Cyber Security – 100 Interview Questions and Answers for Freshers
1. What is Cyber Security?
Answer:
Cyber Security is the practice of protecting computers, networks, applications, devices, and data from unauthorized access, attacks, damage, or theft.
2. Why is Cyber Security important?
Answer:
Cyber Security protects sensitive information and business systems from threats. It helps organizations prevent data loss, financial damage, service interruptions, and unauthorized access.
3. What are the three main principles of Cyber Security?
Answer:
The three main principles are Confidentiality, Integrity, and Availability. Together, they are called the CIA Triad.
4. What is the CIA Triad?
Answer:
CIA stands for Confidentiality, Integrity, and Availability. Confidentiality protects data from unauthorized access. Integrity ensures data is not improperly changed. Availability ensures systems and data are accessible when needed.
5. What is confidentiality?
Answer:
Confidentiality means ensuring that sensitive information is accessible only to authorized people or systems.
6. What is integrity?
Answer:
Integrity means protecting data from unauthorized modification or destruction so that the information remains accurate and trustworthy.
7. What is availability?
Answer:
Availability means ensuring that systems, applications, and data are available to authorized users when they need them.
8. What is a cybersecurity threat?
Answer:
A cybersecurity threat is a potential event or activity that can exploit a weakness and cause harm to a system, network, application, or data.
9. What is a vulnerability?
Answer:
A vulnerability is a weakness in a system, application, network, or process that an attacker could potentially exploit.
10. What is a security risk?
Answer:
Security risk is the possibility that a threat will exploit a vulnerability and cause damage or loss.
11. What is an exploit?
Answer:
An exploit is a technique, code, or method used to take advantage of a vulnerability in a system or application.
12. What is a security control?
Answer:
A security control is a measure used to prevent, detect, or reduce security risks. Examples include firewalls, encryption, access controls, and security monitoring.
13. What is malware?
Answer:
Malware means malicious software designed to damage systems, steal information, disrupt operations, or gain unauthorized access.
14. What are common types of malware?
Answer:
Common types include viruses, worms, Trojans, ransomware, spyware, rootkits, and keyloggers.
15. What is a virus?
Answer:
A virus is malicious code that attaches itself to a legitimate file or program and can spread when the infected file is executed.
16. What is a worm?
Answer:
A worm is malware that can automatically spread across networks or systems without requiring a user to manually execute an infected file.
17. What is a Trojan?
Answer:
A Trojan is malicious software that pretends to be legitimate software or a useful file to trick users into running it.
18. What is ransomware?
Answer:
Ransomware is malware that typically prevents access to files or systems, often by encrypting data, and demands payment from the victim.
19. What is spyware?
Answer:
Spyware is malicious software designed to secretly monitor activities or collect information from a user or system.
20. What is a keylogger?
Answer:
A keylogger records keystrokes made by a user. Attackers may use it to capture sensitive information such as usernames, passwords, or messages.
21. What is phishing?
Answer:
Phishing is a social engineering attack where an attacker uses fake emails, messages, websites, or other communication to trick people into revealing sensitive information or performing an unsafe action.
22. What is spear phishing?
Answer:
Spear phishing is a targeted phishing attack aimed at a specific person or organization. The attacker usually creates a more personalized message to appear trustworthy.
23. What is social engineering?
Answer:
Social engineering is the use of psychological manipulation or deception to convince people to reveal information or perform actions that could create a security risk.
24. What is a brute-force attack?
Answer:
A brute-force attack repeatedly tries different passwords or credentials until the correct combination is found.
25. How can brute-force attacks be prevented?
Answer:
Organizations can use strong passwords, multi-factor authentication, account lockout or rate limiting, monitoring, and other access controls.
26. What is a DoS attack?
Answer:
A Denial-of-Service attack attempts to make a system, application, or service unavailable to legitimate users by overwhelming or disrupting it.
27. What is a DDoS attack?
Answer:
A Distributed Denial-of-Service attack uses multiple systems or devices to generate traffic or requests against a target, making the service difficult for legitimate users to access.
28. What is the difference between DoS and DDoS?
Answer:
DoS generally involves an attack from a single source, while DDoS involves multiple sources or compromised systems attacking the target.
29. What is a botnet?
Answer:
A botnet is a group of compromised devices controlled by an attacker. These devices can be used for activities such as DDoS attacks or spam campaigns.
30. What is a firewall?
Answer:
A firewall is a security control that monitors and filters network traffic based on defined rules. It can help block unauthorized connections.
31. What are the types of firewalls?
Answer:
Common firewall types include packet-filtering firewalls, stateful firewalls, proxy firewalls, and next-generation firewalls.
32. What is a network firewall?
Answer:
A network firewall controls traffic between networks based on security rules. It can allow legitimate traffic and block unauthorized traffic.
33. What is a host-based firewall?
Answer:
A host-based firewall runs on an individual computer or server and controls network traffic entering or leaving that specific system.
34. What is IDS?
Answer:
IDS stands for Intrusion Detection System. It monitors network or system activity and generates alerts when suspicious or potentially malicious activity is detected.
35. What is IPS?
Answer:
IPS stands for Intrusion Prevention System. It detects suspicious traffic and can automatically take action to block or prevent certain threats.
36. What is the difference between IDS and IPS?
Answer:
IDS primarily detects and alerts about suspicious activity. IPS can detect suspicious activity and actively block or prevent certain traffic.
37. What is antivirus software?
Answer:
Antivirus software helps detect, prevent, and remove malicious software from computers and other supported devices.
38. What is endpoint security?
Answer:
Endpoint security protects devices such as laptops, desktops, and servers that connect to an organization’s network.
39. What is EDR?
Answer:
EDR stands for Endpoint Detection and Response. It continuously monitors endpoint activity to help detect suspicious behavior and support investigation and response.
40. What is SIEM?
Answer:
SIEM stands for Security Information and Event Management. It collects and analyzes security-related logs and events from different systems to help security teams detect and investigate threats.
41. Why is SIEM used?
Answer:
SIEM helps security teams centralize logs, identify suspicious patterns, generate alerts, investigate incidents, and maintain security visibility across an environment.
42. What is a security log?
Answer:
A security log is a record of events related to systems, applications, users, networks, or security controls. Security teams analyze logs to identify unusual or suspicious activity.
43. What is SOC?
Answer:
SOC stands for Security Operations Center. It is a team or function responsible for monitoring, detecting, investigating, and responding to security threats.
44. What does a SOC analyst do?
Answer:
A SOC analyst monitors security alerts, investigates suspicious activity, analyzes logs, identifies potential threats, and supports incident response.
45. What is an alert in Cyber Security?
Answer:
An alert is a notification generated by a security tool when activity matches a suspicious condition or predefined detection rule.
46. What is a false positive?
Answer:
A false positive occurs when a security system identifies legitimate activity as potentially malicious.
47. What is a false negative?
Answer:
A false negative occurs when malicious or suspicious activity is not detected by a security control.
48. What is incident response?
Answer:
Incident response is the structured process of identifying, analyzing, containing, eradicating, and recovering from a security incident.
49. What are the main stages of incident response?
Answer:
Common stages include preparation, detection and analysis, containment, eradication, recovery, and post-incident activities.
50. What is a security incident?
Answer:
A security incident is an event that may compromise the confidentiality, integrity, or availability of information or systems.
51. What is incident containment?
Answer:
Containment means taking actions to limit the impact and spread of a security incident. For example, a compromised device may be isolated from the network.
52. What is eradication?
Answer:
Eradication means removing the root cause or malicious components of an incident, such as malware or compromised accounts.
53. What is recovery?
Answer:
Recovery involves restoring affected systems and services to normal operation and monitoring them to ensure the threat has been removed.
54. What is a security policy?
Answer:
A security policy is a set of organizational rules and guidelines that define how systems, data, users, and security processes should be protected.
55. What is authentication?
Answer:
Authentication is the process of verifying the identity of a user, device, or system.
56. What is authorization?
Answer:
Authorization determines what an authenticated user or system is allowed to access or perform.
57. What is the difference between authentication and authorization?
Answer:
Authentication answers, “Who are you?” Authorization answers, “What are you allowed to access or do?”
58. What is MFA?
Answer:
MFA stands for Multi-Factor Authentication. It requires two or more different types of verification before granting access.
59. What are the common authentication factors?
Answer:
Common factors include something you know, such as a password; something you have, such as a security token; and something you are, such as a biometric characteristic.
60. What is the principle of least privilege?
Answer:
Least privilege means giving users, applications, or systems only the minimum access required to perform their tasks.
61. What is access control?
Answer:
Access control determines who can access a resource and what actions they are allowed to perform.
62. What is role-based access control?
Answer:
RBAC stands for Role-Based Access Control. Permissions are assigned to roles, and users receive access based on their assigned roles.
63. What is Zero Trust?
Answer:
Zero Trust is a security approach based on the principle that access should not automatically be trusted. Users and devices should be continuously verified according to security requirements.
64. What is encryption?
Answer:
Encryption converts readable information into an encoded form so that unauthorized people cannot easily understand it.
65. What is decryption?
Answer:
Decryption converts encrypted data back into its readable form using the appropriate key or mechanism.
66. What is symmetric encryption?
Answer:
Symmetric encryption uses the same secret key for encryption and decryption.
67. What is asymmetric encryption?
Answer:
Asymmetric encryption uses a pair of keys: a public key and a private key.
68. What is the difference between symmetric and asymmetric encryption?
Answer:
Symmetric encryption uses one shared key, while asymmetric encryption uses a public and private key pair. Symmetric encryption is generally faster, while asymmetric cryptography is useful for tasks such as secure key exchange and digital signatures.
69. What is hashing?
Answer:
Hashing converts data into a fixed-length value using a hash algorithm. It is designed to be one-way and is commonly used for integrity checks and secure password storage.
70. What is the difference between encryption and hashing?
Answer:
Encryption is designed so authorized users can decrypt the original data. Hashing is generally one-way and is mainly used for integrity verification and password protection.
71. What is a digital signature?
Answer:
A digital signature helps verify the authenticity and integrity of digital information. It uses cryptographic techniques to prove that the content came from the claimed signer and was not improperly changed.
72. What is a digital certificate?
Answer:
A digital certificate is an electronic credential that helps associate a public key with an identity. Certificates are commonly used in secure communications.
73. What is PKI?
Answer:
PKI stands for Public Key Infrastructure. It provides the systems, technologies, policies, and processes used to manage digital certificates and public-key cryptography.
74. What is SSL/TLS?
Answer:
TLS is a cryptographic protocol used to protect data exchanged over networks. SSL is an older predecessor to TLS and is no longer considered the preferred protocol.
75. What is HTTPS?
Answer:
HTTPS is HTTP protected using TLS. It helps provide confidentiality and integrity for communication between a browser and a web server.
76. What is a VPN?
Answer:
VPN stands for Virtual Private Network. It creates a protected connection over a network and can help secure communication between a user and a private network.
77. What is a proxy server?
Answer:
A proxy server acts as an intermediary between a client and another server. It can be used for traffic control, filtering, privacy, or other network functions.
78. What is DNS?
Answer:
DNS stands for Domain Name System. It translates domain names, such as example.com, into IP addresses used by networked systems.
79. What is an IP address?
Answer:
An IP address is a numerical address used to identify a device or network interface on an IP network.
80. What is the difference between public and private IP addresses?
Answer:
A public IP address is used for communication across the public Internet. A private IP address is used within private networks and is not directly routable across the public Internet.
81. What is a MAC address?
Answer:
A MAC address is a hardware-level network identifier associated with a network interface. It is commonly used for communication within a local network.
82. What is a port?
Answer:
A port is a logical communication endpoint used by network services. Ports help systems identify which application or service should receive network traffic.
83. What is port scanning?
Answer:
Port scanning is the process of checking a system for open, closed, or filtered network ports. Security professionals can use it during authorized security assessments.
84. What is Nmap?
Answer:
Nmap is a network scanning and security auditing tool. It can help identify hosts, open ports, services, and other network information during authorized assessments.
85. What is vulnerability scanning?
Answer:
Vulnerability scanning uses security tools to identify known weaknesses or misconfigurations in systems, networks, or applications.
86. What is penetration testing?
Answer:
Penetration testing is an authorized security assessment in which security professionals simulate attacks to identify and validate vulnerabilities.
87. What is the difference between vulnerability assessment and penetration testing?
Answer:
Vulnerability assessment focuses on identifying and reporting potential vulnerabilities. Penetration testing goes further by safely attempting to validate whether selected vulnerabilities can actually be exploited.
88. What is OWASP?
Answer:
OWASP stands for Open Worldwide Application Security Project. It is a nonprofit community that provides resources, guidance, and tools for improving application security.
89. What is SQL Injection?
Answer:
SQL Injection is a web application vulnerability where attacker-controlled input is improperly included in database queries, potentially allowing unauthorized database actions.
90. How can SQL Injection be prevented?
Answer:
Developers can use parameterized queries or prepared statements, proper input handling, least-privilege database accounts, and secure coding practices.
91. What is Cross-Site Scripting?
Answer:
Cross-Site Scripting, or XSS, occurs when an application improperly handles untrusted input and allows attacker-controlled scripts to execute in another user’s browser.
92. How can XSS be prevented?
Answer:
XSS can be reduced through proper output encoding, safe input handling, secure frameworks, content security policies, and avoiding unsafe methods of inserting untrusted content into web pages.
93. What is CSRF?
Answer:
CSRF stands for Cross-Site Request Forgery. It tricks an authenticated user’s browser into sending an unwanted request to a web application.
94. What is a security patch?
Answer:
A security patch is a software update designed to fix security vulnerabilities or other security-related issues.
95. Why is patch management important?
Answer:
Patch management helps organizations reduce exposure to known vulnerabilities by keeping operating systems, applications, and other software updated.
96. What is a zero-day vulnerability?
Answer:
A zero-day vulnerability is a previously unknown or unpatched security weakness for which defenders may have little or no time to prepare before exploitation becomes possible.
97. What is data loss prevention?
Answer:
Data Loss Prevention, or DLP, refers to technologies and processes that help prevent sensitive information from being improperly accessed, copied, transferred, or exposed.
98. What would you do if you received a suspicious email?
Answer:
I would avoid clicking links or opening attachments, verify the sender through a trusted method, report the email according to company policy, and avoid sharing credentials or sensitive information.
99. What would you do if you noticed a suspicious login?
Answer:
I would review the available authentication and security logs, verify whether the activity is legitimate, follow the organization’s incident-response process, and escalate the event if it appears suspicious.
100. Why should we hire you as a Cyber Security fresher?
Answer:
I have a strong interest in Cyber Security and understand important fundamentals such as networking, authentication, access control, malware, phishing, firewalls, SIEM, SOC operations, vulnerability management, and incident response. I am willing to learn continuously, follow security procedures, and apply my knowledge to real-world security situations.
