Cybersecurity Interview Prep

Question 1

What is the CIA Triad?

Accepted Answer

The CIA Triad is the three core principles of information security: Confidentiality (only authorized users can access information), Integrity (data is accurate and has not been tampered with), and Availability (systems and data are accessible to authorized users when needed). Every security control maps back to protecting one or more of these properties.

Question 2

What is the difference between authentication and authorization?

Accepted Answer

Authentication (AuthN) is verifying who you are — proving your identity (username + password, biometrics, certificate). Authorization (AuthZ) is determining what you're allowed to do — what resources or actions you have permission to access after being authenticated. Example: logging into a system is authentication; being able to access admin settings is authorization.

Question 3

What is a firewall and what types exist?

Accepted Answer

A firewall is a network security device that monitors and controls incoming and outgoing network traffic based on defined rules. Types: 1. Packet filter — inspects packets at the network layer (IP/port rules), stateless.2. Stateful inspection — tracks connection state, more intelligent than packet filters.3. NGFW (Next-Gen Firewall) — deep packet inspection, application awareness, IPS, TLS inspection, user identity.4. WAF (Web Application Firewall) — specialized for HTTP/HTTPS traffic, protects against OWASP Top 10.

Question 4

Explain the principle of least privilege.

Accepted Answer

Least privilege means granting users, processes, and systems only the minimum permissions required to perform their job function — nothing more. This limits the blast radius of a compromise: if an attacker takes over a low-privilege account, they can't immediately access everything. Applied to: user accounts (no local admin for standard users), service accounts (dedicated accounts with scoped permissions), API keys (read-only where possible), and network access (segmentation).

Question 5

What is defense in depth?

Accepted Answer

Defense in depth is a security strategy that uses multiple overlapping layers of controls so that if one layer fails, others still provide protection. Inspired by medieval castle design (moat, walls, keeps). Layers in a modern org: perimeter (firewall, IPS), network (segmentation, VLANs), endpoint (EDR, AV, patch management), application (WAF, SAST/DAST), data (encryption, DLP), identity (MFA, PAM), and people (security awareness training).

Question 6

What is the difference between symmetric and asymmetric encryption?

Accepted Answer

Symmetric encryption uses the same key for both encryption and decryption. It's fast and efficient for bulk data. Examples: AES-256, ChaCha20. Challenge: secure key distribution — how do two parties share the key securely?Asymmetric encryption uses a key pair: a public key (sharable) for encryption and a private key (secret) for decryption. Solves the key distribution problem but is computationally slower. Examples: RSA, ECC. Used in TLS handshakes, digital signatures, SSH.In practice, TLS uses asymmetric crypto to exchange a symmetric session key, then switches to symmetric for bulk data transfer.

Question 7

What is zero trust and how does it differ from perimeter-based security?

Accepted Answer

Perimeter security (castle-and-moat model) assumes everything inside the network is trusted and focuses on keeping attackers out. Once inside, attackers move laterally freely. This model fails with cloud, remote work, and insider threats.Zero Trust assumes breach: "Never trust, always verify." Every access request is authenticated, authorized, and continuously validated regardless of network location. Core principles: verify explicitly (MFA, device health, context), use least privilege (JIT, micro-segmentation), assume breach (monitor everything, segment blast radius).Implementation: identity-centric controls, microsegmentation, conditional access policies, UEBA, and continuous monitoring.

Question 8

Walk me through your process for triaging a phishing alert.

Accepted Answer

1. Confirm the alert — open the SIEM alert, check the rule that fired, verify it's not a known false positive pattern.2. Gather email artifacts — sender address, Reply-To, sending IP, subject, attachment hashes, embedded URLs (defanged).3. Enrich IOCs — check sender IP/domain in VirusTotal, urlscan.io, URLhaus. Run attachment hash through VT or sandbox.4. Assess impact — did the user click? Did they open the attachment? Check EDR for process spawned from Outlook/browser downloads.5. Contain — block sender/domain in email gateway, quarantine email from all mailboxes, isolate endpoint if compromised.6. Document — create incident ticket with all findings, IOCs, timeline, and actions taken.

Question 9

What is a SIEM and what is it used for?

Accepted Answer

A SIEM (Security Information and Event Management) platform centralizes, normalizes, correlates, and analyzes log data from across the environment (firewalls, endpoints, servers, apps, cloud) to detect security threats and generate alerts.Key functions: log aggregation, event normalization, correlation rules (e.g., "failed logins from 10 sources in 5 minutes"), dashboards, alerting, and long-term log retention for compliance and investigations.Common SIEMs: Splunk (enterprise standard), Microsoft Sentinel (cloud-native), IBM QRadar, Elastic SIEM (open-source).

Question 10

What Windows Event IDs should every SOC analyst know?

Accepted Answer

Critical Windows Event IDs to monitor:Authentication: 4624 (successful logon), 4625 (failed logon), 4648 (logon with explicit credentials), 4768/4769 (Kerberos TGT/TGS requests), 4776 (NTLM auth)Account changes: 4720 (account created), 4722 (account enabled), 4725 (account disabled), 4728/4732/4756 (member added to security/local/universal group)Privilege use: 4672 (special privileges assigned), 4673/4674 (privilege use)Process execution: 4688 (process creation), 4689 (process termination)Object access: 4663 (file/registry access), 4698 (scheduled task created)

Question 11

What is the MITRE ATT&CK framework and how do you use it in SOC operations?

Accepted Answer

MITRE ATT&CK is a knowledge base of adversary tactics, techniques, and procedures (TTPs) based on real-world attack observations. It's organized as a matrix with Tactics (attacker's goal, e.g., "Persistence"), Techniques (how, e.g., "Registry Run Keys"), and Sub-techniques (specific implementations).SOC uses: • Detection development — map SIEM rules to ATT&CK techniques to find coverage gaps• Threat hunting — use techniques as hypotheses ("Are there any T1053 Scheduled Task creations this week?")• Incident analysis — tag findings with ATT&CK IDs to tell the attack story• Purple teaming — validate that controls detect specific techniques• Threat intelligence — group threat actors by their TTPs

Question 12

How do you detect lateral movement in a Windows environment?

Accepted Answer

Lateral movement indicators to hunt for:Authentication anomalies: Logon Type 3 (network) events (4624) from unusual source hosts, NTLM auth (4776) when Kerberos is standard, failed auth spikes (4625)Remote execution: PsExec artifacts (ADMIN$ share access + service creation), WMI execution (4648 + process events under WmiPrvSE.exe), SMBExec (net use to C$), PSRemoting (new PSSession events)Credential use: Same account logging into many hosts in short time, service accounts logging in interactively, accounts accessing unrelated systemsNetwork: SMB (445), WMI (135/dcom), RDP (3389) traffic between workstations (W2W traffic = red flag)Tools: BloodHound paths being walked, Impacket tool signatures in network traffic

Question 13

Describe how you would build a detection rule for Kerberoasting.

Accepted Answer

Kerberoasting generates Kerberos service ticket requests (TGS-REQ, Event ID 4769) for accounts with Service Principal Names (SPNs). Detection approach:Event ID 4769 with:• Ticket Encryption Type = 0x17 (RC4-HMAC) — weak encryption that's faster to crack offline• Failure Code = 0x0 (success)• Service Name NOT ending in $ (not a computer account)Behavior patterns: Single user account requesting TGS for many different service accounts in a short window; requests for service accounts that haven't been accessed recently; RC4 requests in an AES-only environmentSigma rule approach: `EventID=4769 AND TicketEncryptionType=0x17 AND ServiceName NOT LIKE '%$'`Mitigations: Enforce AES encryption for all SPNs (disables RC4 requests), use MSAs/gMSAs for service accounts, rotate service account passwords regularly.

Question 14

What is threat hunting and how does it differ from alert-based detection?

Accepted Answer

Alert-based detection is reactive — a rule fires when a known bad pattern occurs. It's fast but blind to unknown threats and tuned to known TTPs. If the attacker's technique has no rule, it goes undetected.Threat hunting is proactive — a human analyst forms a hypothesis about attacker behavior (often based on MITRE ATT&CK or threat intel) and searches logs/EDR data to find evidence of that behavior, whether or not an alert fired.Hunting process: 1) Hypothesis ("I think attackers may be using scheduled tasks for persistence") → 2) Data collection (query for task creations in past 30 days) → 3) Baseline (what's normal?) → 4) Anomaly detection (what deviates?) → 5) Investigation → 6) If confirmed, create detection rule.Hunting assumes that advanced attackers are already inside and have evaded detection.

Question 15

What are the phases of a penetration test?

Accepted Answer

Standard pentest methodology phases:1. Planning & Scoping — define targets, rules of engagement, testing window, emergency contacts, out-of-scope systems.2. Reconnaissance — passive OSINT (shodan, LinkedIn, certificate transparency, WHOIS) and active scanning (Nmap, DNS enumeration).3. Scanning & Enumeration — service version detection, vulnerability scanning (Nessus, OpenVAS), web app crawling.4. Exploitation — attempt to exploit discovered vulnerabilities to gain unauthorized access.5. Post-Exploitation — privilege escalation, lateral movement, credential harvesting, persistence, data exfiltration simulation.6. Reporting — executive summary + technical findings with CVSS scores, proof-of-concept, and remediation guidance.7. Remediation verification (optional retesting) — confirm patches resolved findings.

Question 16

What is the difference between a vulnerability scan and a penetration test?

Accepted Answer

Vulnerability scan: automated tool that checks for known vulnerabilities (CVEs, misconfigurations) without attempting to exploit them. Fast, scalable, good for compliance. Tools: Nessus, OpenVAS, Qualys. High false positive rate — reports potential issues, not confirmed ones.Penetration test: a human-led assessment that attempts to exploit vulnerabilities to demonstrate real-world impact. Confirms which vulnerabilities are actually exploitable in your specific environment, chains vulnerabilities together (vulnerability A + B = full compromise), and assesses detective controls. Much deeper insight, but slower and more expensive.

Question 17

Explain SQL injection and how to test for it.

Accepted Answer

SQL injection occurs when user-supplied input is incorporated into a SQL query without proper sanitization, allowing the attacker to modify the query logic.Basic test: Enter ' (single quote) in input fields — a database error indicates the input is reflected in a query.Types:• In-band (Union-based): use UNION SELECT to retrieve data from other tables• Error-based: trigger DB error messages that reveal data• Blind (Boolean): ask true/false questions: 1=1 vs 1=2• Time-based blind: use SLEEP(5) (MySQL) or WAITFOR DELAY (MSSQL) to infer data• Out-of-band: exfiltrate via DNS/HTTP from the DB serverTesting: use SQLMap for automated detection, or manual payloads via Burp Suite Intruder/Repeater.Mitigation: parameterized queries/prepared statements — NEVER string concatenation for queries.

Question 18

What is Kerberoasting and how do you perform it?

Accepted Answer

Kerberoasting exploits the Kerberos ticket system to obtain crackable hashes for service accounts.How it works: Any domain user can request Kerberos service tickets (TGS) for any service registered with a SPN. The ticket is encrypted with the service account's NTLM hash — the attacker can request the ticket and crack it offline without triggering account lockouts.Steps:1. Enumerate SPNs: GetUserSPNs.py -dc-ip <DC-IP> domain/user:pass (Impacket) or setspn -T domain -Q */*2. Request TGS tickets: same tool with -request flag, or Invoke-Kerberoast in PowerShell3. Crack offline: hashcat -m 13100 hashes.txt wordlist.txt -r rules/best64.ruleHigh-value targets: SQL service accounts, IIS app pool accounts, backup service accounts — often have weak passwords set years ago.Defense: long random passwords (25+ chars) for service accounts, use gMSAs (auto-rotating passwords), enforce AES encryption.

Question 19

How do you escalate privileges on a Linux system?

Accepted Answer

Common Linux privilege escalation paths:SUID/SGID binaries: find / -perm -4000 -type f 2>/dev/null — binaries with SUID run as owner (often root). Check GTFOBins for exploitation.Sudo misconfigurations: sudo -l — if you can run specific binaries as root via sudo, check GTFOBins. Wildcard in sudo path is exploitable.Writable /etc/passwd or /etc/shadow — add root-equivalent userCron jobs: cat /etc/crontab — world-writable scripts run by root cronWeak file permissions: find / -writable -type f 2>/dev/null — writable paths in root-owned processesKernel exploits: last resort (noisy). uname -a → search for public exploits (Dirty COW, PwnKit/CVE-2021-4034, DirtyPipe)Capabilities: getcap -r / 2>/dev/null — binaries with cap_setuid+epTools: LinPEAS, Linux Smart Enumeration (LSE)

Question 20

Explain how you would bypass an AV/EDR solution.

Accepted Answer

(Defensive context — for authorized red team engagements.)Modern EDR uses: signature detection, behavioral analysis (API hooking), memory scanning, and ML models. Bypasses operate across these layers:Signature evasion: payload encoding/encryption (XOR, RC4, AES), obfuscation (string concatenation, variable renaming), packers, custom loadersBehavioral evasion: syscall substitution (use direct syscalls instead of Win32 API to avoid user-space hooks), process injection variants (process hollowing, module stomping, thread hijacking), sleep obfuscation (encrypt beacon in memory while sleeping)Memory scanning evasion: on-the-fly decryption (only decrypt shellcode when needed), AMSI bypass for PowerShell, ETW patching to blind loggingExecution flow: LOLBins (rundll32, mshta, regsvr32), DLL sideloading, bring your own vulnerable driver (BYOVD)Process: test in an isolated VM with the target EDR installed; iterate until the EDR doesn't alert.

Question 21

What are the steps of the incident response lifecycle?

Accepted Answer

Per NIST SP 800-61, the IR lifecycle has 4 phases:1. Preparation — IR plan, playbooks, tool deployment (SIEM, EDR), team training, communication trees, backup procedures, legal retainer for breaches.2. Detection & Analysis — identify the incident via alerts, user reports, or threat hunting. Scope it: what systems are affected? What data was accessed? Is the attacker still present? Assign severity.3. Containment, Eradication & Recovery — short-term containment (isolate hosts, block IPs/accounts), evidence preservation, long-term containment (patches, reimaging), eradication (remove malware, close access), recovery (restore from clean backups, monitor).4. Post-Incident Activity — lessons learned meeting within 2 weeks, update playbooks and detections, root cause analysis, report to stakeholders.

Question 22

What is a chain of custody and why does it matter?

Accepted Answer

Chain of custody is the chronological documentation that tracks the seizure, custody, control, transfer, analysis, and disposition of digital evidence. It answers: who touched the evidence, when, why, and what was done with it.Why it matters: Evidence without an intact chain of custody can be challenged in court as tampered, contaminated, or unreliable — potentially making it inadmissible. Even in internal investigations, a clear chain of custody is essential for credibility.In practice: Use write blockers when imaging drives, document hash values before and after acquisition (SHA-256), label and seal physical media, log every person who accesses the evidence, never work on originals — always use forensic copies.

Question 23

What forensic artifacts would you examine after a suspected ransomware incident?

Accepted Answer

Ransomware investigation artifacts:Timeline establishment: MFT ($MFT) for file creation/modification times, USN Journal for file system changes, Event Logs (System, Security, Application) for service/process activityInitial access: IIS/Apache logs for web exploitation, email client PST/OST for phishing, browser history/downloads for drive-by, RDP event logs (Event ID 4624 logon type 10) for brute-force entryExecution: Prefetch files (C:\Windows\Prefetch) for executed binaries, Shimcache/Amcache for recently run programs, PowerShell script block logging, Sysmon Event 1Persistence: Registry Run keys, scheduled tasks (taskschd.msc + Event 4698), startup folders, new servicesEncryption activity: Volume shadow copy deletion (vssadmin delete shadows), high-volume file rename events in $MFT, ransom note drop timeMemory: Capture RAM if system is still live — may contain decryption keys, C2 URLs, or injected code

Question 24

How do you analyze a suspicious Windows process?

Accepted Answer

Systematic suspicious process analysis:1. Context checks:• Path — is it running from a temp folder, AppData, or unusual location?• Parent process — who spawned it? (Word spawning PowerShell = red flag)• Command line — what arguments? Encoded? Obfuscated?• Time — when was it first seen? Matches phishing email time?2. Network connections: netstat -anob or Sysmon Event 3 — is it calling out? To what IP/domain?3. File activity: Process Monitor / Sysmon Event 11 — what files is it reading/writing/creating?4. Registry activity: Sysmon Event 13 — Run key additions, COM hijacking5. Memory analysis: Dump the process with Task Manager or ProcDump, run YARA rules, check for PE injection with hollowing signatures6. Hash verification: SHA-256 of the executable against VirusTotal, check digital signature validityTools: Process Hacker, Sysinternals Suite (Process Explorer, Autoruns), Volatility, PE Bear

Question 25

Walk through how you would analyze a memory dump with Volatility.

Accepted Answer

Memory forensics workflow with Volatility 3:1. Profile identification: vol.py -f memory.vmem windows.info — confirms OS version2. Process listing:vol.py windows.pslist — list running processesvol.py windows.pstree — visualize parent-child relationshipsvol.py windows.psscan — finds hidden/terminated processes (scans raw memory)3. Network connections: vol.py windows.netstat — active and recently closed connections (including C2)4. DLL injection detection:vol.py windows.malfind — finds memory regions with execute permissions that contain PE headers (common injection indicator)vol.py windows.dlllist --pid — loaded modules for a process5. Dump for analysis:vol.py windows.dumpfiles --pid — dump process memoryvol.py windows.procdump --pid — extract executable6. Registry analysis: vol.py windows.registry.hivelist then windows.registry.printkey7. Run YARA on dump: vol.py windows.vadyarascan --yara-file rules.yar

Question 26

What is the shared responsibility model in cloud security?

Accepted Answer

The shared responsibility model defines who is responsible for securing different aspects of a cloud environment — the cloud provider and the customer each own specific layers.AWS example:• AWS is responsible of the cloud: physical infrastructure, hypervisor, network, host OS, and managed service security.• Customer is responsible in the cloud: guest OS patching, application security, data encryption, IAM configuration, network security groups, logging and monitoring.The split varies by service type:• IaaS (EC2): customer manages OS, apps, data• PaaS (RDS): AWS manages OS; customer manages DB config, access, data• SaaS (Workmail): customer only manages data and user accessMost cloud breaches are customer-side misconfigurations — S3 buckets left public, overly permissive IAM roles, missing MFA.

Question 27

What are the most common AWS security misconfigurations?

Accepted Answer

Top AWS misconfigurations seen in real breaches:IAM: Root account without MFA; overly permissive IAM policies (*:* actions/resources); inline policies instead of managed; access keys for root or long-lived keys without rotation; no permission boundaries on delegated rolesS3: Public ACLs or bucket policies granting public read/write; Block Public Access not enabled; no server-side encryption; no versioning or MFA delete; no access loggingEC2/VPC: Security groups with 0.0.0.0/0 on SSH (22) or RDP (3389); no VPC flow logs; instances with IMDSv1 (exploitable via SSRF for credential theft); unencrypted EBS volumes with sensitive dataLogging & Monitoring: CloudTrail disabled or single-region; no Config rules; GuardDuty disabled; no alerting on root account usage or IAM key creationTools to check: Prowler, ScoutSuite, AWS Security Hub, AWS Config conformance packs

Question 28

How would you investigate a potentially compromised AWS account?

Accepted Answer

Cloud IR investigation process for a compromised AWS account:1. Immediate containment: Identify the compromised credential (IAM user, role, access key). Disable or delete the access key (aws iam update-access-key --status Inactive). If root: change password, revoke sessions, enable MFA.2. CloudTrail investigation: Query CloudTrail for all actions by the compromised principal in the past 90 days. Focus on: CreateUser, AttachPolicy, CreateAccessKey (privilege escalation), AssumeRole, RunInstances (cryptomining), GetObject (data exfiltration from S3).3. Determine blast radius: What services did they access? What data? What changes did they make (new users, policies, instances)?4. Eradication: Remove all resources created by the attacker, revoke all sessions (sts:AWSServiceRoleForOrganizations), remove attacker-created users/policies/roles, rotate all potentially exposed secrets.5. AWS tools: CloudTrail, AWS Config (configuration change history), GuardDuty findings, IAM Access Analyzer, Security Hub6. Report: Timeline, IOCs (attacker IPs, user agents), impact assessment.

Question 29

Explain IAM privilege escalation in AWS and how to detect it.

Accepted Answer

IAM privilege escalation involves abusing overly permissive IAM configurations to gain higher privileges than originally granted.Common escalation paths (from Rhino Security research):• iam:CreatePolicyVersion — set a new default version of a managed policy with *:*• iam:AttachUserPolicy — attach AdministratorAccess to your own user• iam:CreateAccessKey — create keys for another user with higher privileges• iam:PassRole + ec2:RunInstances — launch EC2 with a high-privilege role, then access it via EC2 metadata• iam:PassRole + lambda:CreateFunction + lambda:InvokeFunction — create Lambda with admin role and invoke it to create a backdoor userDetection:• CloudTrail alerts on: AttachUserPolicy, PutUserPolicy, CreatePolicyVersion, AddUserToGroup (for admin groups), UpdateAssumeRolePolicy• GuardDuty finding: Policy:IAMUser/RootCredentialUsage, UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration• IAM Access Analyzer: flags policies granting cross-account or public accessPrevention: SCPs (Service Control Policies) at AWS Organizations level to deny iam:* except for dedicated break-glass roles; permission boundaries.