Cybersecurity Interview Questions and Answers

Zero Trust is a security model based on the principle "never trust, always verify". No user, device or network location is trusted by default, even inside the corporate perimeter.

Core principles (NIST SP 800-207):

• Verify explicitly – authenticate and authorise every request using identity, device health, location and behaviour.
• Least privilege access – grant just-in-time and just-enough access.
• Assume breach – segment access, encrypt end to end and monitor continuously to limit blast radius.

Building blocks: strong identity (SSO + phishing-resistant MFA), device posture checks, Zero Trust Network Access (ZTNA) instead of flat VPN access, microsegmentation, continuous monitoring and policy engines that evaluate every session.

MITRE ATT&CK is a publicly available knowledge base of adversary tactics (the *why*, such as Initial Access, Persistence, Privilege Escalation, Lateral Movement, Exfiltration) and techniques (the *how*, such as T1566 Phishing or T1003 OS Credential Dumping), based on real-world observations.

Practical uses:

• Detection engineering – map SIEM and EDR rules to techniques to find coverage gaps.
• Threat hunting – build hypotheses around techniques used by threat groups relevant to your industry.
• Red and purple teaming – emulate specific adversary behaviours and validate detections.
• Incident reporting – describe attacker behaviour in a common language.

Related models: the Lockheed Martin Cyber Kill Chain and MITRE D3FEND (defensive countermeasures).

In the cloud, security responsibilities are split between the provider and the customer:

• Provider – security *of* the cloud: physical data centres, hardware, hypervisor, global network.
• Customer – security *in* the cloud: data, identities, access policies, configuration, application code and (for IaaS) the guest operating system and patches.

Most cloud breaches come from customer-side misconfigurations, such as public storage buckets, over-permissive IAM roles or exposed access keys.

• Identity first – enforce SSO and MFA, remove long-lived access keys, use roles and workload identities, apply least privilege and review permissions regularly.
• Guardrails – organisation-level policies (AWS SCPs, Azure Policy, GCP Organization Policies) to block risky actions such as disabling logging or creating public buckets.
• Logging and detection – CloudTrail / Azure Activity Log / Cloud Audit Logs centralised to a SIEM; enable native threat detection (GuardDuty, Defender for Cloud, Security Command Center).
• Posture management – CSPM tools to continuously detect misconfigurations against CIS Benchmarks.
• Data protection – encryption at rest with KMS-managed keys, TLS in transit, private endpoints instead of public exposure.
• Network – private subnets, security groups with minimal rules, WAF in front of public applications.
• Infrastructure as Code scanning – check Terraform or CloudFormation templates before deployment.

Monitoring is reactive: analysts respond to alerts generated by rules. Threat hunting is proactive: analysts assume an attacker may already be inside and search for evidence that existing detections missed.

A typical hypothesis-driven hunt:

1. Form a hypothesis, e.g. "An attacker is using scheduled tasks for persistence" (ATT&CK T1053).
2. Identify data sources: EDR process telemetry, Windows event ID 4698, Sysmon logs.
3. Query and analyse: look for scheduled tasks created by unusual parents or pointing to user-writable paths.
4. Investigate findings and escalate confirmed incidents.
5. Convert successful hunts into automated detection rules.

Active Directory is a prime target because compromising it gives control of the whole Windows estate.

• Pass-the-Hash – reusing an NTLM hash to authenticate without the password. Defence: LAPS for unique local admin passwords, Credential Guard, restricting admin logons.
• Kerberoasting – requesting service tickets for accounts with SPNs and cracking them offline. Defence: long random passwords or gMSAs for service accounts, AES encryption, monitoring event 4769 anomalies.
• AS-REP Roasting – targeting accounts without Kerberos pre-authentication. Defence: enforce pre-authentication.
• Golden Ticket – forging TGTs using the krbtgt hash. Defence: protect domain controllers, rotate krbtgt twice after compromise.
• DCSync – abusing replication rights to pull password hashes. Defence: restrict replication permissions and alert on replication from non-DC hosts.

Tiered administration (separating Tier 0 domain admins from workstation admins) is the strategic defence.

Security Orchestration, Automation and Response (SOAR) platforms connect security tools and automate repetitive workflows through playbooks.

Example phishing playbook:

1. User reports an email.
2. SOAR extracts URLs, attachments and sender details.
3. It enriches them with threat intelligence and sandbox detonation.
4. If malicious, it searches all mailboxes for the same email, deletes it, blocks the sender and URL, and opens a ticket.
5. An analyst reviews and closes.

Benefits: faster mean time to respond (MTTR), consistent handling, reduced alert fatigue. Examples: Splunk SOAR, Palo Alto Cortex XSOAR, Microsoft Sentinel playbooks (Logic Apps).

DevSecOps embeds security throughout the software delivery lifecycle instead of testing at the end ("shift left").

Pipeline controls:

• Pre-commit – secret scanning (e.g. Gitleaks), IDE security plugins.
• Build – SAST (static analysis such as SonarQube, Semgrep), SCA (dependency scanning such as Snyk, Dependabot) and SBOM generation.
• Test – DAST (dynamic scanning such as OWASP ZAP, Burp Suite) against staging.
• Deploy – IaC scanning (Checkov, tfsec), container image scanning (Trivy), signed artefacts.
• Run – runtime protection, WAF, cloud posture monitoring.

Quality gates should fail the build only for high-confidence, high-severity findings, otherwise developers start ignoring the tools.

A mature programme uses several of these, because each misses things the others catch.

1. Identify assets – systems, data and processes, and their business value.
2. Identify threats and vulnerabilities – using threat intelligence, vulnerability scans and architecture reviews.
3. Analyse likelihood and impact – qualitatively (high/medium/low heat map) or quantitatively (e.g. annualised loss expectancy: ALE = SLE × ARO).
4. Evaluate and prioritise – compare against the organisation's risk appetite.
5. Treat – mitigate (add controls), transfer (insurance, outsourcing), avoid (stop the activity) or accept (with documented sign-off).
6. Monitor and review – maintain a risk register and reassess periodically.

Frameworks: ISO/IEC 27005, NIST SP 800-30, FAIR for quantitative analysis.

• ISO/IEC 27001 – international standard for an Information Security Management System (ISMS), with Annex A controls; organisations can be certified.
• NIST Cybersecurity Framework 2.0 – functions: Govern, Identify, Protect, Detect, Respond, Recover.
• CIS Controls – prioritised, practical set of safeguards.
• PCI DSS – mandatory for organisations handling payment card data.
• SOC 2 – audit report on controls for service organisations (security, availability, confidentiality, processing integrity, privacy).
• GDPR and India's Digital Personal Data Protection (DPDP) Act, 2023 – privacy and personal data protection laws.
• CERT-In directions (2022) – Indian organisations must report specified cyber incidents to CERT-In within 6 hours and retain logs for 180 days.

Privilege escalation is gaining higher permissions than originally granted.

• Vertical – a normal user gains admin or root rights (e.g. exploiting a vulnerable SUID binary, unquoted service paths, a kernel exploit or misconfigured sudo rules).
• Horizontal – a user accesses another user's data at the same privilege level (e.g. changing an ID in a URL – an IDOR flaw).

Prevention: timely patching, least privilege, removing local admin rights, Privileged Access Management (PAM) with just-in-time elevation and session recording, secure service configurations and server-side authorisation checks on every request.

Modern ransomware is usually human-operated and follows a pattern:

1. Initial access – phishing, exposed RDP/VPN with weak credentials, or exploited internet-facing vulnerabilities.
2. Discovery and credential theft – tools like Mimikatz, AD enumeration.
3. Lateral movement – PsExec, RDP, WMI.
4. Data exfiltration – for double extortion.
5. Backup destruction – deleting shadow copies and targeting backup servers.
6. Encryption – often pushed domain-wide via Group Policy.

Defences: MFA on all remote access, patching internet-facing systems, EDR with tamper protection, least privilege and tiered admin, network segmentation, immutable and offline backups with tested restores, and an incident response plan rehearsed through tabletop exercises.

A supply chain attack compromises a trusted third party (software vendor, library, managed service provider) to reach its customers. Examples include the SolarWinds Orion compromise, the 3CX desktop app compromise and the XZ Utils backdoor attempt.

Defences: vendor risk assessments, SBOMs and dependency scanning, pinning and verifying package signatures, least privilege for vendor tools and accounts, network monitoring for unusual outbound connections from trusted software, and segmenting third-party access.

• Order of volatility – collect the most volatile evidence first: CPU registers and cache, memory (RAM), network connections, running processes, disk, then logs and backups.
• Chain of custody – document who handled evidence, when and how.
• Integrity – create forensic images with write blockers and verify them with hashes (e.g. SHA-256).
• Work on copies – never analyse the original evidence.
• Tools – FTK Imager, Autopsy, Volatility (memory analysis), KAPE, Velociraptor.

Avoid powering off a compromised machine before capturing memory; you may lose encryption keys, injected code and network artefacts.