Cyber Security Interview Questions

What is meant by Cybersecurity?

Ans. Cybersecurity is the practice of securing systems, networks, programs, and crucial data from digital or cyber-attacks. In computing language, cyber security protects against unauthorized system access.

What is Cryptography?

Ans: Cryptography is a technique that is used to protect information against third parties referred to as adversaries. Cryptography enables both the sender and the recipient of a message to read the details of the message.

Describe the terms Threat, Vulnerabilities, and Risks.

Ans: 

• Threat: A threat is something that has the potential to cause harm to your organization.
• Vulnerabilities: They are the weak areas of the system which will be able to be exploited by the cyber-criminal.
• Risk: Risk refers to the damage that exploitation of vulnerabilities can cause to the organization.

Wish to make a career in the world of Cyber Security? Start with Cyber Security training!

List some common types of cyberattacks a company may face?

Ans: The cyberattacks most likely to affect a company are:

• Malware
• Phishing
• Data leaks
• DDoS attacks
• Ransomware
• Brute-force attacks

What does the MITM attack mean?

Ans: MITM (Man-in-the-middle) is a kind of attack in which an attacker enters in between the communicating parties and steals the information.
We can prevent MITM attacks by following these methods:

• Using VPN
• Using strong WEP or WPA encryption
• Using Intrusion Detection Systems
• Forcing HTTPS
• Using Public Key Pair Based Authentication

What is port scanning?

Ans: Port scanning is the technique that is used for identifying open ports and the service available on the host. Port scanning is used by Hackers to search for information that may be useful to exploit vulnerabilities. Port Scanning is also used by Administrators for checking network security policies. Commonly used port scanning techniques include:

• UDP
• Ping Scan
• TCP Connect
• TCP Half-Open
• Stealth Scanning

What are Cybersecurity elements?

Ans: Main cyber security elements include:

Information security: Information security involves data protection like customer data, employee login data, and any other data that is essential to the business, like intellectual property data and software development codes.

Network Security: The aim is to protect your company's network like Wi-Fi and Internet from hackers. This is also known as perimeter security.

Application Security: Companies require a secure application for protection against cyber attacks.

End-user education: To have a strong cybersecurity measure in a company, it is essential to educate all employees on cybersecurity. They must be aware of different cyber security threats and the way they can address them.

Operational Security: It is used for the protection of the functions of the company and monitors vital information to detect gaps in the current methods. Business continuity planning is the analysis of the way operations could be affected by a cyber-attack and the way companies can overcome that kind of attack without a significant impact on the business operations.

Leadership commitment: Without proper leadership, the development, implementation, and maintenance of a cybersecurity program will become challenging.

What is the primary purpose of cyber security?

Ans: The main objective of cybersecurity is the protection of data. To protect data from cyberattacks, the security department provides a triangle of three related principles. This principle is called the CIA triad. Confidentiality, integrity, and availability are all elements of the CIA model. It is a security paradigm which guides people through numerous aspects of IT security. The purpose of the CIA model is to assist organizations in developing policies for the architecture of their information security. One or more of the security principles were violated when a security breach was identified.

Cyber Security Training

• Master Your Craft
• Lifetime LMS & Faculty Access
• 24/7 online expert support
• Real-world & Project Based Learning

Explore Curriculum

What is the CIA?

Ans: CIA refers to Confidentiality, integrity, and availability.

• Confidentiality: Confidentiality is similar to privacy to the extent that it prohibits unauthorized access to the data. The goal is to ensure that data is available only to the authorized users to use it and to restrict access to other people. This prevents essential information from falling into the wrong hands. Encrypting data is an excellent example of privacy.
• Integrity: This principle guarantees that the data is accurate, genuine, and free from the perpetrators of unwanted threats or unintentional changes by the user. If modifications are done, precautions must be taken to protect sensitive information from loss or corruption and to recover quickly. It also indicates that the source of information should be genuine.
• Availability: This principle guarantees that information is always accessible and useful to the people who have access to it. It makes sure that system failures or cyberattacks do not interfere with such access.

. What is Traceroute?

Ans: Traceroute is a tool which displays the path of the packets. It lists out all the points through which the package passes. This is especially useful when the package does not reach its destination. It is used to verify the point where the connection breaks or stops to determine the point of failure.

. Distinguish between Threat, Risk, & Vulnerability.

Ans.

Threat: It is an act to show an intention to harm something or to destroy or damage an asset within an organization. Example: Malware or Phishing attack

Risk: In Cyber Security, risk refers to the probability of loss/damage resulting from a cyber attack or organizational data breach. It is a potential loss related to the technical structure of the organization. 

Vulnerability: In Cyber Security, Vulnerability refers to the weaknesses within an information system or internal controls that allows hackers to find their way into your system. Example: SQL injections, system misconfigurations, missing credentials, cross-site scripting

. Define Cross-Site Scripting and its prevention practices.

Ans. Cross-Site Scripting or XSS is a web security vulnerability where an attacker injects malicious scripts into the code on a victim's web browser.

The following are the security best practices to prevent Cross-Site Scripting:

• Sanitize HTML & User Inputs
• Use XSS (Cross-site scripting) HTML Filters
• Validating or Confirming user inputs
• Using Anti-XSS services/tools
• Encoding Special Characters

If you have any doubts on Cyber Security, then get them clarified from Industry experts on our Cyber Security Tutorial !

. Define Cryptography.

Ans. Cryptography is a method or a technique to secure data with encoding to protect it from third parties for whom data is not intended. It restricts the transmission of crucial information to unauthorized parties.

. What do you mean by a Botnet?

Ans. A Botnet or a robot network is a network of internet-connected systems like servers, mobile devices, etc., affected by malware. A bot herder generally controls them.

It is mainly used to send spam, steal crucial data, launch distributed denial-of-service attacks (DDoS attacks), and more. Also, they can share this data with other cybercriminals.

. Distinguish between Hashing and Encryption in Cyber Security.

Ans.  Both hashing and encryption are helpful to make the data unreadable from a readable format. The significant difference between the two is that encrypted data can be transformed into original data by decryption. But we cannot convert the hashed data back to the original data.

Subscribe to our YouTube channel to get new updates..!

Subscribe

. Define the CIA triad.

Ans. CIA refers to the confidentiality, integrity, and availability triad, a model designed to handle the information security policies of an organization.

• Confidentiality means that information is only accessible and available to authorized users. Also, it's a collection of various rules that restrict access to information.
• Integrity - It ensures that the data is highly trusted, reliable, and not altered by unauthorized people.
• Availability - It ensures reliable access to data for authorized users whenever he requires it. Also, it is necessary to take care of data backup, recovery, and network issues.

. What do you mean by Brute force attack? What can we do to prevent it?

Ans: Brute Force is a process to find good references by repeatedly trying all possible permutations and combinations of references. Generally, a Brute force attack will be automated when the software or tool automatically attempts to log in with a list of information. There are several ways you can stop Brute Force attacks. Some are as follows: 

• Password Length: We need to specify a minimum length for the password. The longer the password, the more difficult it becomes to find.
• Password: Adding different character formats to the password complicates brute force attacks. The use of alphanumeric passwords, as well as special characters and lowercase and uppercase characters, increases the complexity of the password, which complicates the task.
• Limiting Login Attempts: Set a limit for the failed login attempts. FoR instance, the limit for failed login attempts can be set to 3. When there are consecutive login failures for three times, then limit the user to login for a while or send an OTP or email to be used to login next time. Since brute force is an automatic process, restricting attempts to connect will break the brute force process.

.How can we reset the password-protected BIOS configuration?

Ans: SQL injection attack is a type of cyberattack where a hacker will manipulate the data that is sent to the server to run malicious SQL code to monitor the database server of a web application, modifying, accessing, and deleting the unauthorized data. SQL injection attack is primarily used to take control of the database servers. We can avoid SQL injection attacks by using these methods:

• Using prepared statements
• Using Stored Procedures
• Validating user input

Check out our Latest Interview Questions video. Register Now Cyber Security Online Training to Become an expert in Cyber security.

. Explain about the OSI model and what are the layers included in it?

Ans: OSI refers to Open Systems Interconnection. The OSI model demonstrates the way applications communicate on the network. It is important to understand and isolate the problem source and is commonly used for the purpose of troubleshooting. There are seven layers in the OSI model. They are:

[Related Articles: Fortinet Cyber Security]

• Physical layer: It transfers the raw data by the communication medium.
• Data Link layer: Determines the format of the data and is responsible for encoding and decoding the data.
• Network layer: The responsibility of the Network layer is to provide communication routes.
• Transport layer: It is Responsible for the end-to-end communication across the network. It makes use of UDP and TCP transmission protocols.
• Session layer: It is used for controlling sessions and ports.
• Presentation Layer: In this layer, Data encryption is carried out, and it will make sure that the data will be in the usable format.
• Application layer: Applications will have access to network services from this layer.

. Explain the differences between symmetric and asymmetric encryption.

Ans: Symmetric encryption needs only one key for encryption and decryption. It is preferable to transfer huge amounts of data because it is quicker.
Asymmetric encryption needs a public key and a private key for data encryption and decryption.
It is used to transfer small data and is slower compared to symmetric encryption.

. Distinguish IDS from IPS in the context of cybersecurity.

Ans: 

IDS refers to Intrusion Detection Systems. It analyzes and monitors network traffic looking for signals which attackers are trying to infiltrate or steal information from your network with the help of a known cyber threat. It detects various activities like malware, security policy violations, and port scanners comparing the existing network activity to a threat database known. 

IPS refers to the Intrusive Prevention System. It is located in between the internal network and the outside world within the same network zone as a firewall. When a packet represents the known security threat, the IPS will proactively ban network traffic according to a security profile.  

The main difference between IPS and IDS is that IPS is a control system while IDS is a monitoring system. IDS does not alter network packets, while IPS blocks packet delivery based on packet content, in the same way that a firewall blocks traffic based on the IP address.

. How do Vulnerability Assessment and Penetration Testing differ?

Ans: Vulnerability assessment is the process for detecting faults on the target. The organization knows that its system or network has defects or weaknesses and wants to identify those defects and prioritize them to correct them. 

The penetration test involves identifying vulnerabilities in the target. Here the organization will implement all possible security measures and would like to test whether there is some alternative way to hack their system or network.

.How do HIDS and NIDS differ?

. What is SSL?

Ans: SSL refers to Secure Sockets Layer. It is a security protocol which permits encrypted connections over the Internet. It is used for preserving the Confidentiality of data and protecting information within online transactions. The steps involved in creating an SSL connection are as follows:

• A browser attempts to connect to the SSL-protected web server.
• The browser transmits a copy of the SSL certificate into the browser.
• The browser verifies whether the SSL certificate can be trusted or not.
• If it is trusted, then the browser will send a message to the web server asking for the creation of an encrypted connection. 
• The web server sends an acknowledgment of receipt to initiate an encrypted SSL connection.
• The SSL encrypted communication happens between the web server and browser.

. Which one is more reliable: HTTPS or SSL?

Ans: SSL is a secure technology which enables two or more parties to communicate in a secure manner on the Internet. To assure security, it operates on HTTP. It functions in the Presentation layer.

HTTPS stands for Hypertext Transfer Protocol Secure. It is a combination of HTTP and SSL, which utilizes encryption to build a more secure browsing experience. The functioning of HTTPS involves the four upper layers of the OSI model - the transportation layer, session layer, presentation layer, and application layer.

When it comes to security, SSL is more secure than HTTPS.

. What does an SQL injection attack mean? How can we prevent it?

Ans: SQL injection attack is a type of cyberattack where a hacker will manipulate the data that is sent to the server to run malicious SQL code to monitor the database server of a web application, modifying, accessing, and deleting the unauthorized data. SQL injection attack is primarily used to take control of the database servers. We can avoid SQL injection attacks by using these methods:

• Using prepared statements
• Using Stored Procedures
• Validating user input

. Define the three-way handshake process.

Ans. A three-way handshake is a process also called the TCP (Transmission Control Protocol) handshake process. This process is mainly helpful in TCP networks for reliable data transmission between the client and the host.

The process is called a three-way handshake because there are three different components to exchange between the server and the client. 

• SYN: This is the first step where the client wants to build a connection with the server. Therefore, he sends a segment or a component with SYN(Synchronize Sequence Number) to the server. It informs the server that a client is ready to communicate and with which sequence number.
• SYN + ACK: The server responds to the client request with an SYN-ACK signal set in this section. Here, the ACK (Acknowledgement) marks the segment's response or component it received. On the other hand, SYN draws the sequence number with which it is likely to begin the segment.
• ACK: The ACK refers to Acknowledgement where the client acknowledges the server's response. They both build a secure and stable connection through which they will begin the actual data transfer process.

[Related Articles: Sap Cyber Security]

. Explain two-factor authentication and its implementation process for public websites.

Ans. Two-factor authentication is also known as 2FA or dual-factor or multi-factor authentication, a process requiring two steps for user verification. It is helpful to protect the user credentials and resources that enhance the security level within the system.

This authentication system can be applied to leading public websites like Twitter, LinkedIn, Gmail, and more. It helps to enable another layer of protection on your existing secure account with a password.

To enable the 2FA or two-factor authentication, you can easily manage security settings by going to the settings tab of your account.

. Explain the use of a Firewall and its implementation process.

Ans. A Firewall is a network security system that monitors and filters incoming and outgoing network traffic. It helps in protecting the system and network from unknown access or malware, viruses, ransomware, etc. Also, it secures the private internal network from unauthorized access.

The following steps will help you to set up and configure firewall security: 

• Change or disable the remote administration feature from the system.
• Modify the default user account and password for a firewall system.
• Design your firewall architecture and IP Addresses and configure the access control lists.
• Configure and set up other firewall services and logging servers and disable the different services that are not in use.
• Ensure that firewall security is configured as per the latest security policies.
• Test your firewall system configuration for its authenticity.
• Continuously monitor and manage firewall systems.

. Distinguish between Vulnerability Assessment and Penetration Testing (PT).

Ans. In the cyber security world, vulnerability assessment and penetration testing are different. But they help to protect the network environment essentially. Let us know the primary difference between the two:-

• Vulnerability Assessment: The main objective of vulnerability assessment is to find the system's or network's critical weaknesses and fix them. Through this, the organization knows that they have some flaws or vulnerabilities in the system. They may want to identify these issues and fix them with significant priority. 
• Penetration Testing: The term penetration testing has another name: pen testing. It's a process of testing or a simulated cyber attack against your system or a network to find the vulnerabilities that attackers could utilize. Here, the pen testers use the same type of tools. Attackers generally use processes and techniques to find the weak areas of the system.

. Distinguish between Stored XSS Attacks and Reflected XSS Attacks.

Ans. 

• Stored XSS Attacks - The stored XSS (Cross-site scripting) attacK occurs when a malicious script is directly injected into the web application. Here, the application receives data from unknown sources. 
• Reflected XSS Attacks - This attack occurs when a malicious script reflects in the website results. Here, the attacker tricks the user by sending a request to his browser; then, it starts running on the victim's browser. Also, it reflects the results from the victim's browser to the attacker who sent the request.

. Explain the HTTP response codes.

Ans. The HTTP response code presents that a specific HTTP request has been finished.

• 1xx (Informational response) - This code explains that the request has been received and the process is continuing.
• 2xx (Success) - The 2xx code says that the request was received successfully and accepted.
• 3xx (Redirection) - The redirection code reflects on taking further action to finish the request.
• 4xx (Client Error) - This code demonstrates that it cannot fulfill the request or contains incorrect syntax.
• 5xx (Server Error) - This code reflects that the server has failed to complete a valid request.

. Define the various techniques used to prevent a Brute Force Attack.

Ans. Brute Force Attack is a hacking method that uses trial and error techniques to crack passwords, login credentials, etc. It's a simple way to identify the proper credentials to get unauthorized access by continuously applying different methods.

The following best practices can help to avoid Brute Force attacks:

• Setup Complex Passwords: Make the passwords stronger by adding special characters.
• (2FA)Two-factor Authentication: To secure accounts from brute force attacks, always prefer the 2FA process.
• Restrict Login Attempts: To avoid Brute Force attacks, try to set up a limit on login attempts.

. Name the most common types of Cyber Security attacks.

Ans. The following types of Cybersecurity attacks are the most common:-

• Ransomware
• Malware 
• Virus Attack
• SQL Injection Attack
• Cross-Site Scripting (XSS) 
• Denial-of-Service Attack (DoS)
• Phishing Attack
• Session Hijacking
• Password Attack
• Man-in-the-middle Attack

. Distinguish between Symmetric and Asymmetric Encryption.

Ans. The following are the differences between symmetric and asymmetric encryption.

Symmetric Encryption

• For encryption purposes, it uses the same or a single key for both the encryption and decryption process. 
• In terms of speed and performance, symmetric encryption is much faster. 
• The different types of algorithms that Symmetric encryption uses include AES, DES, 3DES, RC4, etc.
• The primary use of symmetric encryption is to transfer massive or bulk data. 

Asymmetric Encryption

• It uses different keys or pairs of keys for encryption and decryption of data.
• Performance-wise, the encryption process is slower compared to symmetric encryption.
• The algorithms that this encryption uses include- Diffie-Hellman and RSA.
• The primary purpose of using this type of encryption is to exchange secret keys securely.

.Distinguish between IDS and IPS

Ans. 

IDS or Intrusion Detection Systems

• This system can only detect intrusions but cannot prevent them.
• It's a kind of monitoring system that monitors the network traffic
• Further, looking after the results requires human support or another method.

IPS or Intrusion Prevention Systems

• IPS is capable of detecting and preventing intrusions.
• It's a kind of control system.
• The IPS is an active protection system.
• IPS needs a regularly updated database with new threat data.

. Define Port Scanning.

Ans. Port scanning is a method or an application built to identify open ports and services accessible on a network. It also reveals that any active firewall protection is used within an organization. The following are the different types of port scanning techniques:

• Ping Scan
• TCP half-open
• UDP
• Stealth Scan

. Define the standard methods of Network Security authentication.

Ans. The following are the most common methods for network security authentication:-

Token-based - A token is generally used to access the system, which makes it harder for hackers to access accounts. It is because they use very long credentials for it.

Transaction Authentication - In this type of authentication, a one-time password (OTP) is used in online transaction processing through which they verify the user's identity.

Multi-Factor Authentication- This next-level security system adds an additional layer of protection to the accounts.

Biometric Authentication System - It is a registered physical user feature specifically used to verify the user's identity. 

Out-of-Band Authentication - This two-factor authentication system requires secondary verification through another channel or network.

. Which one is more secure- SSL or HTTPS?

Ans. 

SSL or Secure Sockets Layer

SSL is a security protocol that offers a secure conversation between two parties through the network. Moreover, SSL works on top of the HTTP, enhancing security.

HTTPS or Hypertext Transfer Protocol Secure 

HTTPS is a combination of HTTP and SSL that offers a secure browsing experience to the user with proper encryption.

. What is Salting?

. Differentiate stream cipher and block cipher.

Ans: Steam cipher is a method of encryption in which plain digits are combined with the pseudo-random stream to generate ciphertext one bit at a time. It is used for hardware implementation and is used within the Secure Sockets Layer.

A Block cipher is a method of encryption where a cryptographic key and algorithm are implemented to a block of data, like a group, in order to generate the ciphertext. It is used to encrypt files and databases.

. Explain ARP?

Ans: ARP refers to the Address Resolution Protocol. It is a protocol used to map an IP address to a recognized physical machine address on the LAN. When the incoming packet sent to a host machine on a given local network reaches a gateway, the gateway instructs the ARP program to locate a MAC address or a physical host which matches the IP address. The ARP program searches the ARP cache and, if the address is found, gives it so that the packet will be converted to the appropriate format and length and sent to the machine. If no IP address input is found, ARP will release a special format request packet to every machine on the LAN to identify whether a machine knows it has that associated IP address.

. What is port blocking in LAN?

. What can be done to prevent CSRF attacks?

Ans: The CSRF is known as Cross-site Request Forgery, in which an attacker deceives a victim to act in his or her name. The following steps can be taken to prevent CSRF attacks:

Use of the latest antivirus program to block malicious scripts.

When you authenticate on your bank site or carry out financial transactions on another website, don't navigate to other sites or don't open emails, which makes you run malicious scripts while authenticating to a financial site.

Do not save your login or password in your browsers for financial transactions.

Turn off the script in your browsers.

. What is a botnet?

Ans: A botnet is also referred to as a robot network. It is a malicious program that infects computer networks and puts them under the control of only one attacker, referred to as bot herder. A bot is a single machine which is controlled by bot herders. The attacker acts like a central party that can command each bot to carry out coordinated and criminal actions. 

The botnet is a massive attack as a bot herder will be able to control millions of bots parallelly. Every botnet can be updated by the attacker to change how they behave quickly.

. What are salted hashes?

Ans: If two users have the same password, it results in the same password hashes being created. In this situation, an attacker can easily decode the password by running a dictionary or a brute force attack. In order to prevent this, a salted hash is used.

It is used to Randomize hashes by adding a random string to the password prior to hashing. As a result, two different hashes are created, which may be used to protect users' passwords available in the database from the attacker.

. What is cognitive cybersecurity?

Ans: Cognitive cyber-security is a means of using human-like thinking mechanisms and turning them into artificial intelligence technologies to identify security threats. The aim is to transfer human knowledge to the cognitive system that can serve as a self-learning system. It enables us to identify threats, assess their impact, and implement reactive strategies.

. Explain what cross-site Scripting is and how can we prevent it?

Ans: Cross-Site Scripting is also called a client-side injection attack. Its purpose is to run malicious scripts on the web browser of a victim by malicious code injection.
Cross-Site Scripting may not be possible using the following practices:

• Encryption of special characters.
• With the help of XSS HTML Filter
• Validation of user inputs.
• With the help of Anti-XSS services or tools

. How is Diffie Hellman different from RSA?