Cyber Security Rapid-Fire Questions &amp; Answers

Show answer

TCP is connection oriented with a three-way handshake, which makes it reliable but open to SYN flood attacks. UDP is connectionless, so it is easy to spoof source addresses and is abused in amplification attacks using DNS, NTP or memcached. Firewalls track TCP state easily, while UDP state is inferred from timeouts. Security monitoring must cover both, since DNS tunnelling uses UDP 53.

What is network segmentation and why is it important?

Network SecurityMedium

Show answer

Segmentation splits a network into zones such as user, server, OT, guest and management, with controlled traffic between them using VLANs, firewalls and ACLs. It limits lateral movement, so ransomware on one laptop cannot reach every server. It also reduces compliance scope, for example isolating the cardholder data environment for PCI DSS. Micro-segmentation goes further with per-workload policies in data centres and cloud.

What is a firewall and what types exist?

Show answer

A firewall enforces rules on traffic between networks. Packet-filtering firewalls check IP, port and protocol. Stateful firewalls track connections and allow return traffic automatically. Next-generation firewalls add application awareness, user identity, TLS inspection, IPS and URL filtering. Web application firewalls protect HTTP applications from attacks such as SQL injection. Host firewalls like Windows Defender Firewall or nftables protect individual machines.

What is a man-in-the-middle attack on TLS and how do certificates prevent it?

Cryptography and PKIMedium

Show answer

In a MITM attack, an attacker intercepts traffic and pretends to be the server. Certificates prevent this because the client checks that the server certificate chains to a trusted root, matches the hostname and is valid. An attacker cannot produce a valid certificate without the private key or a compromised CA. Certificate warnings that users click through, and apps that skip validation, break this protection.

What is PKI?

Show answer

Public Key Infrastructure is the system of certificate authorities, certificates, policies and revocation services that binds public keys to identities. A CA signs a certificate saying this public key belongs to this domain or user. Browsers and operating systems trust a set of root CAs, which sign intermediate CAs, which sign end-entity certificates. Enterprises run internal PKI for device certificates, VPN, Wi-Fi 802.1X and code signing.

What should a post-incident review include?

Show answer

A blameless review covers the timeline, root cause, how the attacker got in, what detected it, what slowed response, business impact and decisions made. It ends with specific actions that have owners and dates, such as enabling MFA on all VPN users or adding a detection rule. Tracking these actions to completion matters more than the report itself, otherwise the same incident repeats.

What is the role of IAM in AWS security?

Show answer

AWS IAM controls who can do what on which resources through users, groups, roles and JSON policies. Best practices are avoiding root account use and protecting it with MFA, using roles with temporary credentials instead of access keys, least privilege policies, permission boundaries, and Service Control Policies in AWS Organizations to set guardrails across accounts. IAM Access Analyzer helps find unused and external access.

What is EDR and how is it different from antivirus?

Show answer

Endpoint Detection and Response records detailed endpoint activity, like process creation, command lines, network connections and registry changes, and detects suspicious behaviour, not just known files. Analysts can investigate a process tree, isolate a host and remove malware remotely. Traditional antivirus mainly blocks known signatures. XDR extends EDR by correlating endpoint, email, identity and cloud signals in one platform.

What is the Cyber Kill Chain?

Security FundamentalsMedium

Show answer

The Lockheed Martin Cyber Kill Chain describes seven stages of an intrusion: reconnaissance, weaponisation, delivery, exploitation, installation, command and control, and actions on objectives. Defenders use it to map controls to each stage, for example email filtering at delivery and egress filtering at command and control. Its weakness is a perimeter focus, so many teams pair it with MITRE ATT&CK for detailed techniques after initial access.

What are the four risk treatment options?

GRC and ComplianceEasy

Show answer

Mitigate by adding controls to reduce likelihood or impact, such as MFA. Transfer by shifting financial impact to others, like cyber insurance or contracts. Avoid by stopping the risky activity, for example retiring an old system. Accept when the risk is within appetite and formally documented with an owner and review date. Risk acceptance should be signed by a business owner, not just the security team.

What is a business email compromise attack?

Incident Response and ForensicsMedium

Show answer

In BEC, attackers take over or impersonate an executive, vendor or finance mailbox to trick staff into making payments or changing bank details. It often uses no malware, just a compromised account, mailbox forwarding rules and convincing requests. Controls include MFA, DMARC enforcement, alerts on new inbox rules, and a mandatory call-back process on a known number for any change to payment details.

What is Infrastructure as Code security scanning?

Show answer

IaC scanning checks Terraform, CloudFormation, Bicep or Kubernetes manifests for misconfigurations before deployment, such as public buckets or unencrypted databases. Tools include Checkov, tfsec in Trivy, and KICS. It shifts security left, so issues are fixed in a pull request rather than in production. Combine it with policy as code, like OPA, and drift detection to catch manual changes made in the console.

What is the difference between a vulnerability assessment and a penetration test?

Show answer

A vulnerability assessment uses scanners to find and rank as many known weaknesses as possible across many assets, and it is broad and frequent. A penetration test is a time-boxed, authorised attempt to exploit weaknesses and show real impact, such as reaching sensitive data. Assessments answer what is wrong; pen tests answer what an attacker could actually achieve. Most programmes run monthly scans and annual or release-based pen tests.

How does a VPN protect traffic and what are its limits?

Network SecurityMedium

Show answer

A VPN creates an encrypted tunnel, using IPsec, WireGuard or TLS, between a client and a network, protecting data on untrusted networks. Its limits are important: once connected, users often get broad network access, and VPN appliances are a frequent target for exploited vulnerabilities. That is why many companies move to Zero Trust Network Access, which grants per-application access after identity and device checks.

What is single sign-on and what protocols does it use?

Identity and Access ManagementEasy

Show answer

SSO lets a user authenticate once with an identity provider and access many applications without separate passwords. SAML 2.0 uses signed XML assertions and is common for enterprise web apps. OpenID Connect, built on OAuth 2.0, uses JSON tokens and suits modern web and mobile apps. SSO reduces password reuse and helps central control, but makes the identity provider a high-value target that needs strong MFA.

How does encryption work for data at rest in the cloud?

Show answer

Most cloud storage, databases and disks encrypt data at rest by default with provider-managed keys. For more control, use customer managed keys in KMS, with key policies, rotation and logs of every use, or bring and hold your own keys for strict regulatory needs. Encryption at rest protects against physical media theft, but not against someone with valid IAM permissions, so access control remains critical.

What is a SIEM and what does it do?

Show answer

A Security Information and Event Management platform collects logs from firewalls, endpoints, servers, cloud and applications, normalises them, stores them for search and correlates events to raise alerts. Examples are Splunk, Microsoft Sentinel, IBM QRadar, Elastic Security and Google Security Operations. A SIEM supports detection, investigation, dashboards and compliance reporting. Its value depends on good log sources, parsing and tuned rules.

What are the most common cloud security misconfigurations?

Cloud SecurityEasy

Show answer

Frequent issues are publicly accessible storage buckets, overly permissive IAM policies with wildcards, long-lived access keys, security groups open to 0.0.0.0/0 on SSH, RDP or databases, disabled audit logging, unencrypted snapshots shared publicly, and exposed instance metadata. Cloud Security Posture Management tools and native services such as AWS Security Hub, Microsoft Defender for Cloud and Google Security Command Center detect them continuously.

What is malware and how do virus, worm, trojan and ransomware differ?

Show answer

Malware is any software built to harm or misuse a system. A virus attaches to files and spreads when they run. A worm spreads by itself across networks, often using a vulnerability. A trojan pretends to be legitimate software to trick users into installing it. Ransomware encrypts or steals data and demands payment, and modern groups use double extortion by threatening to leak stolen data.

What is the difference between a policy, a standard, a procedure and a guideline?

GRC and ComplianceEasy

Show answer

A policy is a high-level management statement of intent, such as all data must be classified. A standard sets mandatory specific requirements, like AES-256 for confidential data. A procedure gives step-by-step instructions to meet the standard. A guideline is recommended but optional advice. This hierarchy lets policies stay stable while standards and procedures change with technology.

What is the difference between an event, an alert and an incident?

Show answer

An event is any observable occurrence, like a login or a file change. An alert is an event or pattern that a tool flags as possibly malicious. An incident is a confirmed or highly likely violation of security policy that needs response, such as a compromised account. Clear definitions matter because incidents trigger escalation, legal review and regulatory reporting timelines.

What is the principle of least privilege?

Show answer

Least privilege means every user, service and application gets only the minimum access needed for its job, and only for as long as needed. It limits the damage from compromised accounts and insider mistakes. Examples are giving developers read-only production access, using separate admin accounts, and just-in-time elevation that expires after a few hours. Regular access reviews are needed because permissions tend to grow over time.

What is conditional access?

Identity and Access ManagementMedium

Show answer

Conditional access applies policies based on signals at sign-in, such as user, group, device compliance, location, application and risk score. For example, allow finance apps only from managed devices with MFA, block legacy authentication, and require a password change when sign-in risk is high. It is a key Zero Trust building block in platforms like Microsoft Entra ID. Policies need testing in report-only mode first.

What is the difference between IDS and IPS?

Show answer

An Intrusion Detection System monitors traffic or hosts and raises alerts but does not block. An Intrusion Prevention System sits inline and can drop malicious packets in real time. IDS is safer for tuning because false positives do not break traffic, while IPS gives active protection. Detection can be signature based, as in Snort and Suricata rules, or anomaly based using baselines of normal behaviour.

What is the difference between a threat, a vulnerability and a risk?

Show answer

A vulnerability is a weakness, such as an unpatched server. A threat is anything that can exploit it, such as a ransomware group. Risk is the likelihood that the threat exploits the vulnerability multiplied by the business impact. For example, an unpatched internet-facing VPN is high risk, while the same flaw on an isolated lab machine is low risk because likelihood and impact are smaller.

Which Windows event IDs should a SOC analyst know?

SOC Operations and SIEMMedium

Show answer

Key Security log events are 4624 successful logon, 4625 failed logon, 4672 special privileges assigned, 4688 process creation, 4720 user created, 4728 and 4732 user added to privileged groups, 4740 account lockout, 1102 audit log cleared, 4698 scheduled task created and 7045 service installed in the System log. Logon type in 4624, such as 3 for network and 10 for RDP, adds important context.

What are the phases of incident response?

Show answer

NIST SP 800-61 describes preparation; detection and analysis; containment, eradication and recovery; and post-incident activity. The 2025 revision aligns these with the NIST CSF 2.0 functions of Govern, Identify, Protect, Detect, Respond and Recover. Preparation includes playbooks, contacts and tools. Containment limits spread, eradication removes the attacker, recovery restores operations, and lessons learned improve controls and detections.

What is the difference between encoding, encryption and obfuscation?

Show answer

Encoding, like Base64 or URL encoding, changes data format for transport and is reversible by anyone, so it gives no security. Encryption makes data unreadable without a key. Obfuscation makes code or data harder to understand but does not use a secret key, so a determined analyst can reverse it. A common mistake is treating Base64 credentials in config files as protected.

What is a digital signature and how does it work?

Show answer

A digital signature proves who created data and that it has not changed. The signer hashes the data and signs the hash with their private key using algorithms like RSA-PSS, ECDSA or Ed25519. Anyone with the public key can verify it. Signatures give integrity, authentication and non-repudiation, and are used in software updates, TLS certificates, e-sign documents and signed emails.

What is multi-factor authentication and which factors are strongest?

Identity and Access ManagementEasy

Show answer

MFA requires two or more factor types: something you know like a password, something you have like a phone or security key, and something you are like a fingerprint. SMS OTPs are vulnerable to SIM swap and phishing, and push approvals to MFA fatigue. Phishing-resistant methods such as FIDO2 security keys, passkeys and certificate-based authentication are strongest because they are bound to the real site.

What is MITRE ATT&CK and how is it used?

Security FundamentalsMedium

Show answer

MITRE ATT&CK is a public knowledge base of adversary tactics and techniques observed in real attacks, organised in matrices for Enterprise, Mobile and ICS. Tactics are the goal, such as Persistence, and techniques are the method, such as T1053 Scheduled Task. Teams use it to map detection coverage, write threat-informed detections, plan red and purple team exercises, and describe incidents in a common language.

What is a DMZ?

Show answer

A DMZ, or perimeter network, is a separate zone between the internet and the internal network for public-facing services like web servers, mail relays and reverse proxies. Firewall rules allow internet traffic only to DMZ hosts and allow DMZ hosts only limited, specific connections inward. If a DMZ server is compromised, the attacker still faces another firewall layer before reaching internal systems.

What is threat hunting?

SOC Operations and SIEMMedium

Show answer

Threat hunting is proactive searching for attackers who evaded existing detections. Hunters start from a hypothesis, for example that attackers use scheduled tasks for persistence, then query EDR and SIEM data to confirm or reject it. Findings become new detection rules. Hunting requires good data retention, knowledge of normal behaviour and frameworks like MITRE ATT&CK to guide hypotheses.

What is a Security Operations Center?

Show answer

A SOC is the team, processes and technology that monitor an organisation's environment around the clock, detect threats, triage alerts and coordinate response. Tier 1 analysts triage alerts, Tier 2 investigate and contain, and Tier 3 or threat hunters handle complex cases and build detections. A SOC can be in-house, outsourced to an MSSP or hybrid. Many Indian IT firms run global SOCs for international clients.

What is the difference between hashing and encryption?

Show answer

Encryption is reversible with the right key and protects confidentiality. Hashing is a one-way function that produces a fixed-length digest and is used for integrity checks and password storage. SHA-256 of a file lets you detect tampering, but you cannot get the file back from the hash. Passwords should be stored with slow salted hashes such as Argon2id or bcrypt, never encrypted or with plain SHA-256.

Explain the difference between symmetric and asymmetric encryption at a basic level.

Show answer

Symmetric encryption uses one shared key for encryption and decryption, such as AES; it is fast and used for bulk data. Asymmetric encryption uses a public and private key pair, such as RSA or elliptic curve keys; it is slower but solves key distribution and enables digital signatures. Real protocols like TLS combine them: asymmetric methods agree on a session key, then AES encrypts the traffic.

What is memory forensics and which tool is commonly used?

Incident Response and ForensicsMedium

Show answer

Memory forensics analyses a RAM capture to find running processes, injected code, network connections, loaded DLLs, command history and encryption keys. It reveals fileless malware that leaves little on disk. Volatility 3 is the common open source framework, with plugins such as windows.pslist, windows.netscan and windows.malfind. Captures are taken with tools like WinPmem or through EDR live response.

What is the difference between authentication, authorisation and accounting?

Show answer

Authentication proves who you are, for example password plus an OTP or passkey. Authorisation decides what you are allowed to do after login, such as read-only access to a finance folder. Accounting, or auditing, records what you actually did, like logins, file access and admin changes. Together they are called AAA. Weak accounting is a common gap, because without logs an incident cannot be investigated.

What is the shared responsibility model in cloud security?

Cloud SecurityEasy

Show answer

The cloud provider secures the infrastructure: data centres, hardware, hypervisors and managed service internals. The customer secures what they put in the cloud: identities, data, configurations, network rules and their applications. The split changes by service type; with IaaS you patch the OS, with SaaS you mainly manage users and data settings. Most cloud breaches come from customer-side misconfiguration, not provider failures.

What is PCI DSS?

GRC and ComplianceMedium

Show answer

The Payment Card Industry Data Security Standard applies to any organisation that stores, processes or transmits cardholder data. Version 4.0.1 is current, and its future-dated requirements became mandatory from March 2025. It has 12 requirement areas, including network security controls, protecting stored data, encryption in transit, vulnerability management, access control, logging and testing. Reducing scope through tokenisation and segmentation lowers compliance effort.

What is the difference between a SIEM and a SOAR?

Show answer

A SIEM collects and correlates logs to detect threats. SOAR, Security Orchestration, Automation and Response, takes alerts and runs playbooks that enrich, decide and act, for example looking up an IP's reputation, querying EDR, disabling a user and opening a ticket. SIEM answers what is happening; SOAR speeds up the response. Many platforms now combine both, but automation still needs human approval for disruptive actions.

What is the difference between OAuth 2.0 and OpenID Connect?

Identity and Access ManagementMedium

Show answer

OAuth 2.0 is an authorisation framework; it lets an app get an access token to call an API on a user's behalf, without the user's password. It does not define who the user is. OpenID Connect adds an identity layer with an ID token, a signed JWT containing user claims, and a userinfo endpoint. Use OIDC for login, and OAuth access tokens for API authorisation.

What is a salt and why is it used in password hashing?

Show answer

A salt is a unique random value stored with each password hash. It makes identical passwords produce different hashes, so precomputed rainbow tables are useless and attackers must crack each hash separately. Salts are not secret. A pepper is an additional secret kept outside the database. Combined with slow algorithms like Argon2id, bcrypt or scrypt, salting makes offline cracking much more expensive.

What does GRC stand for in cyber security?

GRC and ComplianceEasy

Show answer

GRC is Governance, Risk and Compliance. Governance sets direction, policies, roles and accountability for security. Risk management identifies, assesses and treats risks to an acceptable level. Compliance ensures the organisation meets laws, regulations, contracts and standards such as the DPDP Act, RBI directions, ISO 27001 and PCI DSS. GRC analysts write policies, run risk assessments, manage audits and track remediation.

What is chain of custody in digital forensics?

Show answer

Chain of custody is the documented record of who collected evidence, when, how, where it was stored and every person who handled it. It proves evidence was not altered, which is essential if the case goes to court or regulators. Practices include hashing disk images at acquisition, using write blockers, storing evidence securely and logging every transfer with signatures and timestamps.

What is third-party or vendor risk management?

GRC and ComplianceMedium

Show answer

TPRM assesses and monitors the security of vendors that access your data or systems, since many breaches start with a supplier. It includes tiering vendors by risk, security questionnaires, reviewing SOC 2 or ISO 27001 reports, contract clauses for breach notification and audit rights, and continuous monitoring. High-risk vendors such as payroll or cloud providers get deeper reviews and annual reassessment.

What is the order of volatility in evidence collection?

Incident Response and ForensicsMedium

Show answer

Collect the most volatile evidence first because it disappears quickly. The order is CPU registers and cache, memory including running processes and network connections, temporary files, disk, remote logs, and finally archived media. That is why responders capture RAM before shutting down a machine, since malware running only in memory, decrypted keys and active connections are lost at power off.

What is TLS and what does the handshake achieve?

Network SecurityMedium

Show answer

TLS secures data in transit. In the TLS 1.3 handshake the client and server agree on cipher suites, perform an ephemeral key exchange such as X25519 for forward secrecy, and the server proves its identity with a certificate signed by a trusted CA. Both derive session keys, then traffic is encrypted with an AEAD cipher like AES-GCM. TLS 1.0 and 1.1 are deprecated and should be disabled.

What is a false positive and a false negative in SOC alerts?

Show answer

A false positive is an alert on benign activity, such as an admin running a legitimate script flagged as malicious. A false negative is a real attack that produced no alert, which is more dangerous. Too many false positives cause alert fatigue and missed real incidents. Analysts tune rules with allowlists, thresholds and context, and test detections against simulated attacks to find false negatives.

Which cloud logs are essential for security monitoring?