All jobs / IT support / sysadmin
IT Security interview questions
IT Security questions a IT support / sysadmin can be asked, from first job to senior. Open one to see the strongest answer and why it works.
Someone calls: “Reset my password, I am the CFO.” First move?
The strongest answer: Verify identity with the process you already have — callback, manager, or a known device — then reset. A title is not a badge
Why it works: Exactly. Identity first. Urgency is how attackers sound.
- Verify, then reset.
- A job title is not identity.
- Do not handle their new password.
- Do not refuse all resets; use the process.
A user forwards a “payroll update” mail and asks if they should click. What do you say?
The strongest answer: Do not click — report it with the company button or to the mailbox you name, and I will treat the sample as evidence, not as a link to try
Why it works: Exactly. Report, do not detonate. Your curiosity is not a sandbox.
- Do not click; report.
- Keep the sample as evidence.
- Do not open it “to see.”
- Do not reply to the bait.
A user wants local admin “to install one app.” What do you do?
The strongest answer: Ask what the app is, use the approved install path or a time-boxed exception with a ticket — I do not hand out standing admin for convenience
Why it works: Exactly. Least privilege is the default. Exceptions are written and short.
- Approved path or a short written exception.
- No standing local admin for speed.
- Do not make everyone admin.
- Do not install mystery files.
A user pastes their password into the chat so you can “do it faster.” What do you do?
The strongest answer: Stop, tell them to change it now, and use a proper remote or reset path — I do not copy it into a note “just this once”
Why it works: Exactly. A pasted password is a leak. Rotate and use the real path.
- Treat it as leaked; they change it.
- Use the proper remote/reset path.
- Do not store it.
- Do not move it to email.
A user sends a “helpful utility” EXE from a forum. What do you do?
The strongest answer: Do not run it — find the approved tool or a vendor we already trust, and say why a random EXE is a no
Why it works: Exactly. Approved path or a real review. Forums are not your catalogue.
- Use approved software.
- Do not run forum EXEs.
- User PCs are not labs.
- Do not fake a signature.
MFA device lost. User is travelling. What is the bar?
The strongest answer: A stronger identity check than a password reset, a recorded exception, and a new factor they control — I do not email a bypass code to the ticket CC
Why it works: Exactly. MFA reset is the keys. Record it. CC is not a safe channel.
- Stronger check than a password reset.
- Record the exception.
- Do not mail bypass codes to a CC.
- Do not disable MFA for everyone.
Three people clicked. One entered a password. Your first hour?
The strongest answer: Contain those accounts, reset and revoke sessions, preserve the mail, tell the path that handles IR — I do not wait for a weekly meeting
Why it works: Exactly. Contain, reset, evidence, escalate. Shame and silence help the attacker.
- Contain and reset now.
- Keep the sample.
- Call IR; do not wait for a meeting.
- Do not hide it to look good.
A floor printer has a default password and an old firmware. Why is that your ticket?
The strongest answer: It is a computer on the network — I change the password, put it on the right VLAN if we have one, and patch or isolate; I do not ignore it as “just a printer”
Why it works: Exactly. Printers store jobs and speak IP. Defaults are a door.
- Treat printers as hosts.
- Change defaults; segment if you can.
- Do not park them on guest.
- Do not print the password.
A user finds a “free full version” of a paid app. Your answer?
The strongest answer: No — we buy it, use the approved edition, or we do without; cracked installers are malware with extra steps
Why it works: Exactly. Licence or live without. “Free full” is how you buy an incident.
- Buy, approved edition, or without.
- Cracks are malware.
- Off-network is still your device.
- Do not install it “to supervise.”
A phishing wave is hitting many inboxes. Beyond individual resets?
The strongest answer: Block the campaign, hunt who entered secrets, tell people what to look for now, and fix the mail path that let it through — a single reset is not a wave plan
Why it works: Exactly. Block, hunt, warn, fix the path. Shame and pretty reports help the next wave.
- Block, hunt, warn, fix the path.
- Do not roast clickers.
- Do not turn mail off as a plan.
- Do not hide the wave.
How do you find standing admin that nobody needs?
The strongest answer: A recurring access review with managers who can say no, plus logs of use — I do not wait for an incident to notice a ghost admin
Why it works: Exactly. Reviews and use. Friday mass-removals are how you earn a reputation for outages.
- Recurring reviews + use logs.
- Managers must be able to say no.
- Do not Friday-strip as sport.
- Do not assume leavers are clean.
A workstation is beaconing like malware. First network move?
The strongest answer: Isolate it — VLAN, wireless kick, or cable pull — then image-preserving forensics you are allowed to do; I do not keep it on “to watch”
Why it works: Exactly. Pull it off the peers. Watching on the LAN is a lab you did not set up.
- Isolate first.
- Preserve if you can.
- Do not watch on the LAN.
- Do not reboot away evidence.
A standing local-admin exception has lived for 18 months. What do you do?
The strongest answer: Time-box or remove it, and fix the install path that made it necessary — eternal exceptions are the real policy
Why it works: Exactly. Age is a smell. Hiding and promoting are how you fail the next review.
- Expire or remove standing exceptions.
- Fix the path that needed them.
- Do not hide them.
- Do not promote them.
Developers need occasional admin. What is the grown-up path?
The strongest answer: A requestable, expiring elevation with a reason — standing admin on every engineering laptop is how a supply-chain click wins
Why it works: Exactly. Expire and reason. Adults still click. A freeze that trains bypasses is not grown-up.
- Expiring, requestable elevation.
- No standing admin by default.
- No shared devadmin.
- Do not make a policy people must bypass.
What is a useful phishing tabletop?
The strongest answer: A timed story with real buttons: who isolates, who tells, who resets — not a slide that says “be careful”
Why it works: Exactly. Decisions and clocks. Shame quizzes and unplanned board tests are how you lose air cover.
- Timed decisions, real roles.
- No shame leaderboard.
- No button-free film.
- Do not surprise the board without a net.
What does a senior IT person change besides filters?
The strongest answer: How easy it is to report, how people are treated when they do, and whether leaders click the same tests — filters without culture leak
Why it works: Exactly. Reporting must be safe and easy. Rankings and invented cuts are how you teach silence.
- Easy, safe reporting.
- Leaders take the same tests.
- No public clicker ranks.
- No invented training %.
What does least privilege look like as a program, not a slogan?
The strongest answer: Default-deny grants, expiring exceptions, reviews managers finish, and a backlog to remove standing admin — a poster is not a program
Why it works: Exactly. Defaults, expiry, finished reviews, a backlog. Slogans and fake percents are décor.
- Defaults, expiry, finished reviews, backlog.
- Posters ≠ a program.
- Do not neuter the desk.
- No invented zero-trust %.
What does a real access certification do?
The strongest answer: A human who knows the work says keep or drop, with evidence, on a deadline — a bulk “approve all” is theatre
Why it works: Exactly. A decision by someone who can know. Bulk approve and fake percentiles are costumes.
- Keep/drop by someone who knows the work.
- Deadline and evidence.
- No approve-all theatre.
- IT cannot certify need alone.
Security wants twelve steps to open a document. Users mail it to Gmail. Your staff line?
The strongest answer: The control we will keep is the one people can finish — I will not design a maze that trains a side door
Why it works: Exactly. Usable controls. Mazes and total drops are two ways to lose the document.
- Keep controls people can finish.
- Mazes create Gmail.
- Do not only ban the side door.
- Do not drop every control.
How long do you keep admin logs, and what do you refuse?
The strongest answer: A written retention you can defend, and I refuse to keep everyone’s mailbox “just in case” without a rule
Why it works: Exactly. A rule. Forever and ticket-length are two wrong clocks. Do not invent law.
- Write a retention you can defend.
- Do not hoard all mail “in case.”
- Forever is not a policy.
- Do not invent a legal year.