Security Fundamentals interview questions
Security Fundamentals questions a Cybersecurity can be asked, from first job to senior. Open one to see the strongest answer and why it works.
What is the CIA triad, and why do interviewers keep asking about it?
The strongest answer: Confidentiality, integrity, availability — the three things an attack damages. Naming which one a risk hits tells you which control to reach for
Why it works: Exactly — it is a sorting tool. Ransomware is availability and integrity; a leaked export is confidentiality.
- Three goals, not three products.
- Confidentiality: who may see it.
- Integrity: is it still true.
- Availability: can we reach it.
A manager uses “threat”, “vulnerability” and “risk” as if they were one word. How do you separate them?
The strongest answer: A vulnerability is the weakness, a threat is who or what would use it, and risk is the chance it happens and the damage if it does — only risk can be ranked
Why it works: Right — risk is the one with likelihood and impact in it, which is why the queue is sorted by risk, not by count.
- Risk joins likelihood and impact.
- Vulnerability: the weakness itself.
- Threat: who would use it.
- Rank by risk, not by count.
A founder says “we are secure, we have HTTPS.” What do you add?
The strongest answer: HTTPS is the wire — we still owe authz, secrets, XSS, and who can see the data at rest
Why it works: Exactly. Transport is one control. Most cheap bugs live above it.
- TLS = the wire.
- Still do authz and XSS.
- Still protect data at rest.
- Do not skip auth for TLS 1.3.
What is the attack surface of a system, and how would you actually produce a list of it?
The strongest answer: Every place untrusted input or an untrusted user can reach us — endpoints, ports, integrations, admin tools, browser-side dependencies — built from routing, DNS and cloud inventory rather than memory
Why it works: Exactly — enumerating it from sources of truth is what makes forgotten subdomains and staging hosts show up.
- Count the doors, not the bugs.
- Enumerate from DNS, routes, inventory.
- Include admin and integrations.
- Re-run it; the surface drifts.
You have 200 Highs in the scanner. How do you pick this week’s work?
The strongest answer: Internet-facing, known exploit, and data class — I will not pretend all Highs are equal or hide the queue
Why it works: Exactly. Exposure and exploitability. Mass-accept is a lie with a timestamp.
- Face the internet first.
- Known exploits next.
- Data class matters.
- Do not mass-accept.
One filtering rule at the edge was the only thing stopping a known bad request pattern. It was disabled during an incident and nobody noticed for a week.
What does defence in depth actually require here, beyond “add another tool”?
The strongest answer: Layers that fail independently — fix the input handling in the code, keep the outer filter as a net, and alert when a control is disabled, so no single switch is the whole defence
Why it works: Right — independence is the point, and a control you cannot tell is switched off is not a layer.
- Layers must fail independently.
- Fix the cause, keep the net.
- Alert when a control is off.
- Test with one layer removed.
A vendor says their box “is Zero Trust.” What do you ask?
The strongest answer: What we stop trusting — network, device, or identity — and what we still verify on each request; the phrase is not a product
Why it works: Exactly. Zero trust is a direction: verify, least privilege, assume breach. A sticker is not that.
- Ask what we stop trusting.
- Ask what we verify each time.
- The phrase is not a box.
- Do not buy a sticker.
How do you talk about security debt in a planning room?
The strongest answer: As named items with blast radius and a planned burn — not a vibe that “we are messy” and not a surprise freeze the week of launch
Why it works: Exactly. Debt is a backlog. Freezes and private lists are how you get tunnels and surprises.
- Name items and blast radius.
- Plan the burn.
- Same backlog as features.
- No launch-week surprise freeze.
What do you listen for when hiring a senior security engineer?
The strongest answer: How they reduced a class of bugs, and how they said no without becoming a tunnel — not a trivia list of CVE numbers
Why it works: Exactly. Leverage and judgement. Trivia and martyrdom are smells.
- Listen for a class of bugs reduced.
- Listen for a grown-up no.
- Skip CVE trivia.
- Do not hire a martyr.
Give the one-sentence residual you would say at go-live for a payments change.
The strongest answer: “We proved authz and the sandbox charge on the paths we named; we did not prove a novel issuer, and finance accepted that gap.”
Why it works: Exactly. Proved, not proved, accepter. “Good,” counts, and shrugs are not residuals.
- Proved / not proved / accepter.
- Name the gap.
- Do not say “looks good.”
- Do not hide behind a count.