Cyber Security Interview Questions

What is the primary goal of Cyber Security?

The main objective of cyber security is to protect data. To defend data from cyber threats, the security field uses a trio of

interconnected principles called the CIA triad.

What are the fundamental components of cyber security?

Cyber security involves several core elements working collectively to guard systems, networks, and data against cyber threats.

What are the different categories of Cyber Security?

Organizations' assets consist of diverse systems, creating a strong cybersecurity posture requiring coordinated efforts. Cybersecurity

divides into several sub-domains:

What advantages does Cyber Security provide?

Implementing and maintaining cybersecurity offers numerous benefits to organizations and individuals:

Can you explain the CIA Triad in Cyber Security?

The CIA Triad is a key model guiding information security policy in organizations.

- Encryption (AES, RSA)

- Access controls and authentication

- Data classification

- Hashing (SHA-256, MD5)

- Digital signatures

- Checksums and version control

- Redundancy and backups

- DDoS protection

- Disaster recovery plans

How do threat, vulnerability, and risk differ?

Threat, Vulnerability, and Risk are related but distinct concepts in cybersecurity.

Threat (what could go wrong) + Vulnerability (weakness that can be exploited) = Risk (likelihood of damage)

What do Risk, Vulnerability, and Threat mean within a network?

In a network context, these terms have specific meanings related to network security:

- DDoS attacks

- Man-in-the-middle attacks

- Network sniffing

- Malware propagation

- Open ports

- Weak encryption protocols

- Misconfigured firewalls

- Unpatched software

Network Risk = Threat × Vulnerability × Asset Value

| Threat | Vulnerability | Network Risk |

|---|---|---|

| DDoS attacker | No DDoS protection | Service downtime |

| Insider threat | Excessive privileges | Data theft |

| Eavesdropper | Unencrypted traffic | Sensitive data leak |

How do active cyber attacks differ from passive ones?

| Aspect | Active Attack | Passive Attack |

|---|---|---|

| Modifies data | Yes | No |

| Detectable | Usually | Difficult |

| CIA Triad target | Integrity, Availability | Confidentiality |

| Examples | DoS, MITM modification | Sniffing, traffic analysis |

| Damage caused | System disruption | Information disclosure |

| Defense priority | Detection & response | Encryption & monitoring |

Who are black hat, white hat, and grey hat hackers?

Hackers are typically classified into three categories based on their intent and ethics:

| Aspect | White Hat | Black Hat | Grey Hat |

|---|---|---|---|

| Legal | Yes | No | Often illegal |

| Intent | Protective | Malicious | Mixed |

| Permission | Has authorization | No authorization | Often no permission |

| Motivation | Defense, payment | Profit, harm | Curiosity, recognition |

| Examples | Bug bounty hunters | Cybercriminals | Vulnerability finders |

What is a botnet?

A botnet is a network of internet-connected devices infected with malware and controlled remotely by an attacker.

What are some common types of Cyberattacks?

Common cyberattacks that organizations and individuals face include:

What typical cyber security attacks are prevalent?

The most prevalent cybersecurity attacks in modern times include:

How would you define Phishing?

Phishing is a cybercrime where attackers impersonate trusted entities via email, calls, or texts to trick victims into revealing

sensitive data.

1. Attacker crafts a convincing message mimicking a trusted source.

2. Victim receives the message (email, SMS, call).

3. Victim is lured to a fake website or asked to share information.

4. Credentials or data are captured by the attacker.

5. Attacker uses stolen data for fraud, identity theft, or further attacks.

Describe Phishing and methods to prevent it.

Phishing is a deceptive cyberattack where attackers masquerade as trustworthy sources to steal credentials and financial info.

What is meant by a Man-in-the-Middle Attack?

A Man-in-the-Middle (MITM) attack happens when an attacker secretly intercepts and potentially alters communication between two

parties who believe they are directly connected.

```

Victim ←→ [Attacker] ←→ Server

(intercepts &

relays messages)

```

1. Attacker positions between victim and destination.

2. Victim's traffic is routed through the attacker.

3. Attacker reads and/or modifies the data.

4. Modified data is forwarded to the destination.

5. Neither party detects the interception.

Can you explain the man-in-the-middle attack?

A Man-in-the-Middle (MITM) attack involves a malicious actor inserting themselves into communication between two parties, capturing

and possibly modifying data without detection.

What does brute force mean in Cyber Security?

A brute force attack tries all possible combinations to guess passwords, login credentials, or encryption keys through **systematic

trial and error**.

```

Try "password1" → Wrong

Try "password2" → Wrong

Try "password3" → Wrong

...

Try "letmein" → Success!

```

| Password | Time to Crack |

|---|---|

| 6 chars (lowercase) | ~10 seconds |

| 8 chars (mixed) | ~8 hours |

| 12 chars (complex) | ~34,000 years |

| 16 chars (complex) | Trillions of years |

How can brute force attacks be prevented?

Brute force attacks can be effectively prevented through multiple defensive measures:

What is a Distributed Denial of Service (DDoS) attack?

A DDoS (Distributed Denial of Service) attack floods a target server or network with **excessive traffic from multiple compromised

devices**, overwhelming resources and disrupting services.

```

[Botnet of 1000s of devices]

↓

Coordinated Attack

↓

Target Server (overwhelmed)

↓

Legitimate users → DENIED

```

What is Spoofing in Cyber Security?

Spoofing is an attack where attackers fake a trusted identity by falsifying data to access systems, steal info, or spread malware.

What is Shoulder Surfing?

Shoulder Surfing is when an attacker observes someone's screen or keyboard to steal sensitive info like passwords or PINs.

What is a Replay Attack?

A Replay Attack involves intercepting legitimate data transmissions and retransmitting them maliciously to deceive recipients.

```

1. Victim sends authentication to server: "Login: encrypted_credentials"

2. Attacker intercepts and saves the message

3. Later, attacker replays: "Login: encrypted_credentials"

4. Server accepts as valid → attacker gains access

```

Define encryption and decryption.

Encryption and decryption are fundamental cryptographic operations for protecting information.

```

Plaintext → [Encryption Algorithm + Key] → Ciphertext

Ciphertext → [Decryption Algorithm + Key] → Plaintext

```

```

Plaintext: "Hello World"

Encryption: AES with key "secret_key_123"

Ciphertext: "x9$Kj!2mPq#aZ"

Decryption: AES with key "secret_key_123"

Plaintext: "Hello World"

```

| Algorithm | Type | Use Case |

|---|---|---|

| AES | Symmetric | Bulk data encryption |

| DES | Symmetric | Legacy systems |

| RSA | Asymmetric | Key exchange, signatures |

| ECC | Asymmetric | Modern lightweight |

| Blowfish | Symmetric | Fast block cipher |

How do hashing and encryption differ?

| Aspect | Hashing | Encryption |

|---|---|---|

| Reversibility | One-way | Two-way (reversible) |

| Output length | Fixed | Variable (depends on input) |

| Purpose | Integrity, verification | Confidentiality |

| Uses key | No (or salt only) | Yes |

| Output for same input | Same | Same (with same key) |

| Examples | MD5, SHA-256 | AES, RSA |

```

Input: "password123"

SHA-256: "ef92b778bafe771e89245b89ecbc..."

Input: "password123" (same)

SHA-256: "ef92b778bafe771e89245b89ecbc..." (same hash)

Input: "password124" (changed)

SHA-256: "completely_different_hash..." (avalanche effect)

```

```

Plaintext: "Secret Message"

Key: "encryption_key_123"

Encrypted: "x9$Kj!2mPq#aZ"

Decrypted with same key: "Secret Message" (recoverable)

```

What distinguishes hashing from encryption?

Hashing and encryption serve different purposes in cybersecurity:

| Property | Hashing | Encryption |

|---|---|---|

| Direction | One-way | Two-way |

| Output size | Fixed length | Variable |

| Recovery | Impossible | Possible with key |

| Key required | No (or salt) | Yes |

| Speed | Fast | Slower |

| Purpose | Verify integrity | Protect confidentiality |

| Same input → same output | Always | With same key |

```

User registers with password "mypass123"

System stores: SHA-256("mypass123") = "a1b2c3d4..."

User logs in with "mypass123"

System computes: SHA-256("mypass123") = "a1b2c3d4..."

Match → Login successful

If database is breached:

Attacker sees "a1b2c3d4..."

Cannot reverse to get "mypass123"

```

```

Alice wants to send "Hi Bob" to Bob securely

Alice encrypts: AES("Hi Bob", key) = "x7$kP9!@"

Bob receives "x7$kP9!@"

Bob decrypts: AES_decrypt("x7$kP9!@", key) = "Hi Bob"

```

What is the difference between Symmetric and Asymmetric Encryption?

| Aspect | Symmetric | Asymmetric |

|---|---|---|

| Number of keys | One (shared) | Two (public + private) |

| Speed | Fast | Slow (100-1000x slower) |

| Key distribution | Difficult | Easy |

| Use case | Bulk data | Key exchange, signatures |

| Key size | 128-256 bits | 2048-4096 bits (RSA) |

| Examples | AES, DES, Blowfish | RSA, ECC, ElGamal |

```

Sender: Plaintext + SecretKey → AES → Ciphertext

↓

(Send ciphertext)

↓

Receiver: Ciphertext + SecretKey → AES → Plaintext

```

Challenge: How do sender and receiver share the secret key securely?

```

1. Receiver generates Public-Private key pair

2. Receiver shares Public key openly

3. Sender encrypts message with Receiver's Public key

4. Receiver decrypts with their Private key

```

Solution: No need to share secret keys — public key can be freely distributed.

What is a block cipher?

A block cipher encrypts data in fixed-size blocks instead of bit-by-bit or byte-by-byte.

```

Plaintext: "Hello World, this is a secret message"

↓

Divide into blocks: [Block1][Block2][Block3]...

↓

Encrypt each block with key

↓

Ciphertext: [Cipher1][Cipher2][Cipher3]...

```

| Aspect | Block Cipher | Stream Cipher |

|---|---|---|

| Processing | Fixed-size blocks | Bit/byte by bit/byte |

| Padding | Required | Not required |

| Speed | Slower | Faster |

| Memory | More | Less |

| Use case | Bulk data | Real-time data |

How do Stream Cipher and Block Cipher differ?

| Aspect | Stream Cipher | Block Cipher |

|---|---|---|

| Processing | Bit/byte at a time | Fixed-size blocks |

| Speed | Fast | Slower |

| Memory | Low | Higher |

| Padding | Not needed | Required |

| Hardware needs | Simple | More complex |

| Error propagation | Limited (single bit) | Affects entire block |

| Use case | Real-time, streaming | Bulk data |

| Examples | RC4, ChaCha20, Salsa20 | AES, DES, Blowfish |

```

1. Generate keystream from key

2. XOR keystream with plaintext, bit by bit

3. Result is ciphertext

Plaintext: 0 1 1 0 0 1 1 0

Keystream: 1 0 1 1 0 1 0 1

Ciphertext: 1 1 0 1 0 0 1 1 (XOR)

```

```

1. Divide plaintext into fixed-size blocks

2. Encrypt each block separately with key

3. Combine encrypted blocks for ciphertext

Plaintext: [Block1][Block2][Block3]...

↓ ↓ ↓

Encrypt: [E1] [E2] [E3]

↓ ↓ ↓

Ciphertext: [C1][C2][C3]...

```

What is the difference between plaintext and cleartext?

Plaintext and Cleartext are often used interchangeably but have subtle distinctions:

| Aspect | Plaintext | Cleartext |

|---|---|---|

| Definition | Input to encryption | Unencrypted state |

| Context | Cryptographic process | Transmission/storage |

| Implies encryption | Yes (or will be) | No |

| Example | "Hello" before AES encryption | Password in HTTP form |

```

Plaintext: "Confidential Document"

↓ AES Encryption

Ciphertext: "x7$kP9!@mNq2"

```

```

HTTP POST request:

username=admin&password=mypass123

(Sent in cleartext over HTTP — visible to any observer)

```

| Cleartext Protocol | Secure Alternative |

|---|---|

| HTTP | HTTPS (TLS) |

| FTP | SFTP, FTPS |

| Telnet | SSH |

| POP3 | POP3S |

| SMTP | SMTPS |

| LDAP | LDAPS |

What are some common hashing functions?

Common hashing algorithms used in cybersecurity include various cryptographic and non-cryptographic functions:

| Algorithm | Output Size | Security Status | Use Case |

|---|---|---|---|

| MD5 | 128-bit | Broken | Checksums only |

| SHA-1 | 160-bit | Deprecated | Legacy systems |

| SHA-256 | 256-bit | Secure | Modern crypto |

| SHA-512 | 512-bit | Secure | High security |

| SHA-3 | Variable | Secure | Future-proof |

| Whirlpool | 512-bit | Secure | Disk encryption |

What is Perfect Forward Secrecy?

Perfect Forward Secrecy (PFS) ensures session keys remain safe even if the server's long-term private key is compromised later.

```

Without PFS:

With PFS:

```

```

1. Server uses RSA key for years

2. Attacker records encrypted traffic over time

3. Attacker eventually steals server's private key

4. Attacker decrypts ALL recorded past traffic

```

```

1. Server uses ephemeral keys for each session

2. Attacker records encrypted traffic

3. Attacker steals server's long-term key later

4. Attacker CANNOT decrypt past traffic (session keys deleted)

```

```

SSLCipherSuite ECDHE-RSA-AES256-GCM-SHA384

```

```

ssl_ciphers ECDHE-RSA-AES256-GCM-SHA384;

```

What is the key difference between Diffie-Hellman and RSA?

| Aspect | Diffie-Hellman | RSA |

|---|---|---|

| Primary use | Key exchange | Encryption + signatures |

| Encryption ability | No | Yes |

| Key pair | Generates shared secret | Public-private pair |

| Authentication | No (alone) | Yes |

| Year invented | 1976 | 1977 |

| Inventors | Diffie, Hellman | Rivest, Shamir, Adleman |

| Mathematical basis | Discrete logarithm | Factoring large primes |

```

1. Alice and Bob agree on public parameters (g, p)

2. Alice picks secret 'a', computes A = g^a mod p

3. Bob picks secret 'b', computes B = g^b mod p

4. Alice sends A to Bob, Bob sends B to Alice

5. Both compute shared secret:

Alice: K = B^a mod p

Bob: K = A^b mod p

6. Both arrive at same key K (without ever sharing it)

```

```

1. Generate two large primes p and q

2. Compute n = p × q

3. Compute φ(n) = (p-1)(q-1)

4. Choose e (public exponent, often 65537)

5. Compute d such that (e × d) mod φ(n) = 1

6. Public key: (n, e)

7. Private key: (n, d)

Encryption: ciphertext = plaintext^e mod n

Decryption: plaintext = ciphertext^d mod n

```

- ECDHE for key exchange (PFS).

- RSA for server authentication (certificate signature).

| Operation | RSA-2048 | ECDH P-256 |

|---|---|---|

| Key generation | Slow | Fast |

| Key exchange | Slow | Fast |

| Encryption | Fast | N/A |

| Signature | Slow | Fast |

| Verification | Fast | Fast |

What is the Blowfish encryption algorithm?

Blowfish, created by Bruce Schneier in 1993, is a symmetric block cipher.

```

1. Input: 64-bit plaintext block

2. Split into 32-bit halves: L and R

3. For each of 16 rounds:

- L = L XOR P[i]

- R = F(L) XOR R

- Swap L and R

4. After 16 rounds:

- R = R XOR P[16]

- L = L XOR P[17]

5. Output: 64-bit ciphertext block (L + R)

```

| Algorithm | Block Size | Key Size | Speed | Status |

|---|---|---|---|---|

| Blowfish | 64-bit | 32-448 bit | Fast | Limited use |

| Twofish | 128-bit | 128-256 bit | Fast | Secure |

| AES | 128-bit | 128-256 bit | Fast | Standard |

| DES | 64-bit | 56 bit | Slow | Deprecated |

| 3DES | 64-bit | 168 bit | Slow | Being phased out |

What is a Firewall?

A firewall is a network security device or application that monitors and controls incoming and outgoing traffic based on **predefined

rules**.

```

Internet (untrusted) → [Firewall] → Internal Network (trusted)

↑

Allows/Blocks based on rules

```

```

Permit TCP from any to 192.168.1.10 port 443 (Allow HTTPS to web server)

```

```

Deny TCP from any to any port 23 (Block Telnet)

```

Can you define a Firewall?

A firewall is a network security system designed to block unauthorized access while allowing legitimate communication.

```

Firewall Rules for a Small Office:

1. Allow employees to browse web (HTTP/HTTPS outbound)

2. Allow email (SMTP/IMAP)

3. Block streaming services (Netflix, YouTube during work hours)

4. Block all incoming traffic except web server (port 443)

5. Block known malicious IPs from threat intelligence

6. Log all blocked attempts

```

- PCI-DSS for payment systems.

- HIPAA for healthcare.

- SOX for financial data.

What is a Virtual Private Network (VPN)?

A Virtual Private Network (VPN) creates a secure, encrypted connection over public networks like the Internet.

```

Without VPN:

You → Internet (visible) → Website

ISP sees everything you do

With VPN:

You → [Encrypted Tunnel] → VPN Server → Website

ISP only sees encrypted traffic to VPN

```

What is the Domain Name System (DNS)?

The Domain Name System (DNS) is a hierarchical naming system that translates human-readable domain names into IP addresses.

```

1. User types www.google.com in browser

2. Browser checks local cache → not found

3. OS asks Recursive DNS Resolver (e.g., ISP's)

4. Resolver asks Root DNS server

5. Root server points to .com TLD server

6. TLD server points to Google's authoritative DNS

7. Authoritative server returns IP: 142.250.xxx.xxx

8. Browser connects to that IP

```

```

Root (.)

↓

TLD (com, org, net, ...)

↓

Domain (google.com)

↓

Subdomain (mail.google.com)

```

Why Caching?

- Email delivery.

- Web browsing.

- All internet services.

What is SQL injection?

SQL Injection (SQLi) is a code injection attack where attackers insert malicious SQL commands into input fields to manipulate

databases.

```sql

SELECT * FROM users

WHERE username = '$username' AND password = '$password';

```

```

Username: admin'--

Password: anything

```

```sql

SELECT * FROM users

WHERE username = 'admin'--' AND password = 'anything';

```

The `--` comments out the password check, allowing login without password!

```

Input: ' OR '1'='1

Query: SELECT * FROM users WHERE username = '' OR '1'='1' AND password = ''

Result: '1'='1' is always true, returning all rows

```

```python

# Vulnerable:

query = f"SELECT * FROM users WHERE username = '{username}'"

# Safe:

cursor.execute("SELECT * FROM users WHERE username = ?", (username,))

```

```python

# String concatenation

query = "SELECT * FROM users WHERE id = " + user_input

# String formatting

query = "SELECT * FROM users WHERE id = %s" % user_input

# f-strings

query = f"SELECT * FROM users WHERE id = {user_input}"

# All of these are vulnerable!

```

```python

# Parameterized query

cursor.execute("SELECT * FROM users WHERE id = ?", (user_input,))

# Named parameters

cursor.execute("SELECT * FROM users WHERE id = :id", {"id": user_input})

```

What does Network Sniffing mean?

Network sniffing involves capturing and analyzing network packets traveling across a network.

```

Source Destination Protocol Info

192.168.1.5 192.168.1.1 HTTP GET /login.php

192.168.1.5 192.168.1.1 HTTP POST /login.php

username=admin&password=secret123

(captured in cleartext!)

```

What is IP blocklisting?

IP blocklisting denies access to specific IP addresses known to be malicious, suspicious, or linked to cyberattacks.

```

1. Identify bad IP address (manually or automatically)

2. Add to blocklist

3. Firewall/security tool checks incoming connections

4. If source IP is on blocklist → deny connection

5. Connection blocked at network level

```