Cybersecurity interviews usually test four things: your grasp of the fundamentals, how you would respond to a real incident, how you balance risk against business needs, and how well you explain technical issues to people who aren’t technical. Below are 30 common cybersecurity interview questions with short sample answers. Use them as a starting point and add examples from your own work.
Fundamentals
1. What is the CIA triad?
Confidentiality, integrity and availability. Confidentiality keeps data away from people who shouldn’t see it, integrity makes sure it isn’t changed improperly, and availability keeps it accessible to the people who need it. Most security decisions involve balancing the three.
2. What’s the difference between a threat, a vulnerability and a risk?
A vulnerability is a weakness. A threat is something that could exploit it. Risk is the likelihood of that happening combined with the impact if it does. An unpatched server is a vulnerability, an attacker scanning for it is a threat, and the risk depends on what that server holds.
3. What’s the difference between symmetric and asymmetric encryption?
Symmetric encryption uses one shared key and is fast, so it suits large amounts of data (AES, for example). Asymmetric uses a public and private key pair and is slower, but it solves key exchange (RSA or elliptic curve). TLS uses both: asymmetric to establish a shared key, then symmetric for the session.
4. What’s the difference between hashing and encryption?
Encryption is reversible with the right key. Hashing is one-way and is used to check integrity or store passwords. Passwords should be stored with a salted, deliberately slow algorithm such as bcrypt or Argon2, not a fast one like MD5 or plain SHA-256.
5. What is the principle of least privilege?
Give users and systems only the access they need to do their job, for only as long as they need it. It limits the damage from a compromised account or a mistake.
6. What is defense in depth?
Using several layers of security so that one failure doesn’t lead to a breach: for example, multi-factor authentication, network segmentation, endpoint detection, logging and backups together.
7. What is multi-factor authentication, and why does it matter?
It requires two or more of something you know, something you have and something you are. It greatly reduces the value of stolen passwords. App-based or hardware options are generally stronger than SMS codes.
8. What is zero trust?
A model that doesn’t assume anything inside the network is safe. Each request is verified based on identity, device and context, access is limited, and activity is monitored.
Network Security
9. What’s the difference between IDS and IPS?
An intrusion detection system monitors traffic and raises alerts. An intrusion prevention system sits in the traffic path and can block it. An IPS needs careful tuning, because a false positive can block legitimate traffic.
10. What does a firewall do?
It filters traffic based on rules such as source, destination, port and protocol. Next-generation firewalls can also inspect applications and content.
11. How does TLS protect traffic?
The client checks the server’s certificate, the two sides agree on a session key, and traffic is then encrypted and protected against tampering. It protects data in transit, not on the servers at either end.
12. What is a man-in-the-middle attack, and how do you prevent it?
An attacker secretly relays or changes communication between two parties. TLS with proper certificate validation, HSTS, secure Wi-Fi and VPNs on untrusted networks all help.
13. What is a DDoS attack, and how do you reduce its impact?
Many systems flood a target to exhaust its resources. Mitigations include upstream scrubbing services, a CDN, rate limiting and designing systems to scale and fail gracefully.
14. Why segment a network?
Segmentation limits how far an attacker can move after getting in, and it keeps sensitive systems away from general traffic.
15. Which ports should you know?
Common ones include 22 (SSH), 25 (SMTP), 53 (DNS), 80 (HTTP), 443 (HTTPS) and 3389 (RDP). Exposed RDP and SSH are frequent targets, so be ready to explain how you’d protect them.
Application and Web Security
16. What is SQL injection, and how do you prevent it?
An attacker puts SQL into an input so the database runs it. Use parameterized queries, validate input, and give the database account only the permissions it needs.
17. What is cross-site scripting (XSS)?
Malicious script runs in another user’s browser through a vulnerable page. Encode output for its context, sanitize any HTML you accept, and add a Content Security Policy.
18. What is cross-site request forgery (CSRF)?
A site tricks a logged-in user’s browser into sending an unwanted request. Anti-CSRF tokens and SameSite cookies are the standard defenses.
19. What is the OWASP Top 10?
A widely used list of the most critical web application security risks, such as broken access control and injection. Interviewers often ask you to explain one or two and how you’d fix them.
20. What’s the difference between a vulnerability scan and a penetration test?
A scan is automated and finds known issues across many systems. A penetration test is a focused attempt, usually by a person, to actually exploit weaknesses and show their impact.
Incident Response and Scenarios
21. What are the phases of incident response?
The common NIST-based model is preparation; detection and analysis; containment, eradication and recovery; and post-incident activity. Be ready to walk through a real or hypothetical example.
22. A user reports a phishing email and says they clicked the link. What do you do?
Find out what they did: did they enter credentials or download anything? Reset passwords and revoke sessions, isolate the device if needed, check logs for suspicious activity, search for and remove the same email from other inboxes, block the sender and domain, and document it. Thank the user for reporting it, so that people keep reporting.
23. You see a large outbound data transfer at 3 a.m. How do you investigate?
Identify the host, account, destination and data volume. Check whether it’s a scheduled backup or a known job. If it can’t be explained, contain the host, preserve logs and evidence, and escalate according to the response plan.
24. How would you respond to ransomware?
Isolate affected systems quickly, keep evidence, identify the variant and how it got in, involve leadership, legal and any outside responders, and restore from clean, tested backups. Paying a ransom is a business and legal decision, not one for the analyst alone.
25. What’s the difference between a SIEM and a SOAR?
A SIEM collects and correlates logs to detect issues. A SOAR automates response steps, such as enriching alerts or disabling an account.
Risk, Compliance and Behavioral Questions
26. What frameworks have you worked with?
Mention only what you’ve really used, such as NIST CSF, ISO 27001, SOC 2, PCI DSS or HIPAA, and what you did with it. Doing the work counts for more than knowing the name.
27. How do you prioritize vulnerabilities?
Don’t rely on the CVSS score alone. Consider whether it’s being exploited in the wild, whether the system is exposed, how important the asset is, and what controls already reduce the risk.
28. How do you explain a security risk to non-technical leaders?
Talk about business impact, likelihood and options, not technical details. For example: “If this is exploited, customer records could be exposed. Fixing it takes two days and we’d recommend doing it this sprint.”
29. Tell me about a time you disagreed with a team about a security decision.
Use the STAR method. Show that you understood their deadline or concern, offered options rather than just saying no, and reached a decision with the risk clearly documented.
30. How do you keep up with security news?
Name specific sources you really use, such as CISA alerts, vendor advisories, podcasts, or labs like Hack The Box and TryHackMe, and mention something you learned recently.
How to Prepare by Experience Level
- Entry level: focus on fundamentals, networking and a home lab or capture-the-flag projects you can describe. Certifications such as Security+ help, but be ready to show what you can do.
- Mid level: prepare two or three detailed incidents or projects, including your exact role, the tools you used and the outcome.
- Senior: expect questions on architecture, risk decisions, leading incident response, and working with executives and other teams.
Also review the common interview questions and behavioral questions most interviewers ask alongside the technical ones, and prepare your answer to “Tell me about yourself”.
Get Help in the Interview Itself
Preparation gets you most of the way. For the interview itself, ApplyQuick Interview Copilot listens to each question and suggests a structured answer based on your resume and the job description, on Zoom, Microsoft Teams, Google Meet or a phone call. Your first session is free, no card needed.
