Cybersecurity Engineer interview questions

Try each question out loud before opening the answer. Shared questions (tagged by skill) also appear on other roles that use the same skill.

Concepts

1. Beginner · Applied cryptography, Security fundamentalsWhat is the difference between hashing, encryption and encoding?

   Encoding (Base64, URL encoding) changes representation and is reversible by anyone; it gives no security. Encryption is reversible only with a key and protects confidentiality. Hashing is one-way: you cannot recover the input, which suits integrity checks and, with a slow salted function such as Argon2id or bcrypt, password storage. A common mistake is calling Base64 "encryption" or storing passwords encrypted instead of hashed.

2. Beginner · Linux and BashWhat does chmod 640 mean, and what permissions would you give a file holding a service's database password?

   Each digit is owner, group and others, adding read (4), write (2) and execute (1). 640 gives the owner read and write, the group read, and others nothing. For a secret, make the service's own user the owner and use 600 (or 640 with a dedicated group if another process must read it), keep it out of world-readable directories, and prefer a secrets manager that injects it at runtime.

3. Beginner · Linux and BashWhat does set -euo pipefail do in a Bash script?

   -e exits when a command fails; -u treats unset variables as errors instead of empty strings; -o pipefail makes a pipeline fail if any command in it fails, not just the last. Together they stop scripts carrying on after an error, which is how scripts delete the wrong files or deploy broken builds. Know the caveats: -e is ignored in some contexts (conditions, parts of && lists), so still check important commands explicitly.

4. Beginner · Networking fundamentalsWalk through the network layers involved when a browser loads an HTTPS page, and where common problems appear.

   Application (HTTP), presentation and session concerns handled by TLS, transport (TCP, or QUIC over UDP for HTTP/3), network (IP routing), data link (Ethernet or Wi-Fi frames, MAC addresses, ARP) and physical. Before any of that, DNS resolves the name. Typical problems per layer: DNS returning the wrong address, routes or firewalls dropping packets (timeouts), nothing listening on the port (connection refused), TLS certificate or name mismatches, and HTTP errors from the application or a proxy. Troubleshoot bottom-up or with a quick test at each layer.

5. Beginner · Networking fundamentalsWhat is the difference between TCP and UDP, and when is each used?

   TCP is connection-oriented: a three-way handshake, ordered and reliable delivery with retransmission, and flow and congestion control. It suits web traffic, APIs, databases and file transfer. UDP sends independent datagrams with no handshake, ordering or retransmission, so it has less overhead and no head-of-line blocking; it suits DNS queries, streaming, voice, games and newer protocols such as QUIC, which builds its own reliability on top of UDP.

6. Beginner · Networking fundamentalsWhat are A, AAAA, CNAME, MX, TXT and NS records, and what is a TTL?

   A maps a name to an IPv4 address, AAAA to an IPv6 address. CNAME makes a name an alias of another name (not allowed at the zone apex in standard DNS, which is why providers offer alias records). MX lists mail servers. TXT holds text, used for domain verification and email security (SPF, DKIM, DMARC). NS delegates a zone to name servers. The TTL tells resolvers how long to cache an answer; lower it well before a planned change so the new value spreads quickly.

7. Beginner · Cloud platforms (AWS, Azure, Google Cloud), Security compliance and data protectionWhat is the shared responsibility model?

   The cloud provider secures the cloud itself: data centres, hardware, the virtualisation layer and managed service infrastructure. The customer secures what they put in the cloud: identities and permissions, network configuration, data and its encryption, operating systems and applications on virtual machines, and configuration of managed services. The split shifts with the service type: more is the provider's responsibility for fully managed services than for virtual machines. Most cloud breaches are on the customer side, such as public buckets or leaked keys.

8. Beginner · Identity and access managementWhen should you use an IAM role instead of an IAM user with access keys?

   Almost always. Roles give temporary credentials that expire, so there is no long-lived secret to leak or rotate. People should sign in through single sign-on and assume roles; workloads use roles through instance profiles, Kubernetes service account identity or OIDC federation from CI. IAM users with access keys are a last resort for systems that cannot use any of these, with keys rotated, scoped narrowly and monitored.

9. Beginner · Linux and BashWhat is the difference between SIGTERM and SIGKILL, and why does it matter for containers?

   SIGTERM asks a process to stop; it can catch the signal, finish in-flight work, close connections and exit. SIGKILL cannot be caught and ends the process immediately. Docker and Kubernetes send SIGTERM first, wait a grace period (30 seconds by default in Kubernetes), then SIGKILL. Applications must handle SIGTERM to shut down gracefully, and the main process must actually receive it: a shell wrapper that does not forward signals makes every shutdown a SIGKILL.

10. Beginner · Security fundamentalsWhat is the CIA triad? Give an example of a control for each part.

    Confidentiality, integrity and availability. Confidentiality keeps data from people who should not see it: encryption, access control, MFA. Integrity makes sure data is not changed without detection: hashes, digital signatures, authenticated encryption, audit logs. Availability keeps systems usable: redundancy, backups, rate limiting, DDoS protection. Good answers note that controls often trade these off, for example strict lockouts improve confidentiality but can hurt availability.

11. Beginner · Security fundamentalsHow should an application store user passwords?

    Never in plain text or with fast hashes such as MD5 or SHA-256. Use a password hashing function designed to be slow and memory-hard, preferably Argon2id (or scrypt or bcrypt), through a maintained library, with a unique salt per password (the library handles it) and cost settings tuned so a login takes tens of milliseconds. Add MFA, rate limiting, breached-password checks, and rehash with higher cost when users log in after you raise it.

12. Beginner · SIEM and security operationsWhat is the difference between a SIEM and an EDR?

    A SIEM collects and correlates logs from many sources (servers, network devices, cloud, applications, identity) to detect and investigate threats across the environment. An EDR runs an agent on endpoints, records detailed process, file and network activity, detects malicious behaviour on the host and can respond there, for example by isolating a machine or killing a process. They complement each other, and EDR telemetry is usually sent into the SIEM.

13. Beginner · Vulnerability managementWhat is the difference between CVSS and EPSS, and how do you use them together?

    CVSS rates how severe a vulnerability would be if exploited (0 to 10). EPSS estimates the probability that it will be exploited in the next 30 days, updated daily from real-world data. Use CVSS for impact and EPSS for likelihood, put anything in the CISA Known Exploited Vulnerabilities catalogue first, then add your own context: is the system internet-facing, does it hold sensitive data, is the vulnerable code reachable? That turns thousands of findings into a short, defensible list.

14. Beginner · Penetration testing, Vulnerability managementWhat is the difference between a vulnerability scan and a penetration test?

    A vulnerability scan is automated and finds known issues, such as missing patches and misconfigurations, across many systems quickly, with false positives to review. A penetration test is an authorised, human-led exercise that confirms which weaknesses are really exploitable, chains them together, finds logic flaws scanners miss and reports business impact. Scans run continuously; tests are periodic and scoped. Both require permission.

15. Beginner · Application securityWhat is SQL injection and how do you prevent it?

    SQL injection happens when user input is concatenated into a query, so crafted input changes the query's meaning, for example bypassing a login or reading other tables. Prevent it with parameterised queries or prepared statements (or an ORM used correctly), never string building; validate input types; and give the application's database account least privilege so a mistake cannot drop tables or read unrelated data. Static analysis tools flag string-built queries.

16. Intermediate · Applied cryptographyWhen do you use symmetric and when asymmetric cryptography? How does TLS use both?

    Symmetric encryption (AES) uses one shared key and is fast, so it protects bulk data. Asymmetric cryptography uses key pairs and is slower; it solves key distribution and provides signatures. TLS uses both: the handshake uses asymmetric cryptography to authenticate the server with its certificate and an ephemeral key exchange (ECDHE) to agree a shared secret, then the connection data is encrypted with fast symmetric ciphers such as AES-GCM. Ephemeral keys give forward secrecy.

17. Intermediate · Applied cryptographyWhat does a digital signature prove, and what does it not?

    A valid signature proves that the holder of the private key signed exactly this data (authenticity and integrity) and, if the key is well protected, non-repudiation. It does not provide confidentiality: the signed data remains readable. It also only proves which key signed, so trust depends on knowing that key belongs to the claimed signer, which is what certificates and PKI provide. Always verify before trusting or using the data.

18. Intermediate · Identity and access managementA user has one policy that allows s3:DeleteObject on a bucket and another that denies it on part of the bucket. What happens?

    In AWS policy evaluation an explicit Deny always overrides an Allow, so deletes are denied where the Deny matches and allowed elsewhere in the bucket. Everything not explicitly allowed is denied by default. Organisations use this for guard rails (service control policies, permission boundaries) that no individual policy can override.

19. Intermediate · Cloud platforms (AWS, Azure, Google Cloud), Security fundamentalsHow does encryption at rest with a cloud key management service work?

    With envelope encryption: the service generates a data key to encrypt your data, and the data key itself is encrypted by a key held in the KMS that never leaves it. To read data, the service asks the KMS to decrypt the data key, which requires permission on the KMS key. That gives you central control: key policies decide who can decrypt, every use is logged, and disabling the key makes the data unreadable. Choose customer-managed keys when you need your own policies, rotation or separation of duties.

20. Intermediate · REST APIs and HTTP, TypeScript and JavaScriptHow do you secure a webhook endpoint?

    Verify every request: most providers sign the raw body with an HMAC and a shared secret, so recompute the signature over the exact bytes received and compare in constant time. Reject requests with old timestamps to limit replays, and store processed event ids so duplicates are ignored. Use HTTPS, limit the body size, validate the payload, and return 2xx quickly before doing slow work in the background. Keep the secret in a secrets manager and support rotating it.

21. Intermediate · Docker and containers, Security fundamentalsWhy should containers not run as root?

    By default the root user inside a container is root on the host kernel, limited only by namespaces, capabilities and security profiles. If an attacker exploits the application and then a container escape or a misconfiguration (a mounted Docker socket, a privileged container, a host path), root in the container becomes root on the host. Run as a non-root user (USER in the Dockerfile), drop capabilities, use a read-only root filesystem where possible, and enforce this with admission policies.

22. Intermediate · SIEM and security operationsYour SIEM produces hundreds of alerts a day and most are false positives. What do you do?

    Measure which rules produce the noise and review them with data. Tune thresholds on your own baseline, add context (exclude known scanners, service accounts, maintenance windows), move low-value rules to dashboards or hunting queries instead of alerts, and raise severity only when correlations make an event meaningful. Test each change against known-bad samples so you do not remove real detection. Track alert volume and true-positive rate per rule over time.

23. Intermediate · SIEM and security operations, Threat modellingWhat is MITRE ATT&CK and how do you use it?

    A public knowledge base of adversary tactics (goals such as initial access, persistence, privilege escalation) and techniques (how they are achieved), built from real incidents. Teams use it to map detections to techniques and find coverage gaps, to describe incidents in a common language, to plan purple-team exercises, and to prioritise defences against techniques used by threat actors relevant to their industry.

24. Intermediate · Incident responseDescribe the phases of incident response.

    Following NIST SP 800-61: preparation (logging, playbooks, contacts, tools), detection and analysis (confirm, scope, build a timeline), containment, eradication and recovery (stop spread, remove every foothold, restore safely and monitor), and post-incident activity (a blameless review with actions). Emphasise preserving evidence before making changes, scoping before eradicating, and communicating on a schedule.

25. Intermediate · Incident responseWhy should you avoid powering off a compromised machine straight away?

    Powering off destroys volatile evidence: running processes, network connections, memory-resident malware and encryption keys. Isolating the machine from the network stops the attacker while keeping that evidence available for a memory capture. Record what you do and when, hash collected artifacts, and keep a chain of custody if the incident may lead to legal action. The exception is when keeping it on causes ongoing serious harm, such as active data destruction.

26. Intermediate · Penetration testingWhat must be agreed before a penetration test starts?

    Written authorisation from someone entitled to give it, a precise scope (systems, ranges, applications, accounts in and out), rules of engagement (allowed techniques, testing windows, whether social engineering or denial of service is allowed), data handling rules, and emergency contacts with a stop procedure. Without these the activity may be illegal and risky to the business. Findings are then confirmed with the least intrusive proof and reported with reproduction steps and fixes.

27. Intermediate · Application securityWhat is cross-site scripting, and how do you prevent it?

    XSS happens when an application includes untrusted input in a page without proper encoding, so the browser runs attacker-supplied script in the victim's session. Prevent it by contextual output encoding (templating engines that escape by default, and not bypassing them), avoiding dangerous APIs such as setting raw HTML from user input, validating input, and adding a strict Content Security Policy as defence in depth. HttpOnly cookies limit what stolen scripts can read.

28. Intermediate · Application securityWhat is an insecure direct object reference, and why do scanners often miss it?

    It is broken access control where the server acts on an identifier from the request (an invoice id, a user id) without checking that the caller may access that object, so changing the id reveals or changes someone else's data. Scanners miss it because the application behaves "correctly" from a technical point of view; they do not know who should own what. Prevent it with an authorisation check on every object access, default deny, and tests that one user cannot reach another's objects.

29. Intermediate · Application securityWhat is CSRF and how do modern applications defend against it?

    Cross-site request forgery tricks a logged-in user's browser into sending a state-changing request to a site where they have a session, because the browser attaches cookies automatically. Defences: anti-CSRF tokens tied to the session and checked on every state-changing request, SameSite cookie attributes (Lax or Strict), checking the Origin header, and requiring re-authentication for sensitive actions. APIs that use bearer tokens in headers instead of cookies are not exposed in the same way.

30. Intermediate · Threat modellingWhat does STRIDE stand for, and how do you use it in a threat model?

    Spoofing, tampering, repudiation, information disclosure, denial of service and elevation of privilege. Draw a data flow diagram with trust boundaries, then walk each element and flow asking which STRIDE threats apply, especially where data crosses a boundary. For each threat decide to mitigate, eliminate, transfer or accept, and turn mitigations into tracked work. Revisit the model when the design changes.

31. Intermediate · Security compliance and data protectionWhat is the difference between ISO 27001, SOC 2 and PCI DSS, and what does India's DPDP Act add?

    ISO 27001 is an international standard for an information security management system, certified by an accredited auditor. SOC 2 is a US attestation report on controls against trust service criteria, common for SaaS vendors. PCI DSS is a mandatory standard for anyone storing, processing or transmitting payment card data. India's Digital Personal Data Protection Act, 2023 is a law about personal data: lawful processing, consent and notice, security safeguards, breach notification and rights of data principals. Frameworks describe controls; laws create obligations.

32. Advanced · Identity and access management, Networking fundamentals, Security fundamentalsWhat does zero trust mean for network design?

    No implicit trust based on network location: being inside the corporate network or VPC does not grant access. Every request is authenticated and authorised based on identity (user or workload), device posture and context, with least privilege and short-lived credentials. In practice: identity-aware proxies instead of broad VPN access, mutual TLS or workload identity between services, micro-segmentation with default-deny rules, and continuous logging and verification. Networks still matter, but as one layer rather than the main control.

Case studies

1. Beginner · SIEM and security operationsYou get an alert for 50 failed SSH logins on a server. Walk me through your triage.

   Read the rule and raw events, then add context: is the source internal or external, known scanner infrastructure, a real account or non-existent usernames? Most importantly, check for any success from the same source or for the same account before and after, and what that session did. Scanner noise against non-existent users is usually closed as benign (and a reason to restrict SSH exposure). A success after failures, or unusual activity after login, is escalated as an incident with evidence. Document the decision either way.

2. Intermediate · Git and GitHub, Security fundamentalsSomeone pushed a cloud access key to a Git repository. What do you do?

   First revoke or rotate the key immediately, because anything pushed may already be copied, especially in public repositories. Then check audit logs for use of the key since it was pushed. Remove it from history (git filter-repo or BFG) and coordinate a force push if the repository must be cleaned, but treat that as secondary. Prevent a repeat: secret scanning in CI and push protection, pre-commit hooks, and moving the workload to short-lived credentials so there is no key to leak.

3. Intermediate · Networking fundamentalsA service cannot reach api.partner.com. How do you narrow down the cause?

   Go layer by layer. Name resolution: getent hosts api.partner.com or dig (wrong record, private DNS zone, stale cache). Routing and firewalls: can you connect to the IP and port, for example with nc -vz or curl -v? A quick "connection refused" means nothing listens; a timeout usually means a firewall, security group, NACL or missing route (a private subnet without NAT). TLS: openssl s_client -connect host:443 -servername host for certificate and name errors. HTTP: status codes and headers. Compare with the same request from another machine.

4. Intermediate · Cloud platforms (AWS, Azure, Google Cloud), Security compliance and data protection, Security fundamentalsYou discover that a storage bucket with customer documents has been publicly readable. What do you do?

   Contain first: block public access on the bucket (and at account level) immediately. Then assess: which objects were exposed, since when, and whether they were accessed (server access logs or CloudTrail data events). Follow the incident process: inform security and legal, because personal data exposure may need notifying under laws such as India's DPDP Act or GDPR. Then prevent recurrence: account-level public access block, policy checks in CI for infrastructure code, alerts on configuration changes, and a review of how it happened.

5. Intermediate · Incident responseA Linux web server has a new root cron job that downloads and runs a script. What do you do?

   Treat it as a root compromise. Preserve evidence first: copy logs, crontabs and account files, and snapshot the disk (and memory if you can). Contain: isolate the host from the network or remove it from the load balancer and block the remote address. Scope: build a timeline of how the attacker got in, what accounts and credentials they used, and whether other hosts show the same indicators. Eradicate by rebuilding from a known-good image rather than cleaning, rotate every secret on the host, and restore data from before the compromise. Then fix the entry point and add detections.

6. Intermediate · Vulnerability managementA critical vulnerability affects a system that cannot be patched for three months. What do you do?

   Reduce exposure and likelihood until it can be fixed: restrict network access to the affected service, apply vendor workarounds or configuration changes, add a WAF or IPS rule if applicable, increase monitoring with specific detections for exploitation attempts, and make sure backups are sound. Document the risk acceptance with an owner and an expiry date, get it approved at the right level, and track the patch date.

7. Advanced · Security compliance and data protection, Infrastructure as codeAn auditor asks you to prove that all storage in your cloud accounts is encrypted and not public. How do you provide evidence?

   Show controls that are enforced and continuously checked, not screenshots: infrastructure code with encryption and public access blocks, CI policy checks that reject non-compliant changes, account-level guard rails (public access block, service control policies), and a configuration compliance tool (for example AWS Config rules or a CSPM scanner) reporting all resources against the control over time, with exceptions documented and approved. Export the reports with dates, and explain how new accounts inherit the controls.

Behavioural

1. Intermediate · Communication, Stakeholder managementTell me about a time you had to balance a security concern against a delivery deadline.

   Use a STAR story. Strong answers show you explained the risk in business terms, offered options instead of only blocking (a compensating control now, the full fix after launch, with a date and owner), got the decision made by the right person and documented it, and followed through. Interviewers look for security people who enable delivery while keeping real risk visible.