Here we are going to discuss some of the main Interview Questions on Cyber Security.
1. What is CIA?
- Confidentiality-This means only authorized people can access data.
- Integrity- ensuring the data is not modifies.
- Availability- the data is available to its users.
2. What is Encryption? Explain types of encryption.
It is the process of encoding the information in a manner which the authorized person can understand it.
Types of encryption-
- Symmetric encryption- same key is used for encryption and
Example-Blowfish, RC5
- Asymmetric encryption- different key is used for encryption and
Example-RSA, DSA
3. What is hashing?
It is a one way transformation of a string of characters into a fixed- length value or key of original strength. It is used to secure the integrity of data.
4. Difference between Encryption and Hashing
Encryption
- It is the process of encoding the information in a manner which the authorized person can understand
- It is a two-way process e., we can get the data back by decryption.
- It is used to ensure confidentiality of data.
- Algorithms– Bluefish, AES, DES
Hashing –
- It is a one way transformation of a string of characters into a fixed- length value or key of original
- It is a one-way process e. we cannot get the data back by hash value.
- It is used to secure the integrity of data.
- Algorithms- MD5, SHA-1
5. What is Defense in Depth?
Defense in Depth (DiD) is a multi-level cyber security approach in which series of mechanisms are layered to protect the sensitive information. It addresses many attackers thereby increasing the security of system. If one mechanism would fail a different layer would be activated to secure the data and identify attacks.
6. What is Zero Trust Model?
It is an IT security model that requires strict identity verification and a device to access resources on a private network. Principles include multi factor authentication.
7. Explain Kerberos
Kerberos is a computer-network authentication protocol that allows systems to prove their identity to one another on basis of tickets.
Basic steps in a kerberized environment-
- Client requests an authentication ticket(TGT) from the Key Distribution Center (KDC)
- Credentials verified by KDC and sending of encrypted TGT and session
- TGT encrypted with help of Ticket Granting Service(TGS) secret
- Storing of TGT by client and on expiry date , local session manager requests for another TGT
8. What is compliance in cyber security?
Tip- There is different compliance mechanisms to be followed for every Know the basic ones.
It is structured set of policies that deals with detailed organization process to maintain its cyber security. Industry specific compliance are –
- PCI-DSS- to protect the credit card data(banks)
- SOX- public listed companies
- HIPAA- to protect patients health (Hospitals)
9. Different types of Hackers.
Here are different type of Hackers-
- White Hat hackers- works for government and organizations by identifying loopholes in cyber
- Black Hat – they hack systems for malicious purposes like financial
- Grey Hat – they are not legally authorized hackers and fall between white hat and black hat
- Malicious Insider- it could be an employee of company or organization that access knowledge of inside operations of a company and threatens to make it
10. What is System Hardening?
It is process of protecting a system by reducing its attack surface. Few things of system hardening includes-
- Changing the default user credentials
- Closing all unused ports
- Stopping all unused device
- Install updates
- Install antivirus and keep signatures up to date
- Implement access
Few random questions-
1. If you have to both compress and encrypt data during a transmission, which will you do first?
Compress first (to reduce the size) and then encrypt. Encryption on more data will take more time.
2. TLS AND SSL, which one is more secure?
TLS is secure, as SSL is the predecessor of TLS.
3. What is Zeroday?
It is a time period between vulnerability/malware that has been identified but doesn’t have a fix signature yet.
4. Difference between VA and PT.
Vulnerability assessment is a process of identifying the vulnerabilities in a system or network.
Penetration Testing is one step ahead of identifying vulnerabilities and exploit it.
Learn more only at https://cybervie.com/
