Easy Cyber Security Interview Questions

The CIA triad is Confidentiality, Integrity and Availability, the three goals every control supports. Confidentiality keeps data away from unauthorised people, for example with encryption and access control. Integrity ensures data is not altered without detection, using hashes and digital signatures. Availability keeps systems usable when needed, through backups, redundancy and DDoS protection. Most security decisions are a trade-off between these three.

A vulnerability is a weakness, such as an unpatched server. A threat is anything that can exploit it, such as a ransomware group. Risk is the likelihood that the threat exploits the vulnerability multiplied by the business impact. For example, an unpatched internet-facing VPN is high risk, while the same flaw on an isolated lab machine is low risk because likelihood and impact are smaller.

Defence in depth means using several independent layers of controls so that one failure does not lead to a breach. A typical stack has perimeter firewalls, email filtering, endpoint EDR, MFA, network segmentation, least privilege, logging and backups. If a phishing email gets past the filter, MFA and EDR can still stop the attacker. The trade-off is cost and complexity, so layers should target the most likely attack paths.

Least privilege means every user, service and application gets only the minimum access needed for its job, and only for as long as needed. It limits the damage from compromised accounts and insider mistakes. Examples are giving developers read-only production access, using separate admin accounts, and just-in-time elevation that expires after a few hours. Regular access reviews are needed because permissions tend to grow over time.

Symmetric encryption uses one shared key for encryption and decryption, such as AES; it is fast and used for bulk data. Asymmetric encryption uses a public and private key pair, such as RSA or elliptic curve keys; it is slower but solves key distribution and enables digital signatures. Real protocols like TLS combine them: asymmetric methods agree on a session key, then AES encrypts the traffic.

Encryption is reversible with the right key and protects confidentiality. Hashing is a one-way function that produces a fixed-length digest and is used for integrity checks and password storage. SHA-256 of a file lets you detect tampering, but you cannot get the file back from the hash. Passwords should be stored with slow salted hashes such as Argon2id or bcrypt, never encrypted or with plain SHA-256.

Social engineering manipulates people rather than technology to gain access or information. Common forms are phishing emails, spear phishing aimed at specific staff, vishing over phone calls, smishing over SMS or WhatsApp, pretexting with a fake story, baiting with infected USB drives and tailgating into offices. Defences include awareness training, phishing simulations, call-back verification for payment changes, and technical controls such as MFA and email authentication.

Malware is any software built to harm or misuse a system. A virus attaches to files and spreads when they run. A worm spreads by itself across networks, often using a vulnerability. A trojan pretends to be legitimate software to trick users into installing it. Ransomware encrypts or steals data and demands payment, and modern groups use double extortion by threatening to leak stolen data.

A vulnerability assessment uses scanners to find and rank as many known weaknesses as possible across many assets, and it is broad and frequent. A penetration test is a time-boxed, authorised attempt to exploit weaknesses and show real impact, such as reaching sensitive data. Assessments answer what is wrong; pen tests answer what an attacker could actually achieve. Most programmes run monthly scans and annual or release-based pen tests.

Authentication proves who you are, for example password plus an OTP or passkey. Authorisation decides what you are allowed to do after login, such as read-only access to a finance folder. Accounting, or auditing, records what you actually did, like logins, file access and admin changes. Together they are called AAA. Weak accounting is a common gap, because without logs an incident cannot be investigated.

Situation: while setting up a college lab server, I noticed the admin panel of our event website was reachable without login. Task: report it responsibly. Action: I confirmed the issue without accessing any data, wrote a short note with steps and impact, and shared it privately with the faculty in charge. Result: it was fixed in two days and I was asked to review the next release.

A good answer links genuine interest to evidence. For example: I got interested after investigating a phishing email that reached my college group, which led me to study networking and complete Security+. I built a home lab with a SIEM and wrote detections for brute-force logins. I enjoy problem solving under pressure, and I want to grow in a SOC, then specialise in incident response.

TCP is connection oriented with a three-way handshake, which makes it reliable but open to SYN flood attacks. UDP is connectionless, so it is easy to spoof source addresses and is abused in amplification attacks using DNS, NTP or memcached. Firewalls track TCP state easily, while UDP state is inferred from timeouts. Security monitoring must cover both, since DNS tunnelling uses UDP 53.

A firewall enforces rules on traffic between networks. Packet-filtering firewalls check IP, port and protocol. Stateful firewalls track connections and allow return traffic automatically. Next-generation firewalls add application awareness, user identity, TLS inspection, IPS and URL filtering. Web application firewalls protect HTTP applications from attacks such as SQL injection. Host firewalls like Windows Defender Firewall or nftables protect individual machines.

An Intrusion Detection System monitors traffic or hosts and raises alerts but does not block. An Intrusion Prevention System sits inline and can drop malicious packets in real time. IDS is safer for tuning because false positives do not break traffic, while IPS gives active protection. Detection can be signature based, as in Snort and Suricata rules, or anomaly based using baselines of normal behaviour.

A DMZ, or perimeter network, is a separate zone between the internet and the internal network for public-facing services like web servers, mail relays and reverse proxies. Firewall rules allow internet traffic only to DMZ hosts and allow DMZ hosts only limited, specific connections inward. If a DMZ server is compromised, the attacker still faces another firewall layer before reaching internal systems.

Public Key Infrastructure is the system of certificate authorities, certificates, policies and revocation services that binds public keys to identities. A CA signs a certificate saying this public key belongs to this domain or user. Browsers and operating systems trust a set of root CAs, which sign intermediate CAs, which sign end-entity certificates. Enterprises run internal PKI for device certificates, VPN, Wi-Fi 802.1X and code signing.

A digital signature proves who created data and that it has not changed. The signer hashes the data and signs the hash with their private key using algorithms like RSA-PSS, ECDSA or Ed25519. Anyone with the public key can verify it. Signatures give integrity, authentication and non-repudiation, and are used in software updates, TLS certificates, e-sign documents and signed emails.

A salt is a unique random value stored with each password hash. It makes identical passwords produce different hashes, so precomputed rainbow tables are useless and attackers must crack each hash separately. Salts are not secret. A pepper is an additional secret kept outside the database. Combined with slow algorithms like Argon2id, bcrypt or scrypt, salting makes offline cracking much more expensive.

Encoding, like Base64 or URL encoding, changes data format for transport and is reversible by anyone, so it gives no security. Encryption makes data unreadable without a key. Obfuscation makes code or data harder to understand but does not use a secret key, so a determined analyst can reverse it. A common mistake is treating Base64 credentials in config files as protected.

I would advise against it. Custom cryptography almost always has flaws that experts would find, and it fails audits. Instead, use well-reviewed libraries such as libsodium, platform crypto APIs, or the cloud KMS with AES-GCM and envelope encryption. I would offer to help choose the right library and key management design, and include a security review in the feature's pull request.

Situation: in my final year project I needed TLS mutual authentication for an IoT prototype within two weeks. Task: understand PKI enough to build it. Action: I read the TLS 1.3 overview, set up a small CA with OpenSSL, issued device certificates and tested failures deliberately. Result: the demo worked, and I documented the steps so classmates could reuse them, which helped our team score well.

Situation: in a design review, an architect asked me whether our VPN supported post-quantum key exchange. Task: give an accurate answer. Action: I said I did not know rather than guessing, checked the vendor documentation and release notes that afternoon and shared a short summary with options. Result: the team trusted my answers more, and the finding was added to our cryptography roadmap.

A SOC is the team, processes and technology that monitor an organisation's environment around the clock, detect threats, triage alerts and coordinate response. Tier 1 analysts triage alerts, Tier 2 investigate and contain, and Tier 3 or threat hunters handle complex cases and build detections. A SOC can be in-house, outsourced to an MSSP or hybrid. Many Indian IT firms run global SOCs for international clients.

A Security Information and Event Management platform collects logs from firewalls, endpoints, servers, cloud and applications, normalises them, stores them for search and correlates events to raise alerts. Examples are Splunk, Microsoft Sentinel, IBM QRadar, Elastic Security and Google Security Operations. A SIEM supports detection, investigation, dashboards and compliance reporting. Its value depends on good log sources, parsing and tuned rules.

A SIEM collects and correlates logs to detect threats. SOAR, Security Orchestration, Automation and Response, takes alerts and runs playbooks that enrich, decide and act, for example looking up an IP's reputation, querying EDR, disabling a user and opening a ticket. SIEM answers what is happening; SOAR speeds up the response. Many platforms now combine both, but automation still needs human approval for disruptive actions.

Endpoint Detection and Response records detailed endpoint activity, like process creation, command lines, network connections and registry changes, and detects suspicious behaviour, not just known files. Analysts can investigate a process tree, isolate a host and remove malware remotely. Traditional antivirus mainly blocks known signatures. XDR extends EDR by correlating endpoint, email, identity and cloud signals in one platform.

A false positive is an alert on benign activity, such as an admin running a legitimate script flagged as malicious. A false negative is a real attack that produced no alert, which is more dangerous. Too many false positives cause alert fatigue and missed real incidents. Analysts tune rules with allowlists, thresholds and context, and test detections against simulated attacks to find false negatives.

Get the original email with full headers. Check SPF, DKIM and DMARC results, the real sender and Reply-To, and the received path. Extract URLs and attachments without clicking, check them in a sandbox and reputation services, and compare the sender domain for lookalikes. If malicious, search for the same message across mailboxes, purge it, block indicators and check whether anyone clicked or entered credentials.

Use a laptop with virtualisation, run a Windows VM with Sysmon, a Linux server and a free SIEM such as Elastic or Splunk Free, or Wazuh as an open source option. Forward logs, then simulate attacks safely with Atomic Red Team tests on your own VMs. Write detections for each test, document them on GitHub and explain them in interviews.

A good answer shows realism and discipline. For example: I understand SOCs run 24x7 and night shifts are common early in a career. I keep a fixed sleep routine, prepare handover notes carefully and read previous shift notes before starting. During quiet hours I study detections or practise queries. I communicate early if a schedule conflict arises so the team can plan cover.

NIST SP 800-61 describes preparation; detection and analysis; containment, eradication and recovery; and post-incident activity. The 2025 revision aligns these with the NIST CSF 2.0 functions of Govern, Identify, Protect, Detect, Respond and Recover. Preparation includes playbooks, contacts and tools. Containment limits spread, eradication removes the attacker, recovery restores operations, and lessons learned improve controls and detections.

An event is any observable occurrence, like a login or a file change. An alert is an event or pattern that a tool flags as possibly malicious. An incident is a confirmed or highly likely violation of security policy that needs response, such as a compromised account. Clear definitions matter because incidents trigger escalation, legal review and regulatory reporting timelines.

Chain of custody is the documented record of who collected evidence, when, how, where it was stored and every person who handled it. It proves evidence was not altered, which is essential if the case goes to court or regulators. Practices include hashing disk images at acquisition, using write blockers, storing evidence securely and logging every transfer with signatures and timestamps.

A blameless review covers the timeline, root cause, how the attacker got in, what detected it, what slowed response, business impact and decisions made. It ends with specific actions that have owners and dates, such as enabling MFA on all VPN users or adding a detection rule. Tracking these actions to completion matters more than the report itself, otherwise the same incident repeats.

IAM is the set of processes and tools that manage digital identities and control their access to systems. It covers user provisioning and deprovisioning, authentication, authorisation, single sign-on, MFA, privileged access, access reviews and audit. Since most breaches involve stolen or misused credentials, IAM is a core security control. Common platforms include Microsoft Entra ID, Okta, Ping Identity and SailPoint for governance.

MFA requires two or more factor types: something you know like a password, something you have like a phone or security key, and something you are like a fingerprint. SMS OTPs are vulnerable to SIM swap and phishing, and push approvals to MFA fatigue. Phishing-resistant methods such as FIDO2 security keys, passkeys and certificate-based authentication are strongest because they are bound to the real site.

SSO lets a user authenticate once with an identity provider and access many applications without separate passwords. SAML 2.0 uses signed XML assertions and is common for enterprise web apps. OpenID Connect, built on OAuth 2.0, uses JSON tokens and suits modern web and mobile apps. SSO reduces password reuse and helps central control, but makes the identity provider a high-value target that needs strong MFA.

Review the details: unfamiliar location, anonymous IP, leaked credentials or impossible travel. Check what happened after sign-in, such as MFA method registration, mailbox rules or data downloads. If compromise is likely, revoke sessions, reset the password, remove unknown MFA methods and contact the user out of band. Then confirm policies require MFA or block high-risk sign-ins automatically.

The cloud provider secures the infrastructure: data centres, hardware, hypervisors and managed service internals. The customer secures what they put in the cloud: identities, data, configurations, network rules and their applications. The split changes by service type; with IaaS you patch the OS, with SaaS you mainly manage users and data settings. Most cloud breaches come from customer-side misconfiguration, not provider failures.

Frequent issues are publicly accessible storage buckets, overly permissive IAM policies with wildcards, long-lived access keys, security groups open to 0.0.0.0/0 on SSH, RDP or databases, disabled audit logging, unencrypted snapshots shared publicly, and exposed instance metadata. Cloud Security Posture Management tools and native services such as AWS Security Hub, Microsoft Defender for Cloud and Google Security Command Center detect them continuously.

Enable the native posture service, such as AWS Security Hub with the CIS AWS Foundations standard, Microsoft Defender for Cloud with the CIS Azure benchmark, or Security Command Center on Google Cloud. Open source tools like Prowler or ScoutSuite also work. Export findings, prioritise critical ones like root MFA, public storage and open admin ports, assign owners and track remediation over time.

I follow provider security blogs and release notes, since services change monthly, and read incident write-ups to learn real attack paths. I practise in personal free-tier accounts with budget alerts, using deliberately vulnerable labs. I hold a cloud security certification and plan the next one. I also share short notes with my team, which helps me learn more deeply.

GRC is Governance, Risk and Compliance. Governance sets direction, policies, roles and accountability for security. Risk management identifies, assesses and treats risks to an acceptable level. Compliance ensures the organisation meets laws, regulations, contracts and standards such as the DPDP Act, RBI directions, ISO 27001 and PCI DSS. GRC analysts write policies, run risk assessments, manage audits and track remediation.

ISO/IEC 27001 is the international standard for an Information Security Management System. The 2022 version has clauses 4 to 10 for the management system, such as context, leadership, risk assessment, internal audit and improvement, and Annex A with 93 controls grouped into Organisational, People, Physical and Technological themes. Companies get certified through an accredited body, which Indian IT services firms often need for client contracts.

Mitigate by adding controls to reduce likelihood or impact, such as MFA. Transfer by shifting financial impact to others, like cyber insurance or contracts. Avoid by stopping the risky activity, for example retiring an old system. Accept when the risk is within appetite and formally documented with an owner and review date. Risk acceptance should be signed by a business owner, not just the security team.

A policy is a high-level management statement of intent, such as all data must be classified. A standard sets mandatory specific requirements, like AES-256 for confidential data. A procedure gives step-by-step instructions to meet the standard. A guideline is recommended but optional advice. This hierarchy lets policies stay stable while standards and procedures change with technology.

Business continuity keeps critical business functions running during disruption, while disaster recovery restores IT systems. Recovery Time Objective is the maximum acceptable downtime, and Recovery Point Objective is the maximum acceptable data loss measured in time. A payments system may need an RTO of one hour and an RPO near zero, which needs replication, while an internal wiki may accept a day.

Start from business needs and regulations, keep it short and clear, and state scope, purpose, roles, requirements and exceptions. Avoid technical detail that changes often; put that in standards. Get input from IT, HR and legal, then management approval. Publish it where staff can find it, train people, require acknowledgement and review it at least yearly or after major changes.

Create a table where each risk has an ID, description written as cause, event and impact, asset, owner, inherent likelihood and impact, existing controls, residual rating, treatment decision, action plan, due date and review date. Gather risks through workshops, audits, incidents and threat intelligence. Review the register monthly with owners and report top risks to leadership quarterly.

A strong answer is specific yet flexible. For example: in five years I want to lead incident response or security engineering work for a large environment. I plan to master SOC operations first, then specialise through hands-on cloud and IR projects and certifications such as CySA+ and later CISSP. I also want to mentor junior analysts, since teaching strengthens my own skills.