What should you focus on for a cybersecurity interview?
Which topics make these interviews different?
Network security, threat detection, and incident response appeared more often in these cybersecurity interviews than across all interviews. So did web and application security, identity and access management, and vulnerability management. Mid-level and senior-level questions were more common than junior-level questions.
Use those topics to check your range. Can you explain authentication and authorization? Can you describe how you would check an alert, manage a firewall change, and verify a security fix? The questions cover both concepts and work tasks.
Can you explain which vulnerabilities to fix first?
Vulnerability prioritization was the most repeated question, appearing in 9 of 103 interviews. It asks you to weigh severity, exploitability, threat intelligence, and asset criticality when some information is missing.
- Can you explain how each factor affects which vulnerability you would fix first?
- Can you say how you would make that decision with incomplete information?
- Can you describe what should be ready before technicians install a patch, including a plan to roll it back?
- Can you explain how you would verify that Nessus findings were fixed?
Can you work through a firewall access request?
Start by checking whether you can explain the difference between a switch, a router, and a firewall. Then work through the access request itself.
What information would you gather before opening a port for a customer or vendor? After the customer approves access, what should happen before the change? How would you verify the result afterward? Check that your answer covers both preparation and verification, not only the change itself.
Can you investigate an alert without assuming it is an attack?
The failed-logins-then-success scenario appeared in 6 of 103 interviews. Can you explain how you would investigate that sequence?
Also check whether you can distinguish a real security alert from a false positive, including legitimate administrator activity. Can you explain what MITRE ATT&CK is and how you would use it in defensive security work?
Can you handle customer reviews and coding tasks?
Can you say what you would cover in a monthly customer security review?
Writing code was part of 3 of 103 interviews. Check whether you can write Pass-the-Hash detection logic or a function that finds command-injection indicators in request logs. For feature flags, can you handle attribute matching, a default fallback, and a null value? Can you name test cases for input handling?
What Cybersecurity interviews cover
The 20 most asked Cybersecurity questions
Counted by interview, not by mention: a question asked twice in one conversation counts once.
How do you prioritize vulnerabilities using severity, exploitability, threat intelligence, asset criticality, and incomplete information?
Asked in 9 of 103 interviews · last asked Oct 13 · Scenario · Senior
Show answer
I prioritize by likely harm and likelihood of attack, not CVSS alone. I weigh severity, exploitability, threat intelligence, asset importance, exposure, and existing protections. Active exploitation on an exposed, critical system usually comes first. When information is missing, I use cautious assumptions, confirm key facts quickly, and update priorities as evidence improves.
- CVSS describes technical severity, but does not capture your full business risk.
- Confirmed exploitation is stronger evidence of urgency than public exploit code alone.
- A lower-severity flaw can come first if it threatens sensitive data or essential services.
- Use temporary protections when patching must wait, and verify that they reduce the risk.
What the interviewer checks: The interviewer checks whether you combine technical evidence, business impact, and uncertainty instead of ranking findings by score alone.
Other ways it was asked
- “Would you always patch the highest CVSS finding first?”
- “Would you always patch the highest-CVSS finding first?”
- “You have several vulnerabilities to address. How do you decide which ones should come first?”
What is the difference between a switch, a router, and a firewall?
Asked in 6 of 103 interviews · last asked Oct 13 · Concept · Junior
Show answer
A switch connects devices within a local network and usually forwards data using MAC addresses. A router connects different networks and forwards packets using IP addresses. A firewall allows or blocks traffic based on security rules. One device can perform more than one of these roles.
- Switches usually work at Layer 2; Layer 3 switches can also route traffic.
- Routers choose paths between IP networks.
- Firewalls control traffic between or within networks; they can also run on individual computers.
What the interviewer checks: The interviewer is checking whether you can distinguish local connections, routing between networks, and traffic filtering.
Other ways it was asked
- “What distinguishes a switch from a router?”
- “How would you explain the difference between a switch, a router, and a firewall?”
- “Can you tell me the difference between a switch and a router?”
What information would you gather before opening a firewall port for a customer or vendor?
Asked in 6 of 103 interviews · last asked Oct 13 · Scenario · Mid-level
Show answer
I would ask for the business reason, source and destination IP addresses, port, protocol, and connection direction. I would confirm which system needs access, who approves it, and how long access is needed. I would also check authentication, data sensitivity, and whether a safer option, such as a VPN, could meet the need.
- Confirm which side starts the connection and whether NAT changes the addresses used in the rule.
- Limit access to the required sources, destinations, ports, and time period.
- Confirm the system owner’s approval and the vendor’s authentication method.
- Agree on logging, testing, rollback, and removal when access is no longer needed.
What the interviewer checks: The interviewer is checking whether you gather enough detail to allow only necessary, approved access.
Other ways it was asked
- “A vendor needs access to a customer system. What would you ask before opening a firewall port?”
- “A customer wants a port opened. What information do you need?”
- “A vendor needs access to a customer system. What information would you gather before deciding whether to open a firewall port?”
You notice repeated failed logins followed by a successful one. How would you investigate?
Asked in 6 of 103 interviews · last asked Oct 12 · Scenario · Mid-level
Show answer
I would compare the failed and successful logins for the account, time, source IP, device, and MFA results. I would check activity after the login and contact the account owner through a trusted channel. Failed attempts alone do not prove an attack. If the login was unauthorized, I would preserve logs, restrict access, revoke sessions, and reset compromised credentials.
- Check whether failures targeted one account or many accounts.
- Compare the login with normal activity; a shared IP does not prove the same person.
- Review MFA changes, new permissions, and unusual data access after the login.
- If unauthorized, follow the incident response process and check for other affected accounts.
What the interviewer checks: The interviewer is checking whether you can separate user mistakes from an attack and respond safely to confirmed compromise.
Other ways it was asked
- “A string of failed logins ends in a successful login. What would you investigate?”
- “You see failed logins followed by a successful login. What would you investigate?”
- “You noticed several failed sign-ins followed by a successful one. How would you determine whether something suspicious happened?”
What is the MITRE ATT&CK framework, and how would you use it to support defensive cyber operations?
Asked in 5 of 103 interviews · last asked Oct 9 · Concept · Mid-level
Show answer
MITRE ATT&CK is a knowledge base of attacker tactics and techniques based on real observations. Tactics describe attacker goals, while techniques describe how attackers reach them. I use it to map observed activity, guide threat hunting, and find gaps in logging and detection. I also use it to plan tests of our defenses.
- Map incident evidence to techniques to guide further investigation.
- Prioritize techniques used by threats relevant to your organization.
- Test whether your logs and alerts can detect those techniques.
- ATT&CK is not a fixed attack sequence or proof of who attacked.
What the interviewer checks: The interviewer wants to see whether you can use ATT&CK to guide investigations and improve defenses.
Other ways it was asked
- “Can you explain MITRE ATT&CK and how it works?”
- “What is the MITRE ATT&CK framework?”
- “How do MITRE ATT&CK and the cyber kill chain help you investigate security incidents?”
What would you cover in a monthly customer security review?
Asked in 5 of 103 interviews · last asked Oct 12 · Scenario · Senior
Show answer
I would cover the customer’s main security risks, recent incidents, and progress on agreed actions. I would review important vulnerabilities, security control gaps, and trends against agreed service targets. I would explain the business impact, then agree on priorities, owners, deadlines, and any decisions needed from the customer.
- Focus on risks to the customer’s critical systems and business goals.
- Summarize incidents, lessons learned, and repeat issues.
- Show meaningful trends and overdue actions, not just alert counts.
- End with clear next steps, owners, deadlines, and decisions.
What the interviewer checks: The interviewer is checking whether you can turn security findings into clear customer priorities and actions.
Other ways it was asked
- “What would you present at the monthly customer security meeting?”
- “When preparing a monthly customer security review, what should you prioritize?”
After a customer approves a vendor's firewall access, what should happen before the change, and how would you verify it afterward?
Asked in 4 of 103 interviews · last asked Oct 12 · Scenario · Mid-level
Show answer
Before changing the firewall, I would follow the change process, confirm the exact access needed, and prepare a backup, rollback plan, and agreed change window. Afterward, I would test the vendor connection, check firewall logs, and confirm unrelated traffic still works. I would record the results, get customer confirmation, and close the change ticket.
- Use a change ticket and obtain any required internal approval before implementation.
- Limit access to required source and destination addresses, ports, and protocols; set an expiry for temporary access.
- Test from the vendor side and confirm traffic outside the approved scope remains blocked.
- Keep test evidence and the updated configuration with the change record.
What the interviewer checks: The interviewer is checking whether you can turn customer approval into a controlled, tested, and documented firewall change.
Other ways it was asked
- “After a customer approves a vendor connection to its environment, what must happen before changing the firewall?”
- “Once a firewall change for vendor access is authorized, how do you verify it worked and close out the change?”
- “After a customer approves a firewall port change for vendor access, what steps should happen before the change, and how would you verify and close it out?”
What should be ready before technicians install a security patch?
Asked in 4 of 103 interviews · last asked Oct 12 · Scenario · Mid-level
Show answer
Before technicians install a security patch, I would have test results, verified backups, a rollback plan, and an approved maintenance window ready. I would confirm the patch comes from a trusted source and applies to the affected systems. I would also notify users and prepare checks to confirm the patch worked without breaking services.
- Test the patch for compatibility before deploying it to production.
- Verify backups and prepare recovery steps if the patch cannot be uninstalled.
- Approve the change and schedule any downtime with affected users.
- Define post-install checks for patch status and service health.
What the interviewer checks: The interviewer is checking whether you can plan a safe patch rollout and recover if it fails.
Other ways it was asked
- “What would you want in place before technicians start installing a security patch?”
- “What needs to be ready before a technician performs a security patch?”
How would you verify that remediation of Nessus findings was successful?
Asked in 4 of 103 interviews · last asked Oct 13 · Tooling · Mid-level
Show answer
I would apply the patch or configuration fix, then rescan the affected systems with Nessus using the same relevant checks. I would confirm the systems were reachable and authentication succeeded where required. Before closing the findings, I would review the new results and verify the patched version or setting on each system.
- Use current plugins and confirm the affected hosts, ports, and relevant checks are included.
- A missing finding is not proof of a fix if scanning or authentication failed.
- Check installed patches or settings directly, including any required restart.
- Record verification evidence before closing findings; document accepted risks separately.
What the interviewer checks: The interviewer is checking whether you verify both the fix and scan coverage before closing a finding.
Other ways it was asked
- “How do you verify that remediation of Nessus findings was successful?”
- “How would you verify that vulnerabilities identified by a Nessus scan have been remediated?”
- “In Nessus, how would you remediate a vulnerability finding and verify that the fix worked?”
How do you distinguish a true security alert from a false positive, including legitimate administrator activity?
Asked in 4 of 103 interviews · last asked Oct 9 · Scenario · Senior
Show answer
I check the alert against logs, normal activity, and the rule that triggered it. For administrator activity, I verify the approved task, timing, source device, and actions with the owner. I look for signs of account misuse before deciding it is harmless. If evidence is incomplete, I keep investigating rather than close the alert.
- Compare logs from several sources to confirm what happened and build a timeline.
- An administrator account or familiar tool does not prove the activity is safe.
- Match actions to an approved change; check for behavior outside its scope.
- Record the evidence and distinguish harmless activity from a rule that detected the wrong thing.
What the interviewer checks: The interviewer wants to see evidence-based judgment without dismissing attacks that use administrator accounts.
Other ways it was asked
- “When investigating a high-severity alert, how do you distinguish between a true positive and a complex false positive caused by administrative behavior?”
- “Can you describe a recent situation where you had to investigate a high-severity alert? What was your approach to distinguishing a true positive from a false positive?”
- “How do you distinguish a real security finding from a false positive during an assessment?”
What's the difference between encryption and hashing?
Asked in 3 of 103 interviews · last asked Oct 12 · Concept · Junior
Show answer
Encryption protects data by turning it into unreadable text that can be decrypted with the right key. Hashing creates a fixed-length value from data and is designed to be one-way. Use encryption when you need to recover the original data. Use hashing to check data integrity or, with a suitable password-hashing algorithm, verify passwords.
- Encryption is reversible with the right key; hashing has no decryption step.
- Different inputs can produce the same hash, but secure hashes make such collisions hard to find.
- Store passwords using a salted, slow password-hashing algorithm, such as Argon2id, not ordinary fast hashing.
What the interviewer checks: The interviewer checks whether you understand reversibility and can choose the right method for protecting data or verifying passwords.
Other ways it was asked
- “What is the difference between hashing and encryption?”
How does the TLS handshake establish a secure connection between a browser and a server?
Asked in 3 of 103 interviews · last asked Oct 13 · Concept · Junior
Show answer
The browser and server agree on a TLS version and encryption settings. The browser checks the server's certificate to verify its identity. In a typical TLS 1.3 handshake, they exchange key shares and derive shared secret keys. They verify the handshake with Finished messages, then use symmetric encryption to protect application data.
- Certificate checks include the hostname, validity period, and a chain to a trusted certificate authority.
- Shared secret keys are derived locally, not sent across the network.
- TLS protects data from being read or changed during transit.
- TLS 1.2 uses different handshake flows; session resumption can avoid a full certificate exchange.
What the interviewer checks: The interviewer checks whether you understand server authentication, key agreement, and how TLS protects data.
Other ways it was asked
- “How does a browser establish a secure connection?”
- “How does the TLS handshake work?”
- “What do you know about the TLS handshake model?”
The update has been installed, but a critical service is down. What would you do?
Asked in 3 of 103 interviews · last asked Oct 12 · Scenario · Mid-level
Show answer
I would treat this as an incident, assess the impact, and notify the service owner and incident team. I would check service status, logs, dependencies, and update changes. I would restore service through a safe restart, failover, or approved rollback, then test recovery and investigate the cause.
- Follow the incident process and keep affected teams informed.
- Check evidence before assuming the update caused the outage.
- If rollback removes a security fix, use temporary controls to reduce exposure.
- Confirm recovery with health checks and a real user workflow.
What the interviewer checks: The interviewer is checking whether you can restore a critical service safely while managing security risk and communication.
Other ways it was asked
- “A security update has finished installing, but the service is down. What would you do next?”
- “The updates are installed, but a critical service is down. What do you do?”
How do you test SQL injection?
Asked in 3 of 103 interviews · last asked Oct 1 · Scenario · Mid-level
Show answer
I test for SQL injection by checking whether input can change a database query, within an approved scope. I test parameters, forms, headers, and cookies with controlled inputs, then compare responses, errors, and timing. I check error-based, UNION-based, and blind injection using database-specific tests, without changing or exposing real data.
- Compare normal requests with test requests; one error or slow response is not proof.
- Blind tests use true-or-false conditions or controlled delays when query results are hidden.
- UNION-based tests check whether another query’s results can appear in the response.
- Confirm scanner findings manually and use harmless test data.
What the interviewer checks: The interviewer wants to see a safe, systematic approach and an understanding of the main SQL injection types.
Other ways it was asked
- “How do you manually test an application for SQL injection?”
- “What types of SQL injection do you test?”
How would you investigate a phishing email?
Asked in 3 of 103 interviews · last asked Sep 28 · Scenario · Mid-level
Show answer
I would preserve the email and inspect its headers, sender, links, and attachments safely. I would check mail logs, email authentication, and domain reputation using approved tools. I would verify unusual requests through a trusted channel. If malicious, I would find other recipients, quarantine the message, and check for clicks or stolen credentials.
- Compare sender, Reply-To, and link domains for mismatches or lookalike names.
- Check SPF, DKIM, and DMARC results; passing authentication does not prove an email is safe.
- Phishing uses deception to cause harmful actions; spam is unwanted bulk email, not necessarily phishing.
- Use approved sandboxes for suspicious files or links; do not upload sensitive emails to public scanners.
What the interviewer checks: The interviewer is checking whether you investigate safely, weigh evidence, and assess the impact before taking action.
Other ways it was asked
- “How would you determine whether the email was phishing or a legitimate message?”
- “How would you distinguish a phishing email from spam or a legitimate message?”
- “How can phishing emails be identified?”
One of the promised changes depends on field services, and they can't meet the expected date. How would you handle that?
Asked in 3 of 103 interviews · last asked Oct 12 · Scenario · Senior
Show answer
I would confirm the blocker with field services and agree on a realistic delivery date. I would assess the security risk and find a temporary safeguard or another delivery option. I would tell affected stakeholders early, explain the impact, and get agreement on the revised plan. I would track progress with a named owner.
- Confirm the cause, dependencies, and earliest realistic delivery date.
- Reduce exposure with temporary safeguards while the change is delayed.
- Escalate unacceptable risk or a fixed deadline to the responsible decision-maker.
- Agree on owners, milestones, and regular updates.
What the interviewer checks: The interviewer is checking whether you manage dependencies, security risk, and expectations without blaming another team.
Other ways it was asked
- “One of the promised security changes depends on field services, and they cannot meet the expected date. How would you handle that?”
- “A promised security change depends on field services, but they cannot meet the expected date. How would you handle the delay?”
Can you explain the CIA triad in detail?
Asked in 2 of 103 interviews · last asked Jul 16 · Concept · Junior
Show answer
The CIA triad means confidentiality, integrity, and availability. Confidentiality means only authorized people or systems can access information. Integrity means information stays accurate and is protected from unauthorized changes. Availability means authorized users can access information and systems when needed.
- Confidentiality controls include access permissions and encryption.
- Integrity controls include change permissions, digital signatures, and checks against trusted hashes.
- Availability controls include backups, redundant systems, and tested recovery plans.
- Controls must balance all three goals; strict access rules should not block legitimate work.
What the interviewer checks: The interviewer checks whether you can explain each goal, connect it to security controls, and recognize trade-offs.
Other ways it was asked
- “Can you describe your understanding of the CIA triad in cybersecurity?”
What is the difference between HTTP and HTTPS?
Asked in 2 of 103 interviews · last asked Aug 20 · Concept · Junior
Show answer
HTTP sends web requests and responses without encryption. HTTPS is HTTP protected by TLS, which encrypts traffic, detects changes in transit, and verifies the server’s identity through a certificate. HTTPS protects the connection, but it does not guarantee that a website is safe or honest.
- HTTP uses port 80 by default; HTTPS uses port 443 by default.
- TLS protects data from being read or changed in transit.
- Certificate checks help confirm that you connected to the intended server.
What the interviewer checks: The interviewer is checking whether you understand encryption, data integrity, and server identity checks.
What is a VPN, and what is it used for?
Asked in 2 of 103 interviews · last asked Aug 20 · Concept · Junior
Show answer
A VPN, or virtual private network, creates a secure connection over a shared network such as the internet. It usually encrypts traffic between your device and a VPN gateway. It is used to access company systems remotely, connect office networks, or protect traffic on public Wi-Fi.
- Encryption protects traffic within the VPN tunnel, not necessarily beyond its endpoint.
- Remote-access VPNs connect users; site-to-site VPNs connect networks.
- Only traffic routed through the VPN uses its tunnel.
- A VPN does not guarantee anonymity or protect against malware.
What the interviewer checks: The interviewer checks whether you understand VPN tunnels, common uses, and protection limits.
Other ways it was asked
- “What is a VPN, and how does it work?”
What is the TCP three-way handshake?
Asked in 2 of 103 interviews · last asked Jul 16 · Concept · Junior
Show answer
The TCP three-way handshake establishes a TCP connection between a client and a server. The client sends SYN, the server replies with SYN-ACK, and the client sends ACK. This exchange sets up sequence numbers so both sides can track data and confirms that they can communicate in both directions.
- SYN starts the connection and carries the client's initial sequence number.
- SYN-ACK acknowledges the client's SYN and carries the server's initial sequence number.
- The final ACK acknowledges the server's SYN.
- The handshake does not encrypt traffic or verify identities.
What the interviewer checks: The interviewer is checking whether you know the handshake steps and why TCP needs them.
Other ways it was asked
- “Can you explain the TCP three-way handshake?”
Cybersecurity fundamentals interview questions
Start with core security ideas, operating systems, databases, programming basics, command-line tools, and everyday troubleshooting. 75 questions.
What is the difference between a primary key and a unique constraint?
Asked once · last asked Jun 20 · Concept · Junior
Other ways it was asked
- “What is the difference between a primary key and a unique key?”
What is Redis, and how would you use it in an application?
Asked once · last asked Jul 16 · Tooling · Junior
Other ways it was asked
- “What is Redis, and how is it used in networked applications?”
How many NULL values are allowed in a unique-key column?
Asked once · last asked Jun 20 · Concept · Mid-level
What is the difference between risk, threat, and vulnerability? How do you define each of them?
Asked once · last asked Jun 8 · Concept · Junior
What is your understanding of networking fundamentals, including TCP/IP, DNS, VPNs, and firewalls, and of operating system security on Linux and/or Windows?
Asked once · last asked Jun 16 · Concept · Junior
How do you implement data loss prevention (DLP) controls to prevent data from leaving an organization?
Asked once · last asked Jun 16 · Scenario · Mid-level
What are the different normalization forms, and can you give an example?
Asked once · last asked Jun 20 · Concept · Mid-level
What Linux command can you use to find which process is occupying a port?
Asked once · last asked Jun 20 · Tooling · Junior
How would you find all files modified in the last seven days in a particular directory?
Asked once · last asked Jun 20 · Tooling · Junior
In Windows, what command shows which process is listening on a specific port, and what options would you use to show the process and port?
Asked once · last asked Jun 26 · Tooling · Mid-level
Where do you find the Windows logs for the Network Policy Server (NPS) service?
Asked once · last asked Jun 26 · Tooling · Mid-level
What are utilities such as mshta.exe, PowerShell, and Command Prompt commonly called when attackers abuse them?
Asked once · last asked Jul 27 · Concept · Mid-level
Show 7 more
What is the main risk associated with these LOLBins?
Asked once · last asked Jul 27 · Concept · Mid-level
What defenses are effective against ClickFix attacks?
Asked once · last asked Jul 27 · Scenario · Mid-level
What is an advanced persistent threat (APT), and how does it differ from a typical attacker?
Asked once · last asked Jul 27 · Concept · Mid-level
How would you troubleshoot a user's email when it isn't working?
Asked once · last asked Aug 4 · Scenario
What do hackers do in a ransomware attack?
Asked once · last asked Aug 11 · Concept · Junior
An application that was working yesterday can no longer reach an API. How would you troubleshoot the issue?
Asked once · last asked Aug 19 · Scenario · Mid-level
Does deleting a file from the desktop permanently erase it, or can it still be recovered?
Asked once · last asked Aug 20 · Concept · Junior
Network security interview questions
These questions cover networks, protocols, firewalls, VPNs, segmentation, packet analysis, zero trust, and SASE. 102 questions.
What is RDP used for?
Asked in 2 of 103 interviews · last asked Sep 29 · Concept · Junior
Other ways it was asked
- “What is RDP, and what is it used for?”
What is the difference between a VLAN and a subnet?
Asked once · last asked Jun 20 · Concept · Mid-level
What happens on the networking side when you type a URL into a browser?
Asked once · last asked Jun 20 · Concept · Mid-level
What solution components would you include when designing a zero-trust architecture?
Asked once · last asked Aug 6 · Design · Senior
Other ways it was asked
- “Where would you start when designing a zero-trust architecture, and what would be the first solution component?”
How would you determine how many ViPNet coordinators an organization needs?
Asked once · last asked Aug 20 · Scenario · Mid-level
Other ways it was asked
- “How many ViPNet coordinators would an organization need?”
- “How does the number of employees affect the number of ViPNet coordinators an organization needs?”
- “How would you estimate the cost of a ViPNet coordinator?”
When an Ethernet frame arrives at a switch, what does the switch examine to decide which port to forward it through?
Asked once · last asked Jan 29 · Concept · Junior
When a device sends a frame through a new switch and the destination is unknown, what does the switch do?
Asked once · last asked Jan 29 · Scenario · Junior
How can devices in two different VLANs communicate with each other?
Asked once · last asked Jan 29 · Concept · Mid-level
Other ways it was asked
- “If the switch is Layer 2 only, how can devices in different VLANs communicate?”
How would you use Nmap to check whether an HTTP service is running on a particular IP address?
Asked once · last asked Apr 30 · Tooling · Junior
How does a router or firewall block traffic, and how does it protect the network?
Asked once · last asked Jun 8 · Concept · Junior
What factors do you consider when configuring and segmenting an office network, and how does network size affect your approach?
Asked once · last asked Jun 16 · Scenario · Mid-level
What happens if the final acknowledgment in the three-way handshake gets lost?
Asked once · last asked Jun 20 · Scenario · Mid-level
Show 2 more
How would Wireshark help identify ARP spoofing on a network?
Asked once · last asked Jun 20 · Tooling · Mid-level
What is the difference between a stateful and a stateless firewall?
Asked once · last asked Jun 20 · Concept · Mid-level
IAM, cryptography and PKI interview questions
Work through authentication, authorization, Active Directory attacks and defenses, encryption, TLS, certificates, and key management. 111 questions.
What is a pass-the-ticket attack in Kerberos?
Asked in 2 of 103 interviews · last asked Jul 27 · Concept · Senior
Other ways it was asked
- “Can you give me examples of ticket-based attacks in Kerberos?”
How do you manage and improve the certificate lifecycle, including issuance, renewal, revocation, and validation?
Asked in 2 of 103 interviews · last asked Oct 20 · Behavioral · Senior
Other ways it was asked
- “Describe a project or lab in which you set up or improved certificate lifecycle management. What was the outcome?”
- “Describe a project where you managed the end-to-end certificate lifecycle and the outcomes you produced.”
- “How do you manage the certificate lifecycle, including issuance, renewal, revocation, and validation?”
Can you explain Kerberoasting and how to remediate it?
Asked in 2 of 103 interviews · last asked Sep 30 · Concept · Senior
Other ways it was asked
- “What is Kerberoasting, and how does the attack work?”
How would you design and manage Microsoft AD CS or another PKI platform?
Asked in 2 of 103 interviews · last asked Oct 20 · Tooling · Mid-level
Other ways it was asked
- “What tasks are involved in managing Microsoft Active Directory Certificate Services or another PKI platform?”
- “Describe a project where you designed or managed Microsoft ADCS. What components and challenges did you handle?”
What’s the difference between authentication and authorization?
Asked in 2 of 103 interviews · last asked Jul 27 · Concept · Junior
Other ways it was asked
- “Do you know the difference between authentication and authorization?”
- “What is the difference between authentication and authorization?”
Could you decrypt a password hash?
Asked in 2 of 103 interviews · last asked Oct 12 · Concept · Junior
What might an attacker with access to Active Directory and a domain controller do to encrypt an organization's infrastructure?
Asked once · last asked Sep 21 · Scenario · Mid-level
Other ways it was asked
- “What could an attacker do with access to an Active Directory domain controller?”
- “What tools might an attacker use to encrypt an organization's infrastructure after gaining access to Active Directory?”
What weakness in NTLM can make an NTLM relay attack possible?
Asked once · last asked Jun 5 · Concept · Senior
Other ways it was asked
- “What conditions determine whether an NTLM relay attack succeeds?”
- “How can an NTLM relay attack lead to privilege escalation?”
Tell me about a challenging certificate or PKI issue you resolved and how you diagnosed and fixed it.
Asked once · last asked Oct 1 · Behavioral · Senior
Other ways it was asked
- “Tell me about a certificate or PKI incident you resolved and what you did to fix it.”
- “Tell me about a difficult challenge involving cryptographic key management or certificates and how you handled it.”
How would you keep CRLs available during an issuing CA outage, and what implementation steps would you take?
Asked once · last asked Oct 20 · Scenario · Senior
Other ways it was asked
- “What infrastructure and steps did you implement to keep CRLs available during a CA outage?”
What is the difference between a dictionary attack and a brute-force attack?
Asked once · last asked Mar 26 · Concept · Junior
How do you assess the complexity of an environment when implementing role-based access control (RBAC)?
Asked once · last asked Mar 26 · Scenario · Mid-level
Show 6 more
How would you identify applications that connect to SharePoint without multifactor authentication?
Asked once · last asked Apr 3 · Scenario · Mid-level
What is the difference between Kerberos and NTLM authentication?
Asked once · last asked May 8 · Concept · Mid-level
What is the difference between silver tickets and golden tickets?
Asked once · last asked May 8 · Concept · Senior
What are certificate exploitation attacks in an Active Directory environment?
Asked once · last asked May 8 · Concept · Senior
What is a “store now, decrypt later” attack, and why is it called that?
Asked once · last asked May 8 · Concept · Senior
Beyond future advances in decryption capability, what other risks are associated with store-now, decrypt-later attacks?
Asked once · last asked May 8 · Concept · Senior
Vulnerability management and patching interview questions
The focus is on checking scanner findings, choosing fixes by risk, preparing patches, rolling back changes, and measuring results. 40 questions.
What is virtual patching, and when would you use it?
Asked once · last asked May 8 · Concept · Mid-level
If you have a backlog of thousands or even 100,000 vulnerabilities, how would you prioritize them and rescore them beyond using CVSS alone?
Asked once · last asked May 8 · Scenario · Senior
What approaches combine data from multiple security tools to prioritize vulnerabilities by risk?
Asked once · last asked May 8 · Concept · Mid-level
How do you handle a situation where your automated scanner is being blocked or throttled by an IPS or WAF?
Asked once · last asked May 23 · Scenario · Senior
How would you investigate and resolve a mismatch between a scanner's findings and the actual access controls?
Asked once · last asked Jul 9 · Behavioral · Senior
Other ways it was asked
- “Can you provide an example of a time when you discovered a mismatch between a scanner's findings and the actual access controls? What steps did you take to resolve it?”
Could you describe a challenging vulnerability assessment you conducted and how you addressed it?
Asked once · last asked Jul 20 · Behavioral · Mid-level
How would you approach system hardening and patching?
Asked once · last asked Aug 4 · Behavioral · Mid-level
Other ways it was asked
- “How have you approached system hardening and patching in your work?”
If you discover a known exploit affecting a firewall you manage, how would you patch it, test the change, and proceed?
Asked once · last asked Aug 19 · Scenario · Senior
What factors can make vulnerability assessment findings noisy or difficult to analyze?
Asked once · last asked Sep 2 · Concept · Mid-level
How would you clean and prioritize noisy vulnerability assessment findings?
Asked once · last asked Sep 2 · Scenario · Mid-level
How do you define asset criticality in your vulnerability prioritization process?
Asked once · last asked Sep 3 · Concept · Mid-level
Other ways it was asked
- “How do you define asset criticality rating (ACR)?”
When you perform vulnerability assessments, there will be a lot of false positives. How do you identify those false positives?
Asked once · last asked Sep 3 · Scenario · Mid-level
Show 4 more
Can you tell me about a time when you really took ownership of a vulnerability remediation process end to end?
Asked once · last asked Sep 7 · Behavioral · Mid-level
How do you coordinate with IT administrators and operations teams to deploy patches while minimizing disruption to systems and users?
Asked once · last asked Sep 7 · Scenario · Mid-level
How would you investigate a complex vulnerability, identify its root cause, and validate that your fix worked?
Asked once · last asked Sep 7 · Behavioral · Senior
Other ways it was asked
- “Can you zoom in on one specific case you handled? Describe a complex vulnerability you encountered, walk through the troubleshooting steps you took, explain the root cause, and how you validated that your fix worked.”
How would you automate vulnerability fixes and configuration changes, and measure the improvements?
Asked once · last asked Sep 7 · Tooling · Mid-level
Other ways it was asked
- “What tools or scripts have you used to automate vulnerability remediation, and can you give me an example where your automation noticeably improved efficiency?”
- “How can PowerShell or similar scripts be used to deploy vulnerability fixes or configuration changes rather than only report issues?”
Penetration testing and application security interview questions
Explore ethical testing, reconnaissance, exploitation, web and memory vulnerabilities, attack chains, checking fixes, and reporting findings. 112 questions.
What is penetration testing?
Asked in 2 of 103 interviews · last asked Aug 11 · Concept · Junior
Other ways it was asked
- “What activities are typically involved in penetration testing?”
What is the root cause of a buffer overflow vulnerability?
Asked in 2 of 103 interviews · last asked May 8 · Concept · Mid-level
Other ways it was asked
- “What is a buffer overflow?”
How do you test for CSRF when the content type is JSON?
Asked once · last asked May 27 · Scenario · Mid-level
Other ways it was asked
- “How do you test for CSRF?”
Can a page read the response data of an image loaded from another origin through an `<img>` element?
Asked once · last asked Oct 1 · Concept · Junior
Does an image loaded through an `<img>` element from another origin load, or is it blocked?
Asked once · last asked Oct 1 · Concept · Junior
Other ways it was asked
- “Does an image loaded through an `<img>` element from another origin load without CORS headers, or is it blocked?”
How do you use Metasploit?
Asked once · last asked Oct 13 · Tooling · Mid-level
Other ways it was asked
- “Why do we use Metasploit?”
In an authorized security assessment, how might you gain initial access to a Windows domain machine and then identify ways to escalate privileges?
Asked once · last asked Jan 29 · Scenario · Senior
How do you approach ethical considerations when conducting penetration tests, especially to ensure no harm is done to the systems under test?
Asked once · last asked Feb 21 · Scenario · Mid-level
What information, such as network resources or login IDs, can an attacker obtain through network scanning, and how might it be used?
Asked once · last asked Mar 25 · Concept · Mid-level
Can you give an overview of any attack or attack chain you’ve attempted or completed on an internal or external network, including anything interesting, novel, or that you learned from? A CTF or lab example is fine.
Asked once · last asked Apr 9 · Behavioral · Mid-level
How do you communicate penetration test findings to clients during a report readout?
Asked once · last asked Apr 9 · Behavioral · Mid-level
If you discover a vulnerability during a penetration test, is there any situation in which you would choose not to attempt to exploit or prove it?
Asked once · last asked Apr 9 · Scenario · Mid-level
Show 7 more
What vulnerabilities do you most commonly find on internet-accessible, external-facing websites?
Asked once · last asked Apr 22 · Concept · Mid-level
What threats do you think are more critical for an external-facing website?
Asked once · last asked Apr 22 · Scenario · Mid-level
From a highly technical standpoint, how does a buffer overflow attack work?
Asked once · last asked May 8 · Concept · Senior
Why can code write past the buffer’s bounds?
Asked once · last asked May 8 · Concept · Mid-level
What technical challenges can arise when reproducing a VLC buffer overflow in a lab?
Asked once · last asked May 8 · Scenario · Senior
How would you develop an exploit, validate that it works, and decide whether to create a custom exploit or use an existing one?
Asked once · last asked May 8 · Scenario · Senior
What does a shell payload do in an exploit, and how can it provide access to a target system?
Asked once · last asked May 8 · Concept · Mid-level
Cloud security, DevSecOps and AI security interview questions
Questions cover secure cloud and application design, access controls, containers, CI/CD pipelines, software supply chains, and AI application risks. 89 questions.
How would you design a CI/CD pipeline?
Asked once · last asked Aug 24 · Design · Mid-level
Other ways it was asked
- “What stages would you include in a CI/CD pipeline?”
What would you recommend if an application team needs to expose an RDS database publicly?
Asked once · last asked Aug 13 · Scenario · Senior
Other ways it was asked
- “An application team needs to expose an RDS database publicly. What would you recommend to reduce the risk?”
How would you design an electronic voting system so the final result accurately reflects the votes cast, each vote remains confidential, no partial results are accessible, and only authorized voters can vote once?
Asked once · last asked Dec 4 · Design · Senior
Other ways it was asked
- “How would you ensure the confidentiality of votes in an electronic voting system?”
What AI threats and risks should adversarial testing assess?
Asked once · last asked Sep 10 · Concept · Senior
Other ways it was asked
- “Which AI cybersecurity risks should an adversarial testing harness detect, and how would you test for them?”
What's your approach to mitigating risks like prompt injection in AI applications?
Asked once · last asked Apr 6 · Scenario · Senior
When you're working with AI integrations like external AI APIs or a vector database for retrieval, how do you usually assess the security risks in those parts of the system?
Asked once · last asked Apr 6 · Scenario · Senior
How would you add or change security tooling in a CI/CD pipeline?
Asked once · last asked Apr 6 · Behavioral · Mid-level
Other ways it was asked
- “Can you give a concrete example of a time you added or changed security tooling in a CI/CD pipeline and walk me through what you did?”
Beyond port scanning or reading local files, what could an attacker do by exploiting SSRF in a cloud-hosted application?
Asked once · last asked May 14 · Scenario · Senior
Why might an attacker use an HTTP PUT request when exploiting SSRF against a cloud instance metadata service?
Asked once · last asked May 14 · Scenario · Senior
After gaining a shell in a container by executing a command through a web application, what would you do next?
Asked once · last asked May 14 · Scenario · Senior
After gaining control of a Kubernetes pod during a penetration test, what post-exploitation steps would you consider?
Asked once · last asked May 14 · Scenario · Senior
What techniques could an attacker use to gain control of a Kubernetes pod and escape its container?
Asked once · last asked May 14 · Scenario · Senior
Show 8 more
How did the SolarWinds attack compromise the software supply chain?
Asked once · last asked Jun 5 · Concept · Senior
What recent methods have threat actors used in supply-chain attacks?
Asked once · last asked Jun 5 · Concept · Senior
What recent attacks have involved GitHub or software-package ecosystems, and what methods did they use?
Asked once · last asked Jun 5 · Concept · Senior
If an open-source library or Python package were compromised, what controls and detections would you use?
Asked once · last asked Jun 5 · Scenario · Senior
How would you control applications that automatically pull the latest package versions during a build?
Asked once · last asked Jun 5 · Scenario · Senior
In a large environment, such as one with 50,000 employees, would version-locking dependencies be sufficient, or are you aware of other security controls?
Asked once · last asked Jun 5 · Scenario · Senior
How would you secure AWS and GCP infrastructure and APIs handling high-volume financial data for a fintech or crypto SaaS platform?
Asked once · last asked Jun 15 · Scenario · Senior
How would you implement a strict zero-trust identity and access management strategy in a new AWS environment?
Asked once · last asked Jun 16 · Scenario · Senior
SOC, detection engineering and threat hunting interview questions
Test your understanding of SIEM queries, alert checks, threat intelligence, detection rules, ATT&CK mapping, purple-team exercises, and security automation. 117 questions.
Can you describe a brute-force attack and how you typically detect one?
Asked in 2 of 103 interviews · last asked Sep 29 · Scenario · Mid-level
Other ways it was asked
- “What is a brute-force attack?”
How would you automate purple-team activities?
Asked once · last asked Jun 5 · Scenario · Senior
Other ways it was asked
- “How would you automate purple-team activities if you could not fund new tools or agents?”
How do you exclude administrator activity from a security detection?
Asked once · last asked Oct 6 · Scenario · Mid-level
Other ways it was asked
- “How did you exclude administrator activity from a security detection?”
When would you use Splunk's `tstats` command instead of a raw search?
Asked once · last asked Oct 6 · Tooling · Mid-level
Other ways it was asked
- “What is the difference between using Splunk's `tstats` command and a raw search such as `index=...`?”
How would you build and evaluate an AI-based URL detector for phishing emails, including measuring its accuracy?
Asked once · last asked Mar 26 · Scenario · Mid-level
How do you create and optimize queries in Kusto Query Language (KQL)?
Asked once · last asked Apr 10 · Tooling · Senior
How would you design a Microsoft Sentinel playbook for automated threat response?
Asked once · last asked Apr 10 · Behavioral · Senior
Other ways it was asked
- “Can you describe a situation where you designed a Microsoft Sentinel playbook for automated threat response?”
What challenges would you face before deploying and monitoring a web application intrusion detection system?
Asked once · last asked Apr 22 · Scenario · Senior
How would you set up monitoring and alerts, and what components would you put in front of the web application server to help secure it?
Asked once · last asked Apr 22 · Scenario · Senior
How would you use threat intelligence sources to help an organization detect, contain, or defend against an attack?
Asked once · last asked Apr 22 · Behavioral · Mid-level
Other ways it was asked
- “Tell me about a time a threat intelligence source helped your organization detect, contain, or defend against an attack.”
In an environment where Splunk, CloudWatch, and CloudTrail collect logs, but Splunk has only default dashboards and reports and nobody actively reviews the data, how would you guide the team in establishing defensive cyber operations?
Asked once · last asked Apr 24 · Scenario · Senior
Other ways it was asked
- “Given a hypothetical environment where Splunk, CloudWatch, and CloudTrail collect logs, but Splunk has only default dashboards and reports and no one is actively reviewing the data, how would you recommend they begin implementing defensive cyber operations, and how would you guide the team?”
How should a defensive cyber operations team account for indicators of compromise (IOCs) in its monitoring and response processes?
Asked once · last asked Apr 24 · Scenario · Senior
Show 6 more
How would you tune a security detection rule to reduce false-positive alerts?
Asked once · last asked May 8 · Scenario · Mid-level
How do you handle alerts in Splunk? Explain how you determine whether an alert is a false positive, what steps you take to reduce false alerts, and how you handle a true positive and notify stakeholders about a security breach.
Asked once · last asked May 13 · Scenario · Mid-level
Suppose I try to log in to my system 10 times in one minute using the wrong password. Is that a brute-force attack?
Asked once · last asked May 13 · Scenario · Mid-level
Other ways it was asked
- “Given that an account locks after five incorrect password attempts, if I keep trying and make 20 failed attempts in one minute, would you consider that a brute-force attack?”
If I try to log in to my system 10 times in one minute using the wrong password, is that a true positive or a false positive?
Asked once · last asked May 13 · Scenario · Mid-level
How would you test a Snort rule to verify that it triggers?
Asked once · last asked May 13 · Tooling · Mid-level
Other ways it was asked
- “What are the components of a Snort rule, and how do its rule options determine when it triggers?”
What network traffic and system evidence would you examine when investigating a Snort alert?
Asked once · last asked May 13 · Scenario · Mid-level
Other ways it was asked
- “When analyzing a Snort alert, what can the triggering traffic and its source tell you?”
- “What system and network evidence should you examine after a Snort signature is generated?”
Incident response and digital forensics interview questions
Follow incident investigations through triage, phishing analysis, containment, recovery, digital evidence, and improvements to response playbooks. 73 questions.
How would you investigate a true-positive security alert?
Asked once · last asked Jul 27 · Behavioral · Senior
Other ways it was asked
- “Tell me about a recent true-positive security alert you handled and how you investigated it.”
- “Tell me about a recent true-positive security alert you handled, and map your actions to the incident response lifecycle.”
How would you respond to a DDoS attack?
Asked once · last asked Aug 24 · Scenario · Mid-level
What would you do if a Linux server ran a script every 30 minutes that sent data to an unknown IP address hosted on DigitalOcean?
Asked once · last asked Sep 21 · Scenario · Junior
Other ways it was asked
- “What might it indicate if a Linux server runs a script every 30 minutes that sends data to an unknown IP address?”
How would you determine whether multiple users were accessing the same PiKVM device?
Asked once · last asked Oct 9 · Scenario · Mid-level
Other ways it was asked
- “What indicators could show that multiple users were accessing the same PiKVM device?”
How would you triage a security detection involving a PiKVM device?
Asked once · last asked Oct 9 · Scenario · Mid-level
Other ways it was asked
- “How would you contribute to triaging a security detection involving a PiKVM device?”
What steps or tools would you add to address gaps and strengthen an incident response process?
Asked once · last asked Feb 21 · Scenario · Mid-level
What additional steps or details would make an incident response playbook more effective for handling a ransomware attack on Windows-based file servers?
Asked once · last asked Feb 21 · Scenario · Mid-level
What is the Volatility Framework, and how is it used in memory forensics?
Asked once · last asked Mar 26 · Tooling · Mid-level
How would you use Microsoft Defender for Identity to conduct threat investigations?
Asked once · last asked Apr 10 · Tooling · Mid-level
Other ways it was asked
- “How have you used Microsoft Defender for Identity to conduct threat investigations?”
How do you manage security incident-response controls in Microsoft Defender tenant settings?
Asked once · last asked Apr 10 · Tooling · Senior
What files or artifacts might a penetration test leave behind that could help a defender understand what happened?
Asked once · last asked May 13 · Concept · Mid-level
What artifacts can forensic triage tools collect or leave behind on a system?
Asked once · last asked May 13 · Concept · Mid-level
Show 6 more
What are Windows ShellBags, and how can they help in a forensic investigation?
Asked once · last asked May 13 · Concept · Mid-level
What areas of the registry would you look at for persistence?
Asked once · last asked May 13 · Scenario · Mid-level
How would you investigate remote connections between Windows workstations, and which event logs would you check?
Asked once · last asked May 13 · Scenario · Mid-level
Other ways it was asked
- “How would you use Windows event logs to identify remote sessions?”
- “How would you determine whether someone had remotely connected from one workstation to another?”
What would indicate to you that an incident involves an advanced persistent threat versus a common opportunistic attacker?
Asked once · last asked May 26 · Concept · Senior
When investigating an active intrusion, what factors influence the decision to let it play out for intelligence versus containing it immediately?
Asked once · last asked May 26 · Scenario · Senior
How would you respond to a security incident, and can you walk us through your incident response process?
Asked once · last asked Jun 11 · Scenario · Mid-level
Cybersecurity governance, risk and behavioral interview questions
Prepare to discuss security programs, policies, privacy rules, audits, tool choices, customer reviews, communication, and times you took ownership. 73 questions.
Can you explain ISO 27001?
Asked in 2 of 103 interviews · last asked Oct 8 · Concept · Junior
Other ways it was asked
- “What is ISO 27001, and what does it cover?”
What is Russia's Federal Law 152-FZ about?
Asked in 2 of 103 interviews · last asked Aug 20 · Concept · Junior
Other ways it was asked
- “What is Russian Federal Law No. 149-FZ?”
If a company has reported no security incidents or breaches in the past two years, is that a good sign or a bad sign?
Asked once · last asked Mar 12 · Scenario · Mid-level
Other ways it was asked
- “Why might having no reported security incidents or breaches over two years be a good sign?”
Tell me about an actual time when you not only met a goal but considerably exceeded expectations. How did you do it, and what challenges did you overcome?
Asked once · last asked Aug 24 · Behavioral
What do you think is the biggest trade-off for security—that is, what do you usually have to sacrifice to gain a certain level of security?
Asked once · last asked Mar 12 · Concept · Mid-level
If City A has very few reported crimes and City B has around 100 reported crimes per day, which city can you say is safer?
Asked once · last asked Mar 12 · Scenario · Mid-level
What cyber risk do you perceive for a large, top-tier financial institution, and what steps would you take to remediate it?
Asked once · last asked Apr 9 · Scenario · Senior
If the team isn't making progress and you identify an opportunity to introduce a process or solution that could improve value or reduce a problem, how would you get the team's and stakeholders' buy-in and present the change?
Asked once · last asked Apr 24 · Scenario · Senior
If you receive and analyze a brute-force alert and determine it is a false positive, what steps would you take to communicate this to the user or relevant stakeholders?
Asked once · last asked May 13 · Scenario · Mid-level
What are the key components of a security policy, and why are they important?
Asked once · last asked Jun 11 · Concept · Mid-level
How do you communicate security risks to an IT head without significantly slowing down projects?
Asked once · last asked Jun 15 · Scenario · Senior
A new sister company is launching, and you need to establish its information security program from scratch. What would your 30-, 60-, and 90-day roadmap be?
Asked once · last asked Jun 15 · Scenario · Senior
Show 6 more
In a brand-new setup, how would you select and implement security tools such as EDR, DLP, SIEM, and firewalls to ensure comprehensive coverage without overpurchasing?
Asked once · last asked Jun 15 · Scenario · Senior
How would you balance transparency and innovation in generative AI and blockchain with data privacy regulations?
Asked once · last asked Jun 15 · Scenario · Senior
Other ways it was asked
- “How would you balance data privacy regulations with transparency and generative AI and blockchain innovation?”
During an audit or rapid development phase, security policies can slow developers down. How do you handle conflicts between security compliance and engineering speed?
Asked once · last asked Jun 15 · Scenario · Senior
Tell me about a time you had to manage a critical technical failure or suspected security breach. How did you handle the response and communication?
Asked once · last asked Jun 15 · Behavioral · Senior
How would you implement and maintain security controls, policies, and procedures?
Asked once · last asked Jun 16 · Behavioral · Mid-level
Other ways it was asked
- “How have you contributed to implementing and maintaining security controls, policies, and procedures in previous roles?”
How do you prepare for and manage internal and external regulatory audits throughout the year?
Asked once · last asked Jun 16 · Scenario · Mid-level
Related interview questions
- DevOps Engineer interview questions
- Cloud Engineer interview questions
- Network Engineer interview questions
- System Administrator interview questions
- IT Support and Help Desk interview questions
How this list is made
Every question here was asked by a real interviewer in a real job interview that a candidate ran MeetAssist in. After the call, the interviewer's questions are pulled from the transcript. Practice sessions, tests, exams and anything that was not a job interview are dropped.
Questions are rewritten so they make sense on their own: names of people, employers and clients are removed, and speech-to-text mistakes are fixed. Small talk, logistics and questions about one candidate's own résumé are left out. Rephrasings of the same question are merged, and the count is the number of different interviews it came up in.
The interviews come from candidates who use MeetAssist, so they lean towards software, data and AI roles: the shares describe these interviews, not every Cybersecurity interview. Answers to the most asked questions are written and checked by an editor; a "common mistake" is shown only when reviews of real answers in these interviews show it, with the count.
103 interviews, 54 candidates, Dec 2025 to Oct 2026. Updated every month with new interviews.
Or add the Chrome extension