Cyber Security Interview Questions and Answers

Cyber Security is of 5 types, namely:

• Critical infrastructure security
• Application security
• Network security
• Cloud security
• Internet of things (IoT) security

The most popular Cyber Security’s elements are:

• Information security
• Network security
• Operational security
• Application security
• End-user education
• Business continuity planning

• Malware attack
• Phishing attack
• Man-in-the-middle attack
• Denial-of-service attack
• SQL injection attack
• Zero-day exploit attack
• DNS Tunneling attack, etc.

• In the business field, Cybersecurity protects the data or software, hardware against

• ransomware,
• malware,
• social engineering,
• phishing.

• End to end protection of users’ data.
• Protects hardware, servers, network, data, and all the software.
• After a breach, it increases the recovery time of the data.
• Prevents data or device accession from unauthorized users.

Cryptography is a technique that helps in protecting the data from the accession and understanding of the third parties which are popularly termed as adversaries. The data can be read by sender and receiver only.

Cryptography is all about the ‘Encryption’ and ‘Decryption’.

Encryption is all about transforming the human understandable language into the coded language for security purposes.

Encryption: Text data —– key——> Cipher Text

• DES algorithm,
• RSA algorithm,
• Blowfish algorithm,
• Twofish algorithm,
• AES algorithm,
• IDEA algorithm,
• SHA 1 algorithm, etc.

Decryption is the opposite process of encryption. It is all about transforming the ciphertext formed through encryption into the original readable text using the key. Generally, this process happens when the text reaches from the sender to the receiver. These are the commonly asked Cyber Security Interview Questions and Answers for fresher candidates.

The Advanced Encryption Standard which is abbreviated as AES is the algorithm that is best suitable for the Encryption and Decryption process. It is highly used and trusted by the U.S. government and other popular organizations.

If we see the Whatsapp chat carefully, we will find a label stating ‘End-to-End encryption’ whose actual meaning is that the message you send is encrypted immediately after you crush the send button. If anyone tries to read the message in between using the attacking mechanisms, they may fail as the data is encryption. Once the data you have sent reaches the other end (receiver), then the data gets decrypted and makes it into the original text making the recipient read it easily.

Symmetric Encryption is a process in which the same key, which is known as a secret key, is used for both encryption and decryption of the data.

Asymmetric is a process of cryptography in which we use different keys for encryption and decryption. For encryption, we use the public key and for decryption, we use the private key.

• In the Symmetric Encryption technique, we use one key (secret key) for both encryption and decryption, whereas in the Asymmetric Encryption technique, we use a public key to encrypt and a private key to decrypt the data.
• Encryption is faster in Symmetric one than in Asymmetric one.

Symmetric Encryption is often used to transfer the data in bulk amounts; so that it would be easy for computations as the encryption and decryption are also done through a single key known as the secret key.

• DES,
• 3DES,
• AES,
• RC4, etc.

Asymmetric Encryption is often used for exchanging the secret data keys securely, as two different keys are handling the cryptography process here (Public one for Encryption and a private one for Decryption).

• Diffie-Hellman,
• RSA.

Data Leakage is a process of transferring the data illegally or unauthorizedly, to the outside world through the mediums like email, laptops, optical media, USB, etc. This can be prevented using the ‘Data Leakage Prevention Tools’.

Data Leakage is majorly categorized into three types, namely:

• Accidental Breach
• Intentional Breach
• System Hack

An accidental breach is a data leaking process in which the entity sends the information to an unauthorized system or account or person due to the fault, unintentionally or accidentally.

An intentional breach is a data leaking process in which one authorized entity sends the information to an unauthorized entity intentionally on purpose.

System Hacking is a data leaking process in which the data is hacked by hackers using hacking techniques.

• Bait and Switch,
• Cookie Theft,
• Denial of Service/Distributed Denial of Service,
• Eavesdropping,
• Keylogging,
• Malware,
• Phishing,
• Watering Hole and WAP Attacks, etc.

The OSI Model refers to the Open Systems Interconnection Model which is a framework that tells us how the information is passed from a software application of one device through the physical medium and functions of the networking system to the software application in the other device.

The layers in the OSI model are seven in number. They are:

• Physical Layer
• Data Link Layer
• Network Layer
• Transport Layer
• Session Layer
• Presentation Layer
• Application Layer

VPN (Virtual Private Network) is a network connection that ensures creating an encrypted and secured environment connection to protect the data from snooping, censorship, interference, etc.

Hacking is nothing but the process of finding the loopholes in the PCs or Private networks or other devices and misusing the loopholes or weaknesses found to gain access to the confidential data.

Cracking down the password of a system by finding some loophole to access the contents in the system. These are the Important Cyber Security Interview Questions and Answers that are put forth to freshers and experienced candidates in an interview.

Hackers are the ones who find the loopholes and weaknesses of the system (the system can be a network or phone or PC, etc) to misuse them to gain access to the data in the system.

Black hat hackers are the hackers who hack a system or software by generating malware, using the knowledge they have on breaching the network security. By doing this, they can steal, misuse, modify, or destroy the data for their malicious reasons or financial gains.

White hat hackers are the ones who do penetration testing. Their main aim is to protect the data system of a company or an organization. They find the loopholes of the system, through which the malicious hackers may attack, and fills them up before the breaching happens.

Grey hat hackers are the ones who hack the data of an organization without permission by violating the ethical standards. The main difference between black and grey hat hackers are, unlike black hat hackers, grey hat hackers don’t hack with malicious intents.

• By removing the CMOS battery.
• By using the software.
• By using a motherboard jumper.
• By using MS-DOS.

The acronym MITM stands for ‘Man-in-the-Middle’, in terms of Cyber Security.

MITM is an attack in which an attacker interrupts the conversation or communication happens between two or more people through a medium, intending to access or steal confidential information without getting caught.

• Using VPN,
• Using the strong WEP/WPA encryption,
• Use IDS (Intrusion Detection System),
• Forcing HTTPS,
• By choosing Public Key Pair Based Authentication, etc.

A botnet is a system of several hardware devices like mobiles, servers, IoTs, PCs that are connected over the internet that are compelled, controlled by malicious attacks.

ARP refers to Address Resolution Protocol. It is a network layer protocol that is used to find the link-layer address (host address like MAC address) that is connected with an IPv4 address (internet address).

RARP refers to Reverse Address Resolution Protocol. It is a network layer protocol that is used to find the IP address based on the request raised by the client by providing the link-layer address like the MAC address. So, RARP works exactly opposite to the ARP protocol.

RARP works exactly opposite to the ARP protocol. ARP protocol is used to find the physical address of the client network by providing the IP address as an input, whereas, RARP is used to find the logical or IP address by providing the physical address of the client’s network.

The ‘IP address’ or the ‘internet-connected universal address’ is known as a logical Address.

The ‘local-address’ or the ‘host address’ is known as a physical address.

CSRF refers to ‘Cross-Site Request Forgery’.

Cross-Site Request Forgery is a process in which the attacker manipulates the victim user to perform some action upon the data, unintentionally by the user.

The attacker can launch the CSRF action if and only if he knows the parameters and the values used in the form along with the respective parameter-value combinations.

As the CSRF attacks happen when the attacker comes to know about the parameter-value combinations; to prevent the attack, we can add the additional parameter to the form whose value should be unknown to the malicious attacker but is validated by the server.

• SSL – Secure Sockets Layer
• TLS – Transport Layer Security

SSL helps in verifying the sender’s identity and in tracking down the person you want to communicate with, whereas, TLS helps in providing the secure channel for the communication between the two clients. These are the frequently asked Cyber Security Interview Questions and Answers to fresher candidates.

TFA or 2FA refers to Two Factor Authentication, which is a security process that is used to know or identify who is using or accessing the online account.

In Cyber Security, IDS stands for Intrusion Detection System.

In Cyber Security, IPS stands for Intrusion Prevention System.

IDS is used to detect the intrusions or any suspicious activity, while IPS helps in finding the intrusion and in preventing it.

CIA refers to Confidentiality, Integrity, and Availability which is used in developing the security policies to protect the data.

In the term CIA itself, we find the three policies. They are:

• Confidentiality
• Integrity
• Availability

Firewall – A security system is used to monitor and control the traffic within the set of boundaries or networks maintained.

A firewall is used to give security to the data or a network or a system from attacks like viruses, malware, worms, etc, and is also useful in preventing the filtration of the content and remote access.

Network sniffing is a software tool known as ‘Network sniffer’, which captures the data that is flowing in a particular network. Similarly, If one wants to access the raw packets of the data, they need to install the ‘packet sniffer’ tool.

• To capture the sensitive details like passwords to the accounts.
• To get access to the chat messages
• To monitor the packets flowing in a network.

These are the commonly asked Cyber Security Interview Questions and answers for freshers & experienced candidates in an interview.

A brute force attack is a cyber-attack that goes by trial and error method to find the correct PIN or passwords with the repeated trials of different combinations made of credentials.

Brute force attack, most of the time is done with the software that automatically forms various combinations of the passwords using the credentials and attempts the login automatically. Poorly assigned passwords can be easily found using this approach.

Brute force attack majorly gets its win over the poorly constructed passwords. To prevent this attack, we need to:

• Set a password of good length.
• Make the password a bit complex to a crackdown by involving the special characters and numbers in your password.
• Set a limit for your login failures.

In Cyber Security, a DNS attack refers to the Domain Name System attack in which the attackers exploit the weaknesses of the domain name targeting the servers.

As there are a lot of chances for the new and weak domains to get infected by malicious software, these DNS monitoring tools will be useful in identifying the presence of malicious programs or software.

• 1xx: Informational responses
• 2xx: Success
• 3xx: Redirection
• 4xx : Client-side error
• 5xx: Server-side error

Port scanning is a process in which the identification of the open ports and services that are available on a specific host is done.

• Ping Scan
• TCP Half-Open
• TCP Connect
• UDP
• Stealth Scanning

Hackers utilize these techniques to find the data for malicious purposes. These tools provide them with information about loopholes.

In Cyber Security, the anagram WAF stands for Web Application Firewall. These are the commonly asked Cyber Security Interview Questions and Answers for the freshers candidates in an interview.

Web Application Firewall is often used to protect the data in the applications by managing the traffic, be it incoming or outgoing, between the internet and Web Apps.

Traceroute is a security tool that shows points in the path in which the packets that are carrying the data are passing through.

As the traceroute tool helps in showing the path in which the packets have gone through, it is used mainly to find where the connection of the destination route has stopped or broke or failed in the case where the packet fails to reach the destination from its starting point. Simply, it helps in finding where the packet has lost, if it doesn’t reach its destination.

Secure Sockets Layer (SSL) is a technology that is used to create an encrypted connection between the web browsers and the servers.

By encrypting the connection between the web browser and the web server through the internet, SSL maintains the privacy of the data by encrypting the confidential information like e-transactions, e-payments, etc.

Salting is the technology that is used to improve the strength of the password by extending the character length using some special characters.

The main use of salting is to protect the passwords from the attacks made by the hackers (Hackers try to crack the password by making combinations or by passing the known words across the system.) The hash we use on the password to protect it is known as ‘salt’.

Secure Socket Shell (SSH) is a tool that tells the administrators about the secured way of accessing the data present in the network.

VA stands for Vulnerability Assessment that works on finding the flaws and loopholes present in the target system or software.

In Cybersecurity, Vulnerability Assessment is used in helping the organization through the process of finding the flaws and loopholes present in a target, so that the organization can fix those flaws and loopholes.

Penetration Testing (PT) works upon finding the vulnerabilities present in the system where the organization pre-defined sets up all the security measures and uses this test to see other loopholes present in the system.

The three-way handshake method is a three-step method that is used to create a connection between the client and the server so that they can exchange the packets of information between them. This method is used in TCP/IP networks.

Referring to the name itself, the three-way handshake method consists of three steps to follow. They are:

• Firstly, to check whether the server has open ports or not, the client needs to send a Synchronize packet to it.
• Secondly, the server sends the Synchronize Acknowledgement to the client (If the server has open ports.)
• Thirdly, the client acknowledges the acknowledgment sent by the server and sends the acknowledgment packet back to the server.

Risk is the power of the occurrence of loss or damage to the data caused by missing the vulnerabilities by threats, where vulnerabilities are the loopholes or weakness of the system and threat is someone who has the power to harm the data in the system.

• Maintain a strong, unique password.
• Avoid sharing confidential information with a third person strictly.
• Never share the details or make transactions on unknown, untrusted websites for purposes like shopping, e-transactions, etc.
• Keep on updating the browsers, systems, software to their latest versions.
• Install the trusted malware, spyware tools.
• Protect the Social Security Number.
• Against financial data, always use specialized software solutions.

Distributed Denial of Service(DDOS) is a cyber-attack that makes the servers deny providing the service to the authorized clients.

A DDOS attack is majorly classified into two types, namely:

• Flooding attacks
• Crash attacks

Flooding attacks are one of the types of DDOS attack in which the hackers use automated programs mainly to send a large number of packets of data, continuously, to the server, so that at a point the traffic at the server increases to the extent where it can’t be handled and breaks down causing the interruption of service supply to the genuine clients.

Crash attacks are one of the types of DDOS attacks in which the hackers go for the exploitation of a bug on the server, such that the bug makes the system crash down resulting in the stoppage of the service supply to the genuine clients.

• By using the Anti-DDOS services.
• By configuring Firewalls and Routers
• By using Front-End Hardware
• By using the Load Balancing
• By handling the spikes in Traffic

XSS refers to the Cross-Site Scripting cyberattack that helps the hackers to dump or input the malicious scripts of the client-side into the online web pages.These are the commonly asked Cyber Security Interview Questions and Answers for the Freshers and Experienced candidate during the Cloud Computing Interview.

An XSS attack is used in:

• Hijacking the sessions,
• Stealing the cookies,
• Modifying the DOM,
• Execution of remote code,
• Crashing the server, etc.

By following the practices such as:

• Validating the user inputs
• Sanitizing the user inputs
• Encoding the special characters
• Using the Anti-XSS services/tools
• Using XSS HTML Filter

• NFS (Network File System),
• NIS+ (Network Information System),
• DNS (Domain Network System),
• TELNET (TeleCommunication Network),
• FTP (File Transfer Protocol),
• SNMP (Simple Network Management Protocol), etc.

• TCP (Transmission Control Protocol)
• UDP (User Datagram Protocol)

• IP (Internet Protocol),
• ARP (Address Resolution Protocol),
• ICMP (Internet Control Message Protocol).

• PPP (Point-to-Point Protocol),
• IEEE 802.2

• Ethernet (IEEE 802.3) Token ring,
• RS-232

Phishing is one of the popular cyberattacks in which a hacker pretends as a trusted person of yours or in a business, to steal the confidential message through the fraudulent messages or emails. Here, the messages or emails look as if they are trusted and real, but they are not. These are the generally asked Cyber Interview Questions and Answers for the freshers and experienced candidate

We can prevent phishing attacks by practicing methods like:

• Avoiding to share the confidential information in the untrusted websites
• Verifying the security of the site before using it
• Using firewalls
• Using the trusted AntiVirus Softwares
• Using Anti-Phishing tools

• @#$)(-*&^%

• akfgjRsmLN

• UcSc4evR!

• 1password

‘UcSc4evR!’ is considered as the strongest and secured password compared to the other three as per the UCSC guidelines. (Length should be of at least 8 characters, should contain uppercase, lowercase, special characters and numbers, and a number shouldn’t be preceded or succeeded by a word.)