Ravindra BagaleCourses & study guides मराठी Track your progress

Cyber Security Interview Questions and Answers: 107 Interview Cards with Examples

By Last updated:

107 common cyber security interview questions, one per card. Each card has a real example, then What it is, Why it matters and How to do it. Save them on your phone or download the PNG. The QR code on each card opens its full lesson.

Most asked

An incident is a security event that harms or may harm systems or data. Incident response is the planned way a team handles it. A calm, fixed plan stops panic and limits damage when an attack happens.
Card 1 of 107: What are the steps of incident response? · Download PNG · Open card page · Full lesson
Containment means stopping the spread. Evidence is the data that shows what happened. Turning the server off wipes memory (RAM), which may hold the attacker's tools. Panic moves can destroy evidence or let the attacker spread.
Card 2 of 107: A server is being hacked right now. What do you do first? · Download PNG · Open card page · Full lesson
Phishing is a fake message sent to thousands; spear phishing is the same trick aimed at a few chosen people. Real examples: fake Netflix payment emails and RSA's 2011 Recruitment Plan file.
Card 3 of 107: Phishing vs spear phishing: what is the difference? · Download PNG · Open card page · Full lesson
The browser turns the name into an IP address (a computer's number address), connects, makes the link secret with TLS (encryption for websites), then asks for the page. It shows you understand DNS, TCP, TLS and HTTP working together.
Card 4 of 107: What happens when you type www.google.com and press Enter? · Download PNG · Open card page · Full lesson
IDS = Intrusion Detection System. It watches traffic and raises an alert. IPS = Intrusion Prevention System. It sits in the path and can drop bad traffic. Interviewers check if you know the difference between watching and stopping.
Card 5 of 107: IDS vs IPS: what is the difference? · Download PNG · Open card page · Full lesson
SIEM = Security Information and Event Management. It collects logs (records of what happened) from all systems into one place and raises alerts. Reading logs on each server one by one does not work for a big company.
Card 6 of 107: What is a SIEM, and what does it do? · Download PNG · Open card page · Full lesson
Both carry data between computers. TCP makes a connection first and checks every piece arrived. UDP just sends, with no checking. Choosing the wrong one makes apps slow or unreliable.
Card 7 of 107: TCP vs UDP: what is the difference? · Download PNG · Open card page · Full lesson
Malware is software made to harm, spy or lock systems. A virus needs a file. A worm spreads alone. A trojan pretends to be useful. Each type needs a different defence.
Card 8 of 107: Virus vs worm vs trojan: what is the difference? · Download PNG · Open card page · Full lesson
Triage means sorting alerts by how real and how urgent they are, like a hospital emergency desk. A SOC gets hundreds of alerts a day. You must pick the dangerous ones fast.
Card 9 of 107: How do you triage a security alert? · Download PNG · Open card page · Full lesson
OWASP is a free, non-profit community for web security. The Top 10 is its list of the most serious web app risks. It is the most used checklist for web app security. Interviewers expect you to know it.
Card 10 of 107: What is the OWASP Top 10? · Download PNG · Open card page · Full lesson
The OSI model splits network work into 7 layers. Each layer does one job and hands data to the next. It helps you say exactly where a problem or attack sits.
Card 11 of 107: What are the 7 layers of the OSI model? · Download PNG · Open card page · Full lesson
Phishing is a fake message that tricks people into clicking or sharing data. Email headers show where a message really came from. One click can give an attacker a real password. Fast action limits the damage.
Card 12 of 107: A user reports a phishing email. What do you do? · Download PNG · Open card page · Full lesson
A vulnerability is a weakness. A threat is something that can use it. Risk is how likely harm is, times how bad it would be. Teams have limited time. Risk tells them what to fix first.
Card 13 of 107: Risk vs threat vs vulnerability: what is the difference? · Download PNG · Open card page · Full lesson
A firewall allows or blocks network traffic using rules on IP addresses and ports. Real example: an AWS security group that allows HTTPS from anyone and SSH only from the office IP.
Card 14 of 107: What does a firewall do? · Download PNG · Open card page · Full lesson
Before TCP sends data, two computers agree to talk in 3 messages. SYN = start. ACK = acknowledge (I got it). Port scans, SYN floods and firewall states all depend on it.
Card 15 of 107: What is the TCP 3-way handshake? · Download PNG · Open card page · Full lesson
Encryption locks data so only key holders can read it. Symmetric: one key locks and opens. Asymmetric: the public key locks, only the private key opens. Real systems use both, so you must know when each one fits.
Card 16 of 107: Symmetric vs asymmetric encryption: what is the difference? · Download PNG · Open card page · Full lesson
Encoding changes format only. Hashing makes a fixed fingerprint you cannot reverse. Encryption hides data with a key. Saying Base64 is encryption is a common interview mistake.
Card 17 of 107: Hashing vs encoding vs encryption: what is the difference? · Download PNG · Open card page · Full lesson
DoS = Denial of Service: flooding a target so it stops working. DDoS = Distributed DoS: many machines attack together. A botnet is a group of hacked devices. It breaks availability: real users cannot use the site.
Card 18 of 107: What is a DDoS attack? · Download PNG · Open card page · Full lesson
SQL is the language apps use to talk to a database. SQL injection means typing SQL code into a form so the app runs it. One bad query can leak a whole customer database.
Card 19 of 107: What is SQL injection, and how do you stop it? · Download PNG · Open card page · Full lesson
XSS happens when a site shows user input as it is. If the input has JavaScript (browser code), it runs in the victim's browser. It can steal login cookies of every visitor.
Card 20 of 107: What is cross-site scripting (XSS)? · Download PNG · Open card page · Full lesson
A positive is when a tool says something is wrong. True means it is right. False means it is wrong. Analysts must not waste time on false alarms or miss real attacks.
Card 21 of 107: True positive vs false positive: what is the difference? · Download PNG · Open card page · Full lesson
A hash is a one-way fingerprint of a password. A salt is a random value added to each password before hashing, so the same password gives different hashes. Leaked hashes are cracked fast if stored badly.
Card 22 of 107: How should passwords be stored? What is a salt? · Download PNG · Open card page · Full lesson
Brute force means trying many passwords until one works. A wordlist is a file of likely passwords. Knowing the type tells you the right defence.
Card 23 of 107: What is a brute force attack? Online vs offline? · Download PNG · Open card page · Full lesson
Hardening means making a system safer by removing what is not needed and locking what stays. Attack surface = all the ways an attacker can try to get in. Every open door is a way in. Fewer doors, fewer attacks.
Card 24 of 107: What is system hardening? · Download PNG · Open card page · Full lesson
A patch is an update that fixes a bug. Patch management means finding, testing and installing patches on time. Most attacks use old bugs that already have a fix.
Card 25 of 107: Why is patch management important? · Download PNG · Open card page · Full lesson
A vulnerability is a weakness. CVE gives each public weakness a unique ID. CVSS scores how serious it is, from 0.0 to 10.0. Teams fix the highest scores first.
Card 26 of 107: What are CVE and CVSS? · Download PNG · Open card page · Full lesson
GuardDuty is AWS's threat detection service. A C&C (command and control) server is the attacker's control point. The server may be controlled by an attacker and leaking data.
Card 27 of 107: An EC2 server is talking to a known bad IP. What do you do? · Download PNG · Open card page · Full lesson
An access key is a long-term password for AWS tools and code. CloudTrail logs every AWS action. Bots scan GitHub for keys within minutes. The attacker gets your AWS power.
Card 28 of 107: An AWS access key was pushed to GitHub. What do you do? · Download PNG · Open card page · Full lesson
Both are AWS firewalls. Stateful means return traffic is allowed by itself. Stateless means you must allow both directions. Picking the wrong one leaves ports open or blocks real users.
Card 29 of 107: Security group vs NACL: what is the difference? · Download PNG · Open card page · Full lesson
IAM controls who can do what in AWS. A user has its own fixed login or keys. A role gives temporary keys to whoever takes it. Long-term keys leak. Roles cut that risk.
Card 30 of 107: IAM role vs IAM user: what is the difference? · Download PNG · Open card page · Full lesson
Data at rest is stored data. KMS (Key Management Service) makes and guards the keys, and logs every use in CloudTrail. If a disk or backup is stolen, encrypted data is useless to the thief.
Card 31 of 107: How do you encrypt data at rest in AWS? · Download PNG · Open card page · Full lesson
Ransomware locks files and asks for money. CERT-In is India's national cyber agency. Companies must report serious incidents to it. Ransomware spreads fast across shared folders and servers.
Card 32 of 107: Ransomware hits one laptop. What are your steps? · Download PNG · Open card page · Full lesson
Brute force is guessing many passwords on one account. fail2ban is a free tool that blocks an IP after repeated fails. A success after many fails can mean the attacker is now inside.
Card 33 of 107: You see a brute-force alert on a server. What do you check? · Download PNG · Open card page · Full lesson
An Event ID is a number Windows gives each kind of log entry. They live in the Security log (Event Viewer). These IDs are the first clues in many Windows attacks.
Card 34 of 107: Which Windows Event IDs should a SOC analyst know? · Download PNG · Open card page · Full lesson
These are DNS records that help inboxes check if an email really came from the domain it claims. Spoofing means faking the sender. Without them, anyone can send email pretending to be your company.
Card 35 of 107: What are SPF, DKIM and DMARC? · Download PNG · Open card page · Full lesson
CSRF = Cross-Site Request Forgery. A bad site makes your browser send a request to a site you are logged in to, like a bank. It can make your logged-in account act without you knowing.
Card 36 of 107: What is CSRF? · Download PNG · Open card page · Full lesson
A digital signature is a hash of the data, locked with the sender's private key. Anyone can check it with the public key. It proves who sent something and that nobody changed it.
Card 37 of 107: What is a digital signature? · Download PNG · Open card page · Full lesson
HTTPS is HTTP inside TLS, which encrypts data and proves the site's identity with a certificate. On HTTP, anyone on the same Wi-Fi can read passwords.
Card 38 of 107: HTTP vs HTTPS: what is the difference? · Download PNG · Open card page · Full lesson

Often asked

CIA = Confidentiality, Integrity and Availability, the 3 goals of security, with one real example for each: Gmail HTTPS, Ubuntu's SHA-256 list and AWS Availability Zones.
Card 39 of 107: What is the CIA triad in cyber security? · Download PNG · Open card page · Full lesson
An IP address is a computer's number address. A public IP works on the internet. A private IP works only inside a home, office or cloud network. Private servers should not be reachable from the internet.
Card 40 of 107: Public vs private IP address: what is the difference? · Download PNG · Open card page · Full lesson
A honeypot is a fake system set up to attract attackers. It records what they try. A honeynet is a group of honeypots. No honest user touches it, so every alert is high-confidence.
Card 41 of 107: What is a honeypot? · Download PNG · Open card page · Full lesson
A session remembers you after login, using a session ID (often in a cookie). Hijacking = stealing that ID and using it. The attacker gets in without knowing the password.
Card 42 of 107: What is session hijacking? · Download PNG · Open card page · Full lesson
DNS = Domain Name System. It turns names like google.com into IP addresses (number addresses). It mostly uses UDP port 53. Attacks like DNS spoofing and phishing domains use it.
Card 43 of 107: How does DNS work? · Download PNG · Open card page · Full lesson
Least privilege = give each user or app only the access its job needs. IAM = Identity and Access Management, the AWS service for users and rights. If an account is hacked, small rights mean small damage.
Card 44 of 107: What is the principle of least privilege? · Download PNG · Open card page · Full lesson
A SOC = Security Operations Centre: a team that watches systems 24×7, finds attacks and responds. To escalate = pass to a senior. Most freshers start as L1 analysts.
Card 45 of 107: What is a SOC, and what does an L1 analyst do? · Download PNG · Open card page · Full lesson
A certificate is a digital ID card for a website. A CA (Certificate Authority) checks the site and signs it. It lets HTTPS encrypt traffic. Without it, browsers show 'Not secure' and data travels readable.
Card 46 of 107: What is an SSL/TLS certificate? · Download PNG · Open card page · Full lesson
Forensics means collecting and studying digital evidence. Chain of custody is the written record of who handled the evidence, when and why. Without it, evidence may not be accepted in court.
Card 47 of 107: What is chain of custody in digital forensics? · Download PNG · Open card page · Full lesson
A white hat (ethical hacker) tests systems with permission to help fix them. A black hat attacks without permission. Scope = the exact systems you may test. Without permission, the same work is a crime.
Card 48 of 107: White hat vs black hat: what makes hacking ethical? · Download PNG · Open card page · Full lesson
WPA = Wi-Fi Protected Access, the lock on a Wi-Fi network. A passphrase is the Wi-Fi password. Weak Wi-Fi lets nearby people read or join your network.
Card 49 of 107: WPA2 vs WPA3: which is safer for Wi-Fi? · Download PNG · Open card page · Full lesson
A vulnerability assessment scans for known weaknesses. A penetration test safely attacks them to show the real risk. Exploit = code that uses a weakness. Clients must know if they get a scan list or a real attack test.
Card 50 of 107: Vulnerability assessment vs penetration test? · Download PNG · Open card page · Full lesson
AWS secures the cloud itself. You secure what you put in the cloud: users, data, settings. Most cloud breaches come from the customer's side settings.
Card 51 of 107: What is the shared responsibility model in the cloud? · Download PNG · Open card page · Full lesson
Sniffing means capturing network traffic. MITM (man-in-the-middle) means an attacker sits between you and the site. On shared Wi-Fi, others can read unencrypted traffic.
Card 52 of 107: What is sniffing, and how does HTTPS stop it? · Download PNG · Open card page · Full lesson
A secret is a password, key or token. AWS Secrets Manager stores secrets encrypted and can rotate (change) them on a schedule. Passwords in code end up on GitHub, laptops and backups.
Card 53 of 107: Where should an app keep its database password? · Download PNG · Open card page · Full lesson
SSRF = Server-Side Request Forgery: tricking a server into fetching a URL for you. IMDSv2 makes the metadata service need a session token first. One SSRF bug in the cloud can leak cloud keys.
Card 54 of 107: What is SSRF, and how does IMDSv2 help? · Download PNG · Open card page · Full lesson
IDOR = Insecure Direct Object Reference. The app shows data by an ID but never checks if it is yours. It is part of Broken Access Control, number 1 on the OWASP list.
Card 55 of 107: What is IDOR? · Download PNG · Open card page · Full lesson
Command injection happens when an app puts user input into a system command without checking it. The attacker can run any command on your server.
Card 56 of 107: What is command injection? · Download PNG · Open card page · Full lesson
Windows NTLM logins can accept a password hash instead of the password. Steal the hash, and you can log in as that user. One hacked laptop can lead to the whole company.
Card 57 of 107: What is pass-the-hash and lateral movement? · Download PNG · Open card page · Full lesson
Signature detection matches known patterns. Anomaly detection learns normal and alerts on change. Each misses things the other catches.
Card 58 of 107: Signature vs anomaly detection? · Download PNG · Open card page · Full lesson
NAT = Network Address Translation. The router swaps private addresses for one public address on the way out, and back on the way in. There are not enough IPv4 addresses for every device.
Card 59 of 107: What is NAT? · Download PNG · Open card page · Full lesson
ARP links an IP address to a MAC address (a device's hardware ID). Spoofing means sending fake ARP replies. It lets an attacker on the same Wi-Fi sit in the middle and read traffic.
Card 60 of 107: What is ARP spoofing? · Download PNG · Open card page · Full lesson
Social engineering tricks people, not computers. Each type uses a different channel. People are often the easiest way in.
Card 61 of 107: What are vishing, smishing and pretexting? · Download PNG · Open card page · Full lesson
Defence in depth means many layers of security, so an attacker must beat all of them. Any single control can fail. Layers keep you safe.
Card 62 of 107: What is defence in depth? · Download PNG · Open card page · Full lesson
A SYN scan never finishes the handshake. A connect scan uses the normal full connection. Interviewers check if you know TCP and scanning basics.
Card 63 of 107: SYN scan vs connect scan in Nmap? · Download PNG · Open card page · Full lesson
Static analysis studies the file without running it. Dynamic analysis runs it in a safe, isolated sandbox. You must learn what malware does without infecting real systems.
Card 64 of 107: Static vs dynamic malware analysis? · Download PNG · Open card page · Full lesson
A disk image is an exact copy of a drive. A hash is its fingerprint. Same hash means same data. Courts accept evidence only if you can prove nobody changed it.
Card 65 of 107: Why do forensics teams hash a disk image? · Download PNG · Open card page · Full lesson
An evil twin is a fake Wi-Fi hotspot with the same name as a real one. It can show a fake login page to steal passwords. People join the strongest network with a known name.
Card 66 of 107: What is an evil twin Wi-Fi attack? · Download PNG · Open card page · Full lesson
An IOC is a clue that a system may be hacked. Compromise = an attacker got in. IOCs help you find the same attack on other machines.
Card 67 of 107: What is an indicator of compromise (IOC)? · Download PNG · Open card page · Full lesson
A port is a number (0–65535) for one service on a computer. IP = building; port = flat number. Port numbers tell you what service is running and what to protect.
Card 68 of 107: What are ports? Name common ones. · Download PNG · Open card page · Full lesson
Ransomware is malware that locks your files and asks for money (a ransom) to unlock them. One attack can stop a whole business.
Card 69 of 107: What is ransomware, and how do you defend? · Download PNG · Open card page · Full lesson
Reconnaissance (recon) means collecting information about a target before testing it. Active recon can be seen in logs and needs permission.
Card 70 of 107: Passive vs active reconnaissance? · Download PNG · Open card page · Full lesson
MFA = Multi-Factor Authentication. You prove who you are in 2 or more ways. 2FA is MFA with exactly 2. A stolen password alone is not enough to get in.
Card 71 of 107: What is MFA, and why use it? · Download PNG · Open card page · Full lesson
IoT = Internet of Things: smart cameras, routers and plugs connected to the internet. Cheap smart devices often ship with weak passwords.
Card 72 of 107: Why are IoT devices a security risk? · Download PNG · Open card page · Full lesson
Permissions are what an app may use. A sandbox keeps each app separate from others. A bad app with too many permissions can steal OTPs.
Card 73 of 107: How does Android keep apps safe? · Download PNG · Open card page · Full lesson
The DPDP Act (Digital Personal Data Protection Act, 2023) is India's personal data law. Personal data = data about a person. Companies in India must protect personal data by law.
Card 74 of 107: What is India's DPDP Act, 2023? · Download PNG · Open card page · Full lesson
CERT-In is India's national cyber security agency. Its 2022 directions set rules for reporting and logs. Indian companies must follow them. Interviewers in India ask often.
Card 75 of 107: What are the CERT-In 2022 rules for companies? · Download PNG · Open card page · Full lesson
A collision is when two different files give the same hash. MD5 collisions are easy to make now. A broken hash lets attackers fake files and signatures.
Card 76 of 107: Why is MD5 not safe any more? · Download PNG · Open card page · Full lesson
A JWT (JSON Web Token) is a signed login token. Anyone can read it, but only the server can sign it. A weak JWT setup lets attackers become any user.
Card 77 of 107: What is a JWT, and how can it go wrong? · Download PNG · Open card page · Full lesson
A certification is an exam that proves a skill. Start with basics, then pick a path: SOC, hacking or cloud. Freshers often ask this, and HR checks your plan.
Card 78 of 107: Which certification should a cyber fresher start with? · Download PNG · Open card page · Full lesson
STAR = Situation, Task, Action, Result. It keeps your answer short and clear. Projects prove skills better than certificates for freshers.
Card 79 of 107: How do you explain your lab project in an interview? · Download PNG · Open card page · Full lesson
Password spraying = one common password tried on many accounts. Each account sees only 1 wrong try, so none get locked (blocked). Lockout stops guessing on one account. Spraying slips past it.
Card 80 of 107: What is password spraying? · Download PNG · Open card page · Full lesson
Zero trust = never trust, always verify. Every request must prove the user and the device, even inside the office. One stolen password should not open the whole network.
Card 81 of 107: What is zero trust? · Download PNG · Open card page · Full lesson
EDR = Endpoint Detection and Response. An agent (small program) on each laptop or server watches behaviour and can act. XDR joins more data sources. Attackers use normal tools like PowerShell. Antivirus often misses that.
Card 82 of 107: What is EDR, and how is XDR different? · Download PNG · Open card page · Full lesson
MITRE ATT&CK is a free list of real attacker behaviour. A tactic is the goal. A technique is the method, with an ID. It gives every security team one shared language for attacks.
Card 83 of 107: What is MITRE ATT&CK? · Download PNG · Open card page · Full lesson
A VPN (Virtual Private Network) builds an encrypted tunnel (a private path) over the internet. Only the two ends can read the data. Data on the public internet can be read on the way. The VPN gate is also a target.
Card 84 of 107: What is a VPN, and how does it work? · Download PNG · Open card page · Full lesson
ISO 27001 is a world standard for an ISMS (a company's system for managing security risk). It is not a law. AWS and Infosys hold it. Big clients want proof a supplier manages security well.
Card 85 of 107: What is ISO 27001? · Download PNG · Open card page · Full lesson

More questions from the course

Privilege = what you are allowed to do. Escalation = getting more rights than you were given. root = the Linux admin. First access is often limited; attackers then try for more.
Card 86 of 107: What is privilege escalation? Vertical vs horizontal? · Download PNG · Open card page · Full lesson
Nmap is a free tool that finds live hosts and open ports. Scan only systems you own or have permission to test. It tells you what an attacker can reach.
Card 87 of 107: What do open, closed and filtered mean in Nmap? · Download PNG · Open card page · Full lesson
Burp Suite is a web testing tool. An intercepting proxy sits between the browser and the website and lets you see and edit each request. Most web bugs are found by changing requests.
Card 88 of 107: What is Burp Suite, and what is an intercepting proxy? · Download PNG · Open card page · Full lesson
Scanning finds hosts and open ports. Enumeration asks an open service for details like users and shared folders. Enumeration finds user names and shares that lead to attacks.
Card 89 of 107: Scanning vs enumeration: what is the difference? · Download PNG · Open card page · Full lesson
Active Directory (AD) is Microsoft's directory of users and computers. The Domain Controller holds it. Kerberos is its ticket-based login. Most company networks run on it, so attackers target it.
Card 90 of 107: What is Active Directory, and how does Kerberos log you in? · Download PNG · Open card page · Full lesson
Permissions decide who can read (r=4), write (w=2) and run (x=1) a file. 3 digits = owner, group, others. Wrong permissions leak files or let others change them.
Card 91 of 107: What do chmod 755, 644 and 400 mean? · Download PNG · Open card page · Full lesson
Logs are records of what happened. grep is a Linux command that shows lines matching a word. Many failed logins from one IP can mean a password attack.
Card 92 of 107: How do you find failed SSH logins in Linux logs? · Download PNG · Open card page · Full lesson
A web server is software that sends web pages to browsers. Nginx and Apache are the two most common. You must know which server you secure and where its settings live.
Card 93 of 107: Nginx vs Apache: what is the difference? · Download PNG · Open card page · Full lesson
A primary key uniquely identifies each row. A foreign key points to the primary key of another table. Keys keep data correct and are asked in every database round.
Card 94 of 107: Primary key vs foreign key: what is the difference? · Download PNG · Open card page · Full lesson
All three remove data. DELETE removes rows. TRUNCATE empties the table. DROP deletes the table itself. One wrong command can wipe data; know which is which.
Card 95 of 107: DELETE vs TRUNCATE vs DROP in SQL? · Download PNG · Open card page · Full lesson
A DNS record is one line that tells the internet where a domain's services are. Wrong or forgotten records can be taken over by attackers.
Card 96 of 107: What are A, CNAME and MX DNS records? · Download PNG · Open card page · Full lesson
S3 is AWS file storage. A bucket is a folder. Block Public Access is a master switch that stops data being made public. Public buckets are a common cause of data leaks.
Card 97 of 107: How do you keep an S3 bucket private? · Download PNG · Open card page · Full lesson
RDS is AWS's managed database service. Encryption at rest = data on disk is locked. An internet-facing database is a top target.
Card 98 of 107: How do you secure a database on AWS RDS? · Download PNG · Open card page · Full lesson
SSH = Secure Shell, encrypted remote login (port 22). A key pair has a public key on the server and a private key with you. Keys are much harder to guess than passwords.
Card 99 of 107: How do you log in to an EC2 server safely? · Download PNG · Open card page · Full lesson
A static site sends ready-made files. A dynamic site runs code, like PHP, to build each page. Dynamic sites need input checks; static sites have fewer risks.
Card 100 of 107: Static vs dynamic website: what is the difference? · Download PNG · Open card page · Full lesson
Netcat (nc) is a small tool that reads and writes data over network connections. People call it a network Swiss army knife. Admins use it to test; attackers use it for shells, so watch for it.
Card 101 of 107: What is Netcat used for? · Download PNG · Open card page · Full lesson
OT = Operational Technology: systems that control physical machines. SCADA is software that monitors them. In OT, an attack can hurt people, not just data.
Card 102 of 107: OT vs IT security: what is different? · Download PNG · Open card page · Full lesson
Persistence is the hidden way back an attacker sets up. A web shell is a hidden page that runs their commands. Fixing only the first bug lets the attacker walk back in.
Card 103 of 107: How do attackers keep access after you reboot or patch? · Download PNG · Open card page · Full lesson
Threat hunting means actively searching for hidden attackers. A hypothesis is an idea you test, like Word should not start PowerShell. Alerts catch only what you already have a rule for.
Card 104 of 107: What is threat hunting? · Download PNG · Open card page · Full lesson
SOAR = Security Orchestration, Automation and Response. It runs saved step plans called playbooks across your tools. Analysts waste time on the same manual steps, so response is slow.
Card 105 of 107: What is SOAR, and how is it different from a SIEM? · Download PNG · Open card page · Full lesson
DLP = Data Loss Prevention: tools that stop sensitive data leaving. Exfiltration means the attacker moving data out. Stopping data from leaving limits damage even after a break-in.
Card 106 of 107: How do you spot data being stolen? · Download PNG · Open card page · Full lesson
Threat modelling lists how a design could be attacked. STRIDE is a six-point checklist so you miss no threat type. Finding design flaws on paper is far cheaper than after launch.
Card 107 of 107: What is STRIDE threat modelling? · Download PNG · Open card page · Full lesson