Cybersecurity interview questions for freshers, covering fundamental concepts, common attacks, and security principles.

Fundamental Concepts

1. What is the CIA Triad in Cybersecurity?

Answer: The CIA Triad is the foundation of cybersecurity, representing three key principles:

• Confidentiality: Ensuring data is accessible only to authorized users (encryption, access controls)

• Integrity: Maintaining accuracy and trustworthiness of data (hashing, digital signatures)

• Availability: Ensuring systems and data are accessible when needed (redundancy, backups, DDoS protection)

2. Explain the difference between Authentication and Authorization.

Answer:

• Authentication: Verifying who you are (proving identity)

  • Examples: Username/password, biometrics, 2FA

  • Question: "Are you who you say you are?"

• Authorization: Determining what you can access (permissions)

  • Examples: File permissions, role-based access

  • Question: "What are you allowed to do?"

Analogy: Authentication is showing your ID card to enter a building. Authorization is which rooms you're allowed to enter once inside.

3. What is the difference between Vulnerability, Threat, and Risk?

Answer:

• Vulnerability: A weakness in a system that could be exploited (unpatched software, misconfiguration)

• Threat: Anything that can exploit a vulnerability (hackers, malware, natural disasters)

• Risk: The potential for loss or damage when a threat exploits a vulnerability

Formula: Risk = Threat × Vulnerability × Impact

4. What are the different types of hackers?

Answer:

• Black Hat: Malicious hackers who break laws for personal gain

• White Hat: Ethical hackers who work legally to improve security

• Grey Hat: Operate between ethical and unethical (may hack without permission but disclose findings)

• Script Kiddie: Inexperienced hackers using pre-made tools

• Hacktivist: Hack for political or social causes

Common Attacks & Threats

5. What is Phishing and what are its variations?

Answer: Social engineering attack that tricks users into revealing sensitive information.

Variations:

• Spear Phishing: Targeted at specific individuals/organizations

• Whaling: Targeting high-level executives

• Vishing: Voice phishing (phone calls)

• Smishing: SMS phishing (text messages)

• Clone Phishing: Replicating legitimate emails with malicious links

6. Explain DDoS attacks and how they work.

Answer: Distributed Denial of Service attack overwhelms a system with traffic from multiple sources.

How it works:

1. Attacker controls a botnet (compromised devices)

2. All bots simultaneously send requests to target

3. Target's resources are exhausted

4. Legitimate users cannot access the service

Types:

• Volume-based: UDP floods, ICMP floods

• Protocol-based: SYN floods, Ping of Death

• Application-layer: HTTP floods, Slowloris

7. What is Malware and what are common types?

Answer: Malicious software designed to harm computer systems.

Common Types:

• Virus: Self-replicating, requires user action to execute

• Worm: Self-replicating, spreads without user interaction

• Trojan: Disguised as legitimate software

• Ransomware: Encrypts files and demands payment

• Spyware: Secretly monitors user activity

• Adware: Displays unwanted advertisements

• Rootkit: Hides deep in system, hard to detect

8. What is a Man-in-the-Middle (MitM) attack?

Answer: Attacker secretly intercepts and relays messages between two parties.

Examples:

• Wi-Fi Eavesdropping: On unsecured public networks

• Session Hijacking: Stealing session cookies

• SSL Stripping: Downgrading HTTPS to HTTP

Protection: Encryption, certificate pinning, VPNs

9. What are SQL Injection attacks?

Answer: Injecting malicious SQL code into database queries through input fields.

Example:

sql

-- User input: ' OR '1'='1
-- Becomes: 
SELECT * FROM users WHERE username = '' OR '1'='1' AND password = ''
-- This bypasses authentication because '1'='1' is always true

Prevention: Input validation, parameterized queries, prepared statements

10. What is Cross-Site Scripting (XSS)?

Answer: Injecting malicious scripts into web pages viewed by other users.

Types:

• Stored XSS: Malicious script stored on server

• Reflected XSS: Script reflected off web server

• DOM-based XSS: Vulnerability in client-side code

Prevention: Input sanitization, Content Security Policy (CSP), output encoding

Network Security

11. What is a Firewall and how does it work?

Answer: Network security device that monitors and controls incoming/outgoing traffic based on security rules.

Types:

• Packet-filtering: Examines packet headers

• Stateful Inspection: Tracks connection state

• Proxy Firewall: Acts as intermediary

• Next-Generation Firewall (NGFW): Includes intrusion prevention, deep packet inspection

12. Explain the difference between IDS and IPS.

Answer:

• IDS (Intrusion Detection System): Monitors network traffic and alerts on suspicious activity (passive)

• IPS (Intrusion Prevention System): Actively blocks detected threats (active)

Comparison:

13. What is VPN and how does it provide security?

Answer: Virtual Private Network creates encrypted tunnel over public network.

Security Benefits:

• Confidentiality: Encryption protects data

• Integrity: Prevents tampering

• Authentication: Verifies communicating parties

Protocols: IPsec, SSL/TLS, OpenVPN, WireGuard

14. What is SSL/TLS and how does the handshake work?

Answer: Secure Sockets Layer/Transport Layer Security - encryption protocols for secure communication.

TLS Handshake Process:

1. Client Hello: Supported cipher suites, TLS version

2. Server Hello: Selected cipher suite, certificate

3. Authentication: Server verification

4. Key Exchange: Pre-master secret exchange

5. Session Keys: Generate encryption keys

6. Secure Communication: Encrypted data transfer

Security Practices & Principles

15. What is Defense in Depth?

Answer: Layered security approach using multiple controls throughout IT system.

Layers:

1. Physical security (access controls)

2. Network security (firewalls, IDS/IPS)

3. Application security (input validation)

4. Data security (encryption)

5. Administrative controls (policies, training)

16. What is the Principle of Least Privilege?

Answer: Users and systems should have only the minimum permissions necessary to perform their tasks.

Benefits:

• Reduces attack surface

• Limits damage from compromised accounts

• Improves compliance

Implementation: Role-Based Access Control (RBAC), regular permission reviews

17. Explain Patch Management process.

Answer: Systematic process of managing software updates.

Steps:

1. Inventory: Catalog all systems and software

2. Monitor: Track available patches and vulnerabilities

3. Evaluate: Assess patch criticality and impact

4. Test: Deploy to test environment first

5. Deploy: Roll out to production

6. Verify: Confirm successful installation

7. Document: Maintain patch records

18. What is Multi-Factor Authentication (MFA)?

Answer: Using multiple authentication factors to verify identity.

Authentication Factors:

• Something you know: Password, PIN

• Something you have: Phone, security token

• Something you are: Fingerprint, facial recognition

Examples: Google Authenticator, SMS codes, hardware tokens, biometrics

Incident Response & Cryptography

19. Explain the Incident Response lifecycle.

Answer: Structured approach to handling security incidents.

Phases:

1. Preparation: Develop policies, train team, establish tools

2. Detection & Analysis: Identify and assess incidents

3. Containment: Isolate affected systems (short-term & long-term)

4. Eradication: Remove threat (malware, attacker access)

5. Recovery: Restore systems and monitor

6. Post-Incident Activity: Lessons learned, improve processes

20. What is the difference between Symmetric and Asymmetric encryption?

Answer:

• Symmetric Encryption: Same key for encryption and decryption

  • Algorithms: AES, DES, 3DES

  • Pros: Fast, efficient for large data

  • Cons: Key distribution problem

• Asymmetric Encryption: Different keys for encryption (public) and decryption (private)

  • Algorithms: RSA, ECC, Diffie-Hellman

  • Pros: Solves key distribution, enables digital signatures

  • Cons: Slower, computationally intensive

Common Use: HTTPS uses both - asymmetric for key exchange, symmetric for data encryption

Bonus: Scenario-Based Questions

21. How would you secure a web application?

Answer:
Security Measures:

• Input Validation: Sanitize all user inputs

• Authentication: Strong password policies, MFA

• Authorization: Role-based access control

• Session Management: Secure cookies, session timeout

• Data Protection: Encryption at rest and in transit

• Security Headers: CSP, HSTS, X-Frame-Options

• Regular Testing: Penetration testing, code reviews

• Dependency Scanning: Monitor third-party vulnerabilities

22. What would you do if you discovered a data breach?

Answer:
Immediate Actions:

1. Contain: Isolate affected systems

2. Assess: Determine scope and impact

3. Notify: Inform management and legal team

4. Preserve Evidence: Don't delete anything

5. Communicate: Follow incident response plan

6. Remediate: Fix vulnerabilities

7. Review: Conduct post-mortem analysis

These questions cover the fundamental knowledge expected from freshers in cybersecurity roles. Focus on understanding the concepts and being able to explain them in simple, clear terms!