Guides

50 Cybersecurity Interview Questions and Answers (Basics / Security+)

By Ravindra Bagale, Cyber Security trainer · LinkedIn · Published: 29 September 2026 · Last updated: 30 September 2026

This pack gives 50 cybersecurity interview Q&As in Security+ / fundamentals style for India and US hiring panels: CIA, IAM basics, crypto concepts, network controls, IR, cloud shared responsibility and secure-coding themes — short solid answers you can speak aloud. Defence and concepts only; no exploit payloads or attack recipes.

Questions 1–50

Q1. What is the CIA triad? (Beginner)

CIA means Confidentiality, Integrity and Availability. Confidentiality keeps data from unauthorised eyes. Integrity means data is not altered without detection. Availability means systems stay usable when needed. Interviewers want a one-line definition plus one example for each — encryption for C, hashing or checksums for I, and backups or redundancy for A.

Q2. What is the difference between a threat, a vulnerability and a risk? (Beginner)

A threat can cause harm (ransomware gang, insider, flood). A vulnerability is a weakness (unpatched server, weak password). Risk combines likelihood and impact if the threat uses that weakness. Say how you prioritise high-impact fixes with business context.

Q3. What is defence in depth? (Beginner)

Defence in depth stacks independent controls so one failure is not total compromise. Layers: identity (MFA), endpoint (EDR), network (firewall/segmentation), application (input validation), data (encryption), detect/respond (SIEM/IR). Give two or three concrete layers, not only the slogan.

Q4. What is least privilege? (Beginner)

Every user, service and process gets only permissions needed for its job. It shrinks blast radius when an account is phished or a key leaks. Separate admin from daily accounts, prefer roles and temporary elevation, and review access periodically.

Q5. What is MFA and why does it matter? (Beginner)

Multi-factor authentication needs two or more factor types: know, have, or are. It stops most password-only takeovers after phishing or stuffing. Prefer authenticator apps or hardware keys over SMS when possible. Never share OTP codes.

Q6. Authentication vs authorisation? (Beginner)

Authentication proves who you are. Authorisation decides what you may do after login. Authn = identity; authz = permission. Broken access control is often authorisation failing after a successful login.

Q7. What is hashing vs encryption? (Beginner)

Hashing is one-way and used for integrity checks or password verifiers. Encryption is reversible with a key and protects confidentiality. You do not decrypt a hash — you compare digests. Store passwords with slow hashes such as bcrypt or Argon2, not raw MD5.

Q8. Symmetric vs asymmetric cryptography? (Beginner)

Symmetric uses one shared secret (AES) and is fast for bulk data. Asymmetric uses a key pair (RSA/ECC) for encrypt/verify versus decrypt/sign. TLS agrees keys with asymmetric methods, then uses symmetric crypto for the session.

Q9. What is a CVE? (Beginner)

CVE is a public ID for a known vulnerability. CVSS helps prioritise, but context wins — internet-facing plus known exploit beats a high score on an isolated box. Mention CISA KEV as a practical patch-first list.

Q10. Patch management in one minute? (Beginner)

Inventory, discover vulns, prioritise (KEV/internet-facing/crown jewels), test, deploy, verify, document exceptions. Keep emergency windows for actively exploited bugs plus regular maintenance.

Q11. What is phishing? (Beginner)

Social engineering that tricks people into giving credentials, running malware, or approving fraud — often via email. Spot urgency, odd senders and mismatched URLs. Defence: reporting, SPF/DKIM/DMARC, MFA, and safe SOC triage — not opening samples on a work laptop.

Q12. Malware vs ransomware vs virus? (Beginner)

Malware is the umbrella. Viruses classically attach to files/programs. Ransomware encrypts or locks data for payment. Interviews focus on readiness: offline backups, least privilege, EDR and IR playbooks.

Q13. What is a firewall? (Beginner)

A firewall filters traffic by policy (IP, port, protocol, sometimes app identity). Host firewalls protect one machine; network firewalls sit at boundaries. Stateful firewalls track connections. Pair with segmentation — a firewall alone is not Zero Trust.

Q14. IDS vs IPS? (Intermediate)

IDS alerts on suspicious patterns. IPS can block inline. IPS reduces dwell time but false positives can break business traffic — tune carefully. Modern stacks blend NDR/EDR with SIEM correlation.

Q15. What is a SIEM? (Beginner)

SIEM aggregates logs, correlates rules and presents alerts. Value needs coverage, tuned detections and analysts who triage well. Related ideas: SOAR orchestration and UEBA behaviour analytics.

Q16. What is a SOC? (Beginner)

A Security Operations Centre monitors, detects, investigates and coordinates response — often 24x7. Roles include L1 triage, L2 investigation and IR. Tools matter; clear playbooks and notes matter more.

Q17. Incident response lifecycle? (Beginner)

Common phases: Preparation, Detection and Analysis, Containment, Eradication, Recovery, Lessons Learned. First hours: scope, preserve evidence, contain carefully, communicate. Do not wipe disks before required capture.

Q18. Policy vs standard vs procedure? (Intermediate)

Policy = leadership must/should rules. Standard = technical baselines (for example TLS versions). Procedure = step-by-step execution. Banks and IT services in India often probe whether you can write procedures that match policy.

Q19. What is risk assessment? (Beginner)

Identify assets, threats and vulnerabilities, estimate likelihood and impact, then treat, transfer, accept or avoid. Qualitative High/Med/Low is common; quantitative uses money when data exists. Tie recommendations to business impact.

Q20. What is the shared responsibility model? (Beginner)

In cloud, the provider secures the cloud fabric; you secure data, identities, configs and apps — split varies by IaaS/PaaS/SaaS. Open buckets and weak IAM are usually the customer side.

Q21. Public vs private vs hybrid cloud security? (Beginner)

Public: strong provider controls, but your configs and identities fail most often. Private: more physical control, still need patching and IAM. Hybrid: identity and network trust paths become critical — segment and monitor.

Q22. What is Zero Trust at a high level? (Beginner)

Assume breach and never trust by network location alone. Verify explicitly, use least privilege, monitor continuously. Pieces: strong identity plus MFA, device health, micro-segmentation. Strategy, not one product.

Q23. What is social engineering? (Beginner)

Manipulating people to bypass technical controls — phishing, vishing, pretexting. Defence: awareness, out-of-band verification for payments, least privilege and email/IdP controls. Reward reporting; do not shame.

Q24. OWASP Top 10 — what is it for? (Beginner)

A community list of critical web risks used as a defence and testing agenda. Recent themes stress broken access control, misconfiguration and supply chain. Use it to prioritise secure design — not as an exploit cookbook.

Q25. SQL injection — how do you prevent it? (Beginner)

Use parameterised queries or prepared statements, ORM bindings, least-privilege DB accounts and input validation as defence-in-depth. Never concatenate untrusted input into SQL. Interviewers want prevention, not payloads.

Q26. XSS — types and prevention? (Beginner)

Reflected, stored and DOM XSS inject scripts into pages users trust. Prevent with context-aware output encoding, CSP, careful HTML sanitising, and HttpOnly/Secure cookies. Framework escaping helps but is not universal.

Q27. What is CSRF and how mitigate? (Intermediate)

Cross-Site Request Forgery tricks a logged-in browser into a state-changing request. Mitigate with anti-CSRF tokens, SameSite cookies, and re-auth for critical changes.

Q28. Security headers worth naming? (Intermediate)

Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, Referrer-Policy, Permissions-Policy. They reduce XSS impact and force HTTPS. Roll out CSP carefully to avoid breaking apps.

Q29. What is a VPN used for? (Beginner)

A VPN encrypts traffic between client and gateway (or site-to-site). It does not make every website safe and is not a substitute for MFA or patching. Corporate VPN access still needs least privilege and device checks.

Q30. Why TLS instead of sharing secrets in clear? (Intermediate)

Sharing a secret over an insecure channel is hard without prior trust. TLS uses certificates so clients authenticate the server and establish session keys. Certificate validation failures must not be casually ignored.

Q31. What is PKI? (Intermediate)

Public Key Infrastructure: CAs issue certificates binding identities to public keys; clients trust root CAs. Includes issuance, renewal, revocation themes and private key protection. Bad validation breaks the model.

Q32. Backup 3-2-1 rule? (Beginner)

At least 3 copies, on 2 media types, with 1 off-site — ideally offline or immutable against ransomware. Test restores. Align RPO and RTO with the business.

Q33. RPO vs RTO? (Beginner)

RPO is how much data loss is tolerable (time since last good backup). RTO is how fast service must return. DR design follows these numbers.

Q34. What is logging best practice? (Beginner)

Log authentication, admin actions, security alerts and sensitive access. Centralise with access control and retention. Protect logs from tampering. Never store passwords in clear text logs.

Q35. Physical security still matters? (Beginner)

Yes — stolen laptops, tailgating and USB drops defeat pure software controls. Disk encryption, screen locks and visitor processes still appear in Security+ style questions.

Q36. What is a DMZ? (Beginner)

A demilitarised zone hosts internet-facing services separated from internal networks. Compromising a web server should not equal full LAN access. Cloud analogue: public subnets with tight security groups and private app/db tiers.

Q37. Black box vs white box testing? (Beginner)

Black box means little internal knowledge. White box means full code and architecture access. Grey box is partial. All require written authorisation and scoped rules of engagement.

Q38. Vulnerability scan vs penetration test? (Beginner)

Scans find known weaknesses broadly and often. Pentests use humans to validate paths with business context — still within authorisation. Neither replaces patching or secure design.

Q39. False positive vs false negative? (Beginner)

False positive: alert with nothing bad — wastes time. False negative: miss a real attack — dangerous. Tune detections and track both. Prefer catching critical true positives over silencing noise blindly.

Q40. What is change management in security? (Intermediate)

Controlled review, approval, implement and rollback so security and availability do not break. Emergency changes still need documentation. Untracked IAM changes cause outages and breaches.

Q41. Security awareness — what works? (Beginner)

Short continuous training, phishing simulations with coaching not humiliation, clear report buttons and leadership example. Measure report and click rates. Training never replaces MFA and patching.

Q42. GDPR / privacy basics for interviews? (Intermediate)

Know lawful-basis themes, data minimisation, breach notification expectations, and that security supports privacy. India roles may mention DPDP themes at a high level. Escalate legal specifics to counsel.

Q43. What is an insider threat? (Beginner)

Risk from employees, contractors or partners misusing access — malicious or negligent. Controls: least privilege, privileged monitoring, offboarding, DLP themes and culture. Many cases are mistakes, not movie villains.

Q44. Hardening — define it. (Beginner)

Reduce attack surface: remove unused services, apply baselines, patch, lock admin protocols, enforce MFA and secure defaults. Document exceptions. Hardening is continuous.

Q45. What is a security baseline? (Intermediate)

Agreed minimum configuration for a class of systems. Tools enforce and detect drift. Baselines make audits possible across India delivery centres and US HQ fleets.

Q46. Explain CIA trade-offs with availability. (Intermediate)

Strict lockdowns can hurt availability (over-blocking IPS, MFA lockouts). Balance with monitored break-glass, staged rollouts and business-impact measures. Security that breaks the business gets bypassed.

Q47. What is non-repudiation? (Intermediate)

Evidence that a party performed an action and cannot credibly deny it — often via digital signatures, audit logs and strong identity binding. Useful in fraud and privileged-action disputes.

Q48. Port 22, 80, 443 — what are they? (Beginner)

22 typically SSH, 80 HTTP, 443 HTTPS. Knowing common ports helps read firewall rules. Do not expose admin ports to the whole internet when avoidable; use VPN, bastion or SSM-style access.

Q49. What should you say if you do not know an answer? (Beginner)

Be honest, outline how you would find out, and relate to a nearby concept you know. Humility plus method beats bluffing exploits in India and US panels.

Q50. How do you stay current in cyber? (Beginner)

Follow vendor advisories, CISA KEV, a few trusted sources, practise in labs you own, and document learning. Mention one recent CVE class or cloud misconfiguration theme — without claiming illegal testing.

Related guides on this site

• What is phishing
• MFA on Google / Microsoft / AWS
• OWASP Top 10 simply
• Zero Trust explained