Tools / Cyber Security Interview Questions
1. What is CyberSecurity?
Cybersecurity is the practice of protecting systems, networks, and programs from digital attacks. These cyberattacks are usually aimed at accessing, changing, or destroying sensitive information; extorting money from users via ransomware; or interrupting normal business processes. Implementing ef...
2. What is a Firewall?
A firewall is a network security device or software that monitors and filters incoming and outgoing traffic based on a defined set of rules. It sits between a trusted internal network and an untrusted external network, such as the internet, deciding what traffic is allowed through. Firewalls insp...
3. What are the types of Firewalls?
Firewalls are generally grouped by how deep they inspect traffic and where they sit in the network path. Type What it does Packet-filtering firewall Checks headers only (IP, port, protocol) with no awareness of connection state Stateful inspection firewall Tracks the state of active connections a...
4. Different Types of Cybersecurity.
Cybersecurity can be categorized into 7 distinct types: Network Security, Cloud Security, Endpoint Security, Mobile Security, IoT Security, Application Security, and Zero Trust.
5. What is Network Security?
Network security is the process of safeguarding your data from unauthorized entry through your computer networks. Network security includes software and hardware technologies and ensures your security from a variety of threats. It acts as a wall between your network and malicious activity and as ...
6. What is Cryptography?
Cryptography is the practice of securing information by transforming it into a form that only authorized parties can read or verify. It underpins confidentiality, integrity, and authentication across almost every secure system. At its core, cryptography relies on mathematical algorithms combined ...
7. What is Malware?
Malware, short for malicious software, is any program or code intentionally designed to damage, disrupt, or gain unauthorized access to a system or data. Unlike an ordinary software bug, malware is deliberately built by an attacker to achieve a goal such as stealing information, extorting money, ...
8. Explain Information Security.
Information Security or InfoSec is the process of designing and deploying tools to safeguard your critical business information from destruction, disruption, and alteration. It is a crucial factor in cybersecurity and it is specifically designed for data security. The main objective of InfoSec is...
9. What is Endpoint Security?
Endpoint security is the practice of securing endpoints or entry points of end-user devices such as desktops, laptops, and mobile devices from being exploited by malicious actors and campaigns. Endpoint security systems protect these endpoints on a network or in the cloud from cybersecurity threa...
10. What are the common types of Malware?
Malware is usually classified by how it spreads and what it does once installed. Type Behavior Virus Attaches itself to a legitimate file and spreads when that file runs Worm Self-replicates across a network without needing a host file Trojan Disguises itself as legitimate software to trick users...
11. What are examples of endpoints in Endpoint security?
Examples of endpoints include desktop computers, smartphones, tablets, laptops, and Internet of Things (IoT) devices.
12. What is Phishing?
Phishing is a social engineering attack where an attacker impersonates a trusted entity, usually through email, text message, or a fake website, to trick a victim into revealing credentials, financial details, or installing malware. A typical phishing email creates urgency, such as claiming an ac...
13. What are the three main types of endpoint security?
Endpoint Protection Platform (EPP) primarily focus on preventing malware and are comparable to what you'd expect from a reactive antivirus program. Endpoint Detection and Response (EDR) offers the same features as EPPs but also has the capability to respond to active threats in real-time. Extende...
14. What is Ransomware?
Ransomware is malware that encrypts a victim's files or locks them out of their system, then demands a ransom, usually in cryptocurrency, in exchange for restoring access. Once it gains a foothold, ransomware often spreads laterally across shared drives and connected systems before triggering enc...
15. What is a Virtual Private Network (VPN)?
A VPN creates an encrypted tunnel between a user's device and a remote server, so traffic traveling across an untrusted network, like public Wi-Fi or the internet, can't be read or tampered with by anyone in between. The tunnel is established using protocols such as IPSec, OpenVPN, or WireGuard, ...
16. What are the 5 C's of Cyber Security?
The 5 C's of cyber security are five areas that are of significant importance to all organizations: change, compliance, cost, continuity, and coverage.
17. What is Multi-Factor Authentication (MFA)?
Multi-Factor Authentication requires a user to prove their identity using two or more independent factors before granting access, rather than relying on a password alone. Something you know , like a password or PIN Something you have , like a phone or hardware token Something you are , like a fin...
18. What is a Digital Signature?
A digital signature is a cryptographic mechanism that proves a message or document came from a specific sender and hasn't been altered since it was signed. It works by hashing the document, then encrypting that hash with the sender's private key. The recipient decrypts the signature using the sen...
19. What is Hashing in Cyber Security?
Hashing takes an input of any size and runs it through an algorithm to produce a fixed-length output, called a hash or digest, that uniquely represents that input. A good hash function is one-way, meaning you can't reverse the digest back into the original data, and even a tiny change in the inpu...
20. What is a Zero-Day Vulnerability?
A zero-day vulnerability is a security flaw that's unknown to the vendor and has no available patch, meaning defenders have had zero days to fix it before it can be exploited. Attackers who discover such a flaw can build a zero-day exploit and use it before anyone else even knows the weakness exi...
21. What is Social Engineering?
Social engineering is the manipulation of people, rather than machines, to get them to break normal security procedures, hand over credentials, or perform an action that benefits the attacker. Phishing , tricking victims through fake emails or websites Pretexting , inventing a believable story to...
22. Define Denial-of-Service (DoS) Attack?
A Denial-of-Service attack overwhelms a target system, service, or network with traffic or requests until it can no longer respond to legitimate users. Attackers typically flood a server with more connection requests or data than it can process, exhausting its CPU, memory, or bandwidth. SYN flood...
23. What is the purpose of an Intrusion Detection System (IDS)?
An Intrusion Detection System monitors network or system activity for suspicious behavior and alerts administrators when it spots something matching a known attack pattern or unusual activity. Network-based IDS (NIDS) watches traffic flowing across a network segment Host-based IDS (HIDS) monitors...
24. What is a Honeypot?
A honeypot is a decoy system deliberately set up to look like a real, valuable target, luring attackers away from production systems while security teams observe their techniques. Because a honeypot has no legitimate business purpose, any traffic that touches it is almost certainly malicious, whi...
25. Describe the CIA Triad in Cyber Security?
The CIA Triad, Confidentiality, Integrity, and Availability, is the foundational model that most security controls are designed to protect. Principle What it protects against Confidentiality Unauthorized disclosure of information, enforced through encryption and access controls Integrity Unauthor...
26. What is Two-Factor Authentication?
Two-Factor Authentication (2FA) is a specific case of MFA that requires exactly two of the three authentication factor categories, most commonly a password plus a one-time code or push notification from a device the user owns. A common flow: the user enters their password, then a six-digit code g...
27. What are the types of Access Control models?
Access control models define who can decide, and how, whether a user is allowed to reach a resource. Model How access is granted DAC (Discretionary Access Control) The resource owner decides who gets access MAC (Mandatory Access Control) A central authority assigns access based on classification ...
28. What is a Security Information and Event Management (SIEM) system?
A SIEM system collects log and event data from across an organization's servers, network devices, applications, and endpoints, then correlates it to detect suspicious patterns in near real time. Centralizes logs from firewalls, servers, endpoints, and cloud services Applies correlation rules to f...
29. List common types of Cyber Attacks?
Phishing : tricking users into giving up credentials Malware : malicious software that damages or spies on systems DoS/DDoS : flooding a system to make it unavailable Man-in-the-Middle : intercepting communication between two parties SQL Injection : manipulating database queries through unsanitiz...
30. What is Public Key Infrastructure (PKI)?
PKI is the framework of policies, roles, and technology used to create, manage, distribute, and revoke digital certificates that bind public keys to identities. Certificate Authority (CA) , issues and signs digital certificates Registration Authority (RA) , verifies identity before a certificate ...
31. What is a Man-in-the-Middle (MITM) Attack?
A Man-in-the-Middle attack happens when an attacker secretly positions themselves between two communicating parties, intercepting, and potentially altering, the data exchanged without either side realizing it. Wi-Fi eavesdropping on unsecured public networks ARP spoofing to redirect local network...
32. What is SQL Injection?
SQL injection is an attack where malicious SQL code is inserted into an input field so it gets executed by the backend database, usually because user input is concatenated directly into a query instead of being treated as data. -- Vulnerable query SELECT * FROM users WHERE username = '" + userInp...
33. What is Cross-Site Scripting (XSS)?
Cross-Site Scripting is a web vulnerability where an attacker injects malicious JavaScript into a page viewed by other users, letting the script run in their browser under the trust of the vulnerable site. Type Description Stored XSS Malicious script is saved on the server, e.g. in a comment, and...
34. What is the difference between IDS and IPS?
IDS IPS Monitors traffic and generates alerts Monitors traffic and actively blocks malicious activity Passive, sits out-of-line via a mirrored port Inline, sits directly in the traffic path No impact on traffic flow if it fails Can become a bottleneck or single point of failure if it fails Best f...
35. What is the difference between Symmetric and Asymmetric Encryption?
Symmetric Encryption Asymmetric Encryption Uses a single shared key for encryption and decryption Uses a public/private key pair Fast, suited for encrypting large volumes of data Slower, suited for small data like keys or signatures Key distribution is a challenge since both parties need the same...
36. How does SSL/TLS secure communication over the network?
SSL/TLS secures communication by combining asymmetric encryption for authentication and key exchange with symmetric encryption for the actual data transfer, wrapped around every request between a client and server. The server presents a digital certificate signed by a trusted Certificate Authorit...
37. Why is the Principle of Least Privilege important?
The Principle of Least Privilege states that a user, process, or system should only have the minimum access necessary to perform its function, nothing more. When accounts hold more privileges than they need, a single compromised account, through phishing or a leaked password, gives an attacker a ...
38. What is the difference between Vulnerability Assessment and Penetration Testing?
Vulnerability Assessment Penetration Testing Identifies and lists known vulnerabilities, usually via automated scanning Actively exploits vulnerabilities to demonstrate real-world impact Broad coverage across many systems Focused, often manual, deep dive on specific targets Produces a prioritized...
39. How does a Firewall differ from a Proxy Server?
A firewall controls traffic based on rules like IP address, port, and protocol, deciding whether a packet is allowed through or blocked. A proxy server, by contrast, sits between clients and the destination, actually terminating and re-establishing the connection on the client's behalf. A firewal...
40. What is the difference between Authentication and Authorization?
Authentication Authorization Confirms who you are Confirms what you're allowed to do Happens first, at login Happens after authentication, on every access request Example: entering a username and password Example: checking if that user can access the admin panel Failure results in access denied, ...
41. When should you use a Web Application Firewall (WAF)?
A Web Application Firewall should be deployed in front of any internet-facing web application, especially one that handles user input, authentication, or sensitive data, because it filters HTTP traffic specifically for attacks like SQL injection and cross-site scripting that a standard network fi...
42. What is the difference between DAC, MAC, and RBAC?
Model Who controls access Typical use case DAC The resource owner File permissions on a personal workstation MAC A central security policy enforced by the OS Military and government classified systems RBAC Predefined organizational roles Enterprise applications like HR or ERP systems DAC gives th...
43. Why do we use Salting in password hashing?
Salting adds a unique, random value to each password before hashing, so that even if two users choose the identical password, their stored hashes come out completely different. hash("password123" + salt_user1) -> "a1b2c3..." hash("password123" + salt_user2) -> "9f8e7d..." Defeats precomputed rain...
44. What happens when a Buffer Overflow attack occurs?
A buffer overflow happens when a program writes more data into a fixed-size memory buffer than it was allocated to hold, causing the extra bytes to spill into adjacent memory. If that adjacent memory holds control data, like a function's return address on the stack, an attacker can craft the over...
45. How does a Distributed Denial-of-Service (DDoS) Attack differ from a DoS Attack?
DoS DDoS Originates from a single source Originates from many distributed sources, often a botnet Easier to block by filtering one IP Hard to block since traffic comes from thousands of IPs at once Limited by one attacker's bandwidth Limited only by the combined bandwidth of the whole botnet Simp...
46. What is the difference between a Vulnerability, a Threat, and a Risk?
Term Meaning Vulnerability A weakness in a system that could be exploited, e.g. an unpatched server Threat Anything with the potential to exploit that weakness, e.g. an attacker or malware Risk The likelihood and impact of a threat actually exploiting a vulnerability A simple way to connect them:...
47. How does Zero Trust Architecture change traditional network security?
Traditional network security assumes that anything inside the corporate perimeter, behind the firewall, is trusted by default. Zero Trust discards that assumption entirely: no user, device, or request is trusted just because it's on the internal network. flowchart LR A[Traditional Model] --> B[Tr...
48. Why should you rotate encryption keys periodically?
Rotating encryption keys means retiring an old key and replacing it with a new one on a regular schedule, even if there's no known compromise. Limits how much data is exposed if a key is ever silently compromised, since only data encrypted under that specific key window is at risk Reduces the amo...
49. Explain the lifecycle of an Incident Response process?
flowchart LR A[Preparation] --> B[Identification] B --> C[Containment] C --> D[Eradication] D --> E[Recovery] E --> F[Lessons Learned] F --> A Incident response follows a defined lifecycle so that a security event is handled consistently and nothing critical gets missed under pressure. Preparatio...
50. Explain the internal working of the TLS Handshake?
sequenceDiagram participant C as Client participant S as Server C->>S: ClientHello (supported ciphers, random value) S->>C: ServerHello + Certificate C->>C: Verify certificate against trusted CA C->>S: Key exchange material Note over C,S: Both derive the same session key C->>S: Finished (encrypte...
51. Explain the execution flow of a SQL Injection attack?
flowchart TD A[Attacker finds unsanitized input field] --> B[Submits crafted SQL payload] B --> C[App concatenates input into query string] C --> D[Database executes the altered query] D --> E[Data exfiltrated or authentication bypassed] The attacker identifies an input field, such as a login for...
52. How can you optimize a SIEM system to reduce alert fatigue?
Alert fatigue happens when analysts are flooded with so many low-value alerts that genuine threats get missed or ignored amid the noise. Tune correlation rules to reduce false positives instead of relying on default, overly broad detection logic Apply risk-based alert scoring so high-severity eve...
53. How do you troubleshoot a suspected data breach in its early stages?
Confirm the indicator is real by checking logs, alerts, and system behavior rather than acting on assumption Establish a timeline by determining when the suspicious activity started and what systems were touched Isolate affected systems from the network to stop further spread, without powering th...
54. Which is better and why: Signature-based or Behavior-based Malware Detection?
Signature-based Behavior-based Matches files against a database of known malware fingerprints Watches what a program actually does at runtime Fast and low false-positive rate for known threats Can catch previously unseen, zero-day malware Blind to new or modified malware not yet in the database H...
55. Explain the lifecycle of a Digital Certificate in PKI?
flowchart LR A[Key Pair Generation] --> B[CSR Submission] B --> C[Validation by CA] C --> D[Certificate Issuance] D --> E[Deployment] E --> F[Renewal or Revocation] Key generation : the entity generates a public/private key pair Certificate Signing Request (CSR) : the entity submits its public ke...
56. Explain the internal working of Kerberos Authentication?
sequenceDiagram participant C as Client participant AS as Authentication Server participant TGS as Ticket Granting Service participant Svc as Service C->>AS: Request TGT (login credentials) AS->>C: Issue TGT C->>TGS: Present TGT, request service ticket TGS->>C: Issue service ticket C->>Svc: Prese...
