Q1. Explain the CIA Triad

• Confidentiality: Prevent unauthorized disclosure (encryption, access control)
• Integrity: Prevent unauthorized modification (hashes, checksums, signatures)
• Availability: Ensure timely, reliable access (redundancy, DoS protection, backups)

Q2. Threat vs Vulnerability vs Risk

• Threat: Potential cause of unwanted incident (attacker, malware)
• Vulnerability: Weakness exploitable by threat (unpatched system)
• Risk: Impact × Likelihood; exposure due to vulnerabilities and threats

Risk Management: Avoid, Mitigate, Transfer, Accept.

Q3. Types of Malware

Type	Description	Prevention
Virus	Infects files, needs user action	AV, no pirated software
Worm	Self-propagating via network	Patch, firewall
Trojan	Disguised as legitimate	Download from trusted sources
Ransomware	Encrypts data for ransom	Backups, awareness
Spyware/Adware	Steals info/shows ads	Anti-malware
Rootkit	Hides malicious activity	Secure boot, EDR

Q4. Symmetric vs Asymmetric Cryptography

Aspect	Symmetric (e.g., AES)	Asymmetric (e.g., RSA)
Keys	One shared key	Public/Private key pair
Speed	Fast	Slow
Use	Bulk data encryption	Key exchange, signatures
Distribution	Hard (secure channel needed)	Easy (share public key)

Q5. AES and RSA Overview

• AES: Block cipher (128-bit block, 128/192/256-bit keys). Rounds with SubBytes, ShiftRows, MixColumns, AddRoundKey.
• RSA: Based on integer factorization. KeyGen: pick primes p,q; n=pq; φ=(p−1)(q−1); choose e; find d=e⁻¹ mod φ. Encrypt: c=m^e mod n; Decrypt: m=c^d mod n.

Q6. Hashing & Digital Signatures

• Hash: One-way, fixed-length digest (SHA-256). Integrity check.
• Digital Signature: Sign hash with private key; verify with public key. Provides integrity + authenticity + non-repudiation.

Q7. Network Security: Firewalls, IDS/IPS

• Firewalls: Packet/stateful/app-layer filtering based on rules
• IDS: Detect suspicious traffic (signature/behavior-based)
• IPS: Prevention inline (blocks traffic)
• Architectures: Perimeter, DMZ, Zero Trust

Q8. Web Security: XSS, CSRF, SQL Injection

• XSS: Injected JS. Mitigate with output encoding, CSP, HttpOnly cookies.
• CSRF: Unwanted requests using user's session. Mitigate with anti-CSRF tokens, SameSite=Lax, double-submit.
• SQLi: Untrusted input in queries. Use prepared statements, ORM, input validation.

Q9. Authentication vs Authorization

• Authentication: Prove identity (passwords, MFA, OAuth)
• Authorization: Permissions after auth (RBAC/ABAC)
• Best practices: password hashing (bcrypt/argon2), MFA, least privilege

Q10. PKI & Certificates

• Trust chain: Root CA → Intermediate CA → Server cert
• TLS handshake uses certificates to establish secure channel
• Revocation: CRL, OCSP

Q11. Incident Response Lifecycle

1. Preparation
2. Detection & Analysis
3. Containment
4. Eradication
5. Recovery
6. Post-Incident Activity (lessons learned)

Use playbooks, evidence preservation, chain of custody.

Q12. Security Policies & Compliance

• Policies: AUP, Password Policy, Data Classification, Backup
• Compliance: ISO 27001, PCI-DSS, HIPAA, GDPR
• Risk assessments, audits, awareness training