50 Entry-Level Cybersecurity Interview Questions and Answers

Key takeaways

• Fifty questions, grouped by topic, each with a short answer you can expand in your own words.
• Interviewers test understanding, so expect follow-ups such as "how would you check that?"
• Strong areas for freshers are networking, the CIA triad, common attacks, authentication and basic incident response.
• Mention a lab you actually did. Never claim experience you do not have.
• Know the legal frame: testing systems without written permission is an offence in India under the IT Act.

Fundamentals

1. What is cybersecurity? Protecting systems, networks and data from unauthorised access, misuse or damage.
2. What is the CIA triad? Confidentiality (only authorised access), integrity (data is not altered improperly) and availability (systems work when needed).
3. Threat, vulnerability and risk? A threat is something that can cause harm, a vulnerability is a weakness, and risk is the likelihood and impact of a threat using a vulnerability.
4. What is defence in depth? Layering controls so one failure does not expose everything, for example firewall, EDR, MFA, backups and monitoring.
5. What is least privilege? Giving users and services only the access they need for their task.
6. Authentication vs authorisation? Authentication proves who you are. Authorisation decides what you may do.
7. What is a zero-day? A vulnerability unknown to the vendor, so no patch exists yet.
8. Blue team, red team, purple team? Defenders, authorised attackers, and a mode where both share findings to improve detection.

Networking

9. What are the OSI layers? Physical, Data Link, Network, Transport, Session, Presentation, Application.
10. TCP vs UDP? TCP is connection-oriented and reliable. UDP is connectionless and faster with no delivery guarantee.
11. What is a three-way handshake? SYN, SYN-ACK, ACK, which sets up a TCP connection.
12. What does DNS do? It translates names into IP addresses. Attacks include cache poisoning and tunnelling.
13. Which ports should you know? 22 SSH, 53 DNS, 80 HTTP, 443 HTTPS, 25 SMTP, 3389 RDP, 445 SMB.
14. What is a firewall? A device or software that allows or blocks traffic by rules. Next-generation firewalls also inspect applications.
15. IDS vs IPS? An IDS detects and alerts. An IPS can also block.
16. What is a VPN? An encrypted tunnel across an untrusted network.
17. What is NAT? Translating private addresses to public ones so many devices share fewer public addresses.

Threats and attacks

18. What is phishing? Tricking people into giving credentials or running malware, usually by email, SMS or voice.
19. What is ransomware? Malware that encrypts data and demands payment, often after stealing it too.
20. Virus, worm, trojan? A virus needs a host file, a worm spreads by itself, and a trojan pretends to be useful software.
21. What is a DDoS attack? Overwhelming a service with traffic from many sources so real users cannot reach it.
22. What is a man-in-the-middle attack? An attacker sits between two parties to read or alter traffic. TLS and certificate checks reduce it.
23. What is SQL injection? Untrusted input changes a database query. Prevent it with parameterised queries.
24. What is cross-site scripting (XSS)? Injecting script into a page that runs in other users' browsers. Prevent with output encoding and a content security policy.
25. What is CSRF? Tricking a logged-in user's browser into making an unwanted request. Prevent with tokens and SameSite cookies.
26. What is social engineering? Manipulating people, not systems, to gain access or information.
27. What is a brute force vs password spraying attack? Brute force tries many passwords on one account. Spraying tries a few common passwords across many accounts.

Cryptography and identity

28. Symmetric vs asymmetric encryption? Symmetric uses one shared key and is fast. Asymmetric uses a public and private key pair.
29. Encryption vs hashing? Encryption is reversible with a key. A hash is one-way and used for integrity and password storage.
30. Why salt passwords? A unique salt stops identical passwords having identical hashes and defeats precomputed tables. Use a slow password hashing function such as bcrypt or Argon2.
31. What is a digital certificate? A signed document binding a public key to an identity, issued by a certificate authority.
32. How does HTTPS protect you? TLS encrypts traffic and authenticates the server with its certificate.
33. What is multi-factor authentication? Combining something you know, have and are. Phishing-resistant forms use FIDO2 keys.
34. What is single sign-on? One login gives access to many applications, usually through SAML or OpenID Connect.

Tools and operations

35. What is a SIEM? A platform that collects logs, correlates events and raises alerts. Splunk and Elastic are common examples.
36. What is EDR? Endpoint detection and response, which watches endpoint behaviour and lets analysts investigate and contain.
37. What does Nmap do? Discovers hosts and open ports and identifies services. Use it only on systems you are authorised to scan.
38. What is Wireshark used for? Capturing and analysing network packets for troubleshooting and investigation.
39. What is a vulnerability scan vs a penetration test? A scan finds known weaknesses automatically. A penetration test manually exploits and proves impact within a scope.
40. What is CVSS? A scoring system for vulnerability severity from 0 to 10. It is not the same as risk to your business.
41. What is patch management? Tracking, testing and applying updates by priority, with internet-facing and exploited flaws first.
42. What is hardening? Removing unneeded services and applying secure settings, for example CIS benchmarks.

Incident response and governance

43. What are the incident response phases? Preparation, detection and analysis, containment, eradication, recovery and lessons learned.
44. You see a suspicious login at 3 a.m. What do you do? Verify the alert, check source and device, review related activity, contain by resetting sessions and credentials if confirmed, and document and escalate.
45. What is a false positive? An alert for harmless activity. Tuning rules reduces them without hiding real threats.
46. What is chain of custody? A record of who handled evidence and when, so it stays reliable.
47. What is the MITRE ATT&CK framework? A public knowledge base of adversary tactics and techniques used to map detections.
48. What is GRC? Governance, risk and compliance: policies, risk assessment and meeting standards such as ISO 27001.
49. What is data loss prevention? Controls that detect and block sensitive data leaving the organisation.
50. What are your next steps if a laptop is lost? Report it, revoke sessions, remotely lock or wipe, confirm disk encryption, and assess what data was on it.
51. Why do you want to work in security? Give a true answer, tie it to something you built or learned, and show you keep learning.

How should you prepare beyond reading?

• Build a home lab: a few virtual machines, a log collector and an intentionally vulnerable web app such as OWASP Juice Shop, used only on your own network.
• Practise on PortSwigger Web Security Academy and write short notes on what you learned.
• Rehearse three answers aloud, including one where you say "I do not know, but I would check this".
• Map your answers to the MITRE ATT&CK framework where it fits.

For overlapping question sets, see basic cybersecurity interview questions for beginners, 50 common cybersecurity interview questions and cyber security interview questions for beginners.

Next steps

To prepare with guided practice, see WebAsha's cyber security course and the SOC course for defensive roles.

Related reading

• Top Cyber Security Interview Questions 2026
• Top 2026 Cyber Security Interview Questions and Answers
• [2026] Top 50+ CompTIA Security+ Interview Questions and Answers