Cybersecurity

What interviewers look for

• Basics you can apply, not just define: confidentiality, integrity and availability, least privilege, and layers of defence.
• A calm incident method: contain first, keep the evidence, recover, then learn and fix the gap.
• Reading logs and alerts: telling a real attack from normal noise, and knowing what to escalate and to whom.
• Practical controls for a small budget: patching, MFA, offline backups and staff awareness before expensive tools.
• Integrity and discretion: you will see private data and hold admin access, and they must trust you never to misuse it.
• Explaining risk to managers in plain terms: what could happen, how likely it is, and what the fix costs.

Questions they ask

1. 1“What is the CIA triad? Give an example of each part from a real organisation.”

   Why they ask: Every panel asks it. They want to see you apply the three ideas to real systems, not recite a definition.

   How to answer

   • Confidentiality: only the right people see the data, like payroll or patient records.
   • Integrity: data is not changed without permission and a record of who changed it.
   • Availability: systems work when people need them, such as on salary day or during a distribution.

   At a bank, confidentiality means only the right staff can see a customer's account and ID documents. Integrity means a balance cannot change without a record of who changed it and why, so a transfer of ten dollars cannot quietly become a thousand. Availability means the mobile banking system is up when customers need it, including on salary days. When I review a control, I ask which of the three it protects, and whether it weakens another one.

2. 2“A staff member reports an email asking them to “verify” their Microsoft 365 password. Others may have clicked. What do you do?”

   Why they ask: Phishing is the most common attack. They check you act fast, find everyone affected, and close the attacker's way in.

   How to answer

   • Thank the reporter, then check the sender and the link safely without logging in.
   • Find the same email in all mailboxes, remove it, and block the sender and domain.
   • For anyone who entered a password: reset it, sign out all sessions, check MFA and forwarding rules.

   First I thank the person, because a fast report matters most. I look at the headers and the link without opening it on my own machine. Then I search all mailboxes for the same message and remove it. For anyone who clicked and typed a password, I reset it, sign them out of all sessions, and check for new forwarding rules, which attackers often add. I block the sender and the domain, then send staff a short warning with a screenshot of the fake email.

3. 3“Walk us through the main steps of incident response.”

   Why they ask: They check you have a structure to follow under pressure, and that you think about evidence and communication, not only the fix.

   How to answer

   • Prepare, then detect and analyse: confirm it is real and how big it is.
   • Contain it, remove the cause, and recover from clean backups.
   • Finish with lessons learned, and keep management informed at every step.

4. 4“Ransomware has encrypted the files on the shared drive. What are your first steps?”

   Why they ask: It tests whether you contain the damage quickly, protect the backups, and involve management, instead of panicking.

   How to answer

   • Disconnect affected machines from the network at once, but do not wipe them.
   • Tell management, find the scope, and keep the offline backups disconnected.
   • Clean, reset passwords, restore, then find and close how it got in.

   I would disconnect the affected computers from the network straight away, cable and Wi-Fi, but not wipe them, so we keep evidence. Then I tell management, because this quickly becomes a business decision. I find out how far it has spread: which machines, which accounts, and whether the backups were touched. The offline backup stays disconnected until the infection is removed. Before restoring, I reset passwords for the accounts involved. Afterwards we write up how it got in and close that gap.

5. 5“There are hundreds of updates waiting. How do you decide what to patch first?”

   Why they ask: Patching is daily security work. They want risk-based priorities and a safe process, not “install everything tonight”.

   How to answer

   • First: systems facing the internet and flaws that attackers are already using.
   • Then servers and critical systems, then staff computers, by severity.
   • Test on a few machines, schedule the rest, and check that the patch really installed.

6. 6“Which logs would you look at to see if an account was taken over, and what would make you suspicious?”

   Why they ask: It checks you know where the evidence is and what normal looks like, which is the core of SOC and analyst work.

   How to answer

   • Sign-in logs: many failed attempts then a success, new countries, impossible travel, odd hours.
   • Changes after the sign-in: new mailbox rules, MFA changed, new admin rights.
   • Explain that a SIEM collects these logs in one place and alerts on patterns.

   I start with the sign-in logs for that account. Warning signs are many failed attempts followed by a success, a sign-in from a country where we have no staff, or two sign-ins from far-apart places within an hour. Then I look at what happened after: a new rule forwarding email outside, a changed MFA method, or new admin rights. In a SIEM I would build an alert for exactly that pattern, and check it against the user's normal working hours.

7. 7“A senior manager asks you to secretly read a colleague's emails. What do you do?”

   Why they ask: This is the ethics question. Admin access gives you power over private data, and they want to know you will use it only with proper authorisation.

   How to answer

   • Refuse a verbal request politely, whoever it comes from.
   • Explain the proper route: a written request through HR or legal, approved and logged.
   • If approved, access only what is specified and keep it confidential.

   I would say politely that I can't do that on a verbal request, even from a senior manager, because reading someone's email without authorisation goes against our policy and the staff member's privacy. If there is a real concern, such as suspected fraud, I would explain the proper route: a written request through HR or legal, approved by the right person and logged. If it is approved, I access only what is specified and keep it confidential. Admin access only works if people can trust it.

Example answers are in English, the language most panels use. Say it in your own words.

Topics to revise

• CIA triadConfidentiality (only the right people see data), integrity (data is correct and changes are recorded) and availability (systems work when needed). Every control protects one or more of them. They may ask which one a DDoS attack hits: availability.
• Least privilege and access reviewsEach account gets only the access its job needs. Admins use a separate admin account for admin work and a normal one for email. Review who has access every few months, and remove leavers on their last day. A question: who should have access to the payroll folder?
• MFA (multi-factor authentication)Proof from two different kinds: something you know (password), something you have (phone, key), something you are (fingerprint). An authenticator app is stronger than SMS, because SIM swap can steal SMS codes. Know “MFA fatigue”: attackers send many push requests hoping the user taps Approve.
• Phishing and business email compromiseFake emails, SMS or calls that trick people into giving passwords or money. Signs: urgency, a slightly wrong domain, unexpected attachments. Business email compromise is a fake or hijacked email asking finance to change a supplier's bank details; the fix is always a phone check on a known number.
• Patch management (CVE, CVSS)A CVE is the ID number of a known flaw; CVSS is its severity score from 0 to 10. Patch internet-facing systems and actively exploited flaws first, test before wide rollout, and check the result. Systems that no longer get updates, like Windows 7, are a risk to name and plan to replace.
• Incident response stepsA common model has six steps: preparation, detection and analysis, containment, eradication, recovery, and lessons learned. Containment means stopping the spread, for example isolating a laptop. They may give you a scenario and ask which step you are in.
• Logs and SIEMLogs record events: sign-ins, firewall traffic, server changes. A SIEM (for example Microsoft Sentinel, Splunk or the open-source Wazuh) collects them in one place and raises alerts. Know Windows event IDs 4624 (successful logon) and 4625 (failed logon), and what a false positive is.
• Ransomware and offline backupsRansomware encrypts files and often steals them first. Backups must be offline or immutable (cannot be changed), or the attacker encrypts them too. Common ways in: phishing, Remote Desktop open to the internet, and unpatched VPNs. Test restores so you know how long recovery takes.
• Firewalls, VPN and exposed servicesA firewall blocks all incoming traffic by default and opens only what is needed. Never leave Remote Desktop (port 3389) open to the internet; use a VPN with MFA instead. A good habit: check what your own public IP shows to the outside, with permission.
• Encryption at rest and in transitIn transit: data moving over the network is protected by HTTPS or TLS. At rest: data on disks is protected by BitLocker or FileVault, which matters for laptops that travel to the field. Keep the recovery keys somewhere safe, or a locked laptop becomes lost data.
• Authorised access and ethicsYou only scan, test or read systems and data with written permission and a clear scope. Ethical hacking without authorisation is still hacking. Panels ask this to see if you can be trusted with admin rights and private data, so answer without hesitation.

Practical tasks you may get

1. 1Log review: they give you a sign-in or firewall log, often in Excel, and ask what looks suspicious. Look for many failed logins then a success, unusual countries or hours, and new admin accounts. Practise with sample Windows event logs and public training datasets.
2. 2Phishing analysis: a real-looking email on screen or paper. Point out the sender domain, where the link really goes, the pressure in the wording, and what you would do next. Practise by reading the headers of spam in your own inbox.
3. 3Tabletop scenario: “The finance officer's laptop shows a ransom note.” Talk through the steps in order, including who you tell and what you must not do: wipe it, pay, or hide it. Prepare by writing a one-page response plan for a small office.
4. 4Written task: list the top five risks for a 40-person NGO office with one fix for each, or draft a short password and MFA policy. Keep it prioritised and in plain language a director can act on.
5. 5Reading a scan result: an Nmap output showing open ports on a server. Say which ports should not face the internet and why. Practise scanning only your own lab or systems you have written permission to test.

Mistakes to avoid

• Listing tools like Kali, Metasploit and Wireshark but not being able to explain least privilege or patching.
• Telling stories about getting into systems you had no permission to test. The panel hears a risk, not a skill.
• Answering incident questions with “shut everything down” or “pay the ransom” instead of a calm, ordered response.
• Recommending expensive products before the basics: patching, MFA, offline backups and staff training.
• Blaming users who clicked. Panels want someone who makes staff feel safe to report quickly.
• Forgetting to say who you would inform: management, the data owner, and anyone whose data was affected.

Quick check

5 questions. Answer each one to see the explanation.