50 Cybersecurity Interview Questions and Answers (2026)

Whether you're interviewing for your first SOC analyst role or a mid-level pentesting position, hiring managers ask variations of the same questions. Here are the 50 most common ones, with the answers interviewers are looking for.

Fundamentals and Networking (Q1–Q15)

Q1. What is the CIA triad? Confidentiality (only authorised users access the data), Integrity (data is accurate and hasn't been tampered with), and Availability (systems are accessible when needed). Every security control can be evaluated against these three properties. For example: encryption protects confidentiality, digital signatures protect integrity, and redundant infrastructure protects availability.

Q2. What is the difference between authentication and authorisation? Authentication verifies who you are (proving identity — username + password, MFA, biometrics). Authorisation determines what you're allowed to do once authenticated (access control, permissions). You can be authenticated but not authorised — your login succeeds, but you don't have permission to access a specific file.

Q3. Explain the OSI model and name all 7 layers. Physical (bits over wire), Data Link (MAC addresses, Ethernet frames), Network (IP addresses, routing), Transport (TCP/UDP, ports, end-to-end delivery), Session (manages sessions between applications), Presentation (encryption, data format translation), Application (HTTP, DNS, FTP, SMTP — what users interact with).

Mnemonic: "Please Do Not Throw Sausage Pizza Away" (Physical, Data Link, Network, Transport, Session, Presentation, Application).

Q4. What is the difference between TCP and UDP? TCP is connection-oriented: establishes a connection (three-way handshake), guarantees delivery and ordering, and has error correction. UDP is connectionless: faster, no reliability guarantees, used for speed-sensitive applications like DNS, VoIP, and video streaming where a dropped packet is better than delay.

Q5. What happens when you type a URL into a browser? DNS lookup resolves the domain to an IP address → TCP connection (three-way handshake) → TLS handshake (for HTTPS) → HTTP GET request sent → server processes request → HTTP response with HTML → browser renders the page. Each step involves distinct protocols and potential attack surfaces.

Q6. What is a firewall and how does it work? A firewall filters network traffic based on rules (allow/deny by IP, port, protocol). Packet filtering: checks individual packets against rules. Stateful inspection: tracks connections and only allows responses to established connections. Next-generation firewalls (NGFW) add deep packet inspection, application awareness, and IPS capabilities.

Q7. What is the difference between IDS and IPS? Intrusion Detection System (IDS): monitors traffic and alerts on suspicious patterns — detection only, passive. Intrusion Prevention System (IPS): monitors traffic and actively blocks suspicious patterns — takes action. An IPS is inline with traffic; an IDS can be out-of-band (mirror port). False positives are more dangerous with IPS because they block legitimate traffic.

Q8. What is a VPN and how does it work? A Virtual Private Network creates an encrypted tunnel between a client and a server, making all traffic appear to originate from the VPN server. Uses protocols like OpenVPN, WireGuard, or IPSec. Corporate VPNs extend the private network to remote workers; consumer VPNs provide privacy by hiding traffic from the ISP.

Q9. What is DNS and what is DNS poisoning? DNS (Domain Name System) translates domain names to IP addresses. DNS poisoning (cache poisoning) inserts fraudulent DNS records into a resolver's cache, redirecting users from a legitimate domain to a malicious IP — without the user's knowledge. DNSSEC (DNS Security Extensions) cryptographically signs records to prevent this.

Q10. Explain symmetric vs asymmetric encryption. Symmetric: same key for encryption and decryption (AES). Fast, used for bulk data. Key distribution is the problem — how do you securely share the key? Asymmetric: public key encrypts, private key decrypts (RSA, ECC). Solves key distribution — you publish your public key. Slower. In practice: asymmetric encryption exchanges a symmetric session key (as in TLS), then symmetric encryption handles the bulk data.

Q11. What is a man-in-the-middle (MITM) attack? The attacker intercepts communication between two parties who believe they're communicating directly. Examples: ARP spoofing on a local network, rogue Wi-Fi access points, SSL stripping (downgrading HTTPS to HTTP). Prevented by certificate pinning, HSTS, and verifying TLS certificates.

Q12. What is the difference between a vulnerability, a threat, and a risk? Vulnerability: a weakness in a system (unpatched software, misconfiguration). Threat: something that could exploit a vulnerability (an attacker, malware, natural disaster). Risk: the probability and impact of a threat exploiting a vulnerability. Risk = Threat × Vulnerability × Impact. Security teams manage risk — they can't eliminate all vulnerabilities, so they prioritise by risk.

Q13. What is least privilege? The principle that accounts and systems should have only the minimum permissions needed to perform their function. If a web application only needs to read from a database, it shouldn't have write access. If an employee only works on one project, they shouldn't have access to other departments' data. Limits blast radius when accounts are compromised.

Q14. What is zero trust? Never trust, always verify. Traditional security assumed everything inside the network perimeter was safe. Zero trust assumes breach — every request is authenticated, authorised, and verified regardless of network location. Driven by the reality that perimeters dissolved with cloud, remote work, and lateral movement by attackers who compromise internal systems.

Q15. What is multi-factor authentication (MFA) and why is it important? MFA requires two or more factors: something you know (password), something you have (phone/hardware token), something you are (biometrics). Even if a password is stolen (which it often is — billions of credentials are leaked annually), MFA prevents account compromise. It's the single most effective control against credential-based attacks.

Threats and Attacks (Q16–Q25)

Q16. What is phishing and how do you recognise it? Phishing is fraudulent communication (usually email) that tricks users into revealing credentials or installing malware. Signs: urgent/threatening language, mismatched sender domain, suspicious links (hover to check), generic greetings, grammar errors, requests for credentials. See our social engineering guide for the full taxonomy.

Q17. What is SQL injection? Inserting SQL code into application inputs that are unsafely concatenated into database queries. ' OR '1'='1 in a login field bypasses authentication. '; DROP TABLE users;-- destroys data. Prevented by parameterised queries/prepared statements — never by input sanitisation alone.

Q18. What is cross-site scripting (XSS)? Injecting malicious scripts into web pages that execute in victims' browsers. Reflected XSS: script in URL parameters, reflected back in the response. Stored XSS: script saved in the database, executes for every visitor. DOM XSS: JavaScript manipulates the DOM unsafely. Impact: session hijacking, credential theft, page defacement. Prevented by output encoding and Content Security Policy (CSP).

Q19. What is ransomware? Malware that encrypts the victim's files and demands payment for the decryption key. Modern ransomware groups also exfiltrate data before encrypting ("double extortion") — pay or the data gets published. Defence: offline backups (3-2-1 rule), network segmentation to limit lateral movement, endpoint detection and response (EDR) tools.

Q20. What is the difference between a worm and a virus? Virus: attaches to legitimate files, spreads when those files are shared or executed. Requires human action to propagate. Worm: self-propagating, spreads across networks automatically by exploiting vulnerabilities. WannaCry was a worm — it spread via the EternalBlue exploit without user interaction.

Q21. What is a DDoS attack? Distributed Denial of Service: flooding a target with traffic from many sources (a botnet) to make it unavailable. Volumetric attacks overwhelm bandwidth. Protocol attacks exploit TCP/IP weaknesses. Application layer attacks target specific endpoints (HTTP floods). Mitigated by CDNs (Cloudflare, Akamai), rate limiting, and traffic scrubbing.

Q22. What is social engineering? Manipulating people rather than systems — exploiting psychology (authority, urgency, trust) to gain access or information. Includes phishing, vishing (phone), pretexting (fabricated scenarios), and physical tailgating. The most effective attack vector because it bypasses technical controls entirely.

Q23. What is lateral movement in an attack? After compromising one system, the attacker moves through the network to access additional systems, escalate privileges, and reach high-value targets (domain controllers, databases). Techniques: Pass-the-Hash, Kerberoasting, RDP, WMI. Detected by anomalous authentication patterns, unusual tool execution, and network traffic analysis.

Q24. What is a zero-day vulnerability? A vulnerability that is unknown to the vendor — no patch exists yet ("zero days" for the vendor to fix it). Zero-days are highly valuable because there's no defence once they're exploited. Nation-state actors and sophisticated criminals stockpile zero-days. Once disclosed to the public (or when a patch is released), it's no longer a zero-day.

Q25. What is a supply chain attack? Compromising software or hardware before it reaches the end user — through a vendor, open source dependency, or build system. SolarWinds (2020): attackers compromised SolarWinds' build pipeline, delivering a backdoor to 18,000 organisations. XZ Utils (2024): attacker spent two years gaining trust as an open source contributor, then inserted a backdoor. Hard to detect, catastrophic impact.

Tools (Q26–Q35)

Q26. What is Wireshark and what do you use it for? A network protocol analyser that captures and inspects network traffic in real time. Used to: diagnose network issues, detect suspicious traffic patterns, capture unencrypted credentials on insecure protocols, analyse malware network behaviour, and understand protocol behaviour during security testing.

Q27. What is Nmap? The standard network scanner. Discovers live hosts, open ports, running services, OS versions, and can run NSE scripts for vulnerability detection. nmap -sC -sV -oA initial TARGET is the standard recon command for penetration testers. See our Nmap cheat sheet.

Q28. What is Burp Suite? The industry-standard web application security testing platform. Intercepts HTTP/HTTPS traffic between browser and server (as a proxy), allowing inspection and modification of requests. Used to find SQL injection, XSS, CSRF, authentication bypasses, and logic flaws. Burp Suite Community Edition is free; Pro ($449/year) adds the automated scanner.

Q29. What is Metasploit? An open source exploitation framework. Contains hundreds of verified exploits, payloads, and post-exploitation modules. Allows testers to rapidly test whether a system is vulnerable to known exploits and establish shells. Used for OSCP, HTB, and professional penetration testing.

Q30. What is a SIEM and how does it work? Security Information and Event Management: aggregates logs from across the environment (firewalls, endpoints, servers, applications), correlates them against rules, and alerts on suspicious patterns. Splunk, Microsoft Sentinel, IBM QRadar, and Elastic Security are common platforms. SOC analysts spend most of their time in the SIEM.

Q31. What is Splunk used for in security? Log aggregation, search, alerting, and dashboarding. Security teams use it to search billions of log events, create detection rules (correlations), investigate incidents by reconstructing event timelines, and build security dashboards. SPL (Splunk Processing Language) is used to query data: index=firewall action=blocked | stats count by src_ip.

Q32. What is a vulnerability scanner and name some examples? Automated tools that test systems for known vulnerabilities (CVEs). Nessus (Tenable) is the industry standard for enterprise scanning. OpenVAS is the free/open source alternative. Qualys is cloud-based. Rapid7 InsightVM is widely used. Scanners identify what's vulnerable but don't exploit — that's what penetration testers do.

Q33. What is Kali Linux? A Debian-based Linux distribution purpose-built for penetration testing. Pre-installed with 600+ security tools: Metasploit, Nmap, Burp Suite, Wireshark, John the Ripper, Aircrack-ng, BloodHound, and more. The standard operating system for penetration testers.

Q34. What is John the Ripper? A password cracking tool that uses dictionary attacks, brute force, and hybrid attacks to recover plaintext passwords from hashes. Supports hundreds of hash types. Used to crack captured password hashes from compromised systems. Hashcat is generally faster (GPU-accelerated) but John is more beginner-friendly.

Q35. What is a WAF (Web Application Firewall)? A layer-7 firewall specifically for HTTP/HTTPS traffic. Analyses requests for attack patterns (SQLi, XSS, SSRF, command injection) and blocks or alerts on malicious traffic. Cloudflare WAF, AWS WAF, and ModSecurity are common. WAFs are part of defence-in-depth but aren't a substitute for fixing the underlying vulnerability.

Incident Response (Q36–Q45)

Q36. What are the phases of incident response? NIST IR lifecycle: Preparation → Identification → Containment → Eradication → Recovery → Lessons Learned. Preparation includes runbooks, tools, and training. Identification is detecting and confirming an incident. Containment isolates affected systems. Eradication removes the attacker/malware. Recovery restores normal operations. Lessons learned improves future response.

Q37. What is the first thing you do when you suspect a security incident? Document everything and don't panic. Preserve evidence — take memory dumps, preserve logs before they roll over. Do not immediately power off systems (you lose volatile memory including encryption keys). Notify the incident response team. Begin containment while continuing investigation. Treat it as a crime scene — chain of custody matters.

Q38. What is the difference between an event and an incident? An event is any observable occurrence in a system (login, file access, network connection). A security event is one that could be security-relevant. An incident is a confirmed security event that has or could have a negative impact (data breach, malware infection, unauthorised access). Most events are not incidents.

Q39. What is a playbook in incident response? Documented step-by-step procedures for responding to specific incident types (ransomware, phishing, insider threat, DDoS). Ensures consistent, fast response regardless of who's on call. A well-designed playbook can be partially automated in a SOAR (Security Orchestration, Automation, and Response) platform.

Q40. What is digital forensics? The collection, preservation, analysis, and presentation of digital evidence for legal or investigative purposes. Includes disk forensics (recovering deleted files, analysing file system artefacts), memory forensics (dumping and analysing RAM), network forensics (pcap analysis), and log analysis. Tools: Autopsy, Volatility, FTK.

Q41. What is the chain of custody? The documented record of who handled digital evidence, when, and how. Required to make evidence admissible in legal proceedings. Any break in the chain (unlogged access, evidence not hashed before and after) can invalidate findings in court. This is why IR teams use write blockers and hash everything immediately.

Q42. What is threat hunting? Proactive searching for threats that have evaded automated detection — assuming breach and looking for indicators of compromise (IoCs). Hunters query SIEM data, endpoint telemetry, and network logs for anomalies. Examples: unusual outbound connections on port 443 from servers, rare process parent-child relationships, DLL side-loading indicators.

Q43. What are indicators of compromise (IoCs)? Artefacts that suggest a system has been compromised: unusual outbound traffic, unexpected processes, new user accounts, modified files, known malicious IP addresses or domains, file hashes matching known malware. IoCs are shared between organisations via threat intelligence platforms (MISP, OpenCTI) and feeds (STIX/TAXII format).

Q44. What is MITRE ATT&CK? A knowledge base of adversary tactics, techniques, and procedures (TTPs) observed in real-world attacks. Organises attacks by phases (Initial Access, Execution, Persistence, Privilege Escalation, Defence Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command & Control, Impact). Used to map detections, assess coverage, and communicate about threats precisely.

Q45. What is the difference between a red team, blue team, and purple team? Red team: simulates attacks (offensive). Blue team: defends and detects (defensive — SOC, IR). Purple team: red and blue work together — red shares TTPs and methodology, blue improves detections in real time. The goal of purple teaming is to improve detection coverage faster than traditional red/blue exercises.

Career and Certification (Q46–Q50)

Q46. What certifications are most valuable for cybersecurity? Entry-level: CompTIA Security+, CEH (Certified Ethical Hacker), eJPT. Mid-level: OSCP (offensive), CISM/CISSP (management). Specialised: GPEN (pentesting), GCIH (incident handling), AWS Security Specialty. The OSCP is the gold standard for penetration testing. See our certification roadmap.

Q47. How do you stay current with cybersecurity threats? Follow threat intelligence sources: US-CERT advisories, CISA KEV (Known Exploited Vulnerabilities), vendor security advisories. Read security research blogs (Project Zero, Trail of Bits, Mandiant). Follow CVE feeds. Participate in the community (Twitter/X security accounts, BSides, DEF CON talks on YouTube). Practise on HTB and TryHackMe to maintain offensive skills.

Q48. Describe a time you solved a complex technical problem. [Behavioural — adapt to your experience] Structure with STAR: Situation (what was the context), Task (what were you responsible for), Action (what specifically did you do), Result (what happened). Emphasise methodology, communication, and what you learned. If you're entry-level, use examples from CTFs, home labs, or academic projects.

Q49. Why do you want to work in cybersecurity? [Personal — be genuine] Interviewers look for genuine motivation and self-direction. Good answers reference specific experiences that sparked interest, a long-term career goal, or the mission/impact of security work. Weak answers: "it pays well" or "it's interesting." Show you've already been learning — certifications, CTF competitions, home labs, open source contributions.

Q50. What would you do if you found a vulnerability in a client's system that was out of scope? Document it thoroughly, stop testing it (don't exploit it), and immediately notify the client in writing as a courtesy finding outside the agreed scope. Then follow the rules of engagement for how to handle it — some contracts include guidance, others don't. Never exploit an out-of-scope finding even if technically possible. Good communication here builds trust and often leads to expanded scope.

---

Preparing for a technical interview? Reinforce these concepts with hands-on practice on TryHackMe or HackTheBox — the practical experience will give you concrete answers to "tell me about a time you..." questions.