46.9 AD, Malware, Session, IoT and Mobile — Defensive Talking Points

Q81. What is Active Directory in one interview minute?

AD is the directory service for Windows domains: users, groups, computers, and policies. Compromise of Domain Admin is near-total for that domain. I only practise AD attacks in an isolated lab such as fictional sahyadri.lab.

Q82. What is Kerberoasting at a conceptual defensive level?

Attackers request service tickets for accounts with SPNs and try to crack weak service passwords offline. Defence: gMSA or long random passwords, AES kerberos encryption types, and monitoring unusual 4769 patterns. I do not run roasting tools on real corporate AD.

Q83. Pass-the-Hash – what do defenders do?

PtH reuses NTLM password hashes to authenticate without the clear password. Defence ideas: LAPS, Credential Guard, reducing local admin, preferring Kerberos, and tiered administration so a workstation admin is not Domain Admin.

Q84. How do you talk about malware types without fear-mongering?

I classify by behaviour: trojan, ransomware, worm, spyware, wiper – then I stress prevent/detect/response: least privilege, email filtering, EDR, backups tested offline, and no paying advice as a legal opinion. Analysis stays in sandboxes I own.

Q85. What session attacks should a web defender know?

Session hijacking via XSS or network sniffing on HTTP, fixation, and weak logout. Fixes: HTTPS, cookie flags, regenerate session ids on login, short timeouts, and server-side session invalidation.

Q86. IoT camera in a shop – defensive talking points?

Change default passwords, isolate IoT VLAN from POS/AD, disable UPnP where risky, keep firmware updated, and do not expose admin panels to the internet. Raja-Rani Kolhapur shop cameras stay on a guest/IoT segment in my architecture sketches.

Q87. Mobile app security basics for interviews?

HTTPS only, no secrets in the APK, certificate pinning where fit, safe storage, permission minimisation, and updates. I test on my emulator/test phone, never on a classmate device.

Q88. What is phishing awareness versus running SET on strangers?

Awareness training and reporting buttons are Blue. Social-engineering toolkits stay in OWN lab for education. Real phishing of coworkers without authorisation is unacceptable.

Q89. How do you explain lateral movement simply?

After one foothold, attackers jump to other hosts using stolen credentials or trusts. Segmentation, LAPS, tiering, and detection of unusual auth stop the jump. Target-style vendor paths are a classic lesson in monitoring third-party access.

Q90. What is defence-in-depth?

Multiple layers so one failure does not end the story: perimeter, identity, patching, app secure coding, logging, backups. I prefer boring layers over a single magic box.