Cybersecurity Analyst interview questions

The CIA triad describes confidentiality, integrity, and availability as the core goals of information security.

• Confidentiality limits information access to authorized people and systems.
• Integrity protects data from unauthorized or accidental alteration.
• Availability keeps systems and information accessible when authorized users need them.
• Security controls often support several goals, but a decision may trade one goal against another.

A threat can cause harm, a vulnerability is a weakness, and risk reflects the likelihood and impact of exploitation.

• A threat may be an attacker, malicious software, human error, or a natural event.
• A vulnerability may be an unpatched service, weak password, or unsafe process.
• Risk exists when a relevant threat can exploit a vulnerability and affect an asset.
• Controls reduce risk by lowering likelihood, impact, or both.

Assets are things worth protecting, exposures are conditions that can lead to loss, and controls reduce that possibility.

• Assets include data, identities, devices, applications, services, and business processes.
• Exposure describes being subject to harm, even when no specific software flaw is present.
• Preventive controls try to stop unwanted events, while detective controls reveal them.
• Corrective controls restore a secure state or reduce damage after a problem occurs.

Defense in depth uses multiple independent security layers so one failed control does not expose the entire system.

• Identity controls restrict who can sign in and what they can access.
• Network and endpoint controls limit communication and malicious execution.
• Logging and monitoring provide visibility when preventive controls fail.
• Backups and recovery measures reduce impact when an attack still succeeds.

An attack surface is the set of reachable points where an attacker could try to enter, extract data, or affect a system.

• It includes internet-facing services, endpoints, user accounts, APIs, and physical access.
• Unused ports, excessive permissions, and forgotten cloud resources expand the attack surface.
• Asset inventory is necessary because unknown systems cannot be secured consistently.
• Removing unnecessary exposure is usually safer than relying only on detection around it.

Phishing uses deceptive communication to make a person reveal information, open malicious content, or authorize an action.

• Messages often imitate a trusted organization and create urgency or fear.
• Spear phishing targets a specific person with tailored details, while broad phishing reaches many recipients.
• Link inspection, verified communication channels, email filtering, and user training reduce exposure.
• MFA limits some credential theft impact, although phishing-resistant factors provide stronger protection.

Malware is software designed to disrupt systems, steal information, gain access, or perform unauthorized actions.

• A virus attaches to other files, while a worm can spread between systems without user action.
• A trojan disguises itself as legitimate software to persuade a user to run it.
• Spyware collects information, while a rootkit attempts to hide malicious presence or preserve privileged access.
• Modern malware may combine several behaviors, so categories describe capabilities rather than strict boundaries.

Ransomware is malware that denies access to data or systems and demands payment for restoration or non-disclosure.

• Many campaigns encrypt files, while double-extortion campaigns also steal data before encryption.
• Initial access commonly involves phishing, stolen credentials, or exposed unpatched services.
• Segmentation, patching, MFA, endpoint protection, and restricted privileges reduce likelihood and spread.
• Tested offline or immutable backups reduce recovery dependence on the attacker.

The three attacks misuse credentials differently based on how passwords and accounts are selected.

• Brute force tries many password guesses against one or more accounts.
• Password spraying tries a small set of common passwords across many accounts to avoid lockouts.
• Credential stuffing reuses username and password pairs stolen from another service.
• MFA, rate limits, breached-password checks, strong password policy, and anomaly detection reduce their effectiveness.

Social engineering manipulates people into bypassing normal security behavior or disclosing protected information.

• Pretexting creates a believable identity or story to justify a request.
• Baiting offers something attractive, while tailgating seeks physical access by following an authorized person.
• Verification through a separate trusted channel breaks the attacker's control of the conversation.
• Clear procedures and a culture that rewards cautious reporting are as important as awareness training.

SQL injection occurs when untrusted input changes the structure or meaning of a database query.

• String concatenation can let attacker-controlled characters become executable SQL syntax.
• Parameterized queries keep code separate from values and are the primary defense.
• Input validation helps enforce expected formats but should not replace parameterization.
• Least-privileged database accounts limit damage if an injection flaw remains.

Cross-site scripting, or XSS, makes a trusted website execute attacker-controlled script in a user's browser.

• Stored XSS persists malicious content on the server, while reflected XSS returns it in an immediate response.
• DOM-based XSS arises when client-side code writes unsafe data into a dangerous browser sink.
• Context-aware output encoding and safe templating prevent data from becoming executable markup or script.
• Content Security Policy adds defense in depth but does not replace correct encoding.

Cross-site request forgery, or CSRF, tricks an authenticated browser into sending an unwanted request to a trusted site.

• The browser may automatically attach session cookies even when the request started on a malicious page.
• Anti-CSRF tokens bind state-changing requests to the legitimate application session.
• SameSite cookies and origin checks provide additional protection.
• CSRF differs from XSS because it abuses an existing session rather than executing script in the trusted page.

The OWASP Top 10 is an awareness document describing broad categories of important web application security risks.

• Categories include broken access control, injection, cryptographic failures, and security misconfiguration.
• It helps teams share terminology and prioritize secure development education.
• It is not a complete testing checklist and does not rank every vulnerability in a specific application.
• Risk decisions still require application context, threat modeling, and evidence from testing.

Broken access control allows a user to perform an action or access data beyond their intended permissions.

• Examples include viewing another user's record by changing an identifier or reaching an admin function directly.
• Authorization must be enforced on the server for every protected object and action.
• Deny-by-default rules and centralized policy reduce missed checks.
• Tests should cover horizontal access between peers and vertical access to higher privileges.

Injection is prevented by keeping untrusted data separate from executable commands and enforcing expected input structure.

• Parameterized interfaces should be used for SQL, operating-system commands, and similar interpreters when available.
• Allowlist validation rejects values outside the required format or range.
• Output encoding is context-specific and is especially important when data enters HTML, JavaScript, or shell contexts.
• Least privilege limits the actions available to the interpreter if another control fails.

Security misconfiguration is an unsafe setting or default that exposes more capability or information than intended.

• Examples include default credentials, public storage, verbose errors, and unnecessary services.
• Secure baselines such as CIS Benchmarks make expected settings explicit and repeatable.
• Automated configuration checks can detect drift from an approved baseline.
• Hardening must be maintained through updates because new features and defaults can change exposure.

A firewall permits or blocks network traffic according to rules about source, destination, protocol, port, and connection state.

• Packet-filtering firewalls evaluate header fields, while stateful firewalls also track established connections.
• Rules should allow required communication and deny unnecessary paths.
• Host firewalls protect individual endpoints, while network firewalls control traffic between network zones.
• Firewall logs provide evidence of allowed and denied connections but do not prove that permitted traffic is safe.

Network segmentation divides systems into zones so communication can be limited according to trust and business need.

• User devices, servers, management systems, and sensitive databases should not share unrestricted connectivity.
• Access control lists and firewalls enforce which protocols may cross zone boundaries.
• Segmentation reduces lateral movement and limits the reach of compromised accounts or devices.
• Segments require maintained asset classification and rules or they become broad, ineffective trust zones.

An IDS detects and alerts on suspicious traffic, while an IPS can also block or modify traffic inline.

• Signature-based detection matches known patterns and is precise for covered threats.
• Anomaly-based detection looks for deviations but may generate more false positives.
• An IPS can stop activity quickly but an incorrect rule may disrupt legitimate traffic.
• Both require current rules, relevant traffic visibility, and tuning for the protected environment.