10 cyber security interview questions for freshers

1. Define Cybersecurity?

Cybersecurity refers to the practice of protecting computer systems, networks, programs, and data from unauthorized access, theft, damage, or any other form of malicious attack. It involves the use of various technologies, processes, and practices to secure computers, servers, mobile devices, electronic systems, and networks from cyber threats, such as viruses, worms, malware, ransomware, phishing, and hacking attempts.

Table of Contents

2. What is Computer Networking?

Communication
Sharing Software
Sharing File
Information Preservation
Security
Sharing Hardware

3. What is Cryptography?

Cryptography is the practice of securing communication from unauthorized access or modification. It involves the use of mathematical algorithms and protocols to convert plain text into a coded message that is unintelligible to anyone who does not have the key to decrypt it. The process of encryption is used to protect sensitive information such as passwords, credit card numbers, and other personal information transmitted over the internet. Cryptography is an essential component of secure communication in today’s digital age, and it is used in a wide range of applications, including online banking, e-commerce, email, messaging, and more

4. What is the difference between Threat, Vulnerability, and Risk?

Threat: A threat is any potential danger that could exploit a vulnerability and cause harm to a system or organization. Threats can come from a variety of sources, including human attackers, natural disasters, software bugs, or hardware failures.

Ex: Phishing attack

Vulnerability: A vulnerability is a weakness or flaw in a system or organization’s security that can be exploited by a threat. Vulnerabilities can exist in hardware, software, or human processes and can be introduced through misconfigurations, unpatched systems, or poor security practices.

Ex: SQL injections, cross-site scripting

Risk: Risk is the likelihood of a threat exploiting a vulnerability and causing harm to a system or organization. It is the product of the probability of a threat occurring and the potential impact of that threat if it does occur.

In summary, a threat is a potential danger, a vulnerability is a weakness in the system that could be exploited, and risk is the likelihood of harm occurring due to a threat exploiting a vulnerability. Understanding these concepts is critical in developing effective cybersecurity strategies to protect against potential threats and minimize risk.

5. What is the difference between hashing and encryption?

Hashing is a one-way function that takes input data of any size and generates a fixed-size output, known as a hash. The output is unique to the input, which means that even small changes in the input data will result in a completely different hash value. Hashing is commonly used to verify the integrity of data, as any changes to the original data will result in a different hash value. It is also used to store passwords securely, where the hash value is stored instead of the actual password.

Encryption, on the other hand, is a reversible process that transforms plaintext into ciphertext using an encryption algorithm and a key. The ciphertext can be decrypted back to plaintext using the same key. Encryption is used to protect data confidentiality, where only authorized parties with access to the key can decrypt the ciphertext and access the original data.

6. What is a three-way handshake process?

The three-way handshake is a process used in the Transmission Control Protocol (TCP) to establish a reliable connection between two network devices, such as a client and a server. The process involves three steps, as follows:

SYN: The first step in the three-way handshake is the SYN (synchronize) packet sent by the client to the server. This packet contains a sequence number that is used to synchronize the sequence numbers of both the client and the server.
SYN-ACK: The server responds to the client’s SYN packet with an SYN-ACK (synchronize-acknowledge) packet. This packet contains the acknowledgment number, which is the next sequence number the server expects to receive from the client.
ACK: The final step in the three-way handshake is the ACK (acknowledge) packet sent by the client to the server. This packet acknowledges the receipt of the SYN-ACK packet from the server and completes the establishment of a reliable connection between the client and the server.

7. What is a Firewall and why is it used?

A firewall is a network security system that monitors and controls the incoming and outgoing network traffic based on predetermined security rules. It acts as a barrier between a trusted internal network and an untrusted external network, such as the Internet, and helps to protect against unauthorized access and cyberattacks.

Firewalls can be hardware devices, software applications, or a combination of both. They operate at the network level, examining the source and destination of network traffic and using security rules to determine whether to allow or block the traffic.

Firewalls are used for several reasons, including:

Network security: Firewalls help to protect networks from unauthorized access and cyberattacks, such as malware and hacking attempts.
Access control: Firewalls can restrict access to specific network resources based on user identity, IP address, and other factors.
Traffic monitoring: Firewalls can monitor network traffic for suspicious activity, such as unusual traffic patterns or data volume, and alert administrators to potential threats.
Compliance: Firewalls are often required by regulatory compliance standards, such as the Payment Card Industry Data Security Standard (PCI DSS), to help protect sensitive data.

8. What is HTML Response?

HTML response refers to the response that a web server sends back to a client when the client requests an HTML resource. When a user types a URL into a web browser or clicks on a link, the browser sends a request to the web server asking for the HTML resource that corresponds to that URL.

The server then processes the request and sends back an HTML response, which is essentially the HTML code that makes up the requested webpage. This HTML response may also include other resources, such as images, scripts, and stylesheets, that are necessary for the webpage to display properly.

9. Need for Information Security

To protect the function of the organization
To ensure the safe operation of the application
To protect the data collection by the organization

10. What is a three-way handshake?

A three-way handshake is a method used in TCP/IP networking to establish a connection between two devices over an IP network. It is also known as an SYN-SYN-ACK handshake.

The three-way handshake involves the following steps:

The client sends an SYN (synchronize) message to the server to initiate a connection request. This message includes a random sequence number that is used to identify the connection.
The server receives the SYN message and responds with an SYN-ACK (synchronize-acknowledge) message. This message includes an acknowledgment of the client’s sequence number, as well as a random sequence a number of its own.
The client receives the SYN-ACK message and sends an ACK (acknowledge) message to the server to confirm the connection. This message includes an acknowledgment of the server’s sequence number.

11. What are some of the common Cyberattacks?

Phishing attacks: These are attempts to trick users into divulging sensitive information, such as passwords or credit card numbers, by posing as a trustworthy entity.
Malware attacks: These involve the use of malicious software, such as viruses, worms, or Trojans, to gain unauthorized access to a system or steal sensitive information.
Ransomware attacks: These involve the use of malware to encrypt a user’s files and demand payment in exchange for the decryption key.
DDoS attacks: These are distributed denial-of-service attacks, in which a network or website is flooded with traffic in an attempt to overwhelm it and cause it to crash.
Man-in-the-middle attacks: These involve intercepting communication between two parties in order to steal sensitive information or alter messages.
SQL injection attacks: These exploit vulnerabilities in web applications to gain unauthorized access to databases and steal sensitive information.
Password attacks: These involve attempting to guess or crack a user’s password in order to gain access to their accounts.
Social engineering attacks: These involve using psychological manipulation to trick users into divulging sensitive information or performing actions that could compromise security.

12. What is the need for DNS monitoring?

DNS (Domain Name System) is a service that is used for converting user-friendly domain names into a computer-friendly IP address. It allows websites under a particular domain name that is easy to remember.
DNS monitoring is nothing but monitoring DNS records to ensure does it route traffic properly to your website, electronic communication, services, and more.

13. Which is more secure SSL or HTTPS?

SSL (Secure Sockets Layer) and HTTPS (Hypertext Transfer Protocol Secure) are not interchangeable terms and they serve different purposes when it comes to security.

SSL is a security protocol used to encrypt data in transit between a web server and a client (such as a web browser). It provides secure communication between two endpoints and helps prevent eavesdropping, data tampering, and forgery.

HTTPS, on the other hand, is a combination of the standard HTTP protocol with SSL/TLS encryption. It uses SSL/TLS to encrypt data in transit and verify the authenticity of the website. HTTPS ensures that the website being accessed is genuine and that the data transmitted between the website and the user is secure.

14.What do you understand by compliance in Cybersecurity?

Compliance means living by a set of standards set by an organization/government/independent party.
It helps in defining and achieving IT targets and also in mitigating threats through processes like vulnerability management.

15. What is a cybersecurity risk assessment?

A cybersecurity risk assessment is a process used to identify, evaluate, and prioritize potential cybersecurity risks to an organization’s information systems, data, and assets. The goal of a risk assessment is to help organizations understand their cybersecurity risks and develop strategies to mitigate those risks.

A typical cybersecurity risk assessment involves the following steps:

Asset inventory: Identify and document all the assets that need to be protected, including hardware, software, data, and personnel.
Threat identification: Identify potential cybersecurity threats, such as malware, phishing attacks, social engineering, or insider threats.
Vulnerability assessment: Identify and evaluate vulnerabilities that could be exploited by potential threats.
Risk analysis: Analyze the likelihood and potential impact of each identified risk.
Risk mitigation: Develop and implement strategies to mitigate the identified risks, including technical controls such as firewalls, intrusion detection/prevention systems, and data encryption, as well as administrative controls such as security policies, training and awareness programs, and incident response plans.
Risk monitoring: Continuously monitor and assess cybersecurity risks and adjust mitigation strategies as needed.