Question 1

What is the CIA triad in cybersecurity?

Accepted Answer

The CIA triad is a foundational model for information security, consisting of three pillars: Confidentiality (ensuring data is accessible only to authorized users), Integrity (ensuring data is accurate and unaltered), and Availability (ensuring data and systems are accessible when needed). These three principles guide security policies, controls, and incident response.

Question 2

What is the difference between authentication and authorization?

Accepted Answer

Authentication is the process of verifying the identity of a user or system (e.g., logging in with a username and password). Authorization determines what resources or actions an authenticated user is permitted to access (e.g., permissions, roles). Authentication proves who you are; authorization decides what you can do.

Question 3

Explain symmetric vs. asymmetric encryption.

Accepted Answer

Symmetric encryption uses a single shared key for both encryption and decryption (e.g., AES, DES). It's fast and efficient but requires secure key distribution. Asymmetric encryption uses a pair of keys: a public key for encryption and a private key for decryption (e.g., RSA, ECC). It solves key distribution but is slower. Asymmetric is often used for key exchange and digital signatures.

Question 4

What is a digital signature and how does it work?

Accepted Answer

A digital signature is a cryptographic technique used to verify the authenticity and integrity of a digital message or document. It works by: 1) Hashing the message to create a digest; 2) Encrypting the digest with the sender's private key; 3) The recipient decrypts with the sender's public key and compares hashes. This ensures non-repudiation and tamper-proofing.

Question 5

What is the difference between hashing and encryption?

Accepted Answer

Hashing is a one-way function that maps data of any size to a fixed-size hash value (e.g., SHA-256). It is not reversible; it's used for integrity verification and password storage. Encryption is a two-way function that transforms plaintext to ciphertext using a key; it is reversible with the correct key. Encryption provides confidentiality; hashing provides integrity.

Question 6

What is a firewall and what are its types?

Accepted Answer

A firewall is a network security device that monitors and filters incoming and outgoing traffic based on predetermined security rules. Types include: Packet-filtering firewalls (inspect packets at the network layer), Stateful inspection firewalls (track connection states), Application-layer firewalls (proxy-based, inspect application data), and Next-generation firewalls (combine features like intrusion prevention).

Question 7

What is an intrusion detection system (IDS) and intrusion prevention system (IPS)?

Accepted Answer

IDS monitors network traffic for suspicious activity and alerts administrators. It is passive (does not block traffic). IPS is similar but actively blocks or prevents detected threats (inline). Both use signature-based detection (known patterns) or anomaly-based detection (behavioral baselines). IPS is more proactive and is often deployed inline with the traffic flow.

Question 8

Explain the concept of Defense in Depth.

Accepted Answer

Defense in Depth is a security strategy that employs multiple layers of security controls throughout an IT system. If one layer fails, others continue to protect. Layers include physical security, network security (firewalls, IDS/IPS), host security (antivirus, patch management), application security, data encryption, and user awareness. This approach reduces the risk of a single point of failure.

Question 9

What is the OWASP Top 10?

Accepted Answer

The OWASP Top 10 is a standard awareness document for developers and web application security. It lists the ten most critical web application security risks, including: Broken Access Control, Cryptographic Failures, Injection (SQL, XSS), Insecure Design, Security Misconfiguration, Vulnerable and Outdated Components, Identification and Authentication Failures, Software and Data Integrity Failures, Security Logging and Monitoring Failures, and Server-Side Request Forgery.

Question 10

What is SQL injection and how can it be prevented?

Accepted Answer

SQL injection is an attack where malicious SQL code is inserted into input fields or URL parameters to manipulate database queries. Prevention: Use parameterized queries (prepared statements) with bound parameters, apply input validation and sanitization, use stored procedures, employ least privilege database accounts, and utilize web application firewalls (WAF).

Question 11

What is Cross-Site Scripting (XSS) and its types?

Accepted Answer

XSS is a vulnerability where attackers inject malicious scripts into web pages viewed by other users. Types: Reflected XSS (script is reflected off a web server via input like URL parameters), Stored XSS (script is stored on the server, e.g., in a database), and DOM-based XSS (script executes via client-side DOM manipulation). Prevention: output encoding, input validation, Content Security Policy (CSP).

Question 12

What is CSRF (Cross-Site Request Forgery) and how is it mitigated?

Accepted Answer

CSRF tricks a user's browser into making an unwanted request to a trusted site where the user is authenticated. It exploits session cookies. Mitigation: Use CSRF tokens (synchronizer tokens) embedded in forms and validated on the server, SameSite cookies (Strict/Lax), and require re-authentication for sensitive actions.

Question 13

Explain the concept of Zero Trust Architecture.

Accepted Answer

Zero Trust is a security model based on the principle 'never trust, always verify'. It assumes that threats exist both inside and outside the network. Key tenets: continuous verification of identity and authorization, least-privilege access, micro-segmentation, and assume breach. It requires strong authentication, continuous monitoring, and dynamic policy enforcement for all resources.

Question 14

What is the difference between IDS and IPS?

Accepted Answer

IDS (Intrusion Detection System) monitors network traffic and alerts on suspicious activity but does not take action. IPS (Intrusion Prevention System) actively blocks or mitigates threats in real time. IPS is often deployed inline, while IDS is out-of-band. Both use signatures and anomalies to detect attacks.

Question 15

What are common types of malware?

Accepted Answer

Common malware types include: Viruses (self-replicating, attach to files), Worms (self-replicating, spread via networks), Trojans (disguised as legitimate software), Ransomware (encrypts files, demands payment), Spyware (steals information), Adware (displays unwanted ads), Rootkits (hide malicious activity), and Keyloggers (record keystrokes).

Question 16

What is a DDoS attack and how can it be mitigated?

Accepted Answer

DDoS (Distributed Denial of Service) aims to overwhelm a service with traffic from multiple sources, making it unavailable. Mitigation: Use traffic scrubbing services, rate limiting, load balancing, web application firewalls, and cloud-based DDoS protection. Also, implement network redundancy and scale infrastructure to absorb attacks.

Question 17

What is PKI (Public Key Infrastructure)?

Accepted Answer

PKI is a framework of policies, technologies, and procedures for creating, managing, distributing, and revoking digital certificates. It enables secure communication using asymmetric cryptography. Components: Certificate Authority (CA), Registration Authority (RA), certificate repository, and certificate management system. PKI is used for SSL/TLS, email encryption, and code signing.

Question 18

What is SSL/TLS and how does it work?

Accepted Answer

SSL (Secure Sockets Layer) and its successor TLS (Transport Layer Security) are cryptographic protocols that provide secure communication over a network. They use a handshake to establish a session, negotiate cipher suites, authenticate the server (and optionally client) via certificates, and exchange session keys. TLS is used for HTTPS, email, and VPNs.

Question 19

What is a VPN and why is it used?

Accepted Answer

A VPN (Virtual Private Network) extends a private network across a public network, allowing users to send and receive data as if connected directly. It provides confidentiality and integrity through encryption, and often includes authentication. It's used for remote access, site-to-site connectivity, and to bypass geo-restrictions.

Question 20

Explain the difference between hashing and encryption with examples.

Accepted Answer

Hashing is a one-way function (e.g., SHA-256) that produces a fixed-size output from any input. It's used for password storage (store hash, not plaintext) and file integrity checks. Encryption is two-way (e.g., AES) and is used to protect data confidentiality—both encryption and decryption require keys. Hashing is not reversible; encryption is.

Question 21

What is a man-in-the-middle attack and how can it be prevented?

Accepted Answer

A MITM attack occurs when a malicious actor intercepts and potentially alters communication between two parties without their knowledge. Prevention: Use end-to-end encryption (TLS/SSL), strong authentication (certificates), implement HSTS (HTTP Strict Transport Security), and avoid public Wi-Fi for sensitive transactions.

Question 22

What is the principle of least privilege?

Accepted Answer

The principle of least privilege dictates that a user, system, or process should be granted only the minimum permissions necessary to perform its function. This limits the potential damage from accidental errors, malicious insiders, or compromised accounts. It is applied in access control, system administration, and application design.

Question 23

Explain the concept of 'security through obscurity' and why it's discouraged.

Accepted Answer

Security through obscurity relies on keeping the design or implementation secret to achieve security. It's discouraged because it's not a robust strategy; if the secrecy is discovered, the security fails. Defense should rely on well-understood, tested cryptographic algorithms and secure configurations that remain secure even if the attacker knows the details.

Question 24

What is a security incident response plan?

Accepted Answer

An incident response plan is a documented, systematic approach to handling security breaches. It typically follows phases: Preparation, Identification (detection), Containment (limit impact), Eradication (remove root cause), Recovery (restore systems), and Lessons Learned (post-mortem). It ensures a coordinated and effective response to minimize damage.

Question 25

What is the difference between vulnerability, threat, and risk?

Accepted Answer

A vulnerability is a weakness in a system (e.g., unpatched software). A threat is a potential actor or event that could exploit a vulnerability (e.g., hacker). Risk is the likelihood that a threat will exploit a vulnerability, combined with the potential impact. Risk = Threat × Vulnerability × Impact. Risk management involves identifying and mitigating risks.

Question 26

What is a honeypot in cybersecurity?

Accepted Answer

A honeypot is a decoy system or resource designed to lure attackers. It appears as a legitimate target but is isolated and monitored. It serves to detect, deflect, or study attack behaviors without compromising production systems. Honeypots can be low-interaction (emulate services) or high-interaction (real systems with monitoring).

Question 27

Explain the concept of 'zero-day' vulnerability.

Accepted Answer

A zero-day vulnerability is a previously unknown security flaw that has not been patched. Attackers can exploit it before the vendor becomes aware or develops a fix. The term 'zero-day' refers to the fact that the vendor has zero days to address it. Zero-day exploits are highly valuable and often used in targeted attacks.

Question 28

What is the difference between symmetric and asymmetric encryption in terms of key management?

Accepted Answer

Symmetric encryption uses a single shared secret key for both encryption and decryption, so key distribution is a challenge—must be securely shared. Asymmetric uses a public/private key pair; the public key can be freely distributed, while the private key is kept secret. This simplifies key management for large networks but is computationally heavier.

Question 29

What are common authentication factors?

Accepted Answer

Authentication factors are categories of credentials: Something you know (password, PIN), Something you have (smart card, token, mobile phone), Something you are (biometrics: fingerprint, iris scan), Somewhere you are (location-based), and Something you do (behavioral patterns). Multi-factor authentication (MFA) combines two or more factors for stronger security.

Question 30

What is the purpose of an access control list (ACL)?

Accepted Answer

An ACL is a list of permissions attached to a resource that specifies which users or systems are granted access and what operations they can perform. It's used in file systems, network routers, firewalls, and databases. ACLs enforce the principle of least privilege by defining fine-grained access rules.

Question 31

Explain the difference between a vulnerability assessment and a penetration test.

Accepted Answer

A vulnerability assessment is a systematic review of systems to identify and classify vulnerabilities, typically using automated tools. It generates a report but does not exploit the vulnerabilities. A penetration test (pen test) is a simulated attack that actively exploits vulnerabilities to assess the real-world impact and determine if a malicious actor could breach defenses.

Question 32

What is the NIST Cybersecurity Framework?

Accepted Answer

The NIST Cybersecurity Framework is a voluntary set of standards, guidelines, and best practices to manage cybersecurity risk. It consists of five core functions: Identify, Protect, Detect, Respond, and Recover. It helps organizations align security activities with business requirements and improve risk management.

Question 33

What is GDPR and what are its key requirements?

Accepted Answer

GDPR (General Data Protection Regulation) is a European Union regulation on data protection and privacy. Key requirements: obtain explicit consent for data processing, data minimization, ensure data subject rights (access, rectification, erasure), mandatory breach notification within 72 hours, and appoint a Data Protection Officer (DPO) for certain organizations. Fines can be up to €20 million or 4% of global revenue.

Question 34

What is the difference between a vulnerability and an exploit?

Accepted Answer

A vulnerability is a weakness in a system that could be exploited (e.g., a buffer overflow). An exploit is a piece of code or technique that takes advantage of a vulnerability to cause unintended behavior. An exploit materializes a vulnerability into a real attack.

Question 35

What is a certificate authority (CA)?

Accepted Answer

A CA is a trusted entity that issues digital certificates. It validates the identity of certificate applicants and binds a public key to the identity. The CA is part of the Public Key Infrastructure (PKI) and is trusted by browsers and operating systems. It also manages certificate revocation via CRLs or OCSP.

Question 36

Explain the concept of 'least common mechanism'.

Accepted Answer

Least common mechanism means that processes should not share resources (such as memory, files, or privileges) unless necessary. Minimizing shared resources reduces the attack surface and prevents information leakage across processes. It is a design principle for secure systems.

Question 37

What is a replay attack and how is it prevented?

Accepted Answer

A replay attack involves intercepting and retransmitting a valid communication to trick the receiver. Prevention: Use timestamps or nonces (number used once) in protocols, implement session tokens with expiration, and use cryptographic mechanisms like digital signatures and sequence numbers.

Question 38

What is the role of a Security Operations Center (SOC)?

Accepted Answer

A SOC is a centralized team responsible for monitoring, detecting, analyzing, and responding to cybersecurity incidents. It uses SIEM (Security Information and Event Management) tools to collect and correlate security data from across the organization. SOC analysts handle alerts, threat hunting, and incident response.

Question 39

What is the difference between white-box, black-box, and gray-box testing?

Accepted Answer

These are testing methodologies for security assessments. White-box testing: full knowledge of internal code and architecture. Black-box testing: no knowledge of internals; simulates an external attacker. Gray-box testing: partial knowledge, often combined with limited internal access. They are used in penetration testing and code reviews.

Question 40

Explain the concept of 'security misconfiguration'.

Accepted Answer

Security misconfiguration refers to insecure default settings, incomplete or ad-hoc configurations, open cloud storage, misconfigured HTTP headers, or unnecessary services enabled. It is a common vulnerability (part of OWASP Top 10). Prevention: Hardening guides, regular audits, automated configuration management.

Question 41

What is the difference between a virus and a worm?

Accepted Answer

A virus is a piece of code that attaches itself to a host file or program and requires user action to spread (e.g., opening an infected attachment). A worm is a standalone program that replicates and spreads independently over networks without user intervention. Both are malware, but worms are more self-contained.

Question 42

What is a 'social engineering' attack?

Accepted Answer

Social engineering is a manipulation technique that exploits human psychology to trick individuals into divulging confidential information or performing actions (e.g., clicking malicious links). Common types: phishing (emails), vishing (voice calls), smishing (SMS), and pretexting. Training and awareness are key defenses.

Question 43

Explain the concept of 'least privilege' in the context of operating systems.

Accepted Answer

Least privilege in OS means that users and processes should run with the minimum permissions necessary. For example, users should not have administrative privileges for daily tasks; applications should run with restricted user accounts. This limits the impact of malware or compromised accounts.

Question 44

What is the difference between a risk assessment and a risk analysis?

Accepted Answer

Risk assessment is the overall process of identifying, analyzing, and evaluating risk. Risk analysis is a subset that involves estimating the likelihood and impact of identified risks. Risk assessment includes risk analysis and then risk evaluation (comparing against risk criteria). Both are part of risk management.

Question 45

What is a 'hash collision' and why is it a concern?

Accepted Answer

A hash collision occurs when two different inputs produce the same hash output. This is a concern because it could allow attackers to substitute data without changing the hash, undermining integrity. Modern cryptographic hashes (e.g., SHA-256) are designed to be collision-resistant, but older algorithms like MD5 and SHA-1 have known collisions.

Question 46

What is a 'cloud security' shared responsibility model?

Accepted Answer

In cloud computing, security is a shared responsibility between the cloud provider and the customer. The provider secures the infrastructure (physical, network, hypervisor), while the customer secures their data, applications, access controls, and configurations. The specific division depends on the service model (IaaS, PaaS, SaaS).

Question 47

What is a 'security audit'?

Accepted Answer

A security audit is a systematic evaluation of an organization's security policies, controls, and procedures against a set of standards or regulations. It involves reviewing system logs, configurations, access controls, and compliance with frameworks like ISO 27001. Audits identify weaknesses and ensure continuous improvement.

Question 48

Explain the concept of 'air-gapped' network.

Accepted Answer

An air-gapped network is a physical or logical isolation where a computer or network is not connected to the internet or any other network. This is used for highly sensitive systems (e.g., military, critical infrastructure) to prevent remote attacks. Data transfer is done via physical media (USB, CD).

Question 49

What is a 'brute-force attack' and how can it be prevented?

Accepted Answer

A brute-force attack tries all possible combinations of credentials or keys until the correct one is found. Prevention: Use strong, complex passwords; implement account lockout after failed attempts; use multi-factor authentication; and employ rate limiting or CAPTCHA.

Question 50

What is the role of encryption in data protection?

Accepted Answer

Encryption ensures data confidentiality by transforming readable data into unreadable ciphertext using a key. It protects data at rest (stored on disks), data in transit (network communication), and data in use (memory). Even if an attacker gains access to storage, they cannot read the data without the decryption key.

Question 51

What is a 'supply chain attack'?

Accepted Answer

A supply chain attack targets an organization by compromising third-party vendors, service providers, or software dependencies. Attackers inject malicious code into legitimate updates or products. Prevention: vet vendors, code signing, software composition analysis, and continuous monitoring of dependencies.

Question 52

What are the emerging trends in cybersecurity?

Accepted Answer

Emerging trends include: AI/ML in security (threat detection and response), Zero Trust adoption, cloud-native security (CSPM, CWPP), increased focus on IoT/OT security, Quantum-resistant cryptography, automated security orchestration (SOAR), and growing importance of privacy-preserving technologies (homomorphic encryption, differential privacy). Also, the rise of ransomware-as-a-service and state-sponsored attacks continues.

Cybersecurity Q&A