9 Cybersecurity interview questions and answers

Confidentiality: only authorised people can read data. Integrity: data is not changed without authorisation. Availability: systems and data are there when needed.

Most security controls protect one or more of these three.

Symmetric encryption, such as AES, uses one shared key and is fast. Asymmetric encryption, such as RSA or elliptic-curve, uses a public and private key pair and is used for key exchange and digital signatures.

TLS uses both: asymmetric cryptography to agree a key, then symmetric encryption for the data.

Encryption is reversible with the right key. Hashing is one-way.

Store passwords with a slow, salted hash designed for passwords, such as bcrypt or Argon2, never with plain SHA-256 and never encrypted.

User input is concatenated into a query and executed as SQL, letting an attacker read or change data.

Use parameterised queries or prepared statements, give the database account only the permissions it needs, and validate input.

XSS injects script that runs in the victim's browser on your site. Prevent it with context-aware output encoding and a Content Security Policy.

CSRF tricks a logged-in user's browser into sending a request they did not intend. Prevent it with anti-CSRF tokens and SameSite cookies.

The client sends supported cipher suites and a key share. The server replies with its key share, its certificate and a signature proving it holds the private key.

Both sides derive session keys with ephemeral Diffie-Hellman, the client verifies the certificate chain, and encrypted data flows after one round trip.

An intrusion detection system watches traffic and raises alerts. An intrusion prevention system sits inline and can block traffic.

An IPS needs careful tuning because a false positive blocks legitimate users, not just raises an alert.

Gather context: user, location, device, time, whether MFA passed, and impossible travel compared with recent logins. Correlate with other logs such as new inbox rules, mass downloads or privilege changes.

If it looks malicious, contain it: revoke sessions and reset credentials. Then confirm with the user, document what happened, and tune the rule if it was a false positive.

Publicly readable storage buckets, overly broad IAM roles, no MFA on admin or root accounts, access keys committed to code, security groups that open SSH or RDP to 0.0.0.0/0, and audit logging turned off.

Catch them with policy-as-code checks and a cloud security posture tool.