Top 20 Cyber Security Questions For Your Next Interview

We have been talking about data vulnerability for quite some time now. Isn’t that right? 

And you already know about the solution to it already as well. Of course, it’s focusing on Cyber Security of your organization.

We cannot emphasize more on this fact that in the era that runs on continuous delivery, cybersecurity is the only key to be secured by protecting your data. 

Data manipulation is a serious issue that can clear up millions from any organization’s bank account. So, unless the cybersecurity system of an organization is extremely strong, the risk of getting data robbed will always be there. 

And what’s the easiest way to build a strong cybersecurity system?

Simple! 

Hiring cybersecurity professionals.

And how can you get hired as one? With a thorough preparation of course. 

So here comes the top 20 cybersecurity questions to look up to right before you are going to sit for your cybersecurity examination!

1. What is Cryptography?

Cryptography is the practice and study of techniques to secure information and communication that is mainly used to protect the data from any third party intruders  who don’t have access to that data

2. What is the difference between Symmetric and Asymmetric encryption?

Symmetric encryption uses one shared key for both encryption and decryption. It's fast but requires securely sharing that key beforehand (e.g., AES).

Asymmetric encryption uses a key pair: a public key to encrypt and a private key to decrypt. It's slower but avoids the key sharing problem since the public key can be shared openly (e.g., RSA).

In practice, they're often combined. Asymmetric encryption securely exchanges a symmetric key, then that key handles the actual data encryption for speed. This is how HTTPS works.

3. What is the difference between IDS and IPS?

IDS is an Intrusion Detection System that only detects intrusions and the administrator takes care of preventing the intrusion. On the other hand, in IPS (Intrusion Prevention System) the system detects the intrusion as well as taking actions to prevent the intrusion.

4. Explain CIA triad.

CIA is basically the initials for Confidentiality, Integrity, and Availability. It is basically a model designed to guide policies for Information Security. Let’s see what are the meaning of these three components:

Confidentiality

The information should be accessible and readable only to people who are authorized to it and should be strongly encrypted just against hacking or data manipulation.

Integrity

Integrity makes sure that the data is not corrupted, tampered, or modified by unauthorized people.

Availability

The data should be available to the user as per their requirement with an assurance of maintenance of Hardware, upgradation, Data Backups and Recovery, management of Network Bottlenecks.

5. How is Encryption different from Hashing?

Although Encryption and Hashing both can be used to convert readable data into an unreadable format, encrypted data can be converted back to original data with the help of decryption but the hashed data can’t be converted back to original data.

6. What is a Firewall and why is it used?

A Firewall is a network security system set on the boundaries of the system or network that monitors and controls the network traffic. We use firewalls to protect the system/network from viruses, worms, and malware. It can also be used to prevent remote access and content filtering.

7. What is the difference between VA(Vulnerability Assessment) and PT(Penetration Testing)?

Vulnerability Assessment is the process by which we can find flaws on the target while the organization is aware of the system’s flaws and looking forward to find these flaws and prioritize them for fixing.

Penetration Testing is the process through which we can find vulnerabilities on the target. This helps the organization in exploring the ways of hacking their system/network.

8. What is a three-way handshake?

A three-way handshake is a method that is used in a TCP/IP network. It creates a connection between a host and a client. For being a three-step method, it is called a three-way handshake.  The three steps where the client and the server exchange packets are as follows:

1. The client sends an SYN (Synchronize) packet to the server to check if the server is up or has open ports
2. After this, the server sends SYN-ACK packet to the client to see if it has open ports
3. The client acknowledges this and sends an ACK(Acknowledgment) packet back to the server

9. What are the response codes that can be received from a Web Application?

The response codes that can be received from a Web Application are as follows:

1xx – Informational responses

2xx – Success

3xx – Redirection

4xx – Client-side error

5xx – Server-side error

10. What is traceroute? Why is it used?

Traceroute is a tool to determine the path of a packet by listing all the points (mainly routers) the packet passes through. This becomes helpful when the packet is not reaching its destination. Traceroute checks out the exact point where the connection stopped or broke to identify the point of failure.

11. What is the difference between HIDS and NIDS?

HIDS or Host IDS and NIDS or Network IDS are both Intrusion Detection System that works towards detecting the intrusions. Although, HIDS is set up on a particular host or device and monitors the traffic of that particular device along with suspicious system activities. Whereas, NIDS is set up on a network to monitors the traffic of all devices of the network.

12. What are the steps to set up a firewall?

You need to go through the following steps to set up a firewall:

• Modify the default password for a firewall device
•  Disable the feature of the remote administration
• Configure appropriate port forwarding for certain applications to work properly, such as a web server or FTP server
• Installing a firewall on a network with an existing DHCP server will cause conflict unless the firewall’s DHCP is disabled
• To troubleshoot firewall issues or potential attacks, ensure that logging is enabled and understand how to view logs
• You should have solid security policies in place and make sure that the firewall is configured to enforce those policies.

13. Explain SSL Encryption

SSL(Secure Sockets Layer) is an industry-standard security technology that creates encrypted connections between Web Server and a Browser. It is used to maintain data privacy as well as protecting the information of online transactions. You need to follow the steps mentioned below to establish an SSL

• A browser tries to connect to the webserver secured with SSL
• The browser sends a copy of its SSL certificate to the browser
• The browser checks if the SSL certificate is trustworthy or not. If it is trustworthy, then the browser sends a message to the webserver requesting to establish an encrypted connection
• The web server sends an acknowledgment to start an SSL encrypted connection
• SSL encrypted communication takes place between the browser and the webserver

14. What steps will you take to secure a server?

Secure servers use the Secure Sockets Layer (SSL) protocol for data encryption and decryption to protect data from unauthorized interception.

Here are four simple ways to secure server:

Step 1: Make sure you have a secure password for your root and administrator users

Step 2: The next thing you need to do is make new users on your system. These will be the users you use to manage the system

Step 3: Remove remote access from the default root/administrator accounts

Step 4: The next step is to configure your firewall rules for remote access

15. Explain Data Leakage

Data Leakage is an intentional or unintentional transmission of data from the organization to some external unauthorized destination. It is mainly the revelation of confidential information to an unauthorized party. Data Leakage can be divided into 3 categories based on how it happens:

1. Accidental Breach: An entity unintentionally send data to an unauthorized person due to a fault or a blunder
2. Intentional Breach: The authorized entity sends data to an unauthorized entity on purpose
3. System Hack: Hacking techniques are used to cause data leakage

Data Leakage can be prevented by using tools, software, and strategies known as DLP(Data Leakage Prevention) Tools.

16. What are some of the common Cyberattacks?

• Denial-of-service (DoS) and distributed denial-of-service (DDoS) attacks.
• Man-in-the-middle (MitM) attack.
• Phishing and spear-phishing attacks.
• Drive-by attack.
• Password attack.
• SQL injection attack.
• Cross-site scripting (XSS) attack.
• Eavesdropping attack.

17. What is a Brute Force Attack? How can you prevent it?

Brute Force is a way of finding out the right credentials by repetitively trying all the permutations and combinations of possible credentials. In most cases, brute force attacks are automated where the tool/software automatically tries to login with a list of credentials. There are various ways to prevent Brute Force attacks. Some of them are:

• Password Length: You can set a minimum length for a password. The lengthier the password, the harder it is to find.
• Password Complexity: Including different formats of characters in the password makes brute force attacks harder. Using alpha-numeric passwords along with special characters, and upper and lower case characters increase the password complexity making it difficult to be cracked.
• Limiting Login Attempts: Set a limit on login failures. For example, you can set the limit on login failures as 3. So, when there are 3 consecutive login failures, restrict the user from logging in for some time, or send an Email or OTP to use to log in the next time. Because brute force is an automated process, limiting login attempts will break the brute force process.

18. What is Port Scanning?

Port Scanning is the technique used to identify open ports and services available on a host. Hackers use port scanning to find information that can be helpful to exploit vulnerabilities. Administrators use Port Scanning to verify the security policies of the network. Some of the common Port Scanning Techniques are:

1. Ping Scan
2. TCP Half-Open
3. TCP Connect
4. UDP
5. Stealth Scanning

19. What are the different layers of the OSI model?

An OSI model is a reference model for how applications communicate over a network. The purpose of an OSI reference is to guide vendors and developers so the digital communication products and software programs can interoperate.

Following are the OSI layers:

• Physical
• Data Link
• Network
• Transport
• Session
• Presentation
• Application

20. What is a VPN?

VPN stands for Virtual Private Network. It is used to create a safe and encrypted connection. When you use a VPN, the data from the client is sent to a point in the VPN where it is encrypted and then sent through the internet to another point. At this point, the data is decrypted and sent to the server. When the server sends a response, the response is sent to a point in the VPN where it is encrypted and this encrypted data is sent to another point in the VPN where it is decrypted. And finally, the decrypted data is sent to the client. The whole point of using a VPN is to ensure encrypted data transfer.