infosec-interview-questions - 🗒️ A [work-in-progress] collection for interview q

项目说明

Information Security Interview Questions

> A collection for interview questions for Information Security roles

Table Of Contents

<!-- GFM -->

* Application Security
* Architect
* Blue Team
* Encryption
* Forensics
* General
* Incidence Response
* Networking
* Red Team
* Management
* Where Credit is Due

<!-- -->

Application Security

* If you had to both encrypt and compress data during transmission, which would you do first, and why?

* Compression aims to use patterns in data to reduce its size.
* Encryption aims to randomize data so that it's uninterpretable without a secret key.
* If you encrypt first, then compress, then your compression will be useless. Compression doesn't work on random data.
* If you compress first, then encrypt, then an attacker can find patterns in message length (Compression Ratio) to learn something about the data and potentially foil the encryption (like CRIME)
* Resources:
* Encrypt or Compress First?
* CRIME

* What could attackers do with HTTP Header Injection ?

* Carriage returns and line feeds (or %0D & %0A) are means to an end that would allow attackers to control HTTP headers
* Attackers could inject XSS header
* Attackers could set cookie to a value known by the attacker (session fixation)
* Attackers could redirect to a malicious server

* Describe the last program or script that you wrote. What problem did it solve?

* Just looking for signs that the candidate has basic understanding of programming concepts and is at least able to write simple programs

* How would you implement a secure login field on a high traffic website where performance is a consideration?

* TLS (regardless of performance) is a must
* Also, reducing 3rd party library dependencies could impro and reduce security risks ()
* Content-Security Policy (CSP) to enforce stricter execution rules around JS and CSS ()
* Subresource Integrity (SRI) to ensure only known, trusted resource files are loaded from 3rd-party servers/CDNs ()

* What are the ways to handle brute forcing?

* Account Lockouts/timeouts
* API rate limiting
* IP restrictions
* Fail2ban
* ...etc

* What is Cross-Site Request Forgery? And how to defend against it?

* When an attacker gets a 's browser to make requests with the 's credentials
* Example: if an image tag (<img>) points to a URL with an associated action, e.g.
* Defense includes but are not limited to:
* check origins header & referer header
* check CSRF tokens or nonce

* What is Cross-Site Scripting? What are the different types of XSS? How to defend against XSS?

* XSS is when attackers get 's browsers to execute some code (usually Ja) within their browser
* Traditionally, types have been categorized into *Stored* and *Reflected* XSS attacks.
* Stored XSS is some code that an attacker was able to persist in a database and gets retrieved and presented to (e.g. forum)
* Reflected XSS is usually in the form of a maliciously crafted URL which includes the malicious code. When the user clicks on the link, the code runs in their browser
* Recently there has been discussions around DOM-based XSS, which occurs when attackers can control DOM elements, thus achieve XSS without sending any requests to the server
* XSS categories tend to o, therefore it's much better to describe XSS in terms like *Ser XSS*, *Ser XSS*, *Client Stored XSS* (e.g. stored DOM-based XSS), or *Client Reflected XSS* (e.g. reflected DOM-based XSS)
* Defense includes:
* Output encoding (more important)
* Input (less important)

* How does HTTP handle state?

* HTTP is stateless
* State is stored in cookies

Architect

* Have you designed security measures that span o information domains?
* Can you give me a few examples of security architecture requirements?
* What special security challenges does Serre (SOA) present?
* Have you architected a security solution that in SaaS components? What challenges did you face?
* Have you worked on a project in which stakeholders choose to accept identified security risks that worried you? How did you handle the situation?
* How do you handle demands from different stakeholders who ha requirements?
* How do you ensure that solution architects develop secure solutions?
* How do you ensure that a solution continues to be resilient in the face of e threats?
* What do you think the most important technology is right now? How are we going to secure it?

Blue Team

* Given an HTTP traffic log between a machine on your network and a 3rd party website (e.g. Google), what would the source and destination ports look like?
* Source port might be some number above port 1024 (aka ephemeral port)
* Destination port might be 80 (HTTP) or 443 (HTTPS)

Encryption

* What's the difference between encoding, encryption, and hashing?

* Encoding ensures message integrity. Can be easily re. Example: base64
* Encryption guarantees message confidentiality. Re only using the appropriate decryption keys. Example: AES256
* Hashing is a one-way function. Cannot be re. The output is fixed length and usually smaller than the input.

* Does TLS use symmetric or asymmetric encryption?

* Both.
* The initial exchange is done using asymmetric encryption, but bulk data encryption is done using symmetric. See next question for additional information.
* Resources:
*
*

* Describe the process of a TLS session being set up when someone a secure website.

* Client sends hello message that lists cryptographic information, such as SSL/TLS and the client's order of preference of cipher suites. The message also contains a random byte string that is used in subsequent calculations. Client may include data compression methods in the hello message as well.
* Ser with hello message that contains the cipher suite chosen by the server, the server's digital certificate, and another random byte string. If the ser client certificate authentication, the server will also send client certificate request to the client.
* Client server's digital certificate.
* Client sends a random byte string encrypted with the server's public key to allow both client and server to calculate the secret key used for subsequent encryption between client & server.
* If ser a client certificate, the client sends a random byte string encrypted with the client's private key with the client's digital certificate or "no digital certificate alert". This alert is only a warning, but some implementations will cause the handshake to fail if client authentication is mandatory.
* Ser client's digital certificate.
* Client sends finished message encrypted with the calculated secret key
* Ser finished message encrypted with the calculated secret key
* For the duration of the TLS session, the server and client can now exchange messages that are symmetrically encrypted with the shared secret key
* Resources:
* An o of the SSL or TLS handshake

* How is TLS attacked? How has TLS been attacked in the past? Why was it a problem? How was it fixed?

* Weak ciphers)
* Heartbleed
* BEAST
* CRIME
* POODLE

* What is Forward Secrecy?

* Forward Secrecy is a system that uses ephemeral session keys to do the actual encryption of TLS data so that even if the server’s private key were to be compromised, an attacker could not use it to decrypt captured data that had been sent to that server in the past.

* Describe how Diffie-Hellman works.

Forensics

General

* Are open source projects more or less secure than proprietary projects?

* Both models have pros and cons.
* There are examples of insecure projects that have come out of both camps.
* Open source model encourages "many eyes" on a project, but that doesn't necessarily translate to more secure products
* What's important is not open source , but quality control of the project.

* Who do you look up to in the Information Security field? Why?

* Where do you get your security news from?

Incidence Response

Networking

Red Team

Management

* Which classification of get exploited the most?
* How often should you scan?
* What is the difference between an external and internal scan?
* What is the difference between authenticated and unauthenticated scan?
* How could a scan fingerprint an OS?
* What is a C?
* How should you break out scans?
* How would you advise the different organizations on what they should patch first?
* What is a ?
* Are you familiar with any of the industry standard ways that are tracked?
* What is CVE and why is the standardization it provides important?
* Where would you go to find additional info about a ?
* What is the difference between an exploit and a ?
* If there is a threat, but no , would you say that there is still risk? What if there is a , but no threat?
* Can you list any that you' heard about?
* Are you familiar with any of the tools used to scan for ? If no, can you name any?
* Can you list any tools used to patch across an enterprise?
* What is SCCM?
* Are you familiar with any of the open source tools commonly used to exploit ?
* Can you list any software that is known for consistently having ?
* How often are Microsoft patches released (non emergency?
* What is a Microsoft KB #?

Where Credit is Due

* Daniel Miessler's Blog

项目信息

开发语言：未知

Star 数：138

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕🗒️ A [work-in-progress] collection for interview questions for Information Security roles展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。