15 Cyber Security Interview Questions to Prepare For

• Suspicious privileged account activity: If a cybercriminal gains access to a user account on your network, it’s likely they will try to elevate the account’s privileges or use it to gain access to another account with higher-level privileges. Out-of-hours account usage, unusual amounts of data accessed and out of character account activity may be signs that a system has been hacked.

• Anomalous logon failure: Repeated failed attempts to log into an account or attempts to log into an account that no longer exists are clear signs of suspicious activity. The recommended defensive action here is to execute a custom script that can either shut down the server, change the firewall settings or disable a user account after a certain number of failed attempts over a specific amount of time. 

Anomalous registry changes: APTs are able to establish themselves and remain undetected in part by making changes to the system registry. It’s important to know what the system registry normally looks like and to be informed in real time of any deviation from its typical state.

• HTML response sizes and spikes in database activity: SQL injection, where malicious code is injected into a web form, is just one of the many ways hackers can gain access to a database. In this kind of attack, the HTML response size will likely be abnormally large. If an attacker has gained access to a database, they will attempt to download huge amounts of sensitive data, like credit card information, in a very short period of time. 

• Unusual port usage: In their efforts to navigate around firewalls, hackers will often use obscure port numbers. Cyber security specialists should keep records of port usage, and if a port is used that is not on the whitelist they should be immediately informed and able to automate a response.

• Informational responses (100-199)

• Successful responses (200-299)

• Redirection responses (300-399)

• Client error responses (400-499)

• Server error responses (500-599)

• Use hardware and software firewalls: Defending the perimeter of a network is an effective way to block unauthorized access. Firewalls decide whether to prevent or allow inbound or outbound network connections and can be configured to block all connections except ones that are approved, or whitelisted. 

• Implement encrypted VPN for remote access: Virtual private networks (VPNs) can be used to keep ports and services private, but still make them remotely accessible when users are on the VPN.

• Maintain strong password and authentication policies: Since a number of cyberattacks result from user’s passwords being easy to guess, a policy that requires strong passwords is an effective defensive weapon. Using two-factor or multi-factor authentication, which requires a one-time code sent via text or email, is another way of confirming access by verified users.

• Install SSL certificates: SSL certificates can encrypt traffic data, securing user logins, payment information and other sensitive info on your server. 

• Incorporate monitoring logs and trace logins: Event logs, advanced error logs and monitoring for failed login attempts can help cyber security professionals gain a better understanding of attacks that may be leveraged against their servers. This information can be used to set up scripts that automatically block IPs that have made failed login attempts.

• Blocking access to key components of the network. In a ransomware attack for example, access to data is blocked until a ransom is paid.

• Installing harmful software.

• Obtaining information by transmitting data from a hard drive. 

• Disrupting the system in ways that make it inoperable.

• Man-in-the-middle attack: The attacker eavesdrops on a conversation between two parties and positions themselves between them with the intent to intercept personal data. The attacker may also convince the victim to take an action, such as changing login credentials or transferring funds.

• Credential stuffing: These attacks work on the premise that people tend to use the same user ID and password across multiple online accounts. By obtaining the credentials for one account, the attackers may be able to gain access to other accounts held by the same victim.

• Password spraying: This is when a cybercriminal uses a single common password to gain access to multiple accounts on the same application. The goal here is to go around the lockouts that normally occur after someone tries many passwords on a single account too many times.

• In transit: Via emails, in chat rooms, calls or other communications.

• At rest: As the result of misconfigured cloud storage, unattended or lost devices or insecure databases.

• In use: When it’s processed using printers, USB drives, in screenshots or on clipboards.

Black Hat Hackers: These are the bad guys. These cybercriminals hack into systems with malicious intent, typically to steal data that they can sell to a third party, destroy or hold hostage until a ransom is paid by the victims.

• White Hat Hackers: These are the “ethical hackers” who hack into systems using tactics similar to cybercriminals, but for the purpose of identifying or fixing vulnerabilities that could otherwise be exploited by the guys with the black hats. 

• Gray Hat Hackers: Like their name suggests, these hackers in the third category operate in a gray area. They may not necessarily operate with the malicious or criminal intent like Black Hat Hackers, but they do hack into data systems without authorization to uncover vulnerabilities and report them to the system’s administrators. While they do not exploit the weaknesses they find, they will sometimes demand payment in exchange for providing the details of what they’ve uncovered.

• Ipconfig can be used in an application that displays all the network configurations of the devices currently connected to a network and can modify their protocols as well as DHCP and DNS settings. The ipconfig command is supported by the Windows, React OS and Mac OS operating systems to control what’s displayed on all currently connected interfaces, whether they are active or not.

• Ifconfig is a system administrator utility that is used to configure, control and query the TCP/IP network configurations of the system as well as monitor active interfaces. The ifconfig command is supported by Unix-based operating systems. In terms of its functionality, the ifconfig command displays only the enabled – or active – network interfaces connected to the system.

• Keep systems and software up to date. Because they contain important security patches, software and operating system updates should be installed as soon as they become available.

• Keep devices physically secure. Don’t leave a device unattended in a public place, as it could be stolen or tampered with.

• Purchase and install antivirus software. This type of protection scans files and incoming email for viruses and deletes anything it determines to be malicious. 

• Download software only from sites you know and trust. This includes making sure any mobile apps you download come from Apple’s App Store or Google’s Google Play for Android.

• Configure strong passwords for online accounts. Since hackers use sophisticated programs to guess passwords, use passwords that don’t contain personal information but do use at least 8 digits with a combination of letters, numbers and special characters. You should also avoid using the same password across multiple accounts.

• Use strong authentication. Take advantage of two-factor authentication (2FA) when offered by the social media, email, shopping and financial platforms you use. This method uses a one-time code sent to your email or mobile device to ensure the person logging in is the authorized account user.