- What is the CIA triad in cybersecurity?
– Answer: The CIA triad stands for Confidentiality, Integrity, and Availability. It is a fundamental framework used to evaluate and improve information security policies.
- What is the difference between symmetric and asymmetric encryption?
– Answer: Symmetric encryption uses the same key for both encryption and decryption, while asymmetric encryption uses a pair of keys – public and private keys – for encryption and decryption respectively.
- What is a firewall and how does it work?
– Answer: A firewall is a network security device that monitors and controls incoming and outgoing network traffic based on predetermined security rules. It acts as a barrier between a trusted internal network and an untrusted external network.
- What is a DoS (Denial of Service) attack?
– Answer: A DoS attack is an attempt to disrupt the normal functioning of a targeted server, service, or network by overwhelming it with a flood of illegitimate traffic, rendering it inaccessible to legitimate users.
- What is the principle of least privilege?
– Answer: The principle of least privilege states that users should only be granted the minimum level of access or permissions necessary to perform their job functions or tasks.
- What is a vulnerability assessment?
– Answer: A vulnerability assessment is the process of identifying, quantifying, and prioritizing vulnerabilities in a system, network, or application.
- What is the difference between a vulnerability assessment and a penetration test?
– Answer: A vulnerability assessment identifies and prioritizes vulnerabilities, while a penetration test attempts to exploit those vulnerabilities to assess the security posture of a system or network.
- What is multi-factor authentication (MFA)?
– Answer: Multi-factor authentication is a security mechanism that requires users to provide two or more forms of authentication factors (such as passwords, biometric verification, smart cards) to gain access to a system or application.
- What is a SQL injection attack?
– Answer: A SQL injection attack is a type of injection attack where an attacker inserts malicious SQL queries into input fields of a web application to manipulate the database or gain unauthorized access to data.
- What is encryption and why is it important in cybersecurity?
– Answer: Encryption is the process of encoding information in such a way that only authorized parties can access it. It is important in cybersecurity because it helps protect sensitive data from unauthorized access or interception.
- What is a phishing attack?
– Answer: A phishing attack is a type of cyber-attack where attackers impersonate legitimate entities (such as banks, companies, or government agencies) to trick individuals into providing sensitive information, such as passwords or financial data.
- What is the role of an Intrusion Detection System (IDS)?
– Answer: An Intrusion Detection System (IDS) is a security tool that monitors network or system activities for malicious activities or policy violations and generates alerts or takes actions to mitigate threats.
- What is a zero-day vulnerability?
– Answer: A zero-day vulnerability is a previously unknown security vulnerability in software or hardware that is actively exploited by attackers before the vendor releases a patch or fix.
- What is the concept of defence in depth?
– Answer: Défense in depth is a cybersecurity strategy that employs multiple layers of security controls (such as firewalls, antivirus software, intrusion detection systems) to protect valuable assets and data.
- What is the difference between black-box and white-box testing?
– Answer: Black-box testing is a testing approach where testers have no knowledge of the internal workings of the system being tested, while white-box testing is a testing approach where testers have full knowledge of the internal workings of the system.
- What is the OWASP Top 10?
– Answer: The OWASP Top 10 is a list of the top 10 most critical security risks to web applications, as identified by the Open Web Application Security Project (OWASP).
- What is ransomware?
– Answer: Ransomware is a type of malicious software that encrypts files or locks down systems, demanding payment (usually in cryptocurrency) from the victim in exchange for decryption keys or to unlock the system.
- What is a security incident?
– Answer: A security incident is any event that compromises the confidentiality, integrity, or availability of information or information systems.
- What is the role of a Security Information and Event Management (SIEM) system?
– Answer: A Security Information and Event Management (SIEM) system is a security tool that aggregates, correlates, and analyses log data from various sources to identify and respond to security threats.
- What is the difference between a vulnerability and an exploit?
– Answer: A vulnerability is a weakness or flaw in a system or application that could be exploited by attackers, while an exploit is a piece of software or code that takes advantage of a vulnerability to carry out an attack.
- What is network segmentation and why is it important?
– Answer: Network segmentation is the process of dividing a computer network into smaller subnetworks to improve security and performance. It is important because it helps contain breaches and limit the impact of potential security incidents.
- What is Secure Sockets Layer (SSL) and Transport Layer Security (TLS)?
– Answer: SSL and TLS are cryptographic protocols that provide secure communication over a computer network. They are commonly used to secure web traffic (HTTPS), email, and other applications.
- What is a Man-in-the-Middle (MitM) attack?
– Answer: A Man-in-the-Middle (MitM) attack is a type of cyber-attack where an attacker intercepts and potentially alters communication between two parties without their knowledge.
- What is the principle of non-repudiation?
– Answer: The principle of non-repudiation ensures that a party cannot deny the validity of a digital signature or a message that they have sent.
- What is the concept of least common mechanism?
– Answer: The concept of least common mechanism states that shared mechanisms or components between different security domains should be minimized to reduce the potential impact of security breaches.
- What is a botnet?
– Answer: A botnet is a network of compromised computers or devices controlled by a central command and control server, typically used to carry out coordinated cyber-attacks or malicious activities.
- What is a Distributed Denial of Service (DDoS) attack?
– Answer: A Distributed Denial of Service (DDoS) attack is a type of DoS attack where multiple compromised systems are used to launch a coordinated attack against a single target, overwhelming it with traffic.
- What is the principle of separation of duties?
– Answer: The principle of separation of duties ensures that no single individual has complete control over all aspects of a critical process or system, reducing the risk of fraud or errors.
- What is endpoint security?
– Answer: Endpoint security refers to the protection of individual devices or endpoints (such as laptops, desktops, mobile devices) from cyber threats and unauthorized access.
- What is the difference between a vulnerability scanner and a port scanner?
– Answer: A vulnerability scanner identifies and prioritizes vulnerabilities in systems or networks, while a port scanner identifies open ports and services running on a target system.
- What is the concept of defence in depth?
– Answer: defence in depth is a cybersecurity strategy that employs multiple layers of security controls (such as firewalls, antivirus software, intrusion detection systems) to protect valuable assets and data.
- What is the difference between black-box and white-box testing?
– Answer: Black-box testing is a testing approach where testers have no knowledge of the internal workings of the system being tested, while white-box testing is a testing approach where testers have full knowledge of the internal workings of the system.
- What is the OWASP Top 10?
– Answer: The OWASP Top 10 is a list of the top 10 most critical security risks to web applications, as identified by the Open Web Application Security Project (OWASP).
- What is ransomware?
– Answer: Ransomware is a type of malicious software that encrypts files or locks down systems, demanding payment (usually in cryptocurrency) from the victim in exchange for decryption keys or to unlock the system.
- What is a security incident?
– Answer: A security incident is any event that compromises the confidentiality, integrity, or availability of information or information systems.
- What is the role of a Security Information and Event Management (SIEM) system?
– Answer: A Security Information and Event Management (SIEM) system is a security tool that aggregates, correlates, and analyses log data from various sources to identify and respond to security threats.
- What is the difference between a vulnerability and an exploit?
– Answer: A vulnerability is a weakness or flaw in a system or application that could be exploited by attackers, while an exploit is a piece of software or code that takes advantage of a vulnerability to carry out an attack.
- What is network segmentation and why is it important?
– Answer: Network segmentation is the process of dividing a computer network into smaller subnetworks to improve security and performance. It is important because it helps contain breaches and limit the impact of potential security incidents.
- What is Secure Sockets Layer (SSL) and Transport Layer Security (TLS)?
– Answer: SSL and TLS are cryptographic protocols that provide secure communication over a computer network. They are commonly used to secure web traffic (HTTPS), email, and other applications.
- What is a Man-in-the-Middle (MitM) attack?
– Answer: A Man-in-the-Middle (MitM) attack is a type of cyber-attack where an attacker intercepts and potentially alters communication between two parties without their knowledge.
- What is the principle of non-repudiation?
– Answer: The principle of non-repudiation ensures that a party cannot deny the validity of a digital signature or a message that they have sent.
- What is the concept of least common mechanism?
– Answer: The concept of least common mechanism states that shared mechanisms or components between different security domains should be minimized to reduce the potential impact of security breaches.
- What is a botnet?
– Answer: A botnet is a network of compromised computers or devices controlled by a central command and control server, typically used to carry out coordinated cyber-attacks or malicious activities.
- What is a Distributed Denial of Service (DDoS) attack?
– Answer: A Distributed Denial of Service (DDoS) attack is a type of DoS attack where multiple compromised systems are used to launch a coordinated attack against a single target, overwhelming it with traffic.
- What is the principle of separation of duties?
– Answer: The principle of separation of duties ensures that no single individual has complete control over all aspects of a critical process or system, reducing the risk of fraud or errors.
- What is endpoint security?
– Answer: Endpoint security refers to the protection of individual devices or endpoints (such as laptops, desktops, mobile devices) from cyber threats and unauthorized access.
- What is the difference between a vulnerability scanner and a port scanner?
– Answer: A vulnerability scanner identifies and prioritizes vulnerabilities in systems or networks, while a port scanner identifies open ports and services running on a target system.
- What is the role of cryptography in cybersecurity?
– Answer: Cryptography is used in cybersecurity to secure communication, protect data confidentiality, ensure data integrity, and authenticate users or systems.
- What is a buffer overflow attack?
– Answer: A buffer overflow attack is a type of security vulnerability where an attacker sends more data to a program or process than it can handle, causing it to overwrite adjacent memory locations and potentially execute malicious code.
- What is a security policy?
– Answer: A security policy is a formal document that outlines an organization’s rules, guidelines, and procedures for protecting its information assets and managing security risks.
- What is a security token?
– Answer: A security token is a physical device or software application that generates one-time passwords or authentication codes for multi-factor authentication purposes.
- What is a digital certificate?
– Answer: A digital certificate is a cryptographic credential used to verify the identity of an entity (such as a person, organization, or website) and establish secure communication over a network.
- What is an intrusion prevention system (IPS)?
– Answer: An intrusion prevention system (IPS) is a security tool that monitors network or system activities for malicious behaviour or policy violations and takes proactive measures to block or mitigate threats in real-time.
- What is a security incident response plan?
– Answer: A security incident response plan is a documented set of procedures and actions to be followed in the event of a security incident, such as a data breach, cyber-attack, or system compromise.
- What is the role of a Security Operations Center (SOC)?
– Answer: A Security Operations Center (SOC) is a centralized team responsible for monitoring, detecting, analysing, and responding to cybersecurity threats and incidents in real-time.
- What is a honeypot?
– Answer: A honeypot is a decoy system or network designed to lure attackers and gather information about their tactics, techniques, and procedures (TTPs) without compromising real production systems.
- What is encryption key management?
– Answer: Encryption key management is the process of generating, storing, distributing, and revoking cryptographic keys used for encryption and decryption purposes to protect sensitive data.
- What is a social engineering attack?
– Answer: A social engineering attack is a type of cyber-attack that relies on psychological manipulation and deception to trick individuals into divulging confidential information or performing actions that compromise security.
- What is data masking?
– Answer: Data masking is the process of replacing sensitive information with fictitious or obfuscated data to protect privacy and comply with data protection regulations while retaining data usability for testing or analysis purposes.
- What is a digital forensics investigation?
– Answer: A digital forensics investigation is the process of collecting, preserving, analysing, and presenting digital evidence in a manner that is admissible in a court of law to investigate cybercrimes or security incidents.
- What is the difference between authentication and authorization?
– Answer: Authentication is the process of verifying the identity of a user or system, while authorization is the process of determining what actions or resources a user or system is allowed to access based on their identity and permissions.
- What is a firewall rule?
– Answer: A firewall rule is a predefined set of criteria that determines whether network traffic is allowed or blocked based on source and destination IP addresses, ports, protocols, and other attributes.
- What is a risk assessment?
– Answer: A risk assessment is the process of identifying, analysing, and evaluating potential risks and vulnerabilities to an organization’s assets, systems, and operations, and implementing controls to mitigate those risks.
- What is the difference between a virus and a worm?
– Answer: A virus is a malicious software program that requires user interaction or intervention to spread, while a worm is a self-replicating malicious program that spreads automatically over a network without user intervention.
- What is a cryptographic hash function?
– Answer: A cryptographic hash function is a mathematical algorithm that takes an input (or message) and produces a fixed-size string of characters (hash value) that uniquely represents the input. Hash functions are commonly used in digital signatures, password storage, and data integrity verification.
- What is a secure coding practice?
– Answer: Secure coding practices are coding techniques and guidelines that help developers write software code that is resistant to security vulnerabilities, such as buffer overflows, SQL injection, and cross-site scripting.
- What is the role of a Certificate Authority (CA)?
– Answer: A Certificate Authority (CA) is a trusted entity that issues digital certificates to verify the identity of individuals, organizations, or websites and facilitate secure communication over a network using cryptographic protocols like SSL/TLS.
- What is a digital signature?
– Answer: A digital signature is a cryptographic mechanism used to verify the authenticity and integrity of a digital message or document and ensure that it has not been tampered with or altered during transmission.
- What is network forensics?
– Answer: Network forensics is the process of capturing, analysing, and reconstructing network traffic and communication patterns to investigate security incidents, identify attackers, and gather evidence for legal proceedings.
- What is a virtual private network (VPN)?
– Answer: A virtual private network (VPN) is a secure tunneling technology that encrypts and routes network traffic between remote users or networks and a private network over a public network (such as the internet), ensuring privacy and confidentiality.
- What is a brute force attack?
– Answer: A brute force attack is a trial-and-error method used by attackers to guess passwords or encryption keys by systematically trying all possible combinations until the correct one is found.
- What is a security token?
– Answer: A security token is a physical device or software application that generates one-time passwords or authentication codes for multi-factor authentication purposes.
- What is a digital certificate?
– Answer: A digital certificate is a cryptographic credential used to verify the identity of an entity (such as a person, organization, or website) and establish secure communication over a network.
- What is an intrusion prevention system (IPS)?
– Answer: An intrusion prevention system (IPS) is a security tool that monitors network or system activities for malicious behaviour or policy violations and takes proactive measures to block or mitigate threats in real-time.
- What is a security incident response plan?
– Answer: A security incident response plan is a documented set of procedures and actions to be followed in the event of a security incident, such as a data breach, cyber-attack, or system compromise.
- What is the role of a Security Operations Center (SOC)?
– Answer: A Security Operations Center (SOC) is a centralized team responsible for monitoring, detecting, analysing, and responding to cybersecurity threats and incidents in real-time.
- What is encryption key management?
– Answer: Encryption key management is the process of generating, storing, distributing, and revoking cryptographic keys used for encryption and decryption purposes to protect sensitive data.
- What is a social engineering attack?
– Answer: A social engineering attack is a type of cyber-attack that relies on psychological manipulation and deception to trick individuals into divulging confidential information or performing actions that compromise security.
- What is data masking?
– Answer: Data masking is the process of replacing sensitive information with fictitious or obfuscated data to protect privacy and comply with data protection regulations while retaining data usability for testing or analysis purposes.
- What is a digital forensics investigation?
– Answer: A digital forensics investigation is the process of collecting, preserving, analysing, and presenting digital evidence in a manner that is admissible in a court of law to investigate cybercrimes or security incidents.
- What is the difference between authentication and authorization?
– Answer: Authentication is the process of verifying the identity of a user or system, while authorization is the process of determining what actions or resources a user or system is allowed to access based on their identity and permissions.
- What is a firewall rule?
– Answer: A firewall rule is a predefined set of criteria that determines whether network traffic is allowed or blocked based on source and destination IP addresses, ports, protocols, and other attributes.
- What is a risk assessment?
– Answer: A risk assessment is the process of identifying, analysing, and evaluating potential risks and vulnerabilities to an organization’s assets, systems, and operations, and implementing controls to mitigate those risks.
- What is the difference between a virus and a worm?
– Answer: A virus is a malicious software program that requires user interaction or intervention to spread, while a worm is a self-replicating malicious program that spreads automatically over a network without user intervention.
- What is a cryptographic hash function?
– Answer: A cryptographic hash function is a mathematical algorithm that takes an input (or message) and produces a fixed-size string of characters (hash value) that uniquely represents the input. Hash functions are commonly used in digital signatures, password storage, and data integrity verification.
- What is a secure coding practice?
– Answer: Secure coding practices are coding techniques and guidelines that help developers write software code that is resistant to security vulnerabilities, such as buffer overflows, SQL injection, and cross-site scripting.
- What is the role of a Certificate Authority (CA)?
– Answer: A Certificate Authority (CA) is a trusted entity that issues digital certificates to verify the identity of individuals, organizations, or websites and facilitate secure communication over a network using cryptographic protocols like SSL/TLS.
- What is a digital signature?
– Answer: A digital signature is a cryptographic mechanism used to verify the authenticity and integrity of a digital message or document and ensure that it has not been tampered with or altered during transmission.
- What is network forensics?
– Answer: Network forensics is the process of capturing, analysing, and reconstructing network traffic and communication patterns to investigate security incidents, identify attackers, and gather evidence for legal proceedings.
- What is a virtual private network (VPN)?
– Answer: A virtual private network (VPN) is a secure tunnelling technology that encrypts and routes network traffic between remote users or networks and a private network over a public network (such as the internet), ensuring privacy and confidentiality.
- What is a brute force attack?
– Answer: A brute force attack is a trial-and-error method used by attackers to guess passwords or encryption keys by systematically trying all possible combinations until the correct one is found.
- What is a security token?
– Answer: A security token is a physical device or software application that generates one-time passwords or authentication codes for multi-factor authentication purposes.
- What is a digital certificate?
– Answer: A digital certificate is a cryptographic credential used to verify the identity of an entity (such as a person, organization, or website) and establish secure communication over a network.
- What is an intrusion prevention system (IPS)?
– Answer: An intrusion prevention system (IPS) is a security tool that monitors network or system activities for malicious behaviour or policy violations and takes proactive measures to block or mitigate threats in real-time.
- What is a security incident response plan?
– Answer: A security incident response plan is a documented set of procedures and actions to be followed in the event of a security incident, such as a data breach, cyber-attack, or system compromise.
- What is encryption key management?
Answer: Encryption key management is the process of generating, storing, distributing, and revoking cryptographic keys used for encryption and decryption purposes to protect sensitive data.
- What is a social engineering attack?
Answer: A social engineering attack is a type of cyber-attack that relies on psychological manipulation and deception to trick individuals into divulging confidential information or performing actions that compromise security.