All rolesSecurity & QA
Cybersecurity Analyst A comprehensive repository for security professionals, covering the CIA Triad, Network & Endpoint Security, Malware Analysis, SOC Monitoring (SIEM/SOAR), Incident Response, and Global Compliance standards.
475 questions Updated 2026-02-08 Beginner Intermediate Advanced
What you will be asked about Cybersecurity Fundamentals Network Security Endpoint Security Malware Analysis Vulnerability Management Penetration Testing Web Application Security Identity & Access Management Cryptography Security Monitoring & SIEM Incident Response & Forensics Compliance & Governance Real-World Scenarios
How to prepare Go through the topic list above and mark every one you cannot explain for five minutes unprepared. Those are your gaps. Pair every concept with a story from your own work — interviewers probe depth, and depth comes from having actually done it. Do the DSA rounds anyway. Almost every role in this list still screens with coding. Prepare two projects you can whiteboard end to end, including what you would change now. Cybersecurity Analyst interview questions475 1. What is cybersecurity and why is it important? Beginner 2. What is the CIA Triad in cybersecurity? Beginner 3. Explain Confidentiality, Integrity, and Availability. Beginner 4. What is the difference between a threat, vulnerability, and risk? Intermediate 5. What is risk assessment in cybersecurity? Intermediate 6. What is the AAA framework (Authentication, Authorization, Accounting)? Intermediate 7. What is Defense in Depth strategy? Intermediate 8. What is the principle of Least Privilege? Beginner 9. What is Zero Trust security model? Intermediate 10. What is the difference between information security and cybersecurity? Beginner 11. What is a security incident vs security event? Intermediate 12. What is incident response? Beginner 13. What is the incident response lifecycle? Intermediate 14. What are the phases of incident response (NIST framework)? Advanced 15. What is a security breach? Beginner 16. What is data breach vs system breach? Intermediate 17. What is a security policy? Beginner 18. What is acceptable use policy (AUP)? Beginner 19. What is security awareness training? Beginner 20. What is social engineering? Beginner 21. What are common social engineering techniques? Intermediate 22. What is phishing? Beginner 23. What is spear phishing vs whaling? Intermediate 24. What is vishing and smishing? Beginner 25. What is pretexting? Intermediate 26. What is baiting in social engineering? Beginner 27. What is tailgating/piggybacking? Beginner 28. What is dumpster diving? Beginner 29. How do you prevent social engineering attacks? Intermediate 30. What is security hygiene? Beginner 31. What is a firewall? Beginner 32. What is the difference between stateful and stateless firewall? Intermediate 33. What is Next-Generation Firewall (NGFW)? Intermediate 34. What is Web Application Firewall (WAF)? Intermediate 35. What is the difference between firewall and WAF? Intermediate 36. What is DMZ (Demilitarized Zone)? Intermediate 37. What is network segmentation? Intermediate 38. What is VLAN (Virtual Local Area Network)? Beginner 39. What is VPN (Virtual Private Network)? Beginner 40. What is the difference between site-to-site and remote access VPN? Intermediate 41. What is IPsec VPN? Advanced 42. What is SSL/TLS VPN? Intermediate 43. What is split tunneling in VPN? Intermediate 44. What is IDS (Intrusion Detection System)? Beginner 45. What is IPS (Intrusion Prevention System)? Beginner 46. What is the difference between IDS and IPS? Beginner 47. What is network-based IDS vs host-based IDS? Intermediate 48. What is signature-based detection vs anomaly-based detection? Intermediate 49. What is Snort IDS? Intermediate 50. What is Suricata? Intermediate 51. What is DDoS attack? Beginner 52. What are types of DDoS attacks (volumetric, protocol, application layer)? Advanced 53. How do you mitigate DDoS attacks? Intermediate 54. What is SYN flood attack? Intermediate 55. What is UDP flood attack? Intermediate 56. What is DNS amplification attack? Advanced 57. What is Man-in-the-Middle (MITM) attack? Beginner 58. What is ARP spoofing? Intermediate 59. What is DNS spoofing? Intermediate 60. What is session hijacking? Intermediate 61. What is packet sniffing? Beginner 62. What is Wireshark? Beginner 63. What is tcpdump? Intermediate 64. How do you analyze network traffic? Intermediate 65. What is port scanning? Beginner 67. What are common Nmap commands? Intermediate 68. What is banner grabbing? Intermediate 69. What is network access control (NAC)? Intermediate 70. What is 802.1X authentication? Advanced 71. What is MAC address filtering? Beginner 72. What is network monitoring? Beginner 73. What is NetFlow? Intermediate 74. What is SIEM integration with network devices? Intermediate 75. What is east-west traffic vs north-south traffic? Intermediate 76. What is micro-segmentation? Advanced 77. What is VXLAN? Advanced 78. What is Software-Defined Networking (SDN) security? Advanced 79. What is zero-trust network access (ZTNA)? Intermediate 80. What is secure network architecture design? Advanced 81. What is endpoint security? Beginner 82. What is antivirus vs anti-malware? Beginner 83. What is EDR (Endpoint Detection and Response)? Intermediate 84. What is the difference between antivirus and EDR? Intermediate 85. What is XDR (Extended Detection and Response)? Advanced 86. What is host-based firewall? Beginner 87. What is application whitelisting? Intermediate 88. What is application blacklisting? Beginner 89. What is the difference between whitelisting and blacklisting? Beginner 90. What is device encryption? Beginner 91. What is full disk encryption (FDE)? Intermediate 92. What is BitLocker? Beginner 93. What is FileVault? Beginner 94. What is TPM (Trusted Platform Module)? Intermediate 95. What is patch management? Beginner 96. Why is patch management important? Beginner 97. What is vulnerability patching? Intermediate 98. What is zero-day vulnerability? Intermediate 99. What is exploit? Intermediate 100. What is the difference between vulnerability and exploit? Beginner 101. What is Mobile Device Management (MDM)? Beginner 102. What is BYOD (Bring Your Own Device) security? Intermediate 103. What is remote wipe capability? Beginner 104. What is USB device control? Intermediate 105. What is DLP (Data Loss Prevention) for endpoints? Intermediate 106. What is behavioral analysis for endpoints? Intermediate 107. What is sandboxing? Intermediate 108. What is memory protection? Advanced 109. What is ASLR (Address Space Layout Randomization)? Advanced 110. What is DEP (Data Execution Prevention)? Advanced 111. What is malware? Beginner 112. What are the types of malware? Beginner 113. What is a virus? Beginner 114. What is a worm? Beginner 115. What is a Trojan horse? Beginner 116. What is ransomware? Beginner 117. What is the difference between virus and worm? Beginner 118. What is spyware? Beginner 119. What is adware? Beginner 120. What is rootkit? Intermediate 121. What is bootkit? Advanced 122. What is keylogger? Beginner 123. What is backdoor? Intermediate 124. What is RAT (Remote Access Trojan)? Intermediate 125. What is cryptojacking? Intermediate 126. What is fileless malware? Advanced 127. What is polymorphic malware? Advanced 128. What is metamorphic malware? Advanced 129. What is malware analysis? Intermediate 130. What is static analysis vs dynamic analysis? Intermediate 131. What is sandboxed malware analysis? Intermediate 132. What is behavioral analysis of malware? Intermediate 133. What is reverse engineering malware? Advanced 134. What is indicators of compromise (IOC)? Intermediate 135. What is YARA rules? Advanced 136. What is hash analysis (MD5, SHA-1, SHA-256)? Beginner 137. What is VirusTotal? Beginner 138. What is malware signature? Beginner 139. What is heuristic analysis? Intermediate 140. What is CryptoLocker ransomware? Beginner 141. What is WannaCry ransomware? Intermediate 142. How does ransomware spread? Beginner 143. How do you recover from ransomware attack? Intermediate 144. What is the best defense against ransomware? Beginner 145. What is malware removal process? Intermediate 146. What is quarantine in antivirus? Beginner 147. What is false positive in malware detection? Beginner 148. What is advanced persistent threat (APT)? Advanced 149. What is command and control (C2) server? Intermediate 150. What is lateral movement in malware attacks? Intermediate 151. What is vulnerability management? Beginner 152. What is vulnerability scanning? Beginner 153. What is vulnerability assessment? Intermediate 154. What is the difference between vulnerability scan and penetration test? Intermediate 155. What is Nessus? Beginner 156. What is OpenVAS? Intermediate 157. What is Qualys? Intermediate 158. What is vulnerability scoring? Beginner 159. What is CVSS (Common Vulnerability Scoring System)? Intermediate 160. What is CVE (Common Vulnerabilities and Exposures)? Beginner 161. What is the difference between CVE and CVSS? Beginner 162. What is NVD (National Vulnerability Database)? Intermediate 163. What is vulnerability prioritization? Intermediate 164. What is risk-based vulnerability management? Advanced 165. What is remediation vs mitigation? Intermediate 166. What is compensating control? Advanced 167. What is vulnerability lifecycle? Intermediate 168. What is continuous vulnerability scanning? Intermediate 169. What is authenticated vs unauthenticated scan? Advanced 170. What is agent-based vs agentless scanning? Advanced 171. What is network vulnerability scanning? Beginner 172. What is web application vulnerability scanning? Intermediate 173. What is false positive vs false negative in scanning? Beginner 174. What is vulnerability reporting? Beginner 175. What is SLA for vulnerability remediation? Intermediate 176. What is critical vs high vs medium vulnerability? Beginner 177. What is exploitability in vulnerability assessment? Intermediate 178. What is attack surface? Beginner 179. What is attack vector? Beginner 180. What is exposure management? Advanced 181. What is penetration testing? Beginner 182. What is ethical hacking? Beginner 183. What is the difference between white hat, black hat, and grey hat? Beginner 184. What is the penetration testing methodology? Intermediate 185. What are the phases of penetration testing? Intermediate 186. What is reconnaissance in penetration testing? Beginner 187. What is passive reconnaissance vs active reconnaissance? Intermediate 188. What is OSINT (Open Source Intelligence)? Beginner 189. What is scanning and enumeration? Intermediate 190. What is exploitation phase? Beginner 191. What is post-exploitation? Intermediate 192. What is privilege escalation? Intermediate 193. What is lateral movement? Intermediate 194. What is persistence in penetration testing? Advanced 195. What is pivoting? Advanced 196. What is Metasploit Framework? Intermediate 197. What is Burp Suite? Intermediate 198. What is OWASP ZAP? Intermediate 199. What is Kali Linux? Beginner 200. What is Parrot OS? Beginner 201. What is web application security? Beginner 202. What is OWASP Top 10? Beginner 203. What are the OWASP Top 10 vulnerabilities (latest)? Intermediate 204. What is injection attack? Beginner 205. What is SQL injection and how to prevent it? Intermediate 206. What is prepared statement? Intermediate 207. What is parameterized query? Beginner 208. What is broken authentication? Intermediate 209. What is session management vulnerability? Intermediate 210. What is session fixation? Advanced 211. What is sensitive data exposure? Beginner 212. What is encryption at rest vs in transit? Beginner 213. What is XML External Entities (XXE)? Advanced 214. What is broken access control? Intermediate 215. What is horizontal privilege escalation? Intermediate 216. What is vertical privilege escalation? Intermediate 217. What is security misconfiguration? Beginner 218. What is default credentials risk? Beginner 219. What is directory listing vulnerability? Intermediate 220. What is cross-site scripting (XSS) in detail? Intermediate 221. What is DOM-based XSS? Advanced 222. What is XSS prevention techniques? Intermediate 223. What is Content Security Policy (CSP)? Advanced 224. What is insecure deserialization? Advanced 225. What is using components with known vulnerabilities? Beginner 226. What is insufficient logging and monitoring? Intermediate 227. What is clickjacking? Intermediate 228. What is X-Frame-Options header? Intermediate 229. What is open redirect vulnerability? Beginner 230. What is HTTP response splitting? Advanced 231. What is API security? Intermediate 232. What is REST API security best practices? Intermediate 233. What is OAuth 2.0 security? Advanced 234. What is JWT (JSON Web Token) vulnerability? Advanced 235. What is API rate limiting? Intermediate 236. What is CORS (Cross-Origin Resource Sharing)? Intermediate 237. What is same-origin policy? Intermediate 238. What is HTTPS and SSL/TLS? Beginner 239. What is certificate pinning? Advanced 240. What is HSTS (HTTP Strict Transport Security)? Intermediate 241. What is identity and access management? Beginner 242. What is authentication? Beginner 243. What is authorization? Beginner 244. What is the difference between authentication and authorization? Beginner 245. What is identification? Beginner 246. What is multi-factor authentication (MFA)? Beginner 247. What are the factors of authentication (something you know, have, are)? Beginner 248. What is two-factor authentication (2FA)? Beginner 249. What is SMS-based 2FA and its risks? Intermediate 250. What is TOTP (Time-based One-Time Password)? Intermediate 251. What is authenticator app? Beginner 252. What is hardware token (YubiKey)? Intermediate 253. What is biometric authentication? Beginner 254. What is passwordless authentication? Intermediate 255. What is Single Sign-On (SSO)? Intermediate 256. What is SAML (Security Assertion Markup Language)? Advanced 257. What is OAuth vs SAML? Advanced 258. What is OpenID Connect? Advanced 259. What is federated identity? Intermediate 260. What is identity provider (IdP)? Intermediate 261. What is Active Directory? Beginner 262. What is LDAP (Lightweight Directory Access Protocol)? Intermediate 263. What is Kerberos authentication? Advanced 264. What is NTLM authentication? Intermediate 265. What is pass-the-hash attack? Advanced 266. What is Kerberoasting? Advanced 267. What is Golden Ticket attack? Advanced 268. What is privileged access management (PAM)? Intermediate 269. What is just-in-time (JIT) access? Advanced 270. What is role-based access control (RBAC)? Beginner 271. What is attribute-based access control (ABAC)? Advanced 272. What is least privilege principle? Beginner 273. What is separation of duties? Intermediate 274. What is access review? Intermediate 275. What is account provisioning and deprovisioning? Beginner 276. What is orphaned account? Beginner 277. What is credential stuffing attack? Intermediate 278. What is password spraying attack? Intermediate 279. What is brute force attack on authentication? Beginner 280. What is account lockout policy? Beginner 281. What is cryptography? Beginner 282. What is encryption? Beginner 283. What is the difference between encryption and hashing? Intermediate 284. What is symmetric encryption? Beginner 285. What is asymmetric encryption? Beginner 286. What is the difference between symmetric and asymmetric encryption? Intermediate 287. What is AES encryption? Intermediate 288. What is RSA encryption? Intermediate 289. What is DES and 3DES? Intermediate 290. Why is DES deprecated? Beginner 291. What is encryption key? Beginner 292. What is key length (128-bit, 256-bit)? Beginner 293. What is public key and private key? Beginner 294. What is public key infrastructure (PKI)? Advanced 295. What is digital certificate? Intermediate 296. What is certificate authority (CA)? Intermediate 297. What is X.509 certificate? Advanced 298. What is SSL/TLS protocol? Beginner 299. What is TLS 1.2 vs TLS 1.3? Advanced 300. What is SSL certificate types (DV, OV, EV)? Intermediate 301. What is self-signed certificate? Beginner 302. What is certificate chain? Intermediate 303. What is certificate pinning? Advanced 304. What is certificate revocation? Intermediate 305. What is CRL (Certificate Revocation List)? Intermediate 306. What is OCSP (Online Certificate Status Protocol)? Advanced 307. What is hashing? Beginner 308. What is hash function? Beginner 309. What is MD5 hash? Beginner 310. What is SHA-1, SHA-256, SHA-512? Intermediate 311. Why is MD5 insecure? Intermediate 312. What is collision in hashing? Intermediate 313. What is salted hash? Intermediate 314. What is rainbow table? Intermediate 315. What is HMAC (Hash-based Message Authentication Code)? Advanced 316. What is digital signature? Intermediate 317. What is code signing? Intermediate 318. What is end-to-end encryption (E2EE)? Beginner 319. What is perfect forward secrecy (PFS)? Advanced 320. What is Diffie-Hellman key exchange? Advanced 321. What is security monitoring? Beginner 322. What is SIEM (Security Information and Event Management)? Beginner 323. What is the difference between SIEM and log management? Intermediate 324. What is SOAR (Security Orchestration, Automation and Response)? Intermediate 325. What is the difference between SIEM and SOAR? Intermediate 326. What is Splunk? Beginner 327. What is IBM QRadar? Intermediate 328. What is ArcSight? Intermediate 329. What is LogRhythm? Intermediate 330. What is Elastic Stack (ELK)? Intermediate 331. What is log aggregation? Beginner 332. What is log correlation? Intermediate 333. What is security event? Beginner 334. What is alert vs event? Beginner 335. What is false positive in SIEM? Beginner 336. What is alert tuning? Intermediate 337. What is alert fatigue? Beginner 338. What is use case in SIEM? Intermediate 339. What is correlation rule? Intermediate 340. What is baseline in security monitoring? Intermediate 341. What is anomaly detection? Intermediate 342. What is behavior analytics (UEBA)? Advanced 343. What is user and entity behavior analytics? Advanced 344. What is threat intelligence? Intermediate 345. What is threat feed? Beginner 346. What is IOC (Indicator of Compromise)? Beginner 347. What is TTPs (Tactics, Techniques, and Procedures)? Intermediate 348. What is MITRE ATT&CK framework? Advanced 349. What is Cyber Kill Chain? Intermediate 350. What is Diamond Model of Intrusion Analysis? Advanced 351. What is security incident investigation? Intermediate 352. What is log retention policy? Beginner 353. What is compliance logging? Intermediate 354. What is audit trail? Beginner 355. What is forensic analysis of logs? Intermediate 356. What is time synchronization (NTP) importance? Intermediate 357. What is security dashboard? Beginner 358. What is KPI vs KRI in security? Advanced 359. What is mean time to detect (MTTD)? Intermediate 360. What is mean time to respond (MTTR)? Intermediate 361. What is incident response plan? Beginner 362. What is incident response team roles? Intermediate 363. What is preparation phase in incident response? Intermediate 364. What is detection and analysis phase? Intermediate 365. What is containment strategy? Beginner 366. What is short-term vs long-term containment? Intermediate 367. What is eradication phase? Intermediate 368. What is recovery phase? Intermediate 369. What is post-incident activity? Beginner 370. What is lessons learned meeting? Beginner 371. What is incident severity classification? Intermediate 372. What is incident prioritization? Intermediate 373. What is incident communication plan? Intermediate 374. What is escalation procedure? Beginner 375. What is runbook vs playbook? Advanced 376. What is security playbook? Beginner 377. What is digital forensics? Beginner 378. What is forensic investigation process? Intermediate 379. What is evidence collection? Intermediate 380. What is chain of custody? Intermediate 381. What is evidence preservation? Intermediate 382. What is forensic imaging? Intermediate 383. What is write blocker? Intermediate 384. What is dd command for imaging? Intermediate 385. What is FTK Imager? Beginner 386. What is memory forensics? Advanced 387. What is volatile vs non-volatile data? Intermediate 388. What is RAM analysis? Advanced 389. What is disk forensics? Intermediate 390. What is file carving? Advanced 391. What is deleted file recovery? Intermediate 392. What is network forensics? Advanced 393. What is packet capture analysis? Intermediate 394. What is timeline analysis? Advanced 395. What is log analysis in forensics? Intermediate 396. What is rootkit detection? Advanced 397. What is anti-forensics techniques? Advanced 398. What is steganography detection? Advanced 399. What is malware analysis in forensics? Intermediate 400. What is breach notification requirements? Intermediate 401. What is security compliance? Beginner 402. What is regulatory compliance? Beginner 403. What is PCI-DSS? Intermediate 404. What is HIPAA? Intermediate 405. What is GDPR? Intermediate 406. What is SOX (Sarbanes-Oxley)? Intermediate 407. What is ISO 27001? Advanced 408. What is NIST Cybersecurity Framework? Intermediate 409. What is CIS Controls? Intermediate 410. What is SOC 2 (Type I and Type II)? Advanced 411. What is FISMA? Intermediate 412. What is FedRAMP? Advanced 413. What is security audit? Beginner 414. What is internal audit vs external audit? Beginner 415. What is vulnerability assessment vs compliance scan? Intermediate 416. What is security policy? Beginner 417. What is security standard? Intermediate 418. What is security procedure? Beginner 419. What is security baseline? Intermediate 420. What is configuration management? Intermediate 421. What is change management? Beginner 422. What is risk management? Beginner 423. What is risk assessment methodology? Intermediate 424. What is quantitative vs qualitative risk assessment? Advanced 425. What is risk register? Intermediate 426. What is risk treatment options (accept, mitigate, transfer, avoid)? Intermediate 427. What is residual risk? Intermediate 428. What is business impact analysis (BIA)? Advanced 429. What is disaster recovery plan (DRP)? Beginner 430. What is business continuity plan (BCP)? Intermediate 431. What is RTO (Recovery Time Objective)? Intermediate 432. What is RPO (Recovery Point Objective)? Intermediate 433. What is security awareness program? Beginner 434. What is phishing simulation? Beginner 435. What is security training effectiveness? Intermediate 436. What is insider threat program? Intermediate 437. What is data classification? Beginner 438. What is data handling policy? Beginner 439. What is acceptable use policy? Beginner 440. What is vendor risk management? Intermediate 441. What is third-party risk assessment? Intermediate 442. What is security questionnaire? Beginner 443. What is penetration testing compliance? Intermediate 444. What is vulnerability disclosure policy? Advanced 445. What is bug bounty program? Intermediate 446. You notice unusual outbound traffic at 3 AM - what do you do? Intermediate 447. A user reports a phishing email - what are your steps? Beginner 448. Multiple failed login attempts detected - how do you respond? Intermediate 449. Ransomware detected on one endpoint - what's your action plan? Intermediate 450. User complains their account was compromised - investigation steps? Intermediate 451. Port scan detected from external IP - what do you check? Beginner 452. Alert shows data exfiltration to unknown destination - response? Advanced 453. Critical vulnerability found in production server - how to handle? Intermediate 454. CEO's credentials found on dark web - what do you do? Intermediate 455. Suspicious PowerShell script execution - how to investigate? Advanced 456. New malware variant not detected by antivirus - next steps? Advanced 457. DDoS attack targeting your website - mitigation strategy? Intermediate 458. Insider threat suspected - how do you investigate? Advanced 459. Zero-day exploit announced for software you use - actions? Intermediate 460. Audit shows unpatched systems - how to prioritize? Intermediate 461. User bypassed security controls - how to address? Intermediate 462. Security tool generating too many false positives - solution? Intermediate 463. Compliance audit in 2 weeks, gaps identified - plan? Intermediate 464. Third-party vendor breached - what's your response? Advanced 465. Cryptojacking detected on servers - remediation steps? Intermediate 466. Privileged account misuse detected - investigation approach? Advanced 467. IoT device on network behaving suspiciously - actions? Intermediate 468. Former employee still has access - what to check? Beginner 469. Security budget cut - how to prioritize spending? Advanced 470. New regulation announced - compliance implementation plan? Intermediate 471. What is the difference between DAST and SAST? Intermediate 472. What is a 'Honey Pot'? Beginner 473. What is 'Port Mirroring'? Intermediate 474. What is 'Entropy' in security? Intermediate 475. What is 'Shadow IT'? Beginner