Starting from the host computer, explain how you go to a website.

Your browser first performs a DNS lookup. Sending a query to a recursive resolver which traverses the DNS hierarchy to find the IP for the domain. Once resolved, your device initiates a TCP three-way handshake - SYN, SYN-ACK, ACK - to establish a connection. For HTTPS, a TLS handshake follows to negotiate encryption and exchange certificates. Your browser then sends an HTTP GET request. The server responds with HTML and assets, and your browser renders the page. Along the way, traffic passes through your local router. ISP, BGP hops, and the target datacenter - each of which a security analyst might monitor for anomalous behavior.

What is the difference between a network firewall and an intrusion detection system (IDS)?

A firewall is a preventive control - it enforces rules about what traffic is allowed or denied based on IP. Ports, and protocols. It sits at the network boundary and blocks traffic before it enters. An IDS is a detective control - it monitors traffic already on the network. Alerts when it matches known attack signatures or anomalous behavior. A firewall stops the threat at the door; an IDS tells you when something suspicious has slipped through or is moving laterally. In a mature environment you use both: the firewall blocks obvious bad traffic at the perimeter. And the IDS monitors internal segments for lateral movement or policy violations.

Name the layers of the OSI model and describe an attack type against each layer.

Physical - cable cutting or hardware tampering, mitigated by physical access controls. Data Link - ARP poisoning and MAC spoofing, mitigated by dynamic ARP inspection and port security. Network - IP spoofing and ICMP attacks, mitigated by ingress filtering and firewall rules. Transport - SYN flood attacks, mitigated by SYN cookies and rate limiting. Session - session hijacking via stolen tokens, mitigated by encrypted sessions and short token lifetimes. Presentation - SSL stripping downgrading HTTPS to HTTP, mitigated by HSTS headers. Application - SQL injection and XSS, mitigated by input validation, parameterized queries, and WAF rules.

Explain the CIA triad and give an example of how each principle applies to a real scenario.

Confidentiality means only authorized users can access sensitive data - enforced through encryption, access controls, and need-to-know principles. Example: encrypting patient records at rest and in transit for HIPAA compliance. Integrity means data is accurate and has not been tampered with - enforced through checksums. Digital signatures, and audit logs. Example: a bank using cryptographic hashing to detect if transaction records were altered. Availability means systems and data are accessible when authorized users need them - enforced through redundancy. Backups, and DDoS protection. Example: an e-commerce platform using load balancers so checkout stays up during peak traffic. In incident response I always identify which pillar was compromised to prioritize the response.

Describe the NIST Cybersecurity Framework and its five core functions.

NIST CSF organizes security into five functions. Identify - understand your assets, risks, and who owns what. Protect - implement safeguards: access control, training, encryption, patching. Detect - monitor continuously for security events using SIEM alerts and anomaly detection. Respond - execute your documented IR plan with defined roles and containment playbooks. Recover - restore systems, conduct post-incident reviews, and improve controls. I use it as a maturity model: when joining a new organization I assess where they fall in each function. Prioritize the biggest gaps. It is also useful for communicating security posture to non-technical leadership since the five functions map directly to business risk management.

How do you calculate risk in cybersecurity?

The core formula is Risk equals Threat multiplied by Vulnerability multiplied by Impact. Often simplified to Likelihood times Impact. Threat is who might attack and their capability - a nation-state versus an opportunistic script kiddie. Vulnerability is a weakness that can be exploited - an unpatched CVE or misconfigured S3 bucket. Impact is the consequence if it materializes - financial loss, regulatory fine, reputational damage, or operational downtime. Example: an unpatched Apache vulnerability on a public-facing server with access to customer PII represents high threat likelihood. High vulnerability, high impact - that gets prioritized immediately. The same vulnerability on an air-gapped internal system with no sensitive data gets lower priority. Risk assessment is how you justify security spending to leadership in business terms.

Explain the difference between symmetric and asymmetric encryption.

Symmetric encryption uses the same key for both encryption and decryption - AES is the standard. It is fast and efficient for encrypting large volumes of data. But the challenge is key distribution: how do you securely share the key with the recipient? Asymmetric encryption uses a key pair - a public key anyone can have. A private key you keep secret. Data encrypted with the public key can only be decrypted with the private key. RSA and elliptic curve cryptography are examples. It solves key distribution but is computationally expensive. In practice, TLS uses both: asymmetric encryption during the handshake to securely exchange a symmetric session key. Then symmetric for the actual data transfer because it's much faster. This hybrid approach is what makes HTTPS work at scale.

What is a hash function and how does it contribute to data integrity?

A hash function takes any input and produces a fixed-size output called a digest. It is one-way - you cannot reverse it to recover the original input. Good hash functions are deterministic, fast to compute, and collision-resistant. SHA-256 and SHA-3 are current standards. For data integrity, you hash a file before and after transmission - matching hashes confirm no tampering occurred. For password storage, you hash passwords with a salt so that even if the database is breached. Attackers cannot reverse the hashes to plaintext. In digital forensics, we hash evidence files to prove chain of custody - the hash before collection must match the hash during analysis. Proving the evidence was not modified.

Explain the steps involved in a typical incident response process.

I follow PICERL. Preparation - having playbooks, tools, and team roles defined before an incident. Identification - detecting and confirming an incident occurred. Triaging alerts to separate true positives from false positives, and scoping the impact. Containment - isolating affected systems to stop spread without destroying evidence; short-term might mean blocking an IP. Long-term might mean rebuilding affected systems. Eradication - removing the root cause: deleting malware, patching the exploited vulnerability, removing unauthorized accounts. Recovery - restoring systems to normal operation and monitoring closely for reinfection. Lessons Learned - post-incident review documenting what happened, what worked, what failed, and what controls to improve. Documentation throughout every phase is important for legal, compliance, and future reference.

Describe a security incident you responded to. What went well, what could be better?

In my home lab I simulated a ransomware infection by running a test payload on an isolated VM monitored by Splunk. When Splunk alerted on rapid file modifications and unusual process behavior. I immediately isolated the VM from the network to stop lateral movement. I documented the indicators of compromise - the process tree, file paths modified, and network connections attempted. What went well: my detection rules identified the behavior within 90 seconds. My isolation procedure was clean with no collateral damage. What I would improve: I did not have a pre-staged clean image ready. Which added 40 minutes to recovery. That taught me the value of maintaining known-good snapshots and testing restoration procedures before you actually need them.

What is the role of threat intelligence in incident response?

Threat intelligence gives you context that makes triage faster and more accurate. Without it you're reacting to individual alerts in isolation. With it you can ask: is this IP associated with a known threat actor? Is this malware part of a campaign targeting our industry? In practice I use threat intel feeds to improve SIEM alerts automatically - when an alert fires on an outbound connection. The SIEM queries our threat intel platform and appends whether that IP appears on known bad actor lists. This lets Tier 1 analysts make faster decisions without escalating everything. Threat intel also enables proactive hunting: if a threat report says a specific group is targeting financial services with a specific TTP. I write detection rules for that TTP before we see it in our environment.

What are your favorite security tools and why?

For network analysis, Wireshark for deep packet inspection - understanding exactly what traffic is flowing is fundamental to detection. For vulnerability scanning, Nessus to identify CVEs across assets and prioritize patching by risk. For SIEM, I have the most experience with Splunk - I have written SPL correlation rules. Built SOC dashboards, and used it to investigate alerts end to end. For penetration testing in my lab, Metasploit and Nmap. I choose tools based on the problem: Nmap for reconnaissance. Burp Suite for web application testing, Volatility for memory forensics during incident response. What I value in any tool is good logging so my actions remain auditable and defensible.

Explain the function of a SIEM system and how it improves an organization's security.

A SIEM collects log data from across the environment - firewalls. Endpoints, servers, cloud services, applications - normalizes it into a common format, and correlates events across sources to identify attack patterns. Without a SIEM, analysts manually check logs on dozens of individual systems. The SIEM centralizes everything. You can ask: did the IP that hit our firewall also appear in our web server logs and endpoint logs in the same time window? That correlation is what catches sophisticated attacks that look benign in isolation. It also provides the audit trail for compliance reporting and the forensic timeline for post-incident analysis. In a SOC, the SIEM is the central nervous system - everything flows through it.

What is the purpose of a honeypot and how can it be used as part of a cybersecurity strategy?

A honeypot is a decoy system intentionally designed to appear valuable and vulnerable to attract attackers. It has no legitimate business use, so any traffic to it is inherently suspicious - no false positives. The value is twofold: detection and intelligence. Detection - if an attacker hits the honeypot. You know someone is conducting reconnaissance or lateral movement inside your network, giving early warning before they reach real assets. Intelligence - you can observe their techniques, tools, and malware without risking real data. In a mature SOC, honeypots generate high-fidelity alerts because any interaction is malicious by definition. I have deployed low-interaction honeypots using OpenCanary in my home lab to practice detecting lateral movement patterns.

Why do you want to work in cybersecurity?

I am drawn to the adversarial nature of security - it is one of the few fields where you must think simultaneously like the defender. The attacker. What keeps me engaged is that the threat landscape evolves constantly, so the work never becomes routine. Each incident is a different puzzle. I also care about the impact: security failures have real consequences for real people - a hospital locked out of patient records during ransomware. Or individuals whose financial data is stolen. Being someone who prevents or responds to those outcomes matters to me. I built my foundation through a home lab and TryHackMe. Earned CompTIA Security+ to structure my knowledge, and I want to grow into incident response and threat hunting over time.

How do you stay up to date on security threats, actors, and best practices?

I have a daily routine for this. I follow the CISA Known Exploited Vulnerabilities catalog, Krebs on Security, and the SANS Internet Stormcast podcast. I am active in r/netsec and r/cybersecurity where practitioners share real observations before they make headlines. I use RSS to track vendor security advisories from Microsoft, Cisco, and AWS. When a major CVE drops, I read the technical write-ups to understand the exploitation mechanism - not just the CVSS score - because that helps me write better detection rules. I also participate in CTF competitions periodically because they expose me to attack techniques in a hands-on way that reading alone does not replicate.

How do you manage stress during a security incident?

Cybersecurity incidents are high-stakes by nature, so I have built habits that help me stay effective under pressure. First, I follow the playbook - documented processes mean I make decisions in advance rather than under stress. Second, I communicate status frequently: stakeholders who are informed don't add pressure to my workflow while I am working. Third, I focus on one containment step at a time rather than trying to solve everything simultaneously. After an incident I do a personal debrief to process what happened. Capture lessons while details are fresh. The stress also becomes more manageable with practice - running tabletop exercises. Lab simulations in lower-stakes environments builds the muscle memory that helps during real incidents.

Tell me about a time you had to explain a technical security issue to a non-technical person.

I discovered a misconfiguration in my home lab that would have exposed internal network traffic. To explain it to a non-technical stakeholder I used an analogy: imagine mailing a letter. Forgetting to seal the envelope - anyone who handles it during delivery can read the contents. That is what this misconfiguration does to our network traffic. I then explained the fix in business terms: sealing the envelope takes 30 minutes of configuration time. Prevents someone from reading our internal communications. When explaining technical risks I always focus on three things: what could go wrong. Who is affected, and what it costs to fix versus ignore. That framing lets non-technical stakeholders make informed decisions without needing to understand the underlying technology.

Career Resources · 25 Questions

Cybersecurity Analyst Interview Questions & Career Resources (2026)

Network security, incident response, and threat detection questions from real cybersecurity interviews. Plus the certification path hiring managers actually look for - from CompTIA Security+ to CISSP.

Build your resume View career guide

Resume Score

ATS Optimization

85/ 100

Keywords92%

Formatting88%

Impact76%

“3 callbacks in 5 days. Wild.”

Sarah K. - PM

Ready to Put This Into Action?

Your resume is the first impression. Make it count with our AI-powered resume builder.

Build your resume Try interview prep

Cybersecurity Analyst Interview Questions & Career Resources (2026)

Skills Checklist

Core Skills (Non-Negotiable)

High-Value Skills

Nice-to-Have Skills

Track Your Progress

Ready to Put This Into Action?