.

SQL injection is an attack where malicious SQL code is inserted into an input field so it gets executed by the backend database, usually because user input is concatenated directly into a query instead of being treated as data.

-- Vulnerable query
SELECT * FROM users WHERE username = '" + userInput + "';

-- Malicious input
' OR '1'='1

The input above turns the query into one that always evaluates true, potentially returning every row in the users table or bypassing a login check entirely.

Parameterized queries and prepared statements are the standard fix, since they keep user input separate from the SQL command structure.

Cross-Site Scripting is a web vulnerability where an attacker injects malicious JavaScript into a page viewed by other users, letting the script run in their browser under the trust of the vulnerable site.

Because the script runs as the victim in their own browser, it can steal session cookies, log keystrokes, or redirect the page. Escaping output and setting a strict Content Security Policy are the main defenses.

Many organizations deploy both together: the IDS gives full visibility for investigation, while the IPS blocks known-bad traffic automatically, cutting down the response window compared to relying on IDS alerts alone.

In practice, systems like TLS combine both: asymmetric encryption securely exchanges a symmetric session key during the handshake, then symmetric encryption handles the actual bulk data transfer because it's far faster.

SSL/TLS secures communication by combining asymmetric encryption for authentication and key exchange with symmetric encryption for the actual data transfer, wrapped around every request between a client and server.

• The server presents a digital certificate signed by a trusted Certificate Authority to prove its identity
• Client and server negotiate a shared symmetric session key using asymmetric cryptography
• All subsequent data is encrypted with that session key, protecting confidentiality and integrity
• A message authentication code detects any tampering with data in transit

TLS has evolved through several versions; TLS 1.3, the current standard, removed outdated cipher suites and reduced the handshake to fewer round trips, making connections both faster and more secure than TLS 1.2.

The Principle of Least Privilege states that a user, process, or system should only have the minimum access necessary to perform its function, nothing more.

When accounts hold more privileges than they need, a single compromised account, through phishing or a leaked password, gives an attacker a much larger blast radius to move laterally, escalate privileges, or access sensitive data.

• Limits the damage a compromised account or process can cause
• Reduces the attack surface available to malware that inherits the user's permissions
• Makes audits simpler because access maps clearly to job function

It's applied through role-based access control, just-in-time privilege elevation, and regularly reviewing and revoking unused permissions.

Most mature security programs run vulnerability assessments frequently, such as monthly, and schedule a full penetration test less often, such as annually or after major changes, to validate that the identified weaknesses are actually exploitable in practice.

A firewall controls traffic based on rules like IP address, port, and protocol, deciding whether a packet is allowed through or blocked. A proxy server, by contrast, sits between clients and the destination, actually terminating and re-establishing the connection on the client's behalf.

• A firewall inspects headers, and sometimes payloads, but generally passes traffic straight through
• A proxy fully intercepts the request, can cache content, and can rewrite or filter it before forwarding
• A forward proxy hides internal clients from external servers; a reverse proxy hides internal servers from external clients

The two are often deployed together: a firewall handles broad network-level filtering, while a proxy adds application-aware inspection, caching, and anonymization on top.

A useful way to remember the distinction: authentication answers who are you, authorization answers what are you allowed to do now that we know who you are. OAuth 2.0, for instance, is fundamentally an authorization framework, while OpenID Connect layers authentication on top of it.

A Web Application Firewall should be deployed in front of any internet-facing web application, especially one that handles user input, authentication, or sensitive data, because it filters HTTP traffic specifically for attacks like SQL injection and cross-site scripting that a standard network firewall doesn't understand.

• Applications processing payments or personal data, where compliance often mandates one, such as PCI-DSS
• Public APIs exposed to unauthenticated internet traffic
• Legacy applications that can't be patched quickly, where a WAF can virtually patch known vulnerabilities
• Sites frequently targeted by bots or credential-stuffing attempts

A WAF isn't a replacement for secure coding practices, it's a compensating control that buys time and reduces exposure while the application itself is hardened.

DAC gives the most flexibility but the weakest guarantees, since any user can grant access to their own files. MAC gives the strongest guarantees because users can't override the policy, at the cost of flexibility. RBAC sits in between, mapping permissions to job roles so access scales with the organization rather than with individual decisions.

Salting adds a unique, random value to each password before hashing, so that even if two users choose the identical password, their stored hashes come out completely different.

hash("password123" + salt_user1) -> "a1b2c3..."
hash("password123" + salt_user2) -> "9f8e7d..."

• Defeats precomputed rainbow table attacks, which rely on matching hashes against a lookup table
• Forces an attacker to crack each password individually rather than all at once
• Costs almost nothing to implement since the salt is simply stored alongside the hash

Modern password hashing functions like bcrypt, scrypt, and Argon2 build salting in automatically, along with deliberately slow computation to further frustrate brute-force attempts.

A buffer overflow happens when a program writes more data into a fixed-size memory buffer than it was allocated to hold, causing the extra bytes to spill into adjacent memory.

If that adjacent memory holds control data, like a function's return address on the stack, an attacker can craft the overflowing input to overwrite it with an address pointing to their own malicious code, hijacking the program's execution flow when the function returns.

• Can crash the application, a simple denial of service
• Can allow arbitrary code execution with the privileges of the vulnerable process
• Historically one of the most common routes to remote code execution in C and C++ software

Defenses include bounds checking, stack canaries, address space layout randomization (ASLR), and using memory-safe languages that don't allow raw buffer manipulation.

Because DDoS traffic looks like it's coming from legitimate, widely distributed users, mitigating it usually requires specialized scrubbing services or a Content Delivery Network that can absorb and filter volume far beyond what a single firewall could handle.

A simple way to connect them: risk exists where a threat meets a vulnerability. An unpatched server sitting on an isolated network with no internet access has much lower risk than the same unpatched server exposed directly to the internet, even though the vulnerability itself is identical, because the exposure to threats is different.

Traditional network security assumes that anything inside the corporate perimeter, behind the firewall, is trusted by default. Zero Trust discards that assumption entirely: no user, device, or request is trusted just because it's on the internal network.

• Every request is authenticated and authorized individually, regardless of where it originates
• Access is granted per-session and per-resource, not network-wide
• Micro-segmentation limits how far an attacker can move even after breaching one system
• Continuous verification replaces a one-time login check

This matters most with cloud adoption and remote work, since there's no longer a clean network perimeter to defend; users and services now connect from everywhere.

Rotating encryption keys means retiring an old key and replacing it with a new one on a regular schedule, even if there's no known compromise.

• Limits how much data is exposed if a key is ever silently compromised, since only data encrypted under that specific key window is at risk
• Reduces the amount of ciphertext available for cryptanalysis against any single key
• Supports compliance requirements that mandate periodic key rotation, such as PCI-DSS
• Makes it easier to cleanly revoke access for a former employee or partner

Key rotation needs to be paired with a re-encryption or key-versioning strategy so that data encrypted under a retired key can still be decrypted when needed, usually managed through a dedicated key management service (KMS).

Incident response follows a defined lifecycle so that a security event is handled consistently and nothing critical gets missed under pressure.

1. Preparation: building playbooks, tooling, and training before an incident ever happens
2. Identification: detecting and confirming that an actual security incident is underway
3. Containment: isolating affected systems to stop the incident from spreading further, often split into short-term and long-term containment
4. Eradication: removing the root cause, such as malware or a compromised account
5. Recovery: restoring systems to normal operation and monitoring closely for signs of reinfection
6. Lessons Learned: a post-incident review to document what happened and improve future response

Skipping straight to eradication without proper containment is a common mistake, since it can tip off the attacker and destroy forensic evidence needed to understand the full scope of the breach.

The TLS 1.3 handshake establishes a secure, authenticated channel in as few round trips as possible.

1. The client sends a ClientHello listing supported cipher suites and a random value
2. The server responds with a ServerHello, its digital certificate, and its own random value
3. The client verifies the certificate against a trusted Certificate Authority chain
4. Both sides use a Diffie-Hellman key exchange to independently derive the same shared session key without ever transmitting it
5. Each side sends a Finished message, encrypted with the new session key, confirming the handshake succeeded

From that point on, all application data is encrypted with the derived symmetric session key. TLS 1.3 cut this down to a single round trip in most cases, compared to two in TLS 1.2, reducing connection latency while dropping support for weaker legacy cipher suites.

1. The attacker identifies an input field, such as a login form or search box, that isn't properly sanitized
2. They submit a crafted string containing SQL syntax instead of expected data
3. Because the application builds its query by concatenating that input directly, the database receives a modified query rather than the intended one
4. The database executes the altered query exactly as written, since it has no way to distinguish injected code from legitimate query structure
5. Depending on the payload, this can bypass authentication, dump entire tables, or in some database engines even execute operating system commands

Blind SQL injection variants achieve the same outcome without visible error messages, instead inferring data one bit at a time by observing subtle differences in response timing or content.

Alert fatigue happens when analysts are flooded with so many low-value alerts that genuine threats get missed or ignored amid the noise.

• Tune correlation rules to reduce false positives instead of relying on default, overly broad detection logic
• Apply risk-based alert scoring so high-severity events surface above routine noise
• Group related events into a single incident instead of generating separate alerts for each log line
• Use suppression and allowlisting for known, expected activity, like scheduled backup jobs
• Automate triage for common low-risk alerts through a SOAR (Security Orchestration, Automation, and Response) platform

The goal isn't fewer alerts for its own sake, it's making sure the alerts that do fire are ones an analyst can trust and act on quickly.

1. Confirm the indicator is real by checking logs, alerts, and system behavior rather than acting on assumption
2. Establish a timeline by determining when the suspicious activity started and what systems were touched
3. Isolate affected systems from the network to stop further spread, without powering them off if memory forensics may be needed
4. Preserve evidence, including logs, memory dumps, and disk images, before making further changes
5. Identify the initial entry point and scope, checking for lateral movement, privilege escalation, and data exfiltration
6. Notify the incident response team and relevant stakeholders per the organization's breach response plan

Acting too fast, like immediately wiping a compromised server, can destroy the forensic evidence needed to understand what actually happened and whether the attacker is still present elsewhere in the environment.

Neither approach is strictly better in isolation. Signature-based detection is efficient and reliable against known, widespread threats, while behavior-based detection is essential for catching zero-day and fileless malware that has no signature yet. Most modern endpoint protection platforms layer both together rather than choosing one over the other.

1. Key generation: the entity generates a public/private key pair
2. Certificate Signing Request (CSR): the entity submits its public key and identity details to a Certificate Authority
3. Validation: the CA, sometimes via a Registration Authority, verifies the requester actually controls the domain or identity claimed
4. Issuance: the CA signs the certificate, binding the public key to the verified identity
5. Deployment: the certificate is installed on the server and presented during TLS handshakes
6. Renewal or revocation: the certificate is renewed before expiry, or revoked early if the private key is compromised, and added to a Certificate Revocation List or checked via OCSP

Clients validate a certificate by checking the CA's signature, confirming it hasn't expired, and checking that it hasn't been revoked, before trusting the public key it contains.

Kerberos is a ticket-based authentication protocol that lets a user prove their identity once and then access multiple services without re-entering credentials each time.

1. The client authenticates once to the Authentication Server (AS) and receives a Ticket Granting Ticket (TGT), encrypted with a key derived from the user's password
2. To access a specific service, the client presents the TGT to the Ticket Granting Service (TGS) and requests a service ticket
3. The TGS issues a service ticket encrypted with that specific service's secret key
4. The client presents the service ticket directly to the target service, which decrypts it with its own key to verify the client's identity without ever contacting the AS again

Because the actual password never travels across the network after the initial exchange, and tickets are time-limited, Kerberos significantly reduces the exposure of credentials compared to sending a password with every request. It's the authentication backbone of Microsoft Active Directory.