Cyber Security Interview Questions for Penetration Testers, Red Team Engineers, SCO Analyst, Malware Researchers, Network Security Engineers and more. These are real questions faced by candidates in different domain interviews. These questions can help serious Job seekers and students alike who want to enter Cyber Security and clueless what might be asked in Interviews.

Different Cyber Security Job Roles - A look at different domains in Cyber Security, this is not perfect, but still can help to get some idea of different roles one might take in CYber Security Jobs

Cyber Security Jobs Tweet* Cyber Security Jobs

The Tweet above or the MindMap of different possible Cyber Security Job Roles will help me escape the Question - ” Why every question is not Offensive or Defensive only, I only want Pentesting Questions, or only SOC Analyst Questions.” Answer - ” Cyber Security is big domain and needs for different roles are different. “

Orginal Repository - https://github.com/abhinavkakku/Cyber_Security_Interview_Questions

Note-1: We will keep updating this page (Last updated : 02 November, 2k23), just started so don’t expect this to become encyclopedia yet. I have removed the answers bit for now, might be updated in future.

Note-2: Some questions can fall under more than one Category, forgive me for that, I will try not to repeat. Yet some questions that have very broad scope of follow-up questions maybe repeated ( as it gives context).

Basic Cyber Security Questions

Some basic questions that are very fundamental in nature, are directly or sometimes in-directly related to Cyber Security. These help establish some baseline, and everytime when one of these questions are asked, try to align the answer to Cyber Security. Also, when answering these, try not to miss the basic points, often the interviewer might want to hear some particular keyword, so dont rush on hearing a easy question, gather yourself and the answer and answer it.

  1. What is Cyber Kill Chain.
  2. How can you classfy the roles in Cyber Security ? What is your understanding of different job roles and functions that are part of Cyber Security ?
  3. What is the CIA triangle?
  4. What’s the difference between symmetric and asymmetric (public-key) cryptography?
  5. What are Ports in Computers, how many ports a computer has ?
  6. Why is deleted data not truly gone when you delete it?
  7. What is Encryption, Encoding, Hashing ?
  8. What is Salting (in context of Hashing), and why it is used ?
  9. Would you Encrypt and Compress or Compress and Encrypt ? Why ?
  10. What’s the difference between deep web and dark web?
  11. What is MITRE ATT&CK?
  12. Explain/differentiate Vulnerability and Exploit
  13. Explain Vulnerability, Threat and Risk.
  14. What is difference in VA and PT ?
  15. What is Diffrence Between Events, Alerts & Incidents ?
  16. What is APT Groups ( in Cyber Security Context ) ?
  17. Any experience on working with any Ticketing tools ?

Network Security Interview Questions

Questions around Networks and devices are important as this is very intrinsic part of any security setup. I will again repeat this - while the questions are very very basic, be prepared for follow up questions. These questions are just initiators, the actual question will the follow up question on which you will be judged.

  1. What is traceroute and how do you use it ?
  2. What is SSH ? on What port does SSH works ?
  3. Can you do SSH from Windows ?
  4. Why is DNS Monitoring Important ? What information can it reveal ?
  5. DNS Communication Happens on which port ?
  6. What is VPN?
  7. What is Proxy
  8. What is Difference in VPN and Proxy ?
  9. What is Forward Proxy and Reverse Proxy?
  10. What is a Load Balancer?
  11. What is CDN ?
  12. Can you explain man-in-the middle attack?
  13. Does HTTPS/SSL protects from Man-in-the-Middle Attack ?
  14. What is difference in IPS and IDS ? 1 What are different OSI Layers in Networking
  15. How is TCP/IP Layer Different from OSI Layers in Networking?
  16. Do you prefer filtered ports or closed ports on your firewall?
  17. What is a firewall? What are different types of Firewall ?
  18. How can you bypass firewall? or IDS ?
  19. What is Fragmentation attack ?
  20. How can Fragmentation be used as DoS Attack ? How can this be avoided or handled ?
  21. Mention few types of DoS Attacks .
  22. How do you distinguish between legitimate traffic and attack traffic during DDoS Attack ?
  23. Besides firewalls, what other devices are used to enforce network boundaries?
  24. What is a honeypot?
  25. What is the difference between an HIDS and a NIDS? Exmaples of both.
  26. What is worse in detection, a false negative or a false positive? And why?
  27. What is DDoS and DoS attack ?
  28. What do you understand by IP Subnetting ?
  29. Explain NAT (Network Address Translation) ?
  30. What is Port Forwarding ? and how/why it is used ?
  31. What is VLAN ?
  32. What Security Principle means a signed message came from the owner of key that signed it ? (non-repundiation, Integrity, authority, -non-verifiability)
  33. What is ARP Poisoning ?
  34. What is DNS Poisoning ?

Intermediate Level Questions

Now that you have answered some basic questions, lets level up a bit. These might not be very good, but keeping in mind to keep answer to the realm of Security, focus on security aspect when answering these.

  1. What is Three-way-Handshake ? Explain.
  2. How many packets are sent and received in 3-way handshake ?
  3. Explain BruteForce Attack . How do you detect it ?
  4. How can you prevent Brute Force attack ? Mention some methods.
  5. Have you heard of 2FA ? How 2FA protects users ? Is it possible to bypass 2FA with Phishing ?
  6. What is difference in SSL and TLS ?
  7. What is use of SSL ? How it protects ?
  8. How SSL Certificate Exchange happens ?
  9. What do you understand by DMZ and Non-DMZ ?
  10. What is Meta Data and how can you view it ? What Risk it causes ?
  11. Explain TCP and UDP . How they differ ?
  12. What is DNS ? How DNS Resolution happens ? Which Port is used for DNS ? is it over TCP or UDP ?
  13. What is DLP ? Heard of it ?
  14. What is Data Exfiltration ? Mention some methods of Data Exfiltration.
  15. How can you check for Data Exfiltration Activities ?
  16. Expect some questions on common ports and services, like SMB, DNS FTP, SSH, SMTP, HTTP, HTTPS, DHCP, questions based on some log analysis or directly can be asked, if you are observing too much traffic to/from on port 22, what steps you take ?
  17. How do you place a firewall, load balancer, proxy ? in what order and why ?
  18. What information can you get from MAC Address ?
  19. What port does PING works on ? ( I will change this Ping thing, too much resued now)
  20. Describe TCP Flow Control mechanism. (not potential question anymore, but know this)
  21. Describe packet loss recovery mechanism in TCP. (not potential question anymore, but know this)
  22. Explain how in Linux terminal can you confirm if it is a file or a directory ?
  23. Explain Redirections in Linux.
  24. What are pipes ? Explain named Pipe.

Red Teaming, Penetration Testing, Application Security Questions

When explaining any Vulnerability here, also try mentioning remidiation for the same, and more deep dive if follow up questions asked.

Note : Kindly dont pinpoint yet on hey this is patching or this is Application Security or This falls in Mobile PT or Red Teaming, the border lines between these bit blured, so questions cn fall in one or more categories.

Pentesting (Network/Endpoints)

Again, the questions here are not guessed, can be limitless, so just putting very basic ones. This does NOT pertains to like - Hey ! These are asked in Pentesting Interviews.

  1. How do you start about hacking a target ? What is Information Gathering, Enumeration ?
  2. What are phases of Network Penetration Testing ? (Cyber Kill Chain)
  3. What NMAP argument/flag in nmap tells about version ?
  4. What is difference in -v and -V in NMAP ?
  5. Can SQLi lead to RCE ?
  6. How do you erase tracks when hacked a machine ? consider it is linux.
  7. What is your opinion on Automated Pentesting ? vs Manual Pentesting ? Which one is better ?
  8. What is difference in Black-Box Pentesting vs White-Box Pentesting ?
  9. Any Purple Teaming Exercises done in past ? Explain.
  10. Have you done any Phishing assesments in past ?
  11. How can you bypass Antivirus Detection ? Explain.
  12. How does EDR works ? How to bypass EDR Detections ? Explain.
  13. What is Supply Chain Attack ?
  14. Compromising a local account is easier or an AD account ? (Windows Context)
  15. How would you do Data Exfiltration if you hacked a machine ?
  16. have you worked on Nessus / Qualys before ?
  17. Any open source alternative of Nessus or Qualys ?
  18. What do you prefer ? Vulnerbaility Assessment of a machine with Credentials or without Credentials ?
  19. What are things to consider before doing Pentesting or Vulnerability Assesment of a targt ?
  20. Would you place the machine (server example Nessus) within the same Network of machines which is being tested or seperate ?
  21. Why or Why not will you whitelist the Source machine of attack in Penetration Testing or Vulnerability Assesement ?
  22. How do you rate Vulnerability ? Eplain scoring system or frameworks.
  23. Name some tools you use in Network Pentesting.
  24. How do you report Vulnerability or Security Gaps after pentesting ? (Report Writing)
  25. Do you work often with patching teams to report and get patched the vulnrable software or fixing security gaps ?
  26. What are some HTTP Status codes you monitor during pentest ? Explain some interesting ones.
  27. What is a 0-Day (Zero-Day) attack ?
  28. What is Sub-Domain Takeover. Explain.
  29. How can you detect presence of a WAF ( Web Application Firewall),( and which one) ?
  30. What is C2 Server (Command and Control) ?
  31. Mention some SSL/TLS related Vulnerabilities.
  32. Have you come across any recent Data Breach, explain how it happened . (and IR Part : How we can protect against the same ?)
  33. How does NMAP determines the Operating System of the target ?
  34. What is difference in Pass-the-Hash and Pass-the-Ticket ?
  35. What is OAuth and SAML ? Explain.

Application Security

  1. Heard of OWASP ? What is it ? name some Vulnerabilities from OWASP-T10.
  2. What is Vulnerability Assesment, Pentesting , and Red teaming. Differences ?
  3. How do you handle Brute Forcing on your application ?
  4. What is Authentication and Authorization ?
  5. What is Steteful and Steteless in HTTP context ?
  6. How does HTTP handles state ?
  7. What is Cross Site Scripting ?
  8. What is difference in stored , reflected, and DOM XSS ?
  9. Which of the XSS attacks are hard to detetct and why ?
  10. What is the defense against XSS ? Remidiation.
  11. Do you prefer black-listing approach or whitelisting approach ? and Why ?
  12. What is CSRF ? Impact ? and Remidiation ?
  13. When investigating CSRF Attack , wat are the things you will look for ?
  14. Can you perform CSRF attack if HTTP method is PUT considering there is no CSRF Prevention, Explain?
  15. How do you determine if the Website is hosted on IIS or Apache or Nginix or whatever server stack ?
  16. What is SQL Injection ?
  17. Name some Types of SQL Injection Vulnerability.
  18. Explain Union Based SQL Injection.
  19. Explain Time Based SQL Injection.
  20. Explain Blind SQL Injection.
  21. How do you protect against SQLi ?
  22. What is Prepared Statements and Paramatrized Query ? (in Context of SQLi)
  23. What is 2nd-Order-SQLi ?
  24. How do you store password for applications in database ?
  25. What is RCE ? How do you test for RCE ? How can this bug be remidiated ?
  26. Explain OS Command Injection .
  27. What is CORS ? and SOP ?
  28. Does CORS protect against CSRF Attack ?
  29. Explain XXE ? What causes this flaw ? How do you mitigate it ?
  30. What are some Security headers in HTTP Request? Name some.
  31. Mention some HTTP Response Headers for Security ? Explain.
  32. What are various HTTP methods ?
  33. What is difference in GET POST and PUT Request ?
  34. What is CSP (Content Security Policy) ?
  35. Explain Race Condition ? How can you test for it ?
  36. Explain Cookie Attributes/Flags ? and Explain.
  37. What is Threat Modeling ?
  38. When do you interact with developers for security testing ?
  39. Are you aware of the Software Development Life Cycle ?
  40. When in SDLC should you engage with Developers ?
  41. What is CI/CD Pipeline ? Explain the role of this with the context of Security.
  42. Classify some Web Vulnerabilities into Low, Medium , High and Critical category. Reason why !
  43. Known that MD5 is not the most secured hasing Algorithm, Why we dont use SHA256 or others always ?
  44. Internet facing NGINIX is being used in front of multiple applications (micro service architecture). These application are accessible to users via different sub-domains through NGINIX, What can go Wrong ?
  45. Can server SSL Certificate prevent SSL Injection against your system ? Explain.
  46. An Attacker is trying to extract session cookie using XSS Vulnerability, but a blank popup is shown. What could be the reason for this behaviour ?
  47. Web Application allows user to download their account statement in DF format. How can you securely implement this functionality ? Explain.
  48. What is Threat Model / Threat Modeling ?
  49. What is STRIDE ?

Mobile Application Pentesting

  1. What are some common Risks in Mobile Applications ?
  2. Describe Programatic ways to detect if iOS or Android device is jailbroken or rooted.
  3. Can SMS be used as a medium to perform SQL Injection on Android Application. Explain ?
  4. Which tool is (mostly*) used to hook into iOS application
  5. Which protection mechanism is used for distributing Apple iOS Application on iTunes store?
  6. What are different Obfuscators used to Protect Mobile Apps ?
  7. What are different ways for Mobile Application to store and Protect sensative data in Android and iOS. Recomend best practices.
  8. Brief about the Security improvements in Recent (last 2) Android Releases.
  9. Mention different steps you would perform doing reverse engineering on an iOS Application downloaded from iTunes Store.
  10. Consider that you have decompiled a Android Application, made changes to the code and apk design, Will you be able to install this repacked APK on a newly formatted Android device ? Why ? or Not ?
  11. Provide ADB command with example to fetch APK file from Android Device.
  12. Can Adnroid malware App Extract sqlite file of another app? How? Why?or Not ? Explain with any assumptions made .
  13. Explain different approaches of bypassing SSL Pinning in Android and iOS Applications.

Cloud Pentesting or Security

  1. What are common Misconfigurations around AWS S3 bucket ?

SOC Analyst | Incident Response | DFIR

SOC Analysts can be Clark Kent (superman) touching multiple parts of tech, having a grip over some and idea of many helps many times. Also the questions in a basic SOC job can start from any section above or below and land to this part of page. I will try to keep it concise to the topic.

Note : SOC Analysts work around many different tech, so questions expect to judge the knowledge around some system, which can make response (or handling) around some Incident/Attack better.

Note-2 : Questions in SOC Analyst Role and Incident Response are expected to be asnwered with scenarios and response action, so cover all possible paths you can think of.

  1. How can you break password of BIOS on a locked machine. How to do same on Laptop ( expected follow-up).
  2. Where is password Stored in Windows Machines ?
  3. How can you read SAM File in Windows ? How does it stores passwords ?
  4. Mention some methods you crack Windows Password.
  5. Lets talk about Linux system passwords , where is it stored ? which hash it uses ?
  6. How can you detect malicious activity around both SAM and passwd/shadow file respectively ? ( say things you should be monitoring and how ?)
  7. What is Incident Response ?
  8. What is LifeCycle of a Incident Response Process ?
  9. What is SLA ?
  10. I hope you understand the Idea of P0, P1.2.3.4 Incidents ? Which one will you handle with priority ?
  11. What is IOC (Indicators of Compromise) and IOA (Indicators of Attack) ?
  12. How can you say if an email is Phishing or not ?
  13. What will you do if user reports to have phishing email ?
  14. You discover user clicked links in phishing email, also shared credentials. What actions will be taken by you ?
  15. SPM DKIM DMARC records are related to ?
  16. How can you determine if the email spam ? what is the action taken to arrest the spread of same if you have to act ?
  17. make a playbook for case of BEC ( Business Email Compromise ).
  18. When a user reports their machine is hacked , what are the things yu look for ?
  19. What are some malware persistence Techniques ?
  20. What is Process Injection ? Name some (sub)methods.
  21. Which one is more acceptable Sypware or PUP ?
  22. What would you prefer on your system ? Rootkit or Backdoor ?
  23. Why Ransomware is a buzz word ?
  24. How can you detect/confirm that you (organisation) has been hit (affected) by ransomware ? What are the indicators ?
  25. How do you respond to a Ransomware attack ?
  26. Have you worked on any EDR Tools before ? What makes EDR different from Antivirus ?
  27. How/Why would you classify a website as malicious ?
  28. What is drive-by-downloads ?
  29. Can website with Green-Lock (SSL) be dangerous ?
  30. You discover your Infrastructure / Application is under DDoS attack ? What will be your resonse plan ?
  31. How would you advise backup policy of critical data in infrastructure ?
  32. What are some interesting logs you can collect in Windows Environment ?
  33. What are different DNS Records ? Explain.
  34. Explain DNS Exfiltration. How to detect DNS Exfiltration ?
  35. Browser, Application and OS are Vulnerable, which one will you priotize to fix and why ?
  36. How can you do Network Packet Analysis ? (Wireshark)
  37. Can you do do Network Packet Analysis with Wireshark ? What all information can you get from this analysis ?
  38. Can you do Network backet Analysis of HTTPS (SSL Enabled) traffic with Wireshark ?
  39. What are the logs from a Linux machine you would pick for SIEM ?
  40. What is SIEM ? Its Use ? ( More SIEM based questions in a small section later on same page)
  41. Describe some Incident that you faced, and how you handled it ?
  42. How do you Investigate a suspicious Login alert for a business user email?
  43. What is difference in Credential Stuffing ? and password Spraying ? How do you detect these ?
  44. Make a use-case of Password Spraying attack.

Malware Anaysis

  1. What types of Malware Analysis are posible ?
  2. Explain Static Analysis and Dynamic Analysis of Malwares.
  3. What is difference in Process and Thread ?

Compliance Audit GRC and more.

  1. What s GDPR ? How does this affects you/us ?

Hontesly I have no-clue of this branch, but questions on compliance standards , something around ISO PCI and other standards will be expected, and also updated here. Soon* .

Opinion based questions or Scenario…

These questions are to know your views, and there is usually no right or wrong answer here. It is more of a discussion to know your opinions , the way you see the problem or solve it, there is/are always more approaches to solve the problem.

  1. Do you prefer Open-Source projects or proprietary ones ? and Why ?
  2. Geo-Blocking IP ranges is a good Idea ? Why or Why not ?
  3. Can you explain some recent security breaches or well-known attacks .
  4. Our data is exfiltrated and encrypted in a Ransomware attack we suffered from. Should we pay to attacker to get the key or data back ?

More questions based on some experience coming here soon. As Cyber Sec Interviews are mostly for one of the roles, so follow up questions and scenarios are limited in scope. But will share some.

Programming Automation Tools.

  1. Are you good at coding ? How good are you with programming ?
  2. What is the choice of Language ? Which one are you comfotable with ?
  3. Write code to fetch IP Address from a json file.
  4. Write code to fetch valid email address from json file, email address can have ( . _ numbers )
  5. Have you worked with Python Web Requests ? possibly parsing the response in desired format.
  6. Write program to do the Network Packet Analysis , maybe fetch the .exe or .elf payload data from Network data captured in PCAP file.
  7. Write a RegEx to filter websites / URL / URL with Queries / Email Address / IP Address / Phone Number (10-digits)
  8. (Bash) - replace all occurance of string - string_1 with string_1_1 in text file.
  9. You have a source file of program and want to maintain as such - every parenthesis open and close have exactly 1 whitespace after and before, where white space is not present add it, where extra white-space, remove extra and keep one. How do you programatically solve this ?
  10. Write a script to find out if a list of web pages is live or not.
  11. Write script to list all files that contain the word - ‘yyy’ .
  12. Can you grep for line matches with two words - ‘sss’ , ‘ttt’ .

More questions based on some projects and required coming here soon.

Cryptography

  1. What’s the difference between symmetric and asymmetric (public-key) cryptography? (repeated)
  2. How do you differentiate Encryption / Hashing/ Encoding ?
  3. Mention one instance of failure you noticed cryptography is used incorrectly.

Random Questions

These are totally random questions, makes less sense to judge on ( personal Opinion* ), but just for the sake of interaction sometimes you can hear these. I hope people dont represent the Illuminati view here, and be moderate or balanced in answering.

  1. Security is fast moving field. How do you keep yourself updated.
  2. What is your understanding of Insider Threats ? how to detect ?
  3. Social Media websites such as Instagram and Linkedin are ok to use at workplace ? Why ? or not ?
  4. iOS is more secure compared to Android ?
  5. Are you a Linux user or Windows ? Which is more secure ? Why you think so ?
  6. What is Dark Web, and how is it different compared to Deep Web ?

I want this section to be short, but for this, I wont keep any questions with me.