Top Security Engineering Interview Questions and Answers

Introduction

Security engineering creates and sets up systems to protect data and resources from cyber threats. It combines ideas from computer science, cryptography, and network security to build strong defenses against attacks.

Learning about security engineering is essential to become a security engineer. It teaches you how to design secure systems, check for risks, and handle security problems. This knowledge is crucial for protecting organizations from data breaches and cyber attacks, making security engineers key to keeping digital spaces safe.

Q1: What Is A Three-Way Handshake?

A: The three-way handshake is a process the Transmission Control Protocol (TCP) uses to set up a connection over an IP-based network. It involves three steps in which the computers exchange SYN, SYN-ACK, and ACK messages. This process ensures both computers are ready to communicate and agree on the connection settings.

Q2: What Is The Difference Between VA (Vulnerability Assessment) And PT (Penetration Testing)?

A: Vulnerability Assessment (VA) involves identifying and prioritizing flaws or weaknesses in a system or network. The organization knows there are issues and wants to find and fix them.

Penetration Testing (PT) involves actively testing the system or network to find possible ways to hack it, even after all known security measures are in place. This tests the effectiveness of the security measures and identifies any remaining vulnerabilities.

Q3: What Is Traceroute? Why Is It Used?

A: Traceroute is a tool that shows the route a packet takes across a network. It lists all the stops (mainly routers) through which the packet passes. It's used to discover where a connection fails or slows down, especially when a packet isn't reaching its destination.

Q4: Explain Data Leakage

A: Data leakage happens when confidential information is shared with unauthorized people, either by mistake or purposefully. There are three types:

• Accidental Breach: Someone accidentally sends data to the wrong person.

• Intentional Breach: Someone deliberately shares data with an unauthorized person.

• System Hack: Hackers steal data using hacking techniques.

Data leakage can be prevented using Data Leakage Prevention (DLP) tools and strategies.

Q5: What Is Port Scanning?

A: Port scanning is a method to find open ports and services on a computer or network. Hackers use it to find weak points they can exploit, while network administrators use it to check security policies. Standard port scanning techniques include:

• TCP Connect

• UDP Scan

• Ping Scan

• TCP Half-Open

• Stealth Scanning

Q6: What Do You Understand By Risk, Vulnerability, & Threat In A Network?

A:

• Threat: Someone or something that can cause harm to a system or organization.​​​​​​​
• Vulnerability: A weakness in a system that a hacker can exploit.
• Risk: The chance of loss or damage if a threat exploits a vulnerability.

Q7: What Weak Spots Or Anomalies Would You Look For In A Security System?

A: When checking a security system, be thorough and systematic. Use a network diagram to help explain. Consider the user interface, such as enforcing two-factor authentication or educating users about security best practices.

Q8: What Is 2FA, And How Can It Be Implemented For Public Websites?

A: Two-factor authentication (2FA) is an extra layer of security. It requires a password, username, and something only the user has, like a physical token or a unique code. Authenticator apps can replace getting a code via text, call, or email.

Q9: What Is Layering?

A: Layering separates hardware and software functionality into modular tiers. The complexity of an issue, such as reading a sector from a disk drive, is contained in one layer (the hardware layer in this case). One layer (such as the application layer) is not directly affected by a change to another. Changing from an IDE (Integrated Drive Electronics) disk drive to a SCSI (Small Computer System Interface) drive does not affect an application that saves a file. Those details are contained within one layer and may affect the adjoining layer only.

Q10: What Is The State Machine Model?

A: A state machine model is a mathematical model that groups all possible system occurrences, called states. Every possible state of a system is evaluated, showing all possible interactions between subjects and objects. The system is proven secure if every state is proven to be ­secure.

State machines are used to model real-world software when the identified state must be documented and how it transitions from one state to another. For example, in object-oriented programming, a state machine model may be used to model and test how an object moves from an inactive state to an active state, readily accepting input and providing output.

Q11: What Is Encoding, Encryption, And Hashing?

A: Encoding converts data into a format that is easily read and understood by different applications and recipients. Think of it like translating data into a common language that makes communication possible.

Encryption makes data unreadable to anyone except those with a unique decode key. This keeps the data secret and secure, which protects information over private connections.

Hashing ensures data integrity by generating a unique string (hash) for the data. When data is sent, the hash is also sent. You can check if the data has been altered by comparing the original hash with the received hash. If the hashes match, the data is unchanged. If they don't do it, the data will be tampered with.

Q12: Explain Lattice-Based Access Control.

A: Lattice-based access control allows security controls for complex environments. For every relationship between a subject and an object, the system implements defined upper and lower access limits. This lattice, which allows reaching higher and lower data classification, depends on the subject's need, the label of the ­object, and the role the subject has been assigned. 

Subjects have a Least Upper Bound (LUB) and Greatest Lower Bound (GLB) of access to the objects based on their lattice position. At the highest level of access is the box labelled" {Alpha, Beta, Gamma}." A subject at this level has access to all objects in the lattice. 

At the second tier of the lattice, we see that each object has a distinct upper and lower allowable limit. For example, assume a subject has " {Alpha, Gamma}" access. The only viewable objects in the lattice would be the "Alpha" and "Gamma" objects. Both represent the most significant lower boundary. The subject would not be able to view the beta object.

Q13: What Are The Two Rules Of The Biba Model?

A: The Biba model, named after Kenneth J. Biba, has two primary rules: the Simple Integrity Axiom and the *Integrity Axiom.

• Simple Integrity Axiom: The Simple Integrity Axiom is ""no read down:"" a subject at a specific classification level cannot read data at a lower classification. This prevents subjects from accessing information at a lower integrity level, protecting integrity by preventing bad information from moving up from lower integrity levels.
• Integrity Axiom: The Integrity Axiom is " no write up: "A subject at a specific classification level cannot write to data at a higher classification. This prevents subjects from passing information up to a higher integrity level than they have clearance to change. It also protects integrity by preventing bad information from moving up to higher integrity levels.

Q14: What Are The Six Primitive Operations Of The Harrison-Ruzzo-Ullman Model?

A: The Harrison-Ruzzo-Ullman (HRU) Model maps subjects, objects, and access rights to an access matrix. It is considered a variation of the Graham-Denning Model. HRU has six primitive operations:

• Create object

• Create subject

• Destroy subject

• Destroy object

• Enter right into the access matrix

• Delete right from the access matrix

Q15: Explain The Four Modes Of Operations.

A: Defining the Mode of Operation necessary for an IT system will greatly assist in identifying the access control and technical requirements that the system must have. Depending on the Mode of Operation, it may use a discretionary or mandatory access control implementation.

• Dedicated: A dedicated mode of operation means that the system only contains objects of one classification label (e.g., secret). All subjects must possess a clearance equal to or greater than the label of the objects (a secret or higher clearance, using the previous example). Each subject must have the appropriate clearance and formal access approval and know all the information stored and processed in the system.
• System High: In a high mode of operation, the system contains objects with mixed labels (e.g., confidential, secret, and top secret). All subjects must possess a clearance equal to the system's highest object (top secret, using the previous example).
• Compartmented: In a compartmented mode of operation system, all subjects accessing the system have the necessary clearance but do not have the appropriate formal access approval or need to know all the information found on the system. Objects are placed into "compartments" and require a formal (system-enforced) need to know to access. Compartmented mode systems use technical controls to enforce the need to know (as opposed to a policy-based need to know).
• Multilevel: A multilevel mode of operation stores objects with differing sensitivity labels and allows system access by subjects with differing clearances. The reference monitor mediates access between subjects and objects: access is granted if a top-secret subject (with a need to know) accesses a top-secret object. Access is denied if a secret subject attempts to access a top-secret object.

Q16: What Is The Use Of Process Isolation?

A: Process isolation is a logical control that prevents one process from interfering with another. It is a common feature among multiuser operating systems such as Linux, UNIX, or recent Microsoft Windows operating systems. Older ­operating systems such as MS-DOS provide no process isolation, which means a crash in any MS-DOS application could crash the entire system.

If you shop online and enter your credit card number to buy a book, that number will exist in plaintext in memory (for at least a short period of time). Process isolation means another user's process on the same computer cannot interfere with yours. 

Interference includes attacks on confidentiality (reading your credit card number), integrity (changing your credit card number), and availability (interfering with or stopping the purchase of the book).

Techniques used to provide process isolation include virtual memory, object encapsulation, and time multiplexing. Object encapsulation treats a process as a "black box,"

Q17: Explain The Trusted Platform Module.

A: Developed and updated by the Trusted Computing Group, a Trusted Platform Module (TPM) chip is a processor that can provide additional security capabilities at the hardware level. Not all computer manufacturers employ TPM chips, but their adoption has steadily increased. A TPM chip is typically found on a system's motherboard if included.

The TPM chip allows for hardware-based cryptographic operations. Security functions can leverage the TPM for random number generation, use symmetric, asymmetric, and hashing algorithms, and secure storage of cryptographic keys and message digests. The TPM chip's most commonly referenced use case is ensuring boot integrity. By operating at the hardware level, the TPM chip can help ensure that kernel-mode rootkits are less likely to be able to undermine operating system security. In addition to boot integrity, TPM is also commonly associated with some implementations of full disk encryption. With encryption, the TPM can be used to securely store the keys that can be used to decrypt the hard drive.

Given that the TPM chip itself stores highly sensitive and valuable information, adversaries could target it. However, because TPM is hardware-based, tampering with it remotely from the operating system is much less likely. The chip also has aspects of tamper-proofing to try to ensure that a physically compromised TPM chip does not allow for a trivial bypass of the security functions offered.

Q18: How Do The Thin Client Applications Work?

A: Thin client applications normally run on a system with a full operating system but use a Web browser as a universal client, providing access to robust applications that are downloaded from the thin client server and run in the client's browser. This is in contrast to "fat" applications, which are stored locally, often with locally stored data and sometimes with complex network requirements.

Thin clients can simplify client/server and network architecture and design, improve performance, and lower costs. All data is typically stored on thin client servers. Network traffic typically uses HTTP (TCP port 80) and HTTPS (TCP port 443). The client must patch the browser and operating system to maintain security, but thin client applications are patched on the server. Citrix ICA, 2X Thin Client Server and OpenThinClient are examples of thin client applications.

Q19: How Can A User Bypass Security Checks?

A: A backdoor is a shortcut in a system that allows a user to bypass security checks (such as username/password authentication) to log in. Attackers will often install a backdoor after compromising a system. For example, an attacker gains shell access to a system by exploiting a vulnerability caused by a missing patch. The attacker wants to maintain access (even if the system is patched), so she installs a backdoor to allow future access.

Maintenance hooks are a type of backdoor. They are shortcuts installed by system designers and programmers to allow developers to bypass normal system checks during development, such as requiring users to authenticate. If maintenance hooks are left in production systems, they become a security issue.

Q20: What Are Computer Viruses, Worms, And Logic Bombs?

A: Malicious Code or Malware is the generic term for any software that attacks an application or system. There are many types of malicious code, including viruses, worms, trojans, and logic bombs, which can damage targeted systems.

• Computer Viruses: Computer viruses are malware that does not spread automatically; they require a carrier (usually a human). They frequently spread via floppy disks and (more ­recently) portable USB (Universal Serial Bus) memory, which may be ­physically carried and inserted into multiple computers.
• Worms: Worms are malware that self-propagate (spread independently). The term "worm" was coined by John Brunner in 1975 in the science fiction story The Shockwave Rider. Worms typically cause damage in two ways: first, through the malicious code they carry, and second, through loss of network availability due to aggressive self-propagation. Worms have caused some of the most devastating network attacks.
• Trojans: A trojan (also called a Trojan horse) is malware that performs two functions: benign (such as a game) and malicious. The term derives from the Trojan horse described in Virgil's poem, The Aeneid.
• Logic Bombs: A logic bomb is a malicious program triggered when a logical condition is met, such as after several transactions have been processed or on a specific date (also called a time bomb). Malware such as worms often contains logic bombs, which behave in one manner and then change tactics on a specific date and time.

Conclusion

JanBask Training's cybersecurity courses can help you gain these essential skills. They cover security engineering, risk assessment, and incident response. By taking these courses, you can get hands-on experience and learn from experts, preparing you for a successful career as a security engineer.