Security Questions | PrepOps.Dev

#1

What is DevSecOps? What its core principals?

#2

What the "Zero Trust" concept means? How Organizations deal with it?

#3

Explain the principle of least privilege

#4

What it means to be "FIPS compliant"?

#5

What is a Certificate Authority?

#6

Explain RBAC (Role-based Access Control)

#7

Explain Authentication and Authorization

#8

What authentication methods are there?

#9

Give an example of basic authentication process

#10

What are the three primary factors of authentication? Give three examples of each

#11

Explain Token-based authentication

#12

Explain Risk-based authentication

#13

Explain what is Single Sign-On

#14

Explain how the Kerberos authentication protocol works as a SSO solution

#15

Does Kerberos make use of symmetric encryption, asymmetric encryption, both, or neither?

#16

Explain MFA (Multi-Factor Authentication)

#17

Explain OAuth

#18

How do you manage sensitive information (like passwords) in different tools and platforms?

#19

What password attacks are you familiar with?

#20

How to mitigate password attacks?

#21

What is password salting? What attack does it help to deter?

#22

What are cookies? Explain cookie-based authentication

#23

True or False? Cookie-based authentication is stateful

#24

Explain the flow of using cookies

#25

What is SSH how does it work?

#26

What is the role of an SSH key?

#27

Explain Symmetrical encryption

#28

Explain Asymmetrical encryption

#29

What is "Key Exchange" (or "key establishment") in cryptography?

#30

True or False? The symmetrical encryption is making use of public and private keys where the private key is used to decrypt the data encrypted with a public key

#31

True or False? The private key can be mathematically computed from a public key

#32

True or False? In the case of SSH, asymmetrical encryption is not used to the entire SSH session

#33

What is Hashing?

#34

How is hashing different from encryption?

#35

How hashes are part of SSH?

#36

Explain the following:

Vulnerability
- Exploits
- Risk
- Threat

#37

Are you familiar with "OWASP top 10"?

#38

What is XSS?

#39

What is an SQL injection? How to manage it?

#40

What is Certification Authority?

#41

How do you identify and manage vulnerabilities?

#42

Explain "Privilege Restriction"

#43

How HTTPS is different from HTTP?

#44

What types of firewalls are there?

#45

What is DDoS attack? How do you deal with it?

#46

What is port scanning? When is it used?

#47

What is the difference between asynchronous and synchronous encryption?

#48

Explain Man-in-the-middle attack

#49

Explain CVE and CVSS

#50

What is ARP Poisoning?

#51

Describe how do you secure public repositories

#52

What is DNS Spoofing? How to prevent it?

#53

What can you tell me about Stuxnet?

#54

What can you tell me about the BootHole vulnerability?

#55

What can you tell me about Spectre?

#56

Explain "Format String Vulnerability"

#57

Explain DMZ

#58

Explain TLS

#59

What is CSRF? How to handle CSRF?

#60

Explain HTTP Header Injection vulnerability

#61

What security sources are you using to keep updated on latest news?

#62

What TCP and UDP vulnerabilities are you familiar with?

#63

Do using VLANs contribute to network security?

#64

What are some examples of security architecture requirements?

#65

What is air-gapped network (or air-gapped environment)? What its advantages and disadvantages?

#66

Explain what is Buffer Overflow

#67

What is Nonce?

#68

What is SSRF?

#69

Explain MAC flooding attack

#70

What is port flooding?

#71

What is "Diffie-Hellman key exchange" and how does it work?

#72

Explain "Forward Secrecy"

#73

What is Cache Poisoned Denial of Service?

#74

What is the difference if any between SSL and TLS?

#75

What's SSL termination (or SSL offloading)?

#76

What is SNI (Server Name Indication)?

#77

What benefits SNI introduces?

#78

Explain "Web Cache Deception Attach"

#79

Explain "Advanced persistent threat (APT)"

#80

What is a "Backdoor" in information security?

#81

Briefly describe what a software supply chain is.

#82

What're some benefits of a software supply chain?

#83

Give three examples of three potential security threats related to the software supply chain and describe them.

#84

What is a package manager?

#85

What is a build tool?

#86

Describe bloated dependencies.

#87

Explain a few cons of bloated dependencies.

#88

What solutions are there for managing project dependencies?

#89

What is a threatening actor and how can this actor take advantage of open source or third party vendor's packages/libraries?

#90

How can you make sure that you use trustworthy packages for your project?

#91

Explain checksum.

#92

What is Microsegmentation?

#93

Why do we need Microsegmentation solutions? Why using something such as firewalls isn't enough?

#94

How Microsegmentation is applied?

#95

What are ephemeral environments in the context of Microsegmentation?

#96

How does Microsegmentation help prevent lateral movement?

#97

What challenges arise when scaling Microsegmentation?