Cybersecurity Interview Questions for Beginners

1. What is cybersecurity, and why is it important?
   Cybersecurity protects systems, data, and networks from unauthorised access or disruption. It is vital because breaches can cause financial, operational, and reputational damage.
2. What is cyber risk?
   Cyber risk is the possibility of loss from threats exploiting weaknesses in technology systems.
3. What is the difference between a threat, vulnerability, and risk?
   A threat is a potential harmful event. A vulnerability is a weakness. Risk combines the likelihood of an event with its impact.
4. What is the CIA triad?
   The CIA triad stands for confidentiality, integrity, and availability of data and systems.

Network and System Protection

5. What is a firewall, and how does it work?
   A firewall monitors and filters network traffic. It blocks unauthorised access based on security rules.
6. Explain what a VPN does.
   A VPN encrypts data and secures the connection between a user and the internet. It protects privacy and sensitive information.
7. What is port scanning, and why is it used?
   Port scanning identifies open or listening ports. It helps test system vulnerabilities and strengthen defences.
8. What are common types of cyberattacks?
   Common attacks include phishing, malware, ransomware, DDoS attacks, and password attacks.

IT Controls and Frameworks

9. What are IT General Controls (ITGC)?
   ITGC are controls that ensure the reliability of systems. They include access, change, and operational controls.
10. Why are access controls important?
    Access controls restrict system use to authorised users. This reduces the risk of unauthorised actions.
11. What is change management control?
    Change management controls secure system updates and prevent unintended disruption.
12. What are SOC reports like SOC1, SOC2, and SOC3?
    SOC reports assess internal controls at service organisations. SOC2 focuses on security, availability, and confidentiality.
13. Why use frameworks like ISO 27001 and COBIT?
    ISO 27001 and COBIT provide structured approaches to manage security and governance effectively.
14. What is the NIST Cybersecurity Framework?
    NIST guides organisations to identify, protect, detect, respond, and recover from cyber risks.

Incident Response and Detection

15. What is the incident response?
    Incident response is the process of managing and reducing the impact of a security breach.
16. What is intrusion detection?
    Intrusion detection systems monitor network activity for suspicious actions and alert security teams.
17. What is the difference between IDS and IPS?
    IDS detects suspicious activity. IPS detects and blocks malicious traffic.
18. How would you respond to a suspected security breach?
    Isolate affected systems, investigate the cause, inform stakeholders, and apply remediation measures.

Data Protection and Cryptography

19. What is encryption?
    Encryption converts data into a coded format to prevent unauthorised access.
20. What is the difference between symmetric and asymmetric encryption?
    Symmetric encryption uses one key for encryption and decryption. Asymmetric encryption uses two keys.
21. What is data loss prevention (DLP)?
    DLP includes tools and policies that stop sensitive data leaving an organisation.
22. What is a zero-day vulnerability?
    A zero-day vulnerability is a flaw unknown to developers that attackers may exploit before a patch is available.

Cybersecurity in Risk and Governance Context

23. What is third-party risk?
    Third-party risk arises when vendors access or affect organisation systems and data.
24. Why is cyber governance important?
    Cyber governance ensures risk practices align with business strategy and compliance requirements.
25. What is patch management?
    Patch management involves regularly updating systems to fix vulnerabilities and reduce risk exposure.
26. Explain the principle of least privilege.
    This principle limits access to only what users need to perform their job.

Scenario-Based Questions for Beginners

27. If a colleague clicks a suspicious link, what should you do?
    Disconnect the device, alert IT or security teams, and check for indicators of compromise.
28. If a DDoS attack slows systems, what is your first action?
    Identify traffic patterns and activate mitigation tools like rate limiting or cloud protection.
29. If an email asks for login details, how would you respond?
    Do not reply. Report it as phishing and verify legitimacy through official channels.
30. How do you secure a server from unauthorised access?
    Use strong passwords, restrict remote admin access, configure firewalls, and apply patches.