Cyber Security Analyst Interview Questions and Answers for Freshers
Cyber Security Analyst Interview Questions for Freshers are designed to test a candidate’s basic knowledge of cybersecurity concepts, tools, and practices. They focus on areas like network security, encryption, threat detection, incident response, and common attack methods, helping freshers demonstrate their readiness for entry-level roles in a Security Operations Center (SOC) or related positions
Que 1. What is the difference between a vulnerability, a threat, and a risk?
Answer:
- Vulnerability: A weakness in a system (e.g., unpatched software).
- Threat: Anything that can exploit a vulnerability (e.g., malware, hacker).
- Risk: The potential impact when a threat exploits a vulnerability.
Que 2. What is the difference between symmetric and asymmetric encryption?
Answer:
- Symmetric Encryption: Uses the same key for encryption and decryption (e.g., AES).
- Asymmetric Encryption: Uses a pair of keys – public and private (e.g., RSA).
Que 3. Explain the difference between IDS and IPS.
Answer:
- IDS (Intrusion Detection System): Detects suspicious activity and alerts.
- IPS (Intrusion Prevention System): Detects and also blocks the malicious activity in real time.
Que 4. What are the different layers of security in a network?
Answer:
- Perimeter Security – Firewalls, IDS/IPS
- Network Security – VLANs, segmentation
- Endpoint Security – Antivirus, EDR solutions
- Application Security – Secure coding, WAF
- Data Security – Encryption, DLP
Que 5. What is the difference between hashing and encryption?
Answer:
- Hashing: One-way function, converts data into fixed-length hash (e.g., SHA-256). Cannot be reversed.
- Encryption: Two-way function, data can be encrypted and decrypted using keys.
Que 6. What are some common types of cyber attacks?
Answer:
- Phishing
- Ransomware
- DDoS attacks
- SQL Injection
- Man-in-the-Middle (MITM)
- Zero-day exploits
Que 7. Explain the CIA triad.
Answer:
- Confidentiality: Protecting data from unauthorized access.
- Integrity: Ensuring data is accurate and unaltered.
- Availability: Ensuring resources are accessible when needed.
Que 8. What is the difference between a firewall and an antivirus?
Answer:
- Firewall: Protects network traffic by filtering based on rules.
- Antivirus: Detects and removes malicious software on endpoints.
Que 9. Explain phishing and how to identify it.
Answer: Phishing is a social engineering attack where attackers impersonate trusted sources to steal sensitive information. Signs include:
- Suspicious sender addresses
- Urgent or threatening language
- Mismatched links or fake domains
- Unexpected attachments
Que 10. What is the difference between TCP and UDP in terms of security?
Answer:
- TCP: Connection-oriented, reliable, better for secure communication.
- UDP: Connectionless, faster but less reliable, often exploited in DDoS attacks.
Que 11. What are honeypots and why are they used?
Answer: A honeypot is a decoy system designed to lure attackers. It helps in:
- Detecting attack patterns
- Studying malicious techniques
- Distracting attackers from real assets
Que 12. What is two-factor authentication (2FA) and why is it important?
Answer: 2FA adds an extra layer of security by requiring two credentials:
- Something you know (password)
- Something you have (OTP, token) or are (biometrics)
This reduces the chances of account compromise.
Que 13. Explain port scanning and why attackers use it.
Answer: Port scanning is a technique to identify open ports and running services on a system. Attackers use it to find entry points, while defenders use it for vulnerability assessments.
Que 14. What are SIEM tools and their role in SOC?
Answer: SIEM (Security Information and Event Management) tools collect, analyze, and correlate logs from different devices. They help in:
- Detecting security incidents
- Real-time monitoring
- Incident response Examples: Splunk, QRadar, ArcSight
Que 15. What is the difference between black-hat, white-hat, and grey-hat hackers?
Answer:
- Black-hat: Malicious hackers
- White-hat: Ethical hackers working for security
- Grey-hat: Hackers with mixed motives
Que 16. How would you respond to a ransomware attack in an organization?
Answer:
- Isolate affected systems
- Notify incident response team
- Identify ransomware type
- Restore from backups if possible
- Avoid paying ransom
- Strengthen security to prevent reoccurrence
Que 17. Explain the difference between vulnerability assessment and penetration testing.
Answer:
- Vulnerability Assessment: Identifies security weaknesses in systems.
- Penetration Testing: Actively exploits vulnerabilities to test defenses.
Que 18. What is the difference between HTTPS and HTTP?
Answer:
- HTTP: Transfers data in plain text, vulnerable to MITM attacks.
- HTTPS: Uses SSL/TLS encryption, ensuring secure communication.
Que 19. What are the common log sources you would monitor in a SOC?
Answer:
- Firewall logs
- IDS/IPS logs
- Server logs (Windows/Linux)
- Application logs
- Authentication logs
- Endpoint security logs
Que 20. How would you detect and prevent a brute-force attack?
Answer:
- Monitor login attempts in SIEM
- Use account lockout policies
- Enable CAPTCHA
- Implement MFA
- Use anomaly-based detection systems
Que 21. What is the difference between blacklisting and whitelisting in cybersecurity?
Answer:
- Blacklisting: Blocks known malicious files, IPs, or domains.
- Whitelisting: Allows only trusted applications or IPs to run, blocking everything else.
Que 22. Explain the difference between SSL and TLS.
Answer:
- SSL: Older protocol for encrypting web traffic.
- TLS: Successor to SSL, more secure and widely used today.
Que 23. What are zero-day vulnerabilities?
Answer: A zero-day vulnerability is a security flaw unknown to vendors and without a patch. Attackers exploit it before it’s discovered and fixed, making it highly dangerous.
Que 24. Explain the difference between vulnerability scanning tools like Nessus and penetration testing tools like Metasploit.
Answer:
- Nessus: Identifies system weaknesses through automated scans.
- Metasploit: Exploits identified vulnerabilities to test actual risks.
Que 25. How would you investigate a suspicious network traffic spike?
Answer:
- Review firewall and IDS/IPS logs
- Identify source/destination IPs
- Check for abnormal ports or protocols
- Look for malware or DDoS signs
- Use packet capture tools (Wireshark)
- Contain and block malicious traffic
You can also Download the PDF from here:
Comments
Post a Comment