Top 100 Cybersecurity Interview Questions and Answers [2026]

1. What is Cybersecurity?

Answer: Cybersecurity is the practice of protecting systems, networks, programs, and data from digital attacks, unauthorized access, damage, or theft. It encompasses technologies, processes, and practices designed to safeguard computers, servers, mobile devices, electronic systems, networks, and data from malicious attacks. Cybersecurity covers areas including network security, application security, information security, operational security, disaster recovery, and end-user education.

2. What is the CIA Triad?

Answer: The CIA Triad is the foundational model for information security consisting of three core principles:

• Confidentiality: Ensuring information is accessible only to authorized individuals
• Integrity: Maintaining accuracy and completeness of data, preventing unauthorized modification
• Availability: Ensuring authorized users have reliable access to information and resources when needed

3. What is the difference between a threat, vulnerability, and risk?

Answer:

• Threat: A potential cause of an unwanted incident that may result in harm (e.g., hackers, malware, natural disasters)
• Vulnerability: A weakness in a system that can be exploited by threats (e.g., unpatched software, weak passwords)
• Risk: The potential for loss or damage when a threat exploits a vulnerability. Risk = Threat × Vulnerability × Impact

4. What is a firewall and how does it work?

Answer: A firewall is a network security device that monitors and controls incoming and outgoing network traffic based on predetermined security rules. It acts as a barrier between trusted internal networks and untrusted external networks. Firewalls can be hardware-based, software-based, or cloud-based. They work by examining data packets and either allowing or blocking them based on rules regarding IP addresses, ports, protocols, and application types.

5. What is the difference between IDS and IPS?

Answer:

• IDS (Intrusion Detection System): Monitors network traffic for suspicious activity and alerts administrators. It's passive – it detects and reports but doesn't take action
• IPS (Intrusion Prevention System): Actively monitors and can take action to prevent detected threats. It sits inline with traffic and can block malicious packets in real-time

6. What is a VPN and why is it used?

Answer: A VPN (Virtual Private Network) creates a secure, encrypted connection over a less secure network like the internet. It's used to: protect data transmission from eavesdropping, allow remote workers to securely access corporate resources, bypass geographical restrictions, mask user's IP address and location, and ensure privacy on public WiFi networks. VPNs use protocols like OpenVPN, IPSec, L2TP, and WireGuard.

7. What is the difference between symmetric and asymmetric encryption?

Answer:

• Symmetric Encryption: Uses a single shared key for both encryption and decryption. It's faster but requires secure key exchange. Examples: AES, DES, 3DES
• Asymmetric Encryption: Uses a pair of keys (public and private). The public key encrypts, and only the corresponding private key can decrypt. Slower but more secure for key exchange. Examples: RSA, ECC, Diffie-Hellman

8. What is a DDoS attack?

Answer: A DDoS (Distributed Denial of Service) attack overwhelms a target system, service, or network with traffic from multiple compromised sources (botnet), making it unavailable to legitimate users. Types include volumetric attacks (flooding bandwidth), protocol attacks (exploiting protocol weaknesses), and application layer attacks (targeting web servers). Mitigation includes rate limiting, traffic analysis, CDNs, and DDoS protection services.

9. What is phishing?

Answer: Phishing is a social engineering attack where attackers send fraudulent communications (typically emails) that appear to come from legitimate sources to trick victims into revealing sensitive information like login credentials, credit card numbers, or installing malware. Variants include spear phishing (targeted), whaling (targeting executives), vishing (voice phishing), and smishing (SMS phishing). Prevention includes user awareness training, email filtering, and multi-factor authentication.

10. What is the difference between authentication and authorization?

Answer:

• Authentication: Verifies the identity of a user or system – "Who are you?" Methods include passwords, biometrics, tokens, and certificates
• Authorization: Determines what actions an authenticated user is permitted to perform – "What can you do?" Implemented through access control lists, role-based access control (RBAC), and attribute-based access control (ABAC)

11. What is multi-factor authentication (MFA)?

Answer: MFA is a security mechanism requiring users to provide two or more verification factors to gain access. The factors include: something you know (password, PIN), something you have (phone, token, smart card), and something you are (fingerprint, face recognition). MFA significantly reduces the risk of unauthorized access even if one factor is compromised. Common implementations include SMS codes, authenticator apps (Google Authenticator, Microsoft Authenticator), and hardware tokens (YubiKey).

12. What is SSL/TLS?

Answer: SSL (Secure Sockets Layer) and TLS (Transport Layer Security) are cryptographic protocols that provide secure communication over networks. TLS is the successor to SSL. They work by establishing an encrypted link between a web server and browser through a handshake process involving certificate verification and key exchange. TLS 1.3 is the current standard, offering improved security and performance. Websites using HTTPS employ TLS to encrypt data in transit.

13. What is a zero-day vulnerability?

Answer: A zero-day vulnerability is a software security flaw unknown to the vendor or developers, meaning no patch exists. "Zero-day" refers to the fact that developers have had zero days to fix the issue. These vulnerabilities are highly valuable to attackers and on black markets. Defense strategies include behavior-based detection, application sandboxing, network segmentation, and keeping systems updated to minimize attack surface.

14. What is social engineering?

Answer: Social engineering is the psychological manipulation of people to divulge confidential information or perform actions that compromise security. It exploits human nature rather than technical vulnerabilities. Common techniques include phishing, pretexting (creating false scenarios), baiting (offering something enticing), tailgating (following authorized personnel), and quid pro quo (offering services in exchange for information). Defense requires continuous security awareness training.

15. What is the principle of least privilege?

Answer: The principle of least privilege states that users, programs, and processes should only have the minimum access rights necessary to perform their legitimate functions. This limits the potential damage from accidents, errors, or unauthorized use. Implementation includes role-based access control, regular access reviews, just-in-time access provisioning, and privileged access management (PAM) solutions.

16. What is a SIEM system?

Answer: SIEM (Security Information and Event Management) is a solution that aggregates and analyzes log data from across an organization's technology infrastructure. It provides real-time analysis of security alerts, log correlation, incident detection, and compliance reporting. Popular SIEM tools include Splunk, IBM QRadar, Microsoft Sentinel, and ArcSight. SIEM helps SOC teams identify threats, investigate incidents, and maintain audit trails.

17. What is a security policy?

Answer: A security policy is a formal document that defines an organization's rules and procedures for protecting its information assets. It covers acceptable use, password requirements, data classification, incident response, access control, and compliance requirements. Security policies provide the foundation for an organization's security program and are typically approved by senior management. They should be regularly reviewed and updated.

18. What is hashing and how is it different from encryption?

Answer: Hashing is a one-way function that converts data into a fixed-size string (hash value). Unlike encryption, hashing is irreversible – you cannot retrieve the original data from the hash. Hashing is used for password storage, data integrity verification, and digital signatures. Common algorithms include SHA-256, SHA-3, and bcrypt (for passwords). Encryption is reversible with the correct key; hashing is not meant to be reversed.

19. What is a penetration test?

Answer: A penetration test (pen test) is an authorized simulated cyberattack performed to evaluate the security of a system. It identifies vulnerabilities, tests defenses, and validates security controls. Types include black box (no prior knowledge), white box (full knowledge), and gray box (partial knowledge). Pen testing follows methodologies like OWASP, PTES, and NIST. The output is a detailed report with findings and remediation recommendations.

20. What is the OWASP Top 10?

Answer: The OWASP Top 10 is a standard awareness document listing the most critical web application security risks. The 2021 version includes: Broken Access Control, Cryptographic Failures, Injection, Insecure Design, Security Misconfiguration, Vulnerable and Outdated Components, Identification and Authentication Failures, Software and Data Integrity Failures, Security Logging and Monitoring Failures, and Server-Side Request Forgery (SSRF). It's essential reading for web security professionals.

21. What is the OSI model and why is it important for security?

Answer: The OSI (Open Systems Interconnection) model is a conceptual framework with 7 layers: Physical, Data Link, Network, Transport, Session, Presentation, and Application. Each layer has specific security considerations. For security professionals, understanding OSI helps in identifying where attacks occur (e.g., Layer 3 for IP spoofing, Layer 7 for application attacks), implementing appropriate controls at each layer, and analyzing network traffic during incident investigation.

22. What is the difference between TCP and UDP?

Answer:

• TCP (Transmission Control Protocol): Connection-oriented, reliable, guarantees delivery order, includes error checking and flow control. Used for web, email, file transfer
• UDP (User Datagram Protocol): Connectionless, faster but unreliable, no guaranteed delivery. Used for streaming, gaming, DNS, VoIP

Security implication: TCP's three-way handshake can be exploited in SYN flood attacks; UDP is used in amplification DDoS attacks.

23. What is ARP poisoning/spoofing?

Answer: ARP (Address Resolution Protocol) poisoning is a Layer 2 attack where an attacker sends falsified ARP messages to link their MAC address with a legitimate IP address on the network. This allows traffic interception (man-in-the-middle), session hijacking, and denial of service. Prevention includes using static ARP entries, Dynamic ARP Inspection (DAI), network segmentation, and encryption for sensitive traffic.

24. What is DNS poisoning?

Answer: DNS poisoning (DNS spoofing) corrupts the DNS cache to redirect users to malicious websites. Attackers inject false DNS records, causing users to be directed to fake sites even when entering correct URLs. Prevention includes using DNSSEC (DNS Security Extensions), keeping DNS software updated, implementing DNS over HTTPS (DoH) or DNS over TLS (DoT), and using trusted DNS providers.

25. What is a man-in-the-middle (MITM) attack?

Answer: A MITM attack occurs when an attacker secretly intercepts and possibly alters communications between two parties who believe they're communicating directly. Common techniques include ARP spoofing, DNS spoofing, SSL stripping, and rogue WiFi access points. Prevention includes using encrypted protocols (HTTPS, SSH), certificate pinning, strong authentication, and avoiding untrusted networks.

26. What are common ports that security professionals should know?

Answer: Essential ports include: 20/21 (FTP), 22 (SSH), 23 (Telnet), 25 (SMTP), 53 (DNS), 80 (HTTP), 110 (POP3), 143 (IMAP), 443 (HTTPS), 445 (SMB), 3306 (MySQL), 3389 (RDP), 5432 (PostgreSQL), 8080 (HTTP Proxy). Security teams must monitor these ports for unusual activity, ensure unnecessary ports are closed, and use non-standard ports when appropriate to reduce attack surface.

27. What is network segmentation?

Answer: Network segmentation divides a network into smaller, isolated segments using VLANs, subnets, or physical separation. Benefits include limiting lateral movement during breaches, containing malware spread, improving performance, simplifying compliance, and providing defense in depth. Critical systems like payment processing, IoT devices, and guest networks should be segmented from the main corporate network.

28. What is a DMZ in network security?

Answer: A DMZ (Demilitarized Zone) is a perimeter network segment that sits between an organization's internal network and the external internet. It hosts public-facing services (web servers, email servers, DNS) while protecting internal resources. Traffic from the internet can access DMZ services, but access to the internal network is restricted. DMZ provides an additional security layer, and compromised DMZ servers don't immediately expose internal assets.

29. What is the difference between stateful and stateless firewalls?

Answer:

• Stateless Firewall: Filters packets based solely on source/destination IP and port without tracking connection state. Faster but less secure
• Stateful Firewall: Tracks active connections and makes decisions based on connection state and context. More secure as it understands traffic patterns and can block packets that don't match established connections

30. What is a proxy server?

Answer: A proxy server acts as an intermediary between clients and servers. Security benefits include: anonymity by hiding internal IP addresses, content filtering and malware scanning, caching for performance, access control, and logging for compliance. Types include forward proxies (client-side), reverse proxies (server-side), and transparent proxies. Organizations use proxies to enforce security policies and monitor web traffic.

31. What is port scanning and how do you detect it?

Answer: Port scanning is a technique used to discover open ports and services on a target system. While legitimate for network administration, it's often the first step in an attack. Types include TCP connect, SYN scan, FIN scan, and UDP scan. Tools like Nmap are commonly used. Detection methods include IDS/IPS alerts, firewall logs, rate limiting, and honeypots. Unusual scanning activity should trigger investigation.

32. What is NAT and how does it provide security?

Answer: NAT (Network Address Translation) maps private internal IP addresses to public IP addresses. Security benefits include hiding internal network structure from external networks, conserving public IP addresses, and providing a basic barrier (though not a replacement for firewalls). Types include Static NAT, Dynamic NAT, and PAT (Port Address Translation). NAT complicates peer-to-peer connections and some protocols requiring NAT traversal solutions.

33. What is a honeypot?

Answer: A honeypot is a decoy system designed to attract and detect attackers, gather intelligence about attack methods, and divert attention from actual systems. Types include low-interaction (simulated services) and high-interaction (full operating systems). Honeypots help in early threat detection, studying attacker behavior, and improving defenses. Honeynets are networks of honeypots providing broader coverage and more realistic environments.

34. What is VLAN hopping?

Answer: VLAN hopping is an attack that allows traffic from one VLAN to access another VLAN without routing. Methods include switch spoofing (attacker acts as a switch to negotiate trunking) and double tagging (adding extra VLAN tags). Prevention includes disabling unused ports, not using VLAN 1, disabling DTP on access ports, implementing proper VLAN access lists, and using Private VLANs.

35. What is Wireshark and how is it used in security?

Answer: Wireshark is an open-source network protocol analyzer used for packet capture and analysis. Security uses include: investigating security incidents, analyzing malware communication, detecting suspicious traffic patterns, verifying encryption implementation, and troubleshooting network issues. Key skills include understanding protocols, using display filters (e.g., http, tcp.port==443), following TCP streams, and identifying anomalies in network traffic.

36. What is AES encryption?

Answer: AES (Advanced Encryption Standard) is a symmetric block cipher adopted as the encryption standard by the US government. It operates on 128-bit blocks and supports key sizes of 128, 192, or 256 bits. AES-256 is considered highly secure and is used for classified information. AES is faster than asymmetric encryption and is widely used for encrypting data at rest, SSL/TLS, VPNs, and disk encryption.

37. What is RSA?

Answer: RSA (Rivest-Shamir-Adleman) is an asymmetric encryption algorithm based on the difficulty of factoring large prime numbers. It uses a public key for encryption and a private key for decryption. RSA is commonly used for secure data transmission, digital signatures, and key exchange. Key sizes typically range from 2048 to 4096 bits. While secure, RSA is slower than symmetric encryption and is often used to encrypt symmetric keys rather than large data.

38. What is a digital signature?

Answer: A digital signature is a cryptographic mechanism that verifies the authenticity and integrity of digital messages or documents. The sender creates a hash of the message and encrypts it with their private key. Recipients decrypt with the sender's public key and compare hashes. Digital signatures provide authentication (confirms sender), integrity (detects changes), and non-repudiation (sender cannot deny signing). Used in software distribution, legal documents, and financial transactions.

39. What is PKI (Public Key Infrastructure)?

Answer: PKI is a framework for managing digital certificates and public-key encryption. Components include Certificate Authority (CA) that issues certificates, Registration Authority (RA) that verifies identities, Certificate Repository that stores certificates, and Certificate Revocation List (CRL). PKI enables secure communication, digital signatures, and authentication across the internet. It's the foundation of HTTPS and secure email.

40. What is the difference between encoding, encryption, and hashing?

Answer:

• Encoding: Transforms data into another format for compatibility (Base64, URL encoding). Not for security – easily reversible
• Encryption: Transforms data to prevent unauthorized access using keys. Reversible with correct key. Used for confidentiality
• Hashing: One-way transformation producing fixed-size output. Not reversible. Used for integrity verification and password storage

41. What is salting in password storage?

Answer: Salting is adding random data (salt) to passwords before hashing. Each password gets a unique salt stored alongside the hash. Benefits include defeating rainbow table attacks, ensuring identical passwords produce different hashes, and increasing the cost of brute-force attacks. Best practices include using cryptographically random salts, unique salt per password, and sufficient salt length (at least 16 bytes).

42. What is the Diffie-Hellman key exchange?

Answer: Diffie-Hellman is a key exchange protocol allowing two parties to establish a shared secret over an insecure channel without prior shared secrets. Each party generates public/private key pairs and exchanges public values. Through mathematical operations, both derive the same shared secret. It's used in TLS, VPNs, and SSH. ECDH (Elliptic Curve Diffie-Hellman) is a more efficient variant using elliptic curve cryptography.

43. What is Perfect Forward Secrecy (PFS)?

Answer: PFS ensures that session keys cannot be compromised even if the server's long-term private key is compromised in the future. Each session uses unique ephemeral keys that are discarded after use. Even if an attacker records encrypted traffic and later obtains the private key, they cannot decrypt past sessions. PFS is implemented using ephemeral Diffie-Hellman (DHE or ECDHE) in TLS.

44. What are common hash algorithms and their security status?

Answer:

• MD5: Broken – collision attacks possible. Never use for security
• SHA-1: Deprecated – theoretical attacks demonstrated. Avoid for new applications
• SHA-256/SHA-384/SHA-512: Secure and recommended for general use
• SHA-3: Latest standard, alternative design to SHA-2
• bcrypt/Argon2: Recommended for password hashing due to computational cost

45. What is a rainbow table attack?

Answer: A rainbow table is a precomputed table for reversing cryptographic hash functions, used for cracking password hashes. Attackers lookup hash values in the table to find corresponding passwords. Defenses include using salts (unique random values added to passwords before hashing), strong hashing algorithms (bcrypt, Argon2), and sufficient iterations to slow computation.

46. What is encryption at rest vs. encryption in transit?

Answer:

• Encryption at Rest: Protects data stored on disks, databases, or storage systems. Examples: BitLocker, LUKS, AWS S3 SSE, database TDE
• Encryption in Transit: Protects data moving across networks. Examples: TLS/SSL for web traffic, SSH for remote access, IPSec for VPNs

Both are necessary for comprehensive data protection.

47. What is steganography?

Answer: Steganography is the practice of hiding information within other non-secret data or files, such as embedding data in images, audio, or video. Unlike encryption which makes data unreadable, steganography conceals the existence of the message. Security implications include malware hiding in images and covert data exfiltration. Detection involves steganalysis techniques and monitoring for unusual file characteristics.

48. What is end-to-end encryption?

Answer: End-to-end encryption (E2EE) ensures that only communicating users can read the messages. Data is encrypted on the sender's device and only decrypted on the recipient's device. Even the service provider cannot access the content. Examples include Signal, WhatsApp (messages), and ProtonMail. E2EE protects against eavesdropping, but metadata (who communicated when) may still be visible.

49. What is a certificate and how do you validate it?

Answer: A digital certificate is an electronic document that proves ownership of a public key. Validation includes: checking if the certificate is signed by a trusted CA, verifying the certificate chain, confirming the certificate hasn't expired, checking the Certificate Revocation List (CRL) or using OCSP, and matching the domain name. Browser warnings occur when validation fails, indicating potential security risks.

50. What is quantum cryptography and post-quantum cryptography?

Answer: Quantum cryptography uses quantum mechanics principles for secure communication, notably Quantum Key Distribution (QKD). Post-quantum cryptography refers to cryptographic algorithms resistant to attacks by quantum computers, which could break RSA and ECC. NIST is standardizing post-quantum algorithms (CRYSTALS-Kyber, CRYSTALS-Dilithium). Organizations should begin planning for quantum-resistant encryption as quantum computers advance.

51. What are the main types of malware?

Answer:

• Virus: Self-replicating code that attaches to legitimate programs
• Worm: Self-replicating malware that spreads without user interaction
• Trojan: Malicious software disguised as legitimate applications
• Ransomware: Encrypts files and demands payment for decryption
• Spyware: Secretly monitors and collects user information
• Adware: Displays unwanted advertisements
• Rootkit: Hides malware presence from detection
• Keylogger: Records keystrokes to capture sensitive data

52. What is ransomware and how do you defend against it?

Answer: Ransomware encrypts victim's files and demands payment (usually cryptocurrency) for the decryption key. Defense strategies include: regular offline backups, keeping systems patched, email filtering, user awareness training, network segmentation, disabling macros, endpoint detection and response (EDR), and having an incident response plan. Never pay ransom as it encourages attackers and doesn't guarantee recovery.

53. What is a botnet?

Answer: A botnet is a network of compromised computers (bots/zombies) controlled by an attacker (botmaster) through a command and control (C2) server. Botnets are used for DDoS attacks, spam campaigns, cryptocurrency mining, credential theft, and distributing malware. Detection involves monitoring for unusual network traffic, DNS queries to known C2 domains, and behavioral anomalies. Prevention includes patching, endpoint security, and network monitoring.

54. What is static vs. dynamic malware analysis?

Answer:

• Static Analysis: Examining malware without executing it. Includes file hash analysis, strings extraction, PE header analysis, and disassembly. Tools: VirusTotal, PEview, IDA Pro
• Dynamic Analysis: Running malware in a controlled environment (sandbox) to observe behavior. Includes network activity, file system changes, registry modifications, and process creation. Tools: Cuckoo Sandbox, Any.run, Joe Sandbox

55. What is an Advanced Persistent Threat (APT)?

Answer: An APT is a prolonged, sophisticated cyberattack where intruders establish long-term presence in a network to steal sensitive data. Characteristics include: well-funded attackers (often nation-states), specific targets, extended timeline, stealthy operation, and use of zero-days. Defense requires layered security, continuous monitoring, threat intelligence, incident response capabilities, and assuming breach mentality.

56. What are Indicators of Compromise (IOCs)?

Answer: IOCs are forensic artifacts that indicate potential malicious activity. Types include: file hashes (MD5, SHA256), IP addresses and domains, URLs, email addresses, registry keys, file paths, and mutex names. IOCs are shared through threat intelligence platforms (VirusTotal, AlienVault OTX) and used in SIEM rules and endpoint detection. They help identify known threats but may not detect new or modified malware.

57. What is the MITRE ATT&CK framework?

Answer: MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a knowledge base of adversary behaviors based on real-world observations. It categorizes attack techniques across the cyber kill chain: Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, and Impact. Security teams use it for threat modeling, detection development, and assessing coverage gaps.

58. What is fileless malware?

Answer: Fileless malware operates entirely in memory without writing persistent files to disk, making it difficult for traditional antivirus to detect. It typically exploits legitimate tools (PowerShell, WMI, macros) and resides in registry or memory. Detection requires behavioral analysis, memory forensics, EDR solutions, and monitoring of scripting engines. Examples include PowerShell Empire and Cobalt Strike.

59. What is threat intelligence?

Answer: Threat intelligence is analyzed information about current and potential attacks that helps organizations make informed security decisions. Types include: Strategic (high-level trends for executives), Tactical (TTPs for defenders), Operational (specific attack details), and Technical (IOCs for detection). Sources include commercial feeds, ISACs, government agencies, and open-source intelligence (OSINT). Integration with SIEM enables proactive threat detection.

60. What is the difference between antivirus and EDR?

Answer:

• Antivirus: Traditional signature-based detection, scans files for known malware patterns, limited visibility into endpoint activity
• EDR (Endpoint Detection and Response): Continuous monitoring and collection of endpoint data, behavioral analysis, threat hunting capabilities, forensic investigation tools, and automated response. EDR provides visibility into attacks that bypass traditional AV

61. What is SQL Injection?

Answer: SQL Injection is an attack where malicious SQL code is inserted into application queries through user input. It can lead to unauthorized data access, data modification, or deletion. Prevention includes: using parameterized queries/prepared statements, input validation, stored procedures, least privilege database accounts, and Web Application Firewalls (WAF). Testing involves tools like SQLmap and manual testing with payloads like ' OR '1'='1.

62. What is Cross-Site Scripting (XSS)?

Answer: XSS is a vulnerability where attackers inject malicious scripts into web pages viewed by other users. Types include:

• Stored XSS: Script permanently stored on target server (database)
• Reflected XSS: Script reflected off web server in error messages or search results
• DOM-based XSS: Vulnerability in client-side code

Prevention: Output encoding, Content Security Policy (CSP), input validation, and HTTPOnly cookies.

63. What is Cross-Site Request Forgery (CSRF)?

Answer: CSRF tricks authenticated users into performing unintended actions on web applications where they're logged in. The attacker crafts a malicious request that the victim's browser sends with their credentials. Prevention includes: CSRF tokens (unique per session/request), SameSite cookie attribute, verifying Origin/Referer headers, and requiring re-authentication for sensitive actions. Modern frameworks typically include CSRF protection by default.

64. What is Server-Side Request Forgery (SSRF)?

Answer: SSRF is a vulnerability where an attacker can make the server perform requests to unintended locations, potentially accessing internal services, cloud metadata, or other protected resources. Impact includes accessing internal APIs, reading sensitive files, and cloud instance compromise. Prevention: Validate and sanitize URLs, whitelist allowed destinations, disable unnecessary URL schemes, use network segmentation, and block access to metadata endpoints.

65. What is the Same-Origin Policy?

Answer: The Same-Origin Policy (SOP) is a critical browser security mechanism that restricts how documents or scripts from one origin can interact with resources from another origin. Origins are defined by protocol, host, and port. SOP prevents malicious scripts from reading data from another site. Exceptions include CORS (Cross-Origin Resource Sharing) for controlled cross-origin access and JSONP (deprecated) for cross-origin data retrieval.

66. What is Content Security Policy (CSP)?

Answer: CSP is a security header that helps prevent XSS, clickjacking, and code injection attacks by specifying which content sources are allowed. Directives include: script-src (allowed script sources), style-src (stylesheets), img-src (images), connect-src (AJAX/WebSocket), and default-src (fallback). Implementation involves setting the Content-Security-Policy HTTP header. Report-only mode allows testing before enforcement.

67. What is clickjacking?

Answer: Clickjacking (UI redress attack) tricks users into clicking on something different from what they perceive. Attackers overlay transparent frames over legitimate pages, causing users to unknowingly perform actions. Prevention includes: X-Frame-Options header (DENY or SAMEORIGIN), Content-Security-Policy frame-ancestors directive, and frame-busting JavaScript. Testing involves attempting to embed the target page in an iframe.

68. What security headers should web applications implement?

Answer: Essential security headers include:

• Content-Security-Policy: Controls resource loading
• X-Content-Type-Options: nosniff prevents MIME-type sniffing
• X-Frame-Options: Prevents clickjacking
• Strict-Transport-Security (HSTS): Forces HTTPS
• X-XSS-Protection: Legacy XSS filter (deprecated but still used)
• Referrer-Policy: Controls referrer information
• Permissions-Policy: Controls browser features

69. What is insecure deserialization?

Answer: Insecure deserialization occurs when applications deserialize untrusted data without proper validation, potentially leading to remote code execution, authentication bypass, or denial of service. It's particularly dangerous in Java, PHP, Python, and .NET applications. Prevention includes: avoiding native serialization formats, implementing integrity checks (signing), strict type constraints, running deserialization in low-privilege environments, and logging/monitoring deserialization failures.

70. What is Broken Access Control?

Answer: Broken Access Control occurs when restrictions on authenticated users are improperly enforced, allowing unauthorized access to functionality or data. Examples include: IDOR (Insecure Direct Object References), privilege escalation, accessing admin panels, modifying other users' data, and bypassing access controls through URL manipulation. Prevention: Deny by default, implement consistent access control mechanisms, enforce ownership, disable directory listing, and log access control failures.

71. What is the Shared Responsibility Model?

Answer: The Shared Responsibility Model divides security responsibilities between cloud providers and customers. The provider is responsible for security "of" the cloud (physical infrastructure, hypervisor, network), while customers are responsible for security "in" the cloud (data, applications, identity, OS configuration). In IaaS, customers manage more; in SaaS, providers manage more. Understanding this model is crucial for proper cloud security implementation.

72. What are common cloud security misconfigurations?

Answer: Common misconfigurations include: publicly accessible S3 buckets/storage, overly permissive IAM policies, unencrypted data storage, exposed management ports, default credentials, disabled logging/monitoring, missing MFA, unrestricted outbound traffic, improper network ACLs, and snapshot/backup exposure. Cloud Security Posture Management (CSPM) tools help identify and remediate these issues automatically.

73. What is IAM in cloud security?

Answer: IAM (Identity and Access Management) is the framework for managing digital identities and their access to cloud resources. Key components include: Users (human identities), Roles (assumable identities with policies), Policies (permission documents), Groups (user collections), and Service Accounts (application identities). Best practices include least privilege, MFA enforcement, regular access reviews, avoiding root/admin account usage, and using temporary credentials.

74. What is a Security Group in AWS?

Answer: A Security Group acts as a virtual firewall for EC2 instances, controlling inbound and outbound traffic at the instance level. Key characteristics: stateful (return traffic automatically allowed), deny-all by default for inbound, allow-all by default for outbound, rules specify protocol, port, and source/destination. Best practices include: minimal rule sets, specific CIDR ranges instead of 0.0.0.0/0, separate security groups per function, and regular rule audits.

75. What is AWS GuardDuty?

Answer: AWS GuardDuty is a managed threat detection service that continuously monitors for malicious activity and unauthorized behavior. It analyzes VPC Flow Logs, CloudTrail logs, and DNS logs using machine learning and threat intelligence. It detects account compromise, instance compromise, reconnaissance, and data exfiltration. Findings are categorized by severity and integrated with Security Hub, CloudWatch Events, and third-party tools for automated response.

76. What is container security?

Answer: Container security involves protecting containerized applications throughout their lifecycle. Key areas include: image security (scanning for vulnerabilities, using minimal base images, trusted registries), runtime security (read-only containers, no privileged mode, resource limits), orchestration security (Kubernetes RBAC, network policies, secrets management), and host security (hardened OS, updated runtime). Tools include Trivy, Aqua, Sysdig, and Falco.

77. What is a CASB?

Answer: CASB (Cloud Access Security Broker) is a security policy enforcement point between cloud consumers and providers. Functions include: visibility (discovering cloud services, shadow IT), compliance (enforcing policies, DLP), data security (encryption, tokenization), and threat protection (malware detection, anomaly detection). CASBs can operate as proxy, API-based, or hybrid. Major vendors include Microsoft Defender for Cloud Apps, Netskope, and Zscaler.

78. What is serverless security?

Answer: Serverless security focuses on protecting functions-as-a-service (AWS Lambda, Azure Functions). Challenges include: expanded attack surface through event triggers, function chaining vulnerabilities, over-privileged IAM roles, and dependency vulnerabilities. Best practices: minimal function permissions, secure dependencies (SCA scanning), input validation, encryption for data, function isolation, short timeouts, and monitoring for anomalous behavior. Traditional perimeter security doesn't apply.

79. What is Infrastructure as Code (IaC) security?

Answer: IaC security involves securing infrastructure templates (Terraform, CloudFormation, ARM) before deployment. Risks include hardcoded secrets, misconfigured resources, and insecure defaults. Tools like Checkov, tfsec, and Bridgecrew scan templates for security issues. Best practices: version control templates, code review process, automated scanning in CI/CD, policy-as-code (OPA), and secrets management integration. Shift-left approach catches issues before production.

80. What is Zero Trust Architecture?

Answer: Zero Trust is a security model based on "never trust, always verify." Key principles: verify explicitly (authenticate every request), use least privilege access, assume breach (minimize blast radius). Implementation includes: strong identity verification, device health validation, micro-segmentation, encryption everywhere, continuous monitoring, and dynamic policy enforcement. Zero Trust is especially relevant in cloud environments where traditional perimeter doesn't exist.

81. What are the phases of incident response?

Answer: The NIST incident response lifecycle includes:

• Preparation: Developing plans, training, and acquiring tools
• Detection & Analysis: Identifying and confirming incidents
• Containment, Eradication, Remediation: Limiting damage and removing threats
• Post-Incident Activity: Lessons learned and documentation

Each phase has specific activities and documentation requirements.

82. What is the difference between an event, alert, and incident?

Answer:

• Event: Any observable occurrence in a system or network (login, file access). Most are benign
• Alert: A notification generated when events match detection rules or thresholds. Requires investigation
• Incident: A confirmed security event that violates security policies or threatens assets. Requires formal response

83. What is digital forensics?

Answer: Digital forensics is the process of collecting, preserving, analyzing, and presenting digital evidence in a legally admissible manner. It covers computer forensics (hard drives, memory), network forensics (packet captures, logs), mobile forensics, and cloud forensics. Key principles include chain of custody, evidence integrity (hashing), using forensic tools (FTK, EnCase, Autopsy), and proper documentation. Forensics supports incident investigation and legal proceedings.

84. What is the chain of custody?

Answer: Chain of custody is the documented chronological history of evidence handling, showing who collected, handled, and stored evidence. It maintains evidence integrity and admissibility in legal proceedings. Documentation includes: what was collected, when and where, by whom, how it was transported and stored, and any analysis performed. Breaks in chain of custody can render evidence inadmissible.

85. What logs are important for security investigation?

Answer: Critical logs include: Authentication logs (successful/failed logins), Windows Event Logs (Security, System, Application), Firewall logs (allowed/denied traffic), Web server logs (access, error), DNS logs (queries, responses), Email logs (sender, recipient, attachments), VPN logs (connections, disconnections), Database logs (queries, access), and Application logs. Centralized logging with retention policies is essential for effective investigation.

86. What is memory forensics?

Answer: Memory forensics involves analyzing volatile memory (RAM) to find evidence of malicious activity. It can reveal: running processes, network connections, loaded DLLs, encryption keys, malware that doesn't write to disk, and user activity. Tools include Volatility, Rekall, and WinDbg. Memory must be captured before system shutdown. It's especially valuable for detecting fileless malware and advanced attacks.

87. What is a Security Operations Center (SOC)?

Answer: A SOC is a centralized function that monitors, detects, investigates, and responds to security threats 24/7. Components include: people (analysts at Tier 1-3), processes (playbooks, procedures), and technology (SIEM, SOAR, EDR, threat intelligence). SOC metrics include Mean Time to Detect (MTTD), Mean Time to Respond (MTTR), and false positive rates. Modern SOCs increasingly leverage automation and AI for efficiency.

88. What is SOAR?

Answer: SOAR (Security Orchestration, Automation, and Response) platforms integrate security tools, automate responses, and streamline workflows. Key capabilities: playbook automation (repeatable response procedures), case management (ticket tracking), threat intelligence integration, and reporting. SOAR reduces analyst workload, speeds response times, and ensures consistent handling. Examples include Splunk SOAR, Palo Alto XSOAR, and IBM Resilient.

89. How would you respond to a suspected data breach?

Answer: Data breach response steps: (1) Confirm the breach and assess scope; (2) Contain by isolating affected systems; (3) Preserve evidence for investigation; (4) Eradicate the threat; (5) Recover systems securely; (6) Notify stakeholders (legal, PR, management); (7) Comply with regulatory notification requirements (GDPR 72 hours); (8) Conduct post-incident review; (9) Update security controls. Communication and legal considerations are critical throughout.

90. What is threat hunting?

Answer: Threat hunting is the proactive search for threats that evade existing security controls. Unlike detection (waiting for alerts), hunting actively looks for adversary activity using hypotheses, intelligence, and behavioral analysis. Techniques include: analyzing anomalies, searching for IOCs, examining baseline deviations, and TTP-based hunting (using MITRE ATT&CK). Tools include SIEM queries, EDR hunting features, and specialized platforms like Threat Hunter.

91. What is ISO 27001?

Answer: ISO 27001 is an international standard for Information Security Management Systems (ISMS). It provides a framework for establishing, implementing, maintaining, and improving information security. Key components include: risk assessment methodology, security controls (Annex A), management commitment, and continuous improvement cycle (PDCA). Certification requires third-party audits. ISO 27001 is widely recognized and often required in enterprise vendor assessments.

92. What is the NIST Cybersecurity Framework?

Answer: The NIST CSF is a voluntary framework consisting of standards, guidelines, and practices to manage cybersecurity risk. It has five core functions: Identify (asset management, risk assessment), Protect (access control, awareness training), Detect (monitoring, detection processes), Respond (response planning, communications), and Recover (recovery planning, improvements). Organizations use CSF to assess and improve their security posture.

93. What is GDPR?

Answer: GDPR (General Data Protection Regulation) is the EU's data protection law governing personal data processing. Key requirements include: lawful basis for processing, data subject rights (access, erasure, portability), consent requirements, Data Protection Officer appointment, Privacy Impact Assessments, breach notification (72 hours), and data transfer restrictions. Penalties can reach €20M or 4% of global revenue. It applies to any organization processing EU residents' data.

94. What is PCI-DSS?

Answer: PCI-DSS (Payment Card Industry Data Security Standard) is a set of security requirements for organizations handling credit card data. It has 12 requirements covering: firewall configuration, password management, data protection, encryption in transit, antivirus, access control, unique IDs, physical access, monitoring, testing, and security policies. Compliance levels depend on transaction volume. Non-compliance can result in fines and loss of card processing ability.

95. What is HIPAA?

Answer: HIPAA (Health Insurance Portability and Accountability Act) is US legislation protecting health information. The Security Rule requires: administrative safeguards (policies, training), physical safeguards (facility access, workstation security), and technical safeguards (access control, audit controls, encryption). The Privacy Rule governs PHI use and disclosure. Covered entities include healthcare providers, health plans, and their business associates. Penalties range from $100 to $50,000 per violation.

96. What is SOC 2?

Answer: SOC 2 (System and Organization Controls) is an auditing standard for service providers storing customer data. It evaluates controls based on Trust Services Criteria: Security (protection against unauthorized access), Availability (system accessibility), Processing Integrity (accurate processing), Confidentiality (protection of confidential information), and Privacy (personal information handling). Type I assesses design at a point in time; Type II assesses operating effectiveness over time.

97. What is a risk assessment?

Answer: Risk assessment is the process of identifying, analyzing, and evaluating security risks. Steps include: asset identification, threat identification, vulnerability identification, impact analysis, likelihood determination, and risk calculation. Methods include qualitative (High/Medium/Low ratings) and quantitative (monetary values). Frameworks like NIST 800-30 and ISO 27005 provide guidance. Results inform risk treatment decisions: accept, mitigate, transfer, or avoid.

98. What is the difference between a vulnerability assessment and penetration test?

Answer:

• Vulnerability Assessment: Identifies and prioritizes vulnerabilities using automated scanning tools. Broader coverage, less depth. Regular (weekly/monthly) testing
• Penetration Test: Actively exploits vulnerabilities to demonstrate impact. Deeper analysis, simulates real attacks. Usually annual or after major changes

Both are complementary parts of a security program.

99. What is security awareness training?

Answer: Security awareness training educates employees about security threats and best practices. Topics include: phishing recognition, password security, social engineering, physical security, data handling, incident reporting, and acceptable use policies. Effective programs use varied formats (videos, simulations, tests), measure effectiveness (phishing simulation results), and provide regular updates. Human error is a leading cause of breaches, making awareness training essential.

100. What is a Business Continuity Plan (BCP) vs. Disaster Recovery Plan (DRP)?

Answer:

• BCP (Business Continuity Plan): Ensures critical business functions continue during and after disruption. Covers people, processes, facilities, and technology. Includes business impact analysis
• DRP (Disaster Recovery Plan): Specifically focuses on IT infrastructure and data recovery. Defines RTO (Recovery Time Objective) and RPO (Recovery Point Objective)

DRP is a subset of BCP. Both require regular testing and updates.

How many cybersecurity interview questions should I prepare?

Focus on thoroughly understanding 50-100 core questions across fundamentals, network security, cryptography, and your specialization area. It's better to deeply understand concepts than memorize hundreds of questions. Our list of 100 questions covers the most commonly asked topics in 2026 cybersecurity interviews.

What technical skills are most important for cybersecurity interviews?

Key technical skills include: networking fundamentals (TCP/IP, OSI model), operating systems (Windows/Linux), programming/scripting (Python, Bash), security tools (Wireshark, Nmap, Burp Suite), and knowledge of common vulnerabilities (OWASP Top 10). Hands-on experience is highly valued.

How do I prepare for a cybersecurity interview with no experience?

For entry-level roles: complete relevant certifications (Security+, CEH), practice on platforms like TryHackMe and HackTheBox, work on personal projects, participate in CTFs, build a home lab, and take comprehensive training at institutes like Nexson IT Academy in Hyderabad that provide hands-on experience and placement support.

What certifications should I have before a cybersecurity interview?

For entry-level: CompTIA Security+ or CEH. For mid-level: OSCP, CySA+, or AWS Security. For senior roles: CISSP, CISM. Certifications demonstrate commitment and baseline knowledge. However, practical skills and experience often matter more than certifications alone.

What salary can I expect in cybersecurity in Hyderabad?

Entry-level cybersecurity professionals in Hyderabad can expect ₹4-7 LPA. With 3-5 years of experience and relevant certifications, salaries range from ₹10-18 LPA. Senior security architects and managers can earn ₹25-50+ LPA. Skills in cloud security, penetration testing, and SOC operations command premium salaries.

How long does it take to prepare for cybersecurity interviews?

With dedicated study, 2-3 months is typically sufficient for thorough preparation. This includes reviewing concepts, practicing hands-on labs, studying these 100 questions, and doing mock interviews. Professional training programs at Nexson IT Academy compress this timeline with structured curriculum and expert guidance.