1. What is the CIA triad in cybersecurity, and why is it important?
The CIA triad represents the three pillars of cybersecurity:
- Confidentiality: Ensures that sensitive data is accessed only by authorized individuals.
- Integrity: Ensures data remains accurate and unaltered.
- Availability: Ensures systems and data are accessible when needed.
- These principles guide the development of security policies and measures.
2. What is the difference between symmetric and asymmetric encryption?
- Symmetric encryption uses the same key for encryption and decryption. It is faster but less secure for communication (e.g., AES).
- Asymmetric encryption uses a public key for encryption and a private key for decryption. It’s slower but more secure for transmitting data (e.g., RSA).
3. What is a firewall, and how does it work?
A firewall is a network security device or software that monitors and controls incoming and outgoing traffic based on predetermined security rules. It acts as a barrier between trusted and untrusted networks to block unauthorized access while allowing legitimate traffic.
4. What is the difference between IDS and IPS?
- Intrusion Detection System (IDS): Monitors network traffic for malicious activity and alerts administrators but does not block traffic.
- Intrusion Prevention System (IPS): Monitors and actively blocks malicious traffic in real-time.
5. How would you respond to a ransomware attack?
- Isolate affected systems to prevent further spread.
- Identify the scope of the attack and assess backup availability.
- Notify key stakeholders and law enforcement, if necessary.
- Restore systems from clean backups if available.
- Analyze the attack to strengthen defenses and prevent recurrence.
6. What is a zero-day vulnerability, and how do you protect against it?
A zero-day vulnerability is a software flaw unknown to the vendor, with no patch available.
Mitigation strategies include:
- Employing behavior-based detection tools.
- Using threat intelligence feeds to monitor emerging vulnerabilities.
- Applying defense-in-depth measures (e.g., segmentation, endpoint protection).
7. How do you secure a web server?
- Keep software and the operating system updated.
- Disable unnecessary services and ports.
- Use a Web Application Firewall (WAF).
- Implement strong authentication and access controls.
- Regularly audit and monitor logs for suspicious activity.
8. What is phishing, and how do you prevent it?
Phishing is a social engineering attack where attackers deceive users into providing sensitive information, like passwords, via fake emails or websites.
Prevention:
- Educate users on recognizing phishing attempts.
- Deploy email filtering and anti-phishing tools.
- Use multi-factor authentication (MFA).
9. What tools have you used for vulnerability assessment and penetration testing?
Tools I’ve used include:
- Nmap: For network scanning.
- Nessus: For vulnerability scanning.
- Metasploit: For penetration testing.
- Wireshark: For traffic analysis.
- Burp Suite: For web application testing.
- I analyze results, prioritize vulnerabilities, and recommend mitigation steps.
10. What is the principle of least privilege, and why is it important?
The principle of least privilege ensures users and systems only have the minimum level of access required to perform their tasks.
This reduces the attack surface, minimizes insider threats, and limits damage from compromised accounts.
