Security Administrator Guide: Skills, Tasks and Interview Questions

Anil Jalela · Published Sep 29, 2022 · 29 min read

A security administrator turns risk decisions into repeatable controls: known assets, attributable access, hardened systems, useful telemetry, tested response, and recoverable services. This guide provides a beginner-to-advanced operating path, Linux and Windows evidence commands, practical scenarios, and a complete 200-question preparation bank.

This guide was technically reviewed on 11 August 2026. It uses the six functions of the NIST Cybersecurity Framework 2.0 as its organizing model: Govern, Identify, Protect, Detect, Respond, and Recover. Adapt every example to the organization's approved architecture, legal duties, change process, and supported operating systems.

What a security administrator is responsible for

The role sits between policy and daily operations. A security administrator does not personally own every server, application, identity, network, or business decision. The administrator makes the required security state visible, implements or verifies controls with the system owner, collects evidence, handles exceptions, and escalates risk to the person authorized to accept it.

Confidentiality, integrity, and availability remain useful properties, but they are not a priority order. A payroll record needs confidentiality and integrity; an emergency communication service may put immediate availability first. Add authenticity, accountability, privacy, safety, and resilience when the system requires them.

Start with authorization and a safe operating boundary

Security tools can scan networks, read sensitive logs, disable accounts, isolate devices, block traffic, and collect personal data. Written authorization must name the scope, permitted techniques, maintenance window, evidence handling, escalation path, and stop conditions. A job title does not grant unlimited permission.

• Use a named personal account for administration; use separate privileged access when needed.
• Work from an approved management device through the required VPN, bastion, or privileged access service.
• Open a change or incident record before a production action and record the target precisely.
• Begin with read-only discovery. Preserve output with time, host identity, command, and operator.
• Define a rollback or alternate access path before changing identity, firewall, routing, storage, or encryption.
• Keep secrets, tokens, private keys, full logs, and customer data out of shell history, screenshots, tickets, and chat.

Your first day: build a security baseline

1. Identify the business services. Record what must keep working, its owner, users, data, location, dependencies, recovery objective, and support window.
2. Reconcile assets. Compare discovery, cloud accounts, virtualization, endpoint management, directory services, DNS, DHCP, certificates, repositories, and purchasing records. Mark unknown and unmanaged assets.
3. Map privileged identities. Include people, service accounts, workload identities, API tokens, local administrators, emergency accounts, vendor access, and authentication recovery paths.
4. Confirm minimum telemetry. Prove that authentication, privilege, endpoint, network, cloud control-plane, application, and backup events reach a protected central destination with synchronized time.
5. Review critical exposure. Find internet-facing services, remote administration paths, unsupported software, known exploited vulnerabilities, missing MFA, public storage, stale accounts, and uncontrolled secrets.
6. Test escalation. Contact the service owner and incident path with a harmless exercise. A contact list that has not been tested is an assumption.
7. Restore something. Restore one representative file or disposable service and validate content, access, dependencies, and elapsed time.
8. Create a prioritized plan. Rank work by business impact, exposure, exploitability, control weakness, and recovery difficulty, not only a scanner score.

Build an inventory that can answer incidents

A useful asset record connects technology to ownership and response. At minimum record a stable asset ID, hostname, serial or cloud resource ID, environment, operating system and support status, network addresses, internet exposure, business service, data classification, owner, administrator, criticality, backup policy, log destination, vulnerability source, and decommission state.

Do not treat one scanner as the source of truth. Compare independent views. A cloud resource may have no endpoint agent; a laptop may be offline during a scan; a container may live for minutes; a SaaS application may appear only in identity logs and expense records. Reconciliation is the control.

Read-only Linux discovery

date -u
hostnamectl
uname -a
cat /etc/os-release
ip -brief address
ip route show
ss -lntup
systemctl --failed
systemctl list-unit-files --state=enabled
findmnt
df -hT
timedatectl status

ss -lntup may need privilege to show every process. A listening socket is evidence of a local listener, not proof that a firewall or upstream path exposes it. Compare the output with the approved service inventory, host firewall, security group, load balancer, and an authorized external observation point.

Read-only Windows discovery

Get-Date -AsUTC
Get-ComputerInfo | Select-Object WindowsProductName, WindowsVersion, OsBuildNumber
Get-NetIPConfiguration
Get-NetTCPConnection -State Listen |
  Sort-Object LocalPort |
  Select-Object LocalAddress, LocalPort, OwningProcess
Get-Service | Where-Object Status -eq 'Running'
Get-MpComputerStatus
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 20

Run these from a controlled PowerShell session and export only the evidence required. Product status fields vary with the endpoint protection platform, and Get-HotFix is not a complete software or update inventory. Reconcile with the supported endpoint and patch management system.

Identity and access: make every action attributable

Start with the joiner, mover, and leaver lifecycle. The identity source should establish who a person or workload is; groups and roles should provide the minimum required access; privileged elevation should be time-bounded and approved; reviews should remove unused access; termination should revoke sessions, tokens, keys, recovery methods, and devices.

Do not use a shared root or domain administrator account for convenience. Where a legacy system requires a shared credential, place it in an approved vault, require checkout attribution and strong approval, alert on use, rotate after exposure or personnel change, and maintain a dated plan to remove the dependency.

Secure configuration, patching, and vulnerability management

A scanner finding is an input, not a remediation plan. Verify the asset and software, determine whether the vulnerable component is reachable and used, check authoritative vendor guidance and CISA's Known Exploited Vulnerabilities Catalog, identify compensating controls, test the supported update, deploy to a canary, observe health and security signals, then expand or roll back.

Use a supported configuration baseline such as the vendor security baseline, a CIS Benchmark, or an organization-specific profile. Record every deviation with its reason, owner, compensating control, expiration, and review. A benchmark score without business context can reward a disabled service while ignoring a broken recovery path.

# Package and service evidence; commands vary by distribution.
apt list --upgradable 2>/dev/null
dnf check-update
systemctl --failed
journalctl -p warning..alert --since '24 hours ago'

# Find unexpectedly writable files without crossing mounted filesystems.
find /etc -xdev -type f -perm /022 -printf '%m %u:%g %p\n'

dnf check-update commonly returns exit status 100 when updates are available; automation must treat that as a documented result rather than a generic failure. Package lists can reveal software and repository details, so protect collected output.

Network security: verify paths, not just firewall rules

Network boundaries reduce reachable attack paths but do not create trust by themselves. Document zones, ingress, egress, administrative paths, name resolution, proxies, load balancers, private connectivity, wireless, remote access, and cloud controls. Use default-deny where the service model supports it, permit explicit sources and destinations, and remove expired rules.

ip route get 203.0.113.10
getent ahosts service.example.net
ss -tn state established
traceroute -n service.example.net
curl --fail --show-error --silent --head https://service.example.net/

Ping uses ICMP, not a TCP or UDP port. Traceroute behavior differs by operating system and options and may use UDP, ICMP, or TCP probes with increasing IP time-to-live or hop-limit values. Missing replies do not prove a broken path because routers may forward traffic without returning diagnostic messages.

When changing a remote firewall, schedule an approved window, preserve a separate management path, validate syntax, apply a temporary or automatically reversible rule when the platform supports it, test both allowed and denied flows, and confirm logging. The firewall operations guide provides a fuller staged workflow.

Logging and detection: collect evidence somebody will use

Centralize events from identity, endpoints, servers, network controls, DNS, email security, cloud control planes, applications, databases, secrets platforms, and backup systems. Protect logs from alteration, restrict access, define retention with legal and privacy owners, synchronize clocks, and monitor collection gaps.

A detection is complete only when it has an owner, severity logic, triage steps, evidence sources, safe containment options, communication path, and test history. Measure false positives and false negatives in context. A noisy alert exhausts operators; a missed high-impact event leaves the organization blind.

Application and API security

Use OWASP ASVS 5.0 as a testable requirements catalog for web application controls. Apply the appropriate OWASP standard for mobile or other application types. Threat modeling should identify assets, trust boundaries, entry points, abuse cases, and controls before implementation.

• Use parameterized queries and constrained database identities rather than constructing SQL from input.
• Validate input for the expected data model and encode output for the exact HTML, attribute, URL, JavaScript, or other context.
• Protect state-changing requests with framework-supported anti-CSRF controls, appropriate SameSite cookies, and origin checks where suitable.
• Keep authentication, authorization, and session management server-side. Test access to another user's object and every privileged function.
• Store passwords with a current adaptive password hashing scheme and unique salts. Keep encryption keys and application secrets outside source code.
• Inventory dependencies and build artifacts, pin and review changes, scan continuously, generate an SBOM where required, and define emergency update ownership.
• Rate limits and lockouts must slow abuse without enabling easy denial of service. Add device, behavior, reputation, and risk signals as appropriate.

Encoding is representation, hashing is normally one-way integrity transformation, encryption is reversible with a key, and signing provides origin and integrity properties. TLS protects supported data in transit between validated endpoints; it does not authorize a user, fix application vulnerabilities, or protect plaintext after an endpoint processes it.

Cloud, container, and supplier security

Cloud changes ownership boundaries, not the need for controls. Record the provider, account or tenant, region, resource owner, identity model, public exposure, encryption and key ownership, logs, backup, support, exit path, and shared-responsibility boundary. Separate production accounts, restrict organization-level administration, and monitor control-plane changes.

For containers, scan and sign images, use minimal supported bases, run as a non-root user where possible, restrict capabilities and filesystem writes, keep secrets out of images and environment dumps, enforce network policy, set resource limits, and rebuild rather than patching an unknown running container. The Docker step-by-step guide covers the operational path from installation through hardening and recovery.

Supplier review should cover the service actually purchased: data and subprocessors, identity integration, tenant isolation, logging export, vulnerability response, incident notification, backup and deletion, availability, administrative access, independent assurance, contract exit, and evidence retrieval. A certificate or questionnaire does not replace testing the configured integration.

Incident response runbook

NIST SP 800-61 Revision 3 integrates incident response across all six CSF functions. Preparation, detection, response, and recovery are connected activities rather than a single emergency checklist.

1. Receive and record. Create the incident record, time source, reporter, observed facts, affected service, and evidence locations.
2. Validate and scope. Separate observation from inference. Identify affected identities, assets, data, time range, techniques, and business impact.
3. Assign severity and command. Name the incident commander, technical leads, communication path, legal/privacy contacts, and decision authority.
4. Preserve evidence. Capture volatile data when authorized, protect original logs and images, calculate hashes, document every transfer, and maintain chain of custody.
5. Contain deliberately. Compare account disablement, session revocation, endpoint isolation, network blocking, service failover, or monitoring-only options. Record expected benefit and harm.
6. Remove the cause. Close the exploited path, rotate exposed credentials, remove persistence, patch or rebuild supported systems, and hunt for the same condition elsewhere.
7. Recover in dependency order. Restore from a known suitable point, validate identity and configuration, test service and data integrity, monitor closely, and obtain business-owner acceptance.
8. Learn and track. Produce a factual timeline, root and contributing causes, control improvements, owners, deadlines, and a verification date.

Linux triage evidence

date -u
uptime
who
last -F | head -50
ps -eo user,pid,ppid,lstart,cmd --sort=lstart
ss -plant
systemctl --failed
journalctl --since '2 hours ago' --output=short-iso
find /tmp /var/tmp -xdev -type f -mmin -120 -ls

These commands can expose user names, processes, command lines, remote addresses, and file paths. Store the output as incident evidence. Commands also alter access times or caches on some systems, and a compromised host cannot be trusted to report perfectly. Forensic acquisition requires trained personnel, approved tooling, and a documented chain of custody.

Windows triage evidence

Get-Date -AsUTC
Get-CimInstance Win32_LoggedOnUser
Get-Process | Sort-Object StartTime -ErrorAction SilentlyContinue
Get-NetTCPConnection | Sort-Object State, RemoteAddress
Get-WinEvent -FilterHashtable @{LogName='System'; StartTime=(Get-Date).AddHours(-2)} -MaxEvents 500
Get-WinEvent -FilterHashtable @{LogName='Security'; StartTime=(Get-Date).AddHours(-2)} -MaxEvents 500

Security log access normally requires appropriate privileges. Exporting large event sets to an interactive console is slow and can disclose sensitive data. Use the approved endpoint response or logging platform where it preserves richer, centralized evidence.

Backup and recovery that survives an attack

Define recovery point and recovery time objectives per service. Keep multiple protected recovery copies, separate backup administration from normal production administration, use immutability or offline protection where appropriate, monitor deletion and policy changes, encrypt with recoverable key ownership, and test restoration.

A practical operating cadence

Useful metrics connect to decisions: percentage of critical services with tested recovery, privileged identities using phishing-resistant MFA, median time to revoke terminated access, telemetry coverage for critical assets, overdue known-exploited vulnerabilities, expired exceptions, time to detect and contain incidents, and recurrence of contributing causes. A raw vulnerability count without scope or age is rarely enough.

Security administrator interview questions with answer boundaries

A strong answer states assumptions, asks about business impact, starts with evidence, names the decision owner, distinguishes prevention from detection, and includes rollback and verification. The following questions cover the useful domains of the role without asking candidates to explain how they would compromise a real target.

Foundations and governance

1. What is the difference between a threat, vulnerability, likelihood, impact, and risk? Look for a concrete scenario and a statement that residual risk remains after controls.
2. How do confidentiality, integrity, and availability change priorities? Look for a service-specific trade-off rather than one universal ranking.
3. Who can accept security risk? Look for a designated business authority, documented evidence, expiry, and review, not the scanner operator.
4. How would you start in an unknown environment? Look for critical services, owners, inventories, identities, exposure, logging, backups, incidents, and a prioritized plan.
5. How do you prove a policy works? Look for technical implementation, representative testing, exceptions, monitoring, and outcomes.

Systems, identity, and network

1. What are your first steps for a new server? Look for supported build, inventory, owner, minimal services, identity, patching, baseline, logs, backup, testing, and rollback.
2. How would you investigate an unknown listening port? Look for host identity, process and service ownership, deployment evidence, network reachability, business need, and controlled closure.
3. What does least privilege mean operationally? Look for separate accounts, role scope, time-bound elevation, approval, logging, reviews, and revocation tests.
4. How do you protect service accounts? Look for unique workload identity, no interactive use, constrained permissions, managed secrets, owner, rotation, monitoring, and removal.
5. Why can ping fail while HTTPS works? Look for ICMP versus TCP, policy differences, routing, name resolution, and evidence at each layer.
6. What is the difference between a packet filter and an application-aware control? Look for address/port/state decisions versus protocol or request context, and acknowledgement that either can be misconfigured.
7. How would you make a remote firewall change? Look for exact target, current rules, preserved access, syntax validation, reversible rollout, allowed and denied tests, logs, and rollback.

Application, cloud, and cryptography

1. How do you prevent SQL injection? Look for parameterized queries, constrained database access, validation, safe errors, testing, and monitoring.
2. How do you prevent XSS and CSRF? Look for context-specific output encoding and safe DOM APIs for XSS; framework anti-CSRF tokens, SameSite, and origin controls for state-changing requests.
3. What is the difference between encoding, hashing, encryption, and signing? Look for representation, one-way integrity, keyed confidentiality, and authenticity/integrity.
4. What does TLS not solve? Look for endpoint compromise, authorization, insecure application logic, data at rest, secrets in logs, and traffic analysis.
5. How do you review a cloud service? Look for shared responsibility, identity, public exposure, tenant and data boundaries, keys, logs, backup, provider access, incident terms, and exit.
6. How do you secure a software supply chain? Look for trusted source, reviewed dependencies, locked builds, secret protection, isolated CI, artifact integrity, SBOM, deployment authorization, and response ownership.

Detection, incident response, and recovery

1. An administrator signs in from an unusual country. What do you do? Look for validation of user, device, authentication, session, IP context and concurrent activity before a proportionate containment decision.
2. You suspect ransomware on one endpoint. What comes first? Look for incident declaration, scope, evidence, safe isolation, identity and lateral-movement review, protected backups, communication, and recovery planning.
3. What is chain of custody? Look for who collected, handled, transferred, stored, and analyzed an item, when and why, with integrity and access evidence.
4. How do you compare containment options? Look for attacker interruption, evidence preservation, safety, service impact, reversibility, monitoring, and decision authority.
5. How do you know a backup is good? Look for a completed restore into a controlled environment plus application, integrity, permission, dependency, security, and timing validation.
6. What do you do when a rollout fails? Look for stop conditions, incident or change command, rollback criteria, communication, validation, preserved evidence, and learning.

Senior judgment scenarios

1. A business owner accepts a risk that worries you. What next? Look for clear evidence, alternative treatments, authorized acceptance, residual risk, expiry, monitoring, escalation route, and no silent bypass.
2. A critical fix may cause downtime. How do you prioritize it? Look for exposure and active exploitation, business and safety impact, compensating controls, canary, maintenance options, rollback, and executive decision.
3. A control produces thousands of alerts. Do you disable it? Look for preserving high-risk coverage, tuning with measured samples, data quality, ownership, suppression expiry, and validation against missed events.
4. A supplier cannot provide the telemetry you require. What do you do? Look for risk and contract review, alternate logs or controls, restricted scope, exception ownership, exit plan, and monitoring.
5. How do you design for human error? Look for safe defaults, separation of duties, previews, canaries, confirmations on high-impact targets, reversible operations, guardrails, and clear feedback.
6. What would make you stop an investigation or change? Look for loss of authorization or scope, risk to life or critical service, evidence destruction, wrong target, unavailable rollback, or required incident/legal coordination.

Complete 200-question security administrator preparation bank

Use this bank for self-study, interviews, workshops, and team assessments. Do not answer with a definition alone: state assumptions, give a concrete example, explain the control and its limitations, describe evidence, and include safe verification. Questions that describe compromise or disruption are retained for preparation, but discussion and testing must stay inside an explicitly authorized lab or assessment scope.

General security administration (questions 1-43)

• 1. What is information security and how is it achieved?
• 2. What are the core principles of information security?
• 3. What is non-repudiation (as it applies to IT security)?
• 4. What is the relationship between information security and data availability?
• 5. What is a security policy and why do we need one?
• 6. What is the difference between logical and physical security? Can you give an example of both?
• 7. What’s an acceptable level of risk?
• 8. What are the most common types of attacks that threaten enterprise data security?
• 9. What is the difference between a threat and a vulnerability?
• 10. Can you give me an example of common security vulnerabilities?
• 11. Are you familiar with any security management frameworks such as ISO/IEC 27002?
• 12. What is a security control?
• 13. What are the different types of security control?
• 14. Can you describe the information lifecycle? How do you ensure information security at each phase?
• 15. What is Information Security Governance?
• 16. What are your professional values? Why are professional ethics important in the information security field?
• 17. Are open-source projects more or less secure than proprietary ones?
• 18. Who do you look up to within the field of Information Security? Why?
• 19. Where do you get your security news from?
• 20. What’s the difference between symmetric and public-key cryptography?
• 21. What kind of network do you have at home?
• 22. What are the advantages offered by bug bounty programs over normal testing practices?
• 23. What are your first three steps when securing a Linux server?
• 24. What are your first three steps when securing a Windows server?
• 25. Who’s more dangerous to an organization, insiders or outsiders?
• 26. Why is DNS monitoring important?
• 27. How would traceroute help you find out where a breakdown in communication is?
• 28. Why would you want to use SSH from a Windows PC?
• 29. How would you find out what a POST code means?
• 30. What is the difference between a black hat and a white hat?
• 31. What do you think of social networking sites such as Facebook and LinkedIn?
• 32. Why are internal threats often more successful than external threats?
• 33. Why is deleted data not truly gone when you delete it?
• 34. What is the Chain of Custody?
• 35. How would you permanently remove the threat of data falling into the wrong hands?
• 36. What is exfiltration?
• 37. How do you protect your home wireless access point?
• 38. If you were assessing a database-based website, which attack paths would you evaluate? Authorized defensive discussion only: explain the threat model, detection, prevention, and safe lab validation; do not target systems without written permission.
• 39. What is the CIA triangle?
• 40. What is the difference between information protection and information assurance?
• 41. How would you lock down a mobile device?
• 42. What is the difference between closed-source and open-source? Which is better?
• 43. What is your opinion on hacktivist groups such as Anonymous?

Network security (questions 44-67)

• 44. What port does ping work over?
• 45. Do you prefer filtered ports or closed ports on your firewall?
• 46. How exactly does traceroute/tracert work at the protocol level?
• 47. What are Linux’s strengths and weaknesses vs. Windows?
• 48. What is a firewall? And provide an example of how a firewall can be bypassed by an outsider to access the corporate network. Authorized defensive discussion only: explain the threat model, detection, prevention, and safe lab validation; do not target systems without written permission.
• 49. Besides firewalls, what other devices are used to enforce network boundaries?
• 50. What is the role of network boundaries in information security?
• 51. What does an intrusion detection system do? How does it do it?
• 52. What is a honeypot? What type of attack does it defend against?
• 53. What technologies and approaches are used to secure information and services deployed on cloud computing infrastructure?
• 54. What information security challenges are faced in a cloud computing environment?
• 55. Can you give me an overview of IP multicast?
• 56. How many bits do you need for a subnet size?
• 57. What is packet filtering?
• 58. Can you explain the difference between a packet filtering firewall and an application layer firewall?
• 59. What are the layers of the OSI model?
• 60. How would you login to Active Directory from a Linux or Mac box?
• 61. What is an easy way to configure a network to allow only a single computer to login on a particular jack?
• 62. What are the three ways to authenticate a person?
• 63. You find out that there is an active problem on your network. You can fix it, but it is out of your jurisdiction. What do you do?
• 64. How would you compromise an “office workstation” at a hotel? Authorized defensive discussion only: explain the threat model, detection, prevention, and safe lab validation; do not target systems without written permission.
• 65. What is worse in firewall detection, a false negative or a false positive? And why?
• 66. How would you judge if a remote server is running IIS or Apache?
• 67. What is the difference between an HIDS and a NIDS?

Application security (questions 68-81)

• 68. Describe the last program or script that you wrote. What problem did it solve?
• 69. Can you briefly discuss the role of information security in each phase of the software development lifecycle?
• 70. How would you implement a secure login field on a high-traffic website where performance is a consideration?
• 71. What are the various ways to handle account brute force?
• 72. What is cross-site request forgery?
• 73. How does one defend against CSRF?
• 74. If you were a site administrator looking for incoming CSRF attacks, what would you look for?
• 75. What’s the difference between HTTP and HTML?
• 76. How does HTTP handle state?
• 77. What exactly is cross-site scripting?
• 78. What’s the difference between stored and reflected XSS?
• 79. What are the common defenses against XSS?
• 80. You are remoted into a headless system in a remote area. You have no physical access to the hardware and you need to perform an OS installation. What do you do?
• 81. On a Windows network, why is it easier to break into a local account than an AD account?

Security architecture (questions 82-107)

• 82. Explain data leakage and give examples of some of the root causes.
• 83. What are some effective ways to control data leakage?
• 84. Describe the 80/20 rules of networking.
• 85. What are web server vulnerabilities and name a few methods to prevent web server attacks?
• 86. What are the most damaging types of malwares?
• 87. What’s your preferred method of giving remote employees access to the company network and are there any weaknesses associated to it?
• 88. List a couple of tests that you would do to a network to identify security flaws. Authorized defensive discussion only: explain the threat model, detection, prevention, and safe lab validation; do not target systems without written permission.
• 89. What kind of websites and cloud services would you block?
• 90. What type of security flaw is there in VPN?
• 91. What is a DDoS attack?
• 92. Can you describe the role of security operations in the enterprise?
• 93. What is layered security architecture? Is it a good approach? Why?
• 94. Have you designed security measures that span overlapping information domains? Can you give me a brief overview of the solution?
• 95. How do you ensure that a design anticipates human error?
• 96. How do you ensure that a design achieves regulatory compliance?
• 97. What is capability-based security? Have you incorporated this pattern into your designs? How?
• 98. Can you give me a few examples of security architecture requirements?
• 99. Who typically owns security architecture requirements and what stakeholders contribute?
• 100. What special security challenges does SOA present?
• 101. What security challenges do unified communications present?
• 102. Do you take a different approach to security architecture for a COTS vs a custom solution?
• 103. Have you architected a security solution that involved SaaS components? What challenges did you face?
• 104. Have you worked on a project in which stakeholders choose to accept identified security risks that worried you? How did you handle the situation?
• 105. You see a user logging in as root to perform basic functions. Is this a problem?
• 106. What is data protection in transit vs data protection at rest?
• 107. You need to reset a password-protected BIOS or UEFI configuration on an organization-owned device. What do you do?

Risk management (questions 108-126)

• 108. Is there an acceptable level of risk?
• 109. How do you measure risk? Can you give an example of a specific metric that measures information security risk?
• 110. Can you give me an example of risk trade-offs (e.g. risk vs cost)?
• 111. What is incident management?
• 112. What is business continuity management? How does it relate to security?
• 113. What is the primary reason most companies haven’t fixed their vulnerabilities?
• 114. What’s the goal of information security within an organization?
• 115. What’s the difference between a threat, vulnerability, and a risk?
• 116. If you were to start a job as head engineer or CSO at a Fortune 500 company due to the previous guy being fired for incompetence, what would your priorities be? [Imagine you start on day one with no knowledge of the environment]
• 117. As a corporate information security professional, what’s more important to focus on: threats or vulnerabilities?
• 118. If I’m on my laptop, here inside my company, and I have just plugged in my network cable. How many packets must leave my NIC in order to complete a traceroute to twitter.com?
• 119. How would you model the architecture and defensive indicators of a large botnet? Authorized defensive discussion only: explain the threat model, detection, prevention, and safe lab validation; do not target systems without written permission.
• 120. What are the primary design flaws in HTTP, and how would you improve it?
• 121. If you could redesign TCP, what would you fix?
• 122. What is the one feature you would add to DNS to improve it the most?
• 123. What is likely to be the primary protocol used for the Internet of Things in 10 years?
• 124. If you had to get rid of a layer of the OSI model, which would it be?
• 125. What is residual risk?
• 126. What is the difference between a vulnerability and an exploit?

Security audit, testing, and incident response (questions 127-152)

• 127. What is an IT security audit?
• 128. What is an RFC?
• 129. What type of systems should be audited?
• 130. Have you worked in a virtualized environment?
• 131. What is the most difficult part of auditing for you?
• 132. Describe the most difficult auditing procedure you’ve implemented.
• 133. What is change management?
• 134. What types of RFC or change management software have you used?
• 135. What do you do if a rollout goes wrong?
• 136. How do you manage system major incidents?
• 137. How do you ask developers to document changes?
• 138. How do you compare files that might have changed since the last time you looked at them?
• 139. Name a few types of security breaches.
• 140. What is a common method of disrupting enterprise systems?
• 141. What are some security software tools you can use to monitor the network?
• 142. What should you do after you suspect a network has been hacked?
• 143. How can you encrypt email to secure transmissions about the company?
• 144. What document describes steps to bring up a network that’s had a major outage?
• 145. How can you ensure backups are secure?
• 146. What is one way to do a cross-script hack? Authorized defensive discussion only: explain the threat model, detection, prevention, and safe lab validation; do not target systems without written permission.
• 147. How can you avoid cross script hacks?
• 148. How do you test information security?
• 149. What is the difference between black box and white box penetration testing?
• 150. What is a vulnerability scan?
• 151. In pen testing what’s better, a red team or a blue team?
• 152. Why would you bring in an outside contractor to perform a penetration test?

Cryptography (questions 153-200)

• 153. What is secret-key cryptography?
• 154. What is public-key cryptography?
• 155. What is a session key?
• 156. What is RSA?
• 157. How fast is RSA?
• 158. What would it take to break RSA?
• 159. Are strong primes necessary for RSA?
• 160. How large should an RSA modulus be for a current supported use case?
• 161. How large should the primes be?
• 162. How is RSA used for authentication in practice? What are RSA digital signatures?
• 163. What are the alternatives to RSA?
• 164. Is RSA currently in use today?
• 165. What are DSS and DSA?
• 166. What is difference between DSA and RSA?
• 167. Is DSA secure?
• 168. What are special signature schemes?
• 169. What is a blind signature scheme?
• 170. What is a designated confirmer signatures?
• 171. What is a fail-stop signature scheme?
• 172. What is a group signature?
• 173. What is blowfish? Historical topic: identify its present status and the current supported alternative rather than recommending it for a new design.
• 174. What is SAFER? Historical topic: identify its present status and the current supported alternative rather than recommending it for a new design.
• 175. What is FEAL? Historical topic: identify its present status and the current supported alternative rather than recommending it for a new design.
• 176. What is Skipjack? (It is sometimes incorrectly written as “Shipjack.”) Historical topic: identify its present status and the current supported alternative rather than recommending it for a new design.
• 177. What is stream cipher?
• 178. What is the advantage of public-key cryptography over secret-key cryptography?
• 179. What is the advantage of secret-key cryptography over public-key cryptography?
• 180. What is Message Authentication Code (MAC)?
• 181. What is a block cipher?
• 182. What are different block cipher modes of operation?
• 183. What is a stream cipher? Name a most widely used stream cipher.
• 184. What is one-way hash function?
• 185. What is collision when we talk about hash functions?
• 186. What are the applications of a hash function?
• 187. What is trapdoor function?
• 188. Cryptographically speaking, what is the main method of building a shared secret over a public medium?
• 189. What’s the difference between Diffie-Hellman and RSA?
• 190. What kind of attack is a standard Diffie-Hellman exchange vulnerable to?
• 191. What’s the difference between encoding, encryption, and hashing?
• 192. In public-key cryptography you have a public and a private key, and you often perform both encryption and signing functions. Which key is used for which function?
• 193. What’s the difference between Symmetric and Asymmetric encryption?
• 194. If you had to both encrypt and compress data during transmission, which would you do first, and why?
• 195. What is SSL and why is it not enough when it comes to encryption? Current wording: discuss obsolete SSL versus supported TLS and explain why transport encryption alone is insufficient.
• 196. What is salting, and why is it used?
• 197. What are salted hashes?
• 198. What is the three-way handshake? How can it be used to create a DOS attack? Authorized defensive discussion only: explain the threat model, detection, prevention, and safe lab validation; do not target systems without written permission.
• 199. What’s more secure, SSL or HTTPS? Clarification: HTTPS is HTTP carried over TLS; SSL is obsolete terminology, so they are not competing security choices.
• 200. Can you describe rainbow tables?

Production-readiness checklist

• Every critical service has an owner, asset and dependency record, data classification, recovery objectives, and support path.
• Human, workload, vendor, and emergency identities have attributable access, MFA where applicable, least privilege, lifecycle, and revocation evidence.
• Operating systems, applications, devices, images, and dependencies are supported, inventoried, hardened, scanned, patched, and exception-managed.
• Internet exposure, network zones, administrative paths, DNS, ingress, and egress match reviewed architecture and are tested from representative locations.
• Security-relevant events reach protected central storage with synchronized time, known retention, coverage monitoring, owned detections, and tested response.
• Applications have threat models, testable security requirements, server-side authorization, safe input/output handling, protected secrets, and controlled dependencies.
• Cloud and supplier services have explicit shared responsibility, data, identity, logging, backup, incident, administration, and exit boundaries.
• Incident roles, communications, evidence handling, containment choices, recovery order, and external obligations are documented and exercised.
• Backups survive loss of production credentials, have protected recovery points, and pass timed restore and service-validation tests.
• Metrics expose gaps and drive named decisions; risk acceptances and control exceptions have owners and expiration dates.

Authoritative security references

• NIST Cybersecurity Framework 2.0 resources
• NIST SP 800-61 Revision 3: Incident Response Recommendations and Considerations
• NIST SP 800-207: Zero Trust Architecture
• CISA Secure by Design
• CISA Known Exploited Vulnerabilities Catalog
• CISA guidance for phishing-resistant MFA
• OWASP Application Security Verification Standard 5.0
• OWASP Cheat Sheet Series
• CIS Critical Security Controls v8.1