Advanced Technical Concepts

1. What is Zero Trust Architecture and how does it differ from traditional security?

Answer: Security model that assumes no trust for any entity inside or outside the network.

Traditional vs Zero Trust:

• Traditional: "Trust but verify" - hard perimeter, trusted internal network

• Zero Trust: "Never trust, always verify" - verify every access request

Zero Trust Principles:

• Verify explicitly

• Use least privilege access

• Assume breach

• Micro-segmentation

• Continuous monitoring

2. Explain PKI (Public Key Infrastructure) and its components.

Answer: Framework for managing digital certificates and public-key encryption.

Key Components:

• Certificate Authority (CA): Issues and verifies digital certificates

• Registration Authority (RA): Verifies certificate requests

• Digital Certificates: Bind public keys to entities

• Certificate Repository: Stores certificates and CRLs

• Certificate Revocation List (CRL): List of revoked certificates

3. What is SAML and how does it work for SSO?

Answer: Security Assertion Markup Language - XML-based standard for exchanging authentication and authorization data.

SAML Flow for Single Sign-On (SSO):

1. User accesses service provider (SP)

2. SP redirects to identity provider (IdP)

3. User authenticates with IdP

4. IdP sends SAML assertion to SP

5. SP grants access based on assertion

Use Case: Enterprise SSO, cloud application access

4. What are Security Headers and which are most important for web security?

Answer: HTTP response headers that enhance security.

Critical Security Headers:

• Content Security Policy (CSP): Prevents XSS by whitelisting content sources

• HTTP Strict Transport Security (HSTS): Forces HTTPS connections

• X-Frame-Options: Prevents clickjacking

• X-Content-Type-Options: Prevents MIME sniffing

• Referrer-Policy: Controls referrer information

5. Explain OWASP Top 10 and name the current critical risks.

Answer: Open Web Application Security Project's list of most critical web application security risks.

OWASP Top 10 2021:

1. Broken Access Control

2. Cryptographic Failures

3. Injection

4. Insecure Design

5. Security Misconfiguration

6. Vulnerable and Outdated Components

7. Identification and Authentication Failures

8. Software and Data Integrity Failures

9. Security Logging and Monitoring Failures

10. Server-Side Request Forgery (SSRF)

Network Security & Protocols

6. What is DNSSEC and how does it prevent DNS spoofing?

Answer: DNS Security Extensions - adds cryptographic authentication to DNS responses.

How it works:

• Uses digital signatures to verify DNS data authenticity

• Prevents cache poisoning and man-in-the-middle attacks

• Creates chain of trust from root DNS to final domain

7. Explain DMZ (Demilitarized Zone) in network architecture.

Answer: Physical or logical subnetwork between internal network and external network.

Purpose: Contains external-facing services to isolate them from internal network.

Typical DMZ Services:

• Web servers

• Email servers

• FTP servers

• DNS servers

Architecture: Two-firewall approach or single firewall with multiple interfaces

8. What is NAC (Network Access Control) and how does it work?

Answer: Security solution that enforces policies on devices attempting to access network resources.

NAC Process:

1. Authentication: Verify device/user identity

2. Authorization: Determine access level

3. Posture Assessment: Check device compliance (antivirus, patches)

4. Quarantine/Remediation: Isolate non-compliant devices

5. Access Granting: Provide appropriate network access

9. What are the differences between Stateful and Stateless firewalls?

Answer:

• Stateless Firewall:

  • Filters packets based on static rules (source/destination IP, ports)

  • No memory of previous packets

  • Faster but less secure

• Stateful Firewall:

  • Tracks connection state and context

  • Makes decisions based on connection awareness

  • Can detect unauthorized traffic patterns

  • More secure but resource-intensive

10. Explain ARP Poisoning and how to prevent it.

Answer: Attack where attacker sends falsified ARP messages to link their MAC address with legitimate IP address.

How it works:

• Attacker broadcasts ARP replies associating their MAC with gateway IP

• All traffic to gateway goes through attacker's machine

• Enables MitM attacks

Prevention:

• Static ARP entries

• ARP inspection on switches

• Port security

• Network segmentation

Cryptography & Encryption

11. What is the difference between Hashing, Encryption, and Encoding?

Answer:

• Encoding: Transforming data into different format (reversible)

  • Purpose: Data representation, not security

  • Examples: Base64, URL encoding

  • No key required

• Encryption: Securing data using algorithms and keys (reversible with key)

  • Purpose: Confidentiality

  • Examples: AES, RSA

  • Key required

• Hashing: Creating fixed-size fingerprint of data (irreversible)

  • Purpose: Integrity verification

  • Examples: SHA-256, MD5

  • No key required

12. Explain Digital Signatures and how they work.

Answer: Mathematical scheme for verifying authenticity and integrity of digital messages.

Process:

1. Signing:

   • Create hash of message

   • Encrypt hash with sender's private key

   • Attach encrypted hash to message

2. Verification:

   • Decrypt signature with sender's public key

   • Create hash of received message

   • Compare hashes - if match, signature is valid

Benefits: Authentication, non-repudiation, integrity

13. What are Salt and Pepper in password security?

Answer:

• Salt: Random data added to each password before hashing

  • Purpose: Prevent rainbow table attacks

  • Storage: Stored with the hash (not secret)

  • Uniqueness: Different for each user

• Pepper: Secret value added to password before hashing

  • Purpose: Additional protection if database compromised

  • Storage: Separate from database (secret)

  • Consistency: Same for all users in application

14. Explain Quantum Computing threats to cryptography.

Answer: Quantum computers could break current asymmetric encryption algorithms.

Vulnerable Algorithms:

• RSA: Based on integer factorization

• ECC: Based on elliptic curve discrete logarithm

• Diffie-Hellman: Based on discrete logarithm

Quantum-Resistant Cryptography:

• Lattice-based cryptography

• Hash-based signatures

• Code-based cryptography

• Multivariate cryptography

Incident Response & Forensics

15. What is Digital Forensics and the chain of custody?

Answer: Process of collecting, analyzing, and preserving digital evidence.

Chain of Custody: Documentation of evidence handling from collection to presentation in court.

Requirements:

• Who collected the evidence

• When and where it was collected

• Who has possessed the evidence

• How it was stored and protected

• Any changes made to the evidence

16. Explain the difference between SIEM and SOAR.

Answer:

• SIEM (Security Information and Event Management):

  • Collects and analyzes security data

  • Real-time monitoring and alerting

  • Log management and correlation

  • Examples: Splunk, ArcSight, QRadar

• SOAR (Security Orchestration, Automation, and Response):

  • Automates incident response workflows

  • Orchestrates security tools

  • Case management and reporting

  • Examples: Demisto, Phantom, Swimlane

17. What are Indicators of Compromise (IOCs)?

Answer: Forensic artifacts that indicate potential intrusion or malicious activity.

Common IOCs:

• Network IOCs: Suspicious IP addresses, domains, URLs

• Host IOCs: Malicious files, registry changes, unusual processes

• Behavioral IOCs: Anomalous user activity, data exfiltration

• Email IOCs: Phishing patterns, malicious attachments

18. Explain the concept of Threat Intelligence.

Answer: Evidence-based knowledge about existing or emerging threats.

Types of Threat Intelligence:

• Strategic: High-level trends for executives

• Tactical: TTPs (Tactics, Techniques, Procedures) for security teams

• Operational: Specific campaigns and IOCs

• Technical: Technical details like malware signatures, IP addresses

Lifecycle: Planning → Collection → Processing → Analysis → Dissemination → Feedback

Cloud & Modern Security

19. What is Cloud Security Shared Responsibility Model?

Answer: Division of security responsibilities between cloud provider and customer.

AWS Example:

• AWS Responsibility: Security OF the cloud (infrastructure, hardware, software)

• Customer Responsibility: Security IN the cloud (data, applications, identity management)

Service Models:

• IaaS: Customer responsible for OS, applications, data

• PaaS: Provider manages OS, customer manages applications/data

• SaaS: Provider manages everything, customer manages user access

20. What are API Security best practices?

Answer:

• Authentication: OAuth 2.0, API keys, JWT tokens

• Authorization: Scope-based access control

• Input Validation: Schema validation, rate limiting

• Encryption: TLS/SSL for data in transit

• Monitoring: API logging, anomaly detection

• Security Testing: API penetration testing

• Documentation: Secure API documentation

21. Explain Container Security considerations.

Answer:

• Image Security: Scan for vulnerabilities, use trusted base images

• Registry Security: Secure access to container registries

• Runtime Security: Monitor container behavior, limit privileges

• Network Security: Network policies, service mesh

• Orchestration Security: Secure Kubernetes configurations

• Supply Chain Security: Sign images, verify integrity

22. What is DevSecOps and how is it implemented?

Answer: Integrating security practices into DevOps workflows.

Implementation:

• Shift Left: Security early in development lifecycle

• Automated Security Testing: SAST, DAST, SCA in CI/CD

• Infrastructure as Code Security: Scan Terraform, CloudFormation

• Container Security: Image scanning, runtime protection

• Security Champions: Developers trained in security

• Continuous Monitoring: Real-time security feedback

Emerging Threats & Compliance

23. What is Ransomware and how can organizations defend against it?

Answer: Malware that encrypts files and demands payment for decryption.

Defense Strategy:

• Prevention: Email filtering, application whitelisting, patch management

• Detection: Behavioral monitoring, anomaly detection

• Response: Isolate infected systems, don't pay ransom

• Recovery: Regular backups, incident response plan

• Training: User awareness about phishing

24. Explain GDPR and its key principles.

Answer: General Data Protection Regulation - EU data protection law.

Key Principles:

• Lawfulness, fairness, and transparency

• Purpose limitation

• Data minimization

• Accuracy

• Storage limitation

• Integrity and confidentiality

• Accountability

Individual Rights: Right to access, rectification, erasure, portability

These additional questions cover more advanced topics that demonstrate deeper cybersecurity knowledge, including emerging technologies, advanced defense strategies, and compliance requirements that are increasingly important in modern security roles.