Cyber Security – 100 Interview Questions and Answers for 3 Years Experience
1. Explain your Cyber Security experience.
Answer:
I have around three years of experience in Cyber Security. My experience includes security monitoring, alert investigation, log analysis, incident response, vulnerability management, and working with security tools such as SIEM and endpoint security solutions.
2. What are your main responsibilities in your current security role?
Answer:
My responsibilities include monitoring security alerts, analyzing logs, investigating suspicious activities, identifying potential threats, escalating incidents, documenting investigations, and following incident-response procedures.
3. What is your typical day as a Security Analyst?
Answer:
I start by reviewing security alerts and priority incidents. I investigate suspicious events using SIEM and endpoint logs, correlate information from different sources, document findings, escalate confirmed incidents, and monitor ongoing cases.
4. How do you investigate a security alert?
Answer:
First, I understand what triggered the alert. Then I check the affected user, host, IP address, timestamp, and related logs. I correlate events from different sources and determine whether the activity is legitimate, suspicious, or malicious.
5. How do you decide whether an alert is a true positive or false positive?
Answer:
I examine the alert context, user behavior, source and destination information, historical activity, and related logs. If the activity matches a legitimate business process, it may be a false positive. If evidence indicates malicious behavior, I treat it as a true positive.
6. What information do you collect during an incident investigation?
Answer:
I collect information such as timestamps, usernames, source and destination IP addresses, hostnames, processes, URLs, domains, authentication events, file activity, and relevant SIEM or endpoint logs.
7. What is alert triage?
Answer:
Alert triage is the process of reviewing security alerts, validating their importance, determining their severity, and deciding which alerts require further investigation or escalation.
8. How do you prioritize security incidents?
Answer:
I consider factors such as severity, affected assets, sensitivity of the data, number of affected users, potential business impact, evidence of active compromise, and whether the threat is spreading.
9. What is incident severity?
Answer:
Incident severity represents the potential impact and urgency of a security incident. Organizations commonly categorize incidents using levels such as low, medium, high, and critical.
10. What is incident escalation?
Answer:
Incident escalation means transferring an incident to a more specialized or senior security team when it requires additional expertise, authority, or response actions.
11. What is SIEM?
Answer:
SIEM stands for Security Information and Event Management. It collects and analyzes security logs from multiple sources and helps security teams detect, investigate, and respond to threats.
12. Which log sources are commonly connected to a SIEM?
Answer:
Common sources include firewalls, VPNs, Active Directory, Windows servers, Linux systems, endpoints, cloud platforms, web servers, databases, email security systems, and security applications.
13. What is log correlation?
Answer:
Log correlation means connecting related events from different systems to identify a larger security pattern. For example, a failed login followed by a successful login and unusual data access may indicate suspicious activity.
14. What is a SIEM correlation rule?
Answer:
A correlation rule defines conditions that identify a specific pattern of activity. When those conditions occur, the SIEM can generate an alert.
15. How would you investigate multiple failed login attempts?
Answer:
I would check the username, source IP, target system, timestamps, geographic information if available, authentication method, and whether a successful login followed the failures. I would also check whether the activity resembles password spraying or brute-force behavior.
16. What is password spraying?
Answer:
Password spraying is an attack where an attacker tries a small number of commonly used passwords against many accounts instead of repeatedly targeting one account.
17. How is password spraying different from brute force?
Answer:
Brute force generally attempts many passwords against one account. Password spraying typically attempts a limited set of passwords across many accounts to avoid account lockouts.
18. How would you investigate a suspected compromised account?
Answer:
I would review authentication logs, source IPs, login locations, device information, MFA events, privilege changes, unusual commands, and activity after login. I would compare the behavior with the user’s normal activity.
19. What would you do if you confirmed an account compromise?
Answer:
I would follow the organization’s incident-response procedure. Depending on authorization and severity, actions may include disabling or restricting the account, revoking sessions, resetting credentials, validating MFA, investigating affected systems, and escalating the incident.
20. What is lateral movement?
Answer:
Lateral movement is when an attacker moves from one compromised system or account to other systems within an environment.
21. How can lateral movement be detected?
Answer:
It can be detected by monitoring unusual authentication patterns, remote administration activity, abnormal access between systems, privilege changes, endpoint telemetry, and network traffic.
22. What is privilege escalation?
Answer:
Privilege escalation occurs when an attacker or user gains higher privileges than they were originally authorized to have.
23. What is the difference between vertical and horizontal privilege escalation?
Answer:
Vertical privilege escalation means gaining higher privileges, such as moving from a normal user to administrator. Horizontal privilege escalation means accessing another user’s resources at a similar privilege level.
24. What is a compromised endpoint?
Answer:
A compromised endpoint is a computer or device where unauthorized or malicious activity has occurred or where an attacker has gained some level of access.
25. What would you do if malware was detected on an endpoint?
Answer:
I would validate the alert, identify the affected endpoint and malware details, review endpoint activity, isolate the device if required by the response procedure, investigate related activity, remove the threat, and verify the endpoint is safe before returning it to normal operation.
26. What is EDR?
Answer:
EDR stands for Endpoint Detection and Response. It provides endpoint telemetry and detection capabilities that help security teams investigate suspicious behavior and respond to threats.
27. What is the difference between antivirus and EDR?
Answer:
Traditional antivirus primarily focuses on detecting and preventing malicious software. EDR provides broader endpoint visibility, behavioral detection, investigation capabilities, and response actions.
28. What is a process tree?
Answer:
A process tree shows the relationship between processes, including which process started another process. It is useful for understanding suspicious execution chains.
29. Why is process-tree analysis useful?
Answer:
It helps analysts identify unusual parent-child process relationships. For example, an unexpected script interpreter launched by a document application may require investigation.
30. What is command-line monitoring?
Answer:
Command-line monitoring records or analyzes commands executed on systems. It can help identify suspicious administrative or malicious activity.
31. What is PowerShell security monitoring?
Answer:
PowerShell monitoring involves analyzing PowerShell execution and related telemetry to identify suspicious scripts, commands, or behaviors.
32. What is phishing investigation?
Answer:
Phishing investigation involves analyzing the sender, headers, URLs, attachments, domain information, email content, user actions, and related security events to determine whether the message is malicious.
33. What would you do if an employee clicked a phishing link?
Answer:
I would determine what happened after the click, check authentication and endpoint activity, investigate whether credentials were submitted or malware executed, and follow the organization’s incident-response process.
34. How do you investigate a malicious URL?
Answer:
I would examine the URL, domain, DNS information, reputation data from approved security tools, web-proxy logs, endpoint activity, and whether users accessed the URL. I would avoid directly visiting suspicious URLs from an unsafe environment.
35. What is email header analysis?
Answer:
Email header analysis examines technical information such as sender and recipient details, mail servers, timestamps, authentication results, and message-routing information to help determine whether an email is legitimate.
36. What are SPF, DKIM, and DMARC?
Answer:
SPF helps specify authorized mail servers for a domain. DKIM uses cryptographic signatures to help verify message integrity and domain association. DMARC provides policy and reporting mechanisms around email authentication.
37. What is ransomware?
Answer:
Ransomware is malware that commonly encrypts or otherwise restricts access to data and demands payment. Some ransomware operations also attempt to steal data before encryption.
38. How would you investigate a ransomware alert?
Answer:
I would validate the alert, identify affected systems, look for unusual file activity and processes, determine whether other systems are affected, contain the incident according to the response plan, preserve relevant evidence, and escalate appropriately.
39. What is IOC?
Answer:
IOC stands for Indicator of Compromise. Examples include suspicious IP addresses, domains, file hashes, filenames, email addresses, or other artifacts associated with potentially malicious activity.
40. What is IOA?
Answer:
IOA stands for Indicator of Attack. It focuses on suspicious behaviors or actions that may indicate an attack, rather than only looking for known artifacts.
41. What is threat intelligence?
Answer:
Threat intelligence is analyzed information about threats, threat actors, indicators, tactics, techniques, and procedures that can help organizations improve detection and response.
42. What is the difference between IOC and IOA?
Answer:
An IOC is usually an observable artifact associated with compromise. An IOA focuses more on suspicious behavior or attack activity.
43. What is MITRE ATT&CK?
Answer:
MITRE ATT&CK is a knowledge base that documents adversary tactics and techniques based on observed real-world behavior. Security teams use it for detection, investigation, threat modeling, and analysis.
44. What is a TTP?
Answer:
TTP stands for Tactics, Techniques, and Procedures. Tactics describe an attacker’s goal, techniques describe how the goal is achieved, and procedures describe specific implementations.
45. What is threat hunting?
Answer:
Threat hunting is a proactive security activity where analysts search environments for signs of malicious or suspicious activity that automated alerts may not have detected.
46. What is vulnerability management?
Answer:
Vulnerability management is the continuous process of identifying, assessing, prioritizing, remediating, and validating security vulnerabilities.
47. What is vulnerability scanning?
Answer:
Vulnerability scanning uses automated tools to identify known vulnerabilities, missing patches, weak configurations, and other security weaknesses.
48. What is CVE?
Answer:
CVE stands for Common Vulnerabilities and Exposures. It provides standardized identifiers for publicly known cybersecurity vulnerabilities.
49. What is CVSS?
Answer:
CVSS stands for Common Vulnerability Scoring System. It provides a standardized way to assess the technical severity of vulnerabilities.
50. How do you prioritize vulnerabilities?
Answer:
I consider factors such as severity, exploit availability, asset criticality, exposure, business impact, affected systems, and available compensating controls.
51. What is patch management?
Answer:
Patch management is the process of identifying required software updates, testing them, deploying them, and verifying that systems are properly patched.
52. What is a zero-day vulnerability?
Answer:
A zero-day vulnerability is a vulnerability that is unknown or has no available patch or effective fix at the time it is being exploited or disclosed.
53. What is a false positive in vulnerability scanning?
Answer:
A false positive occurs when a scanner reports a vulnerability that does not actually exist or is not applicable to the affected system.
54. What is network segmentation?
Answer:
Network segmentation divides a network into separate security zones. It can limit unnecessary communication and reduce the impact of a compromised system.
55. What is a DMZ?
Answer:
A DMZ is a network segment used to host systems that need controlled communication with external networks while keeping them separated from internal systems.
56. What is a firewall rule?
Answer:
A firewall rule defines whether specific network traffic should be allowed, denied, or otherwise handled based on criteria such as source, destination, port, protocol, or application.
57. How would you investigate suspicious outbound traffic?
Answer:
I would identify the source host, destination IP or domain, port, protocol, timestamp, process responsible for the connection, DNS activity, and related endpoint and firewall logs.
58. What is DNS tunneling?
Answer:
DNS tunneling is a technique where DNS queries or responses are abused to transfer data or communicate with an external system. Unusual DNS patterns can indicate potential malicious activity.
59. What is a proxy log?
Answer:
A proxy log records web-related network activity passing through a proxy. It can contain information such as users, URLs, domains, timestamps, and destination information.
60. What is NAT?
Answer:
NAT stands for Network Address Translation. It translates network addresses between different addressing environments, commonly allowing private IP addresses to communicate through a public IP.
61. What is TCP?
Answer:
TCP is a connection-oriented transport protocol that provides reliable, ordered delivery of data between endpoints.
62. What is UDP?
Answer:
UDP is a connectionless transport protocol that does not provide the same delivery guarantees as TCP. It is commonly used where speed or low overhead is important.
63. What is the TCP three-way handshake?
Answer:
The TCP three-way handshake establishes a TCP connection using SYN, SYN-ACK, and ACK messages.
64. What is a SYN flood?
Answer:
A SYN flood is a denial-of-service technique that sends large numbers of TCP connection requests, potentially exhausting resources on the target system.
65. What is a packet capture?
Answer:
A packet capture records network packets so analysts can inspect network communications and investigate connectivity or security issues.
66. What is Wireshark?
Answer:
Wireshark is a network protocol analyzer used to capture and inspect network traffic for troubleshooting, analysis, and authorized security investigations.
67. What is a VPN security risk?
Answer:
Potential risks include stolen credentials, compromised endpoints, weak authentication, misconfiguration, and unauthorized access to internal resources.
68. What is MFA fatigue?
Answer:
MFA fatigue is a social engineering technique where an attacker repeatedly sends authentication requests hoping that the user eventually approves one.
69. How can MFA fatigue attacks be reduced?
Answer:
Organizations can use phishing-resistant authentication where appropriate, number matching, user awareness, risk-based controls, rate limiting, and monitoring of unusual authentication activity.
70. What is Active Directory?
Answer:
Active Directory is a Microsoft directory service commonly used to manage users, computers, groups, authentication, and access within Windows-based environments.
71. What is a domain controller?
Answer:
A domain controller is a server that provides authentication and directory services for an Active Directory domain.
72. What is Kerberos?
Answer:
Kerberos is an authentication protocol commonly used in Active Directory environments. It uses tickets to help authenticate users and services securely.
73. What is a service account?
Answer:
A service account is an account used by an application, service, or automated process rather than a normal human user.
74. What is privileged access?
Answer:
Privileged access provides elevated permissions that can make significant changes to systems, applications, or security configurations.
75. How should privileged accounts be protected?
Answer:
They should use strong authentication, least privilege, restricted access, monitoring, secure credential management, and separate administrative accounts where appropriate.
76. What is a security baseline?
Answer:
A security baseline is a defined set of security configuration requirements used to establish an acceptable security posture for systems or applications.
77. What is hardening?
Answer:
Hardening is the process of reducing unnecessary security weaknesses by disabling unused services, applying security configurations, restricting access, and keeping systems updated.
78. What is application security?
Answer:
Application security involves protecting software throughout its development and operational lifecycle against vulnerabilities and attacks.
79. What is the OWASP Top 10?
Answer:
The OWASP Top 10 is a regularly updated awareness document highlighting major categories of web application security risks.
80. What is SQL Injection?
Answer:
SQL Injection occurs when untrusted input is improperly included in database queries, potentially allowing an attacker to manipulate database operations.
81. How can SQL Injection be prevented?
Answer:
Common protections include parameterized queries, prepared statements, input validation, secure coding practices, and least-privilege database accounts.
82. What is XSS?
Answer:
Cross-Site Scripting allows attacker-controlled script content to execute in a user’s browser when an application improperly handles untrusted input.
83. What is CSRF?
Answer:
Cross-Site Request Forgery tricks an authenticated user’s browser into sending an unwanted request to an application.
84. What is API security?
Answer:
API security protects application programming interfaces from unauthorized access, abuse, data exposure, and attacks through controls such as authentication, authorization, validation, rate limiting, and monitoring.
85. What is cloud security?
Answer:
Cloud security involves protecting cloud infrastructure, identities, applications, workloads, data, and configurations from security threats and unauthorized access.
86. What is the shared responsibility model?
Answer:
The shared responsibility model defines which security responsibilities belong to the cloud provider and which belong to the customer. The exact responsibilities depend on the cloud service model.
87. What is IAM?
Answer:
IAM stands for Identity and Access Management. It manages identities and controls who can access which resources and what actions they can perform.
88. What is data exfiltration?
Answer:
Data exfiltration is the unauthorized transfer of sensitive or valuable information from an organization to an external location.
89. How would you detect possible data exfiltration?
Answer:
I would look for unusual outbound traffic, large data transfers, unexpected cloud storage activity, suspicious DNS or web activity, abnormal user behavior, and DLP alerts.
90. What is DLP?
Answer:
DLP stands for Data Loss Prevention. It helps organizations identify and prevent unauthorized exposure or transfer of sensitive information.
91. What is security automation?
Answer:
Security automation uses tools and predefined workflows to perform repetitive security tasks automatically, such as enrichment, alert handling, notification, or containment actions.
92. What is SOAR?
Answer:
SOAR stands for Security Orchestration, Automation, and Response. It helps security teams integrate tools and automate repetitive investigation and response workflows.
93. What is a playbook?
Answer:
A security playbook is a documented set of steps for handling a particular type of security alert or incident.
94. Explain a real-time brute-force investigation.
Answer:
I would first identify the targeted account and source IPs. Then I would review authentication failures, successful logins, timestamps, geographic information, and endpoint activity. If the activity is malicious, I would follow the organization’s containment and escalation process.
95. Explain a real-time phishing investigation.
Answer:
I would examine the email headers, sender, domain, URLs, attachments, authentication results, and user interaction. I would then check proxy, DNS, endpoint, and authentication logs for related activity and determine whether additional users or systems were affected.
96. What would you do if a critical server shows suspicious activity?
Answer:
I would immediately follow the organization’s incident-response process, validate the activity, assess the server’s importance and potential impact, preserve relevant evidence, and coordinate containment and escalation with the appropriate security and infrastructure teams.
97. What would you do if a SIEM generates hundreds of alerts?
Answer:
I would prioritize alerts based on severity, affected assets, confidence, business impact, and evidence of active compromise. I would group related alerts where appropriate and investigate the highest-risk activity first.
98. How do you reduce repeated false-positive alerts?
Answer:
I would identify the reason for the false positives, review the detection logic and event context, document legitimate activity, and work with the appropriate team to tune the rule without creating unnecessary detection gaps.
99. How do you document a security incident?
Answer:
I document the timeline, affected users and systems, indicators, investigation steps, evidence, findings, containment actions, escalation details, recovery actions, and lessons learned.
100. Why should we hire you as a Cyber Security professional with three years of experience?
Answer:
I have practical experience in security monitoring, alert investigation, log analysis, incident response, vulnerability management, and security operations. I can analyze security events, communicate findings clearly, follow incident-response procedures, and continue learning as threats and technologies change.
