Cybersecurity Interview Questions and Answers | CyberSecurity Interview Tips | Edureka

CYBERSECURITY CERTIFICATION COURSE www.edureka.co/cybersecurity-certification-training

CYBERSECURITY CERTIFICATION COURSE www.edureka.co/cybersecurity-certification-trainingCYBERSECURITY CERTIFICATION COURSE www.edureka.co/cybersecurity-certification-training

Cybersecurity Interview Questions
What do you mean by Cybersecurity?1

What do you mean by Cybersecurity?1
Cybersecurity is the combination of processes, practices and technologies designed to protect
networks, computers, programs, data and information from attack, damage or unauthorized
access

What do you have on your home network?2

What do you have on your home network?2
A Home network gives you a test environment for experimentation. Active Directory Domain
Controller, a dedicated Firewall appliance and a net-attached toaster – as long as you are
learning and fiddling with it, that’s what matters.

What is Encryption? Why is it Important?3

What is Encryption? Why is it Important?3
A process of converting data into an unreadable form to prevent unauthorized access and thus
ensuring data protection

Tell me the difference between Symmetric and Asymmetric Encryption4

Tell me the difference between Symmetric and Asymmetric Encryption4
Basis of Comparison Symmetric Encryption Asymmetric Encryption
Encryption key Single key for both encryption and decryption Uses different keys for encryption and
decryption
Performance Encryption is fast but comparatively more
vulnerable
Encryption is slow due to high
computation
Algorithms DES, 3DES, AES, and RC4 Diffie-Hellman, RSA
Purpose Used for bulk data transmission
Often used for securely exchanging
secret keys

What is CIA triad?5

What is CIA triad?5
The CIA Triad for Information security, provides a baseline standard for evaluating and implementing
information security – irrespective of the system and/or organization in question
Security
Confidentiality
Integrity
Availability

What do you understand by Risk, Vulnerability & Threat in a Network?6

What do you understand by Risk, Vulnerability & Threat in a Network?6
Threat refers to someone with the potential to do harm to a system or an organization
Vulnerability refers to a weakness of an asset (resource) that can be exploited by one or more
attackers(threat actors). In other words, it is an issue or bug that allows an attack to be successful
Risk refers to the potential for loss or damage when a threat exploits a vulnerability

How do you report Risk?7

How do you report Risks?7
➢ Risk needs to be assessed first before it can be reported. There are two ways you can analyse risk: it
can be either Quantitative or Qualitative
➢ This approach is suitable for both technical and business guys
➢ The business guys will see the probable loss in numbers while the technical guys will monitor and
assess the impact and frequency. Depending on the audience, the risk can then be reported

How do you differentiate between IPS and IDS system?8

How do you differentiate between IPS and IDS system?8
IDS: Intrusion Detection System
IPS: Intrusion Prevention System
IDS just detect the intrusion and leaves the rest to the administrator for assessment and evaluation or
any further action.
IPS detects the intrusion and takes necessary action to further prevent intrusion.
Also, there is a difference in the positioning of devices in the network. Although they work on the
same concept, the placement is different.

What do you know about Cybersecurity Frameworks?9

What do you know about Cybersecurity Frameworks?9
The Framework is voluntary guidance, based on existing guidelines, and practices for organizations to
better manage and reduce cybersecurity risk.
Most frequently adopted cybersecurity frameworks are: PCI DDS (Payment Card Industry Data Security
Standard), ISO 27001/27002 (International Organization for Standardization), CIS Critical Security
Controls, NIST framework

What is Weak Information Security?10

What is Weak Information Security?10
Information security policy is considered to be weak if it does not meet the criteria of an effective
one. The criteria include: distribution, review, comprehension, compliance, and uniform.
Information security is weak if:
➢ The policy has not been made readily available for review by every employee within the
organization
➢ The organization is unable to demonstrate that employees can review the policy document
➢ The organization is unable to demonstrate that employees understand the content of the policy
document.

What’s the better approach of setting up a firewall?11

What’s the better approach of setting up a firewall?11
Following are the steps you should take to configure your firewall:
Username/password: modify the default password for your firewall device
Remote Administration: Disable the feature of remote administration from outside the network
Port Forwarding: For certain applications to work properly, such as a Web server or FTP server, you
need to configure appropriate port forwarding
DHCP server: Installing a firewall on a network with an existing DHCP server will cause conflicts
unless the firewall’s DHCP server is disabled
Logging: In order to troubleshoot firewall issues or potential attacks, you want to make sure to
enable logging and understand how to view the logs
Policies: you want to have solid security policies in place and make sure that your firewall is
configured to enforce those policies

Can you explain SSL encryption?12

Can you explain SSL encryption?12
SSL (Secure Socket Layer) is a protocol which enables safe conversation between two or more parties.
It is designed to identify and verify that the person you are talking to on the other end is who they say
they are.
HTTPS (Hypertext Transfer Protocol Secure) is HTTP combined with SSL which provides you with a
safer browsing experience with encryption. So, this is a very tricky question but SSL wins in terms of
security.

Which one is more secure SSL or TLS?13

Which one is more secure SSL or TLS?13
SSL Is meant to verify the sender’s identity but it doesn’t search for any more hazards than that. SSL
can help you track the person you are talking to but that can also be tricked at times
TLS is another identification tool just like SSL, but it offers better security features. It provides
additional protection to the data and hence SSL and TLS are often used together for better protection

What are Salted Hashes?14

What are Salted Hashes?14
Salt is a random data. When a properly protected password system receives a new password, it
creates a hash value of that password, a random salt value, and then the combined value is stored in
its database. This helps defend against dictionary attacks and known hash attacks.
Example: If someone uses the same password on two different systems and they are being used using
the same hashing algo, the hash value would be same, however if even one of the system uses salt
with the hashes, the value will be different

How identity theft could be prevented?15

How identity theft could be prevented?15
A few steps to follow are:
➢ Ensure strong and unique password
➢ Avoid sharing confidential information online especially on social media
➢ Shop from known and trusted websites
➢ Use the latest version of the browsers
➢ Install advanced malware and spyware tools
➢ Use specialized security solutions against financial data
➢ Always update your system and the software
➢ Protect your SSN (Social Security Number)

How can you prevent man in the middle attack?16

How can you prevent Man In The Middle (MITM) attack?16
MITM attack happens when a communication between two parties (systems) is intruded or
intercepted by an outside entity.
The first method to prevent this attack would be to have encryption (preferably public key encryption)
between both the parties. This way, they both will have an idea with whom they are talking because of
the digital verification.
Second method, to prevent this, it is best to avoid open Wi-Fi networks and if it is necessary then use
plugins like HTTPS, Forced TLS etc.

State differences between encoding, hashing and encryption17

State differences between encoding, hashing and encryption17
Encoding Hashing Encryption
Converts the data in a desired
format required for exchange
between different systems.
Maintains the integrity of a message
or data. Any change done any day
could be noticed.
ensures that the data is secure and
one needs a digital verification code
or image in order to open or access it

What steps will you take to secure a server?18

What steps will you take to secure a server?18
Secure servers use the Secure Sockets Layer (SSL) protocol for data encryption and decryption to
protect data from unauthorized interception.
Here are four simple ways to secure server:
Step 1: make sure that you have a secure password for your root and administrator users
Step 2: The next thing you need to do is make new users on your system. These will be the users you
use to manage the system
Step 3: Remove remote access from the default root/administrator accounts
Step 4: The next step is to configure your firewall rules for remote access

What is a DDoS attack? How is it Mitigated?19

What is a DDoS attack? How is it mitigated?19
DDoS stands for distributed denial of service. When a network is flooded with large number of requests
which is not recognized to handle making the server unavailable to the legitimate requests.
DDoS can be mitigated by analysing and filtering the traffic in the scrubbing centres. The scrubbing
centres are centralized data cleansing station wherein the traffic to a website is analysed and the
malicious traffic is removed.

Why do you need DNS monitoring?20

Why do you need DNS monitoring?20
The Domain Name System allots your website under a certain domain that is easily recognizable and
also keeps the information about other domain names. It works like a directory for everything on the
internet. Thus, DNS monitoring is very important since you can easily visit a website without actually
having to memorise their IP address

What is a three-way handshake?21

What is a three-way handshake?21
The TCP three-way handshake is the method used by TCP set up a TCP/IP connection over an Internet
Protocol based network.
TCP's three way handshaking technique is often referred to as "SYN-SYN-ACK" (or more accurately SYN,
SYN-ACK, ACK) because there are three messages transmitted by TCP to negotiate and start a TCP
session between two computers.

What are the Black hat, white hat and grey hat hackers?22

What are the Black hat, white hat and grey hat hackers?22
Black hat hackers are those who hack without authority.
White hat hackers are authorised to perform a hacking attempt under signed NDA
Grey hat hackers are white hat hackers which sometimes perform unauthorised activities.

How often should you perform Patch management?23

How often should you perform Patch management?23
Patch manage should be done as soon as it is released. For windows, once the patch is released it
should be applied to all machines not later than one month. Same goes for network devices, patch it as
soon as it is released. Proper patch management process should be followed.

What do you know about application security?24

What do you know about application security?24
Application security is the practice of improving the security of applications using software, hardware
and other procedural methods.
Countermeasures are taken to ensure application security, the most common being an application
firewall that limits the execution of files or the handling of data by specific installed programs.

Differentiate between penetration testing and software testing?25

Differentiate between penetration testing and software testing?25
Penetration Testing Software Testing
Help identify and address the security
vulnerabilities
Focuses on the functionality of the
software and not the security aspect
A good Penetration Tester truly thinks
differently than the other two ... they
don't care about the proper behaviours of
the system/software ... they are crafty,
looking for that one small chink of
vulnerability that was not mitigated
Software Security Tester generally have a
fair amount of cross-over, as they usually
know the full details of the
system/software, they know how its
supposed to properly behave when
properly used, and they can test for a lot
of common end-user misbehaviours

When to use tracert/traceroute?26

When to use tracert/traceroute?26
Small TTL values are transmitted through packets via traceroute. This prevents the packets from getting
into loops. In case you can’t ping the final destination, tracert will help to identify where the connection
stops or gets broken, whether it is firewall, ISP, router etc.

Tell me about some common Cyber Threats27

What are different OSI layers? What is the job of Network layer?28

What are different OSI layers? What is the job of Network layer?28
Application Layer
Presentation Layer
Session Layer
Transport Layer
Network Layer
Physical Layer
Data Link Layer
Network layer controls the
operation of the subnet. The main
job of this layer is to deliver
packets from source to destination
across multiple links.

How would you reset a password-protected BIOS configuration?29

How would you reset a password-protected BIOS configuration?29
Since BIOS is a pre boot system it has its own storage mechanism for its settings and preferences. In
the classic scenario, simply popping out the CMOS (complementary metal-oxide-semiconductor)
battery will be enough to have the memory storing these settings lose its power supply, and as a result
it will lose its settings.
The simplest way by far however is this: if the BIOS has come from the factory with a default password
enabled, try ‘password’.

What is Cross Site Scripting or XSS?30

What is Cross Site Scripting or XSS?30
➢ XSS refers to client-side code injection attack wherein an attacker can execute malicious into a
legitimate website or web application
➢ XSS is amongst the most rampant of web application vulnerabilities and occurs when a web
application makes use of unvalidated or unencoded user input within the output it generates

What is data protection in transit vs data protection at rest?31

What is data protection in transit vs data protection at rest?31
Data Protection in transit Data protection at rest
This when data is going from server to
client
This is when data is just sitting there in its
database or on its hard drive
Effective Data protection measures for in
transit data are critical as data is less
secure when in motion
Data at rest is sometimes considered to be
less vulnerable than data in transit,

Tell me the differences between Cybersecurity and Network Security?32

Tell me the differences between Cybersecurity and Network Security?32
Cybersecurity Network Security
describes that the policies and procedures
implemented by a network administrator to avoid
and keep track of unauthorized access,
exploitation, modification, or denial of the network
and network resources
processes and practices designed to protect
networks, computers, programs and data from
attack, damage or unauthorized access. In a
computing context, security includes both cyber
security and physical security

How will you prevent data leakage?33

How will you prevent data leakage?33
➢ Data leakage is when data gets out of the organisation in an unauthorised way
➢ Data can get leaked through various ways – emails, prints, laptops getting lost, unauthorised upload
of data to public portals, removable drives, photographs etc
➢ a few controls can be restricting upload on internet websites, following an internal encryption
solution, restricting the mails to internal network, restriction on printing confidential data etc.

What is an ARP and how does it work?34

What is an ARP and how does it work?34
➢ Address Resolution Protocol (ARP) is a protocol for mapping an Internet Protocol address (IP
address) to a physical machine address that is recognized in the local network.
How it works?
➢ When an incoming packet destined for a host machine on a particular local area network arrives at
a gateway, the gateway asks the ARP program to find a physical host or MAC address that matches
the IP address
➢ The ARP program looks in the ARP cache and, if it finds the address, provides it so that the packet
can be converted to the right packet length and format and sent to the machine
➢ If no entry is found for the IP address, ARP broadcasts a request packet in a special format to all the
machines on the LAN to see if one machine knows that it has that IP address associated with it.

What is 2FA and how can it be implemented for the public websites?35

What is 2FA and how can it be implemented for the public websites?35
➢ An extra layer of security that is known as "multi factor authentication“
➢ Requires not only a password and username but also something that only, and only, that user has on
them, i.e. a piece of information only they should know or have immediately to hand - such as a
physical token
➢ Authenticator apps replace the need to obtain a verification code via text, voice call or email

What techniques can be used to prevent brute force login attack?36

What techniques can be used to prevent brute force login attack?36
➢ Here, the attacker tries to determine the password for a target (service/system/device) through a
permutation or fuzzing process
➢ As it is a lengthy task, attackers usually employ a software such as fuzzer, to automate the process of
creating numerous passwords to be tested against a target
➢ In order to avoid such attacks – password best practices should be followed, mainly on critical
resources like servers, routers, exposed services and so on

What is Cognitive Cybersecurity?37

What is Cognitive Cybersecurity?37
➢ application of AI technologies patterned on human thought processes to detect threats and protect
physical and digital systems
➢ Self-learning security systems use data mining, pattern recognition and natural language processing
to simulate the human brain, albeit in a high-powered computer model

What is port blocking within LAN?38

What is port blocking within LAN?38
➢ Restricting the users from accessing a set of services within the local area network is called port
blocking
➢ Stopping the source to not to access the destination node via ports as application works on the ports
so ports are blocked to restricts the access filling up the security holes in the network infrastructure

What is the difference between VPN and VLAN?39

What is the difference between VPN and VLAN?39
VPN VLAN
related to remote access to the network of a
company
helps to group workstations that are not within
the same locations into the same broadcast
domain
used to connect two points in a secured and
encrypted tunnel.
basically a means to logically segregate
networks without physically segregating them
with various switches
saves the data from prying eyes while in transit
and no one on the net can capture the packets
and read the data
does not involve any encryption technique but
it is only used to slice up your logical network
into different sections for the purpose of
management and security

What protocols falls under TCP/IP internet layer?40

Scenario Based Cybersecurity Questions
Scenario 1You receive the following email from the Help Desk:
Dear UCSC Email User,
Beginning next week, we will be deleting all inactive email accounts in order to create space for more users. You are required to send the
following information to continue using your email account. If we do not receive this information from you by the end of the week, your
email account will be closed.
• Name (first and last):
• Email Login:
• Password:
• Date of birth:
• Alternate email:
Please contact the Webmail Team with any questions. Thank you for your immediate attention.
What do you do? Justify your actions.1
Scenario 1

Scenario Based Cybersecurity Questions: Answer
➢ This email is a classic example of “phishing” – trying to trick
you into “biting”. The justification is the generalised way of
addressing the receiver which is used in mass spam mails.
➢ Above that a corporate company will never ask personal
details on mail
➢ They want your information. Don't respond to email, instant
messages (IM), texts, phone calls, etc., asking you for your
password or other private information.
➢ You should never disclose your password to anyone, even if
they say they work for UCSC, ITS, or other campus
organizations.

Scenario 1A friend sends an electronic Hallmark greeting card (e-card) to your work email. You need to click on the
attachment to see the card.
What do you do? Justify your actions.2
Scenario 2

This one has four big risks:
➢ 1. Some attachments contain viruses or other malicious
programs, so just in general, it’s risky to open unknown or
unsolicited attachments.
➢ 2. Also, in some cases just clicking on a malicious link can
infect a computer, so unless you are sure a link is safe, don’t
click on it.
➢ 3. Email addresses can be faked, so just because the email
says it is from someone you know, you can’t be certain of this
without checking with the person.
➢ 4. Finally, some websites and links look legitimate, but they’re
really hoaxes designed to steal your information.

Scenario 1One of the staff members in ITS subscribes to a number of free IT magazines.
Among the questions she was asked in order to activate her subscriptions, one magazine asked for her month of birth,
a second asked for her year of birth, and a third asked for her mother's maiden name.
What do you infer is going on in this situation? Justify.3
Scenario 3

➢ All three newsletters probably have the same parent company
or are distributed through the same service. The parent
company or service can combine individual pieces of
seemingly-harmless information and use or sell it for identity
theft
➢ It is even possible that there is a fourth newsletter that asks
for day of birth as one of the activation questions
➢ Often questions about personal information are optional. In
addition to being suspicious about situations like the one
described here, never provide personal information when it is
not legitimately necessary, or to people or companies you
don’t personally know.

Scenario 1In our computing labs and departments, print billing is often tied to the user's login. People login, they print,
they (or their department) get a bill.
Sometimes people call to complain about bills for printing they never did only to find out that the bills are, indeed, correct.
What do you infer is going on in this situation? Justify.4
Scenario 4

➢ Sometimes they realize they loaned their account to a friend
who couldn't remember his/her password, and the friend did
the printing. Thus the charges. It’s also possible that
somebody came in behind them and used their account
➢ This is an issue with shared or public computers in general. If
you don’t log out of the computer properly when you leave,
someone else can come in behind you and retrieve what you
were doing, use your accounts, etc. Always log out of all
accounts, quit programs, and close browser windows before
you walk away.

Scenario 1We saw a case a while back where someone used their yahoo account at a computer lab on campus. She made sure
her yahoo account
was no longer open in the browser window before leaving the lab. Someone came in behind her and used the same
browser to re-access her account.
They started sending emails from it and caused all sorts of mayhem.
What do you think might be going on here?5
Scenario 5

➢ The first person probably didn't log out of her account, so the
new person could just go to history and access her account.
➢ Another possibility is that she did log out, but didn’t clear her
web cache. (This is done through the browser menu to clear
pages that the browser has saved for future use.)

Scenario 1Two different offices on campus are working to straighten out an error in an employee’s bank account due to a
direct deposit mistake.
Office #1 emails the correct account and deposit information to office #2, which promptly fixes the problem.
The employee confirms with the bank that everything has, indeed, been straightened out.
What is wrong here?6
Scenario 6

➢ Account and deposit information is sensitive data that could
be used for identity theft. Sending this or any kind of sensitive
information by email is very risky because email is typically
not private or secure. Anyone who knows how can access it
anywhere along its route.
➢ As an alternative, the two offices could have called each other
or worked with ITS to send the information a more secure
way.

Scenario 1The mouse on your computer screen starts to move around on its own and click on things on your desktop. What do you do?
a) Call your co-workers over so they can see
b) Disconnect your computer from the network
c) Unplug your mouse
d) Tell your supervisor
e) Turn your computer off
f) Run anti-virus
g) All of the above
Select all the options that apply.7
Scenario 7

Right answer is B & D.
➢ This is definitely suspicious. Immediately report the problem
to your supervisor and the ITS Support Center:
itrequest.ucsc.edu, 459-HELP (4357), help@ucsc.edu or Kerr
Hall room 54, M-F 8AM-5PM
➢ Also, since it seems possible that someone is controlling the
computer remotely, it is best if you can disconnect the
computer from the network (and turn off wireless if you have
it) until help arrives. If possible, don’t turn off the computer.

Scenario 1Below are a list of passwords pulled out a database.
A. @#$)*&^%
B. akHGksmLN
C. UcSc4Evr!
D. Password1
Which of the following passwords meets UCSC’s
password requirements?
8
Scenario 8

Answer is UcSc4Evr!
➢ This is the only choice that meets all of the following UCSC
requirements:
➢ At least 8 characters in length
➢ Contains at least 3 of the following 4 types of characters:
lower case letters, upper case letters, numbers, special
characters
➢ Not a word preceded or followed by a digit

Scenario 1You receive an email from your bank telling you there is a problem with your account. The email provides instructions
and a link so you can log in
to your account and fix the problem.
What should you do?9
Scenario 9

➢ Delete the email. Better yet, use the web client (e.g. gmail,
yahoo mail, etc.) and report it as spam or phishing, then
delete it.
➢ Any unsolicited email or phone call asking you to enter your
account information, disclose your password, financial
account information, social security number, or other personal
or private information is suspicious – even if it appears to be
from a company you are familiar with. Always contact the
sender using a method you know is legitimate to verify that
the message is from them.

Scenario 1A while back, the IT folks got a number of complaints that one of our campus computers was sending out Viagra spam.
They checked it out, and the reports were true: a hacker had installed a program on the computer that made it automatically
send out tons of spam email without the computer owner’s knowledge.
How do you think the hacker got into the
computer to set this up?
10
Scenario 10

➢ This was actually the result of a hacked password. Using
passwords that can't be easily guessed, and protecting your
passwords by not sharing them or writing them down can
help to prevent this. Passwords should be at least 8 characters
in length and use a mixture of upper and lower case letters,
numbers, and symbols.
➢ Even though in this case it was a hacked password, other
things that could possibly lead to this are:
➢ Out of date patches/updates
➢ No anti-virus software or out of date anti-virus software

Cybersecurity Interview Questions and Answers | CyberSecurity Interview Tips | Edureka

More Related Content

What's hot (20)

Similar to Cybersecurity Interview Questions and Answers | CyberSecurity Interview Tips | Edureka (20)

More from Edureka! (20)

Recently uploaded (20)

Cybersecurity Interview Questions and Answers | CyberSecurity Interview Tips | Edureka