Cyber Security Interview Questions

Confidentiality means only authorized people can read data. Integrity means data is not changed without authorization. Availability means systems and data work when needed. Any control or attack can be described by which of the three it protects or breaks.

A threat is something that can cause harm, such as an attacker or malware. A vulnerability is a weakness it can use, such as an unpatched server. Risk is the likelihood and impact of the threat using the vulnerability.

Layering controls so that one failure does not expose everything: network segmentation, endpoint protection, least privilege, multi-factor authentication, logging and tested backups.

Symmetric encryption uses one shared key (AES) and is fast, so it protects bulk data. Asymmetric encryption uses a key pair (RSA, elliptic curves) and is used to exchange keys and sign data. TLS uses asymmetric methods to agree on a key, then symmetric encryption for the traffic.

Encryption can be reversed with a key. Hashing is one-way and is used to check integrity and to store passwords, with a salt and a slow algorithm such as bcrypt or Argon2.

It needs two or more kinds of proof: something you know, have or are. It stops most attacks that rely on a stolen password. App-based or hardware keys resist phishing better than SMS codes.

The client sends SYN, the server replies SYN-ACK, and the client sends ACK. A SYN flood abuses this by leaving many half-open connections on the server.

DNS turns names into IP addresses. Attackers abuse it through spoofing or cache poisoning, lookalike domains for phishing, and tunneling data out inside DNS queries. Logging DNS is a useful detection source.

An IDS watches traffic and raises alerts. An IPS sits inline and can block traffic. Tuning matters, because false positives on an IPS can block legitimate users.

SSH 22, DNS 53, HTTP 80, HTTPS 443, SMB 445 and RDP 3389. SMB or RDP exposed to the internet is a red flag that should be investigated.

A SIEM collects and normalizes logs from many sources, correlates events, raises alerts and supports investigation and reporting. Splunk, IBM QRadar, Wazuh and Microsoft Sentinel are common examples.

A false positive is an alert with no real threat, which wastes analyst time. A false negative is a real attack that was not detected, which is more dangerous. Good tuning cuts the first without creating the second.

Check the headers and the SPF, DKIM and DMARC results, inspect links and attachments in a safe sandbox, find who received or clicked, block the indicators, reset affected credentials, and document the case for handover.

Following NIST SP 800-61: preparation; detection and analysis; containment, eradication and recovery; and post-incident activity, where you record lessons and improve detections.

A public knowledge base of attacker tactics and techniques. Teams use it to map detections, find coverage gaps and describe incidents in a common language.

Indicators of compromise are artifacts such as file hashes, IP addresses and domains, which attackers change easily. Tactics, techniques and procedures describe behavior, which is harder to change. Strong detections use both.

A vulnerability assessment finds and ranks weaknesses, usually with scanners. A penetration test goes further: with permission, a tester tries to exploit and chain weaknesses to show real impact.

Scoping and written authorization, reconnaissance, scanning and enumeration, exploitation, post-exploitation such as privilege escalation and pivoting, reporting, and a retest after fixes.

Untrusted input changes the meaning of a database query. Prevent it with parameterized queries, least-privilege database accounts, input validation and by not showing detailed database errors to users.

Reflected, stored and DOM-based. Defend with output encoding for the right context, a Content Security Policy, HttpOnly cookies and validation of input.

A user changes an identifier, such as an invoice number, and the server returns another user's data because it never checked ownership. The fix is a server-side authorization check on every object access, not hiding the identifiers.

CVSS is a standard way to score technical severity. Reports should also explain business context, such as exposure, the data involved and compensating controls, so the owner can prioritize.

In Active Directory, any user can request service tickets for accounts with a service principal name, and weak service-account passwords can be cracked offline. Defend with long random passwords or group managed service accounts, least privilege and monitoring for unusual ticket requests.

An executive summary in business terms, clear scope and method, reproducible evidence, severity with its reasoning, remediation a developer can act on, and retest results.