All jobs / Cybersecurity

Endpoint Security interview questions

Endpoint Security questions a Cybersecurity can be asked, from first job to senior. Open one to see the strongest answer and why it works.

  1. A critical CVE is out for your web server. What is the first honest step?

    The strongest answer: Find where you run it, patch or mitigate, and say what is still exposed — I do not wait for a pretty ticket template

    Why it works: Exactly. Inventory, patch or mitigate, residual. Theatre and banner-spoofing are red flags.

    • Find the running instances.
    • Patch or mitigate.
    • Name what is still open.
    • Do not spoof versions.

  2. What does EDR give you that classic antivirus does not?

    The strongest answer: Antivirus tries to block known-bad files; EDR records what processes actually did, alerts on suspicious behaviour, and lets you investigate afterwards and isolate the host

    Why it works: Exactly — the recorded telemetry is what turns “something is wrong” into a timeline and a contained host.

    • Antivirus blocks; EDR records and responds.
    • Behaviour, not only signatures.
    • Telemetry enables investigation.
    • Isolation is a response action.

  3. You see an unlocked laptop on a cafe table. What is the security lesson for work?

    The strongest answer: Disk encryption, auto-lock, and no prod tokens on a device that can walk away — cafe theatre is the same class as an office walk-by

    Why it works: Exactly. Physical access is a class of attacker. Stickers and “not at work” are not controls.

    • Encrypt and auto-lock.
    • Minimise tokens on the device.
    • Physical access counts.
    • VPN ≠ unlocked is fine.

  4. A critical remote-exec CVE is 12 days old on an internet box. What was missing?

    The strongest answer: An SLA that matches exposure — internet + critical is days, with a named owner, not a quarterly patch window

    Why it works: Exactly. Exposure sets the clock. Dashboards without owners are furniture.

    • SLA by exposure.
    • Named owner.
    • Days, not quarters, for internet critical.
    • “Hard to reach” is not a waiver.

  5. You are asked to “harden” a fleet of servers. What does that mean concretely, and how is it still true six months later?

    The strongest answer: Remove what is not needed, close default accounts and services, write the configuration down as a baseline, and enforce it with configuration management plus drift reporting rather than a one-time checklist

    Why it works: Right — the durable part is enforcement plus drift detection, because a hardened server drifts within weeks.

    • Hardening reduces what exists.
    • Start from a recognised baseline.
    • Enforce with configuration management.
    • Report drift, not just compliance.

  6. Finance wants USB drives blocked after a lost stick; three engineering teams say they need them for lab equipment.

    How do you land a device-control policy that survives?

    The strongest answer: Default block with a real exception path — allow specified device classes on named machines, require encryption where data is written, log the use, and review the exception list on a schedule

    Why it works: Exactly — default deny with a usable exception path and an expiry is what stops the control being switched off in month two.

    • Default deny, real exception path.
    • Allow device classes, not everything.
    • Encrypt and log what is written.
    • Expire and review the exceptions.

  7. EDR flags credential-dumping behaviour on the laptop of a finance director, an hour before the quarterly close.

    Isolating the host stops their work. How do you make that call, and how do you own it?

    The strongest answer: Isolate — credential theft spreads while we debate — then work an alternative path for the close with their team, and rely on a standing rule that says who may isolate so the authority is not invented in the moment

    Why it works: Right — pre-agreed authority is what makes a fast containment decision defensible the next morning.

    • Contain first on credential theft.
    • Pre-agree who may isolate.
    • Offer a continuity path.
    • Record the call and the time.

  8. Vulnerability management at 5,000 assets fails for which usual reason?

    The strongest answer: No owner per asset class, and no SLA by exposure — scanners without assignment are weather reports

    Why it works: Exactly. Ownership and clocks. Feeds and colours are not the scarce thing.

    • Owner per asset class.
    • SLA by exposure.
    • Scanners assign, not decorate.
    • Do not wait on a redder chart.