In this article
- What security interviewers are testing
- Start here: the learning path
- The basics interviewers start with
- Web application attacks and the OWASP Top 10
- Cryptography and TLS
- Threat modelling and STRIDE
- Incident response
- How to answer cyber security interview questions
- Questions interviewers ask on cyber security
- All 8 guides in Cyber security
- Follow-up questions
- Sources
What security interviewers are testing
- Confidentiality, integrity and availability
- Confidentiality, integrity and availability are the three properties of information that security controls protect: only authorised people can read it, it cannot be changed without notice, and it can be used when needed. NIST's Cybersecurity Framework (CSF) names all three in its data-protection outcomes.
- Threat model
- A threat model is a structured description of a system, who might attack it, how, and what protects it, made early so that security gaps are found before the system is built or shipped.
- Incident response
- Incident response is the organised handling of a detected security incident: the actions taken to contain its effects, remove the cause and restore normal operations, and the preparation that makes those actions fast.
- Payment tokenization
- Payment tokenization is a process in which a card's primary account number is replaced by a surrogate value called a token, so that systems that only need to refer to the card never hold the real number.
Security interviewers test risk reasoning more than memory: what is being protected, who might attack it, which controls exist and how you would notice a failure. The National Institute of Standards and Technology (NIST) Cybersecurity Framework 2.0, published on 26 February 2024, gives a ready checklist. It organises cybersecurity outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover (NIST CSF 2.0). Most questions fall under one of the six, so naming the function you are in keeps an answer organised. Roles differ in emphasis: a security operations centre (SOC) analyst works mostly on Detect and Respond, which the SOC analyst page covers, and the threat intelligence page covers the intelligence side.
Start here: the learning path
Take the areas in the order below. The basics and the web-attack list come first because every scenario question reuses them, and they are on this page. Cryptography and the Transport Layer Security (TLS) protocol come next, then threat modelling, then incident response. Read the computer networks questions alongside the TLS material, because security questions often assume you know how traffic moves.
Text description of the diagram
- The guide covers six areas of cyber security interviews.
- The areas run from basics and web attacks to cryptography, threat modelling and incident response.
- Symmetric vs asymmetric crypto in TLS: what each one does
- Threat-modelling scenario questions, worked with STRIDE and trust boundaries
- Incident response for security roles: who owns triage, containment and comms
Knowing it is half the job. Saying it is the other half.
Interview Clozo is an AI interview copilot for real interview rounds: it hears the question and puts a strong answer on your screen, and you say it in your own words. See the features or how it works.
Start Free Trial →The basics interviewers start with
Confidentiality, integrity and availability is the frame for most opening questions: for any system ask which of the three matters most and what threatens it. A bank statement needs confidentiality; a payment record needs integrity; a hospital system needs availability. NIST CSF 2.0 lists protecting all three for data at rest, in transit and in use among its Protect outcomes.
Three ideas recur. Authentication proves who someone is. Authorisation decides what that person may do once known. Least privilege gives each account only the access it needs, so a stolen credential does limited damage. Add defence in depth, meaning several independent controls so that one failure does not expose everything. Interviewers listen for whether you apply these to the system in front of you, for example "this application programming interface (API) needs authentication on every call and separate authorisation per resource", not whether you can recite them.
Web application attacks and the OWASP Top 10
The Open Worldwide Application Security Project (OWASP) Top 10 is "a standard awareness document for developers and web application security", and its page says the most current released version is the 2025 edition (OWASP, read 2026-10-24). Interviewers use it as a shared vocabulary, so know each category and one realistic example. You do not need to memorise numbers; you need to explain what goes wrong. Worked answers are in application security interview questions and answers.
| OWASP 2025 category | What goes wrong (our wording) |
|---|---|
| A01 Broken Access Control | a user can act outside their permissions |
| A02 Security Misconfiguration | unsafe defaults, open services or wrong settings |
| A03 Software Supply Chain Failures | a dependency, build step or update path is compromised |
| A04 Cryptographic Failures | data is unprotected or weakly protected |
| A05 Injection | untrusted input is run as a command or query |
| A06 Insecure Design | the design lacks a control it needed |
| A07 Authentication Failures | an attacker gets in as someone else |
| A08 Software or Data Integrity Failures | code or data is trusted without checking it |
| A09 Security Logging and Alerting Failures | attacks are not recorded or noticed |
| A10 Mishandling of Exceptional Conditions | errors and edge cases are handled unsafely |
Cryptography and TLS
TLS is the protocol that protects most traffic between a browser and a server, and interviews ask how it combines the two kinds of cryptography. Symmetric encryption uses one shared secret key and is fast, so it protects the data. Asymmetric cryptography uses a key pair and is used to agree keys and to prove identity. Request for Comments (RFC) 9846, the current TLS 1.3 text, describes three properties TLS provides: authentication, confidentiality and integrity.
Its changes from earlier versions removed static Rivest–Shamir–Adleman (RSA) and Diffie-Hellman suites so that every public-key based key exchange provides forward secrecy: a later leak of the server's long-term private key does not expose traffic recorded earlier (RFC 9846, read 2026-10-24; the same wording appears in RFC 8446, August 2018, which RFC 9846 obsoletes). Session resumption with a pre-shared key alone, and zero round-trip time (RTT) early data, do not get full forward secrecy.
Say which key is used for what, and what a certificate proves: a certificate binds a public key to the server's name and is signed by a certificate authority the client trusts. In the handshake, the CertificateVerify message gives "explicit proof that an endpoint possesses the private key corresponding to its certificate" (RFC 9846 section 4.5.2).
Threat modelling and STRIDE
A threat-modelling question gives you a system and asks what could go wrong. Start by drawing the parts and the data flows between them, then walk through each part with a checklist. Microsoft describes a threat model named from its six categories, spoofing, tampering, repudiation, information disclosure, denial of service and elevation of privilege (STRIDE), as a way to categorise threats and simplify security conversations (Microsoft Learn, updated March 2026).
| STRIDE category | The threat, in short |
|---|---|
| Spoofing | using another user's authentication information |
| Tampering | malicious modification of data, at rest or in flight |
| Repudiation | a user denies an action and nothing can prove otherwise |
| Information disclosure | data is exposed to people who should not see it |
| Denial of service | valid users are denied service |
| Elevation of privilege | an unprivileged user gains privileged access |
After finding threats, rank them by impact and likelihood, then say which control you would add and what risk remains.
Incident response
An incident response question asks what you do when something is wrong: confirm, contain, remove the cause, restore, then learn. NIST published Special Publication 800-61 Revision 3 in April 2025, titled as a Cybersecurity Framework 2.0 community profile, superseding Revision 2 of August 2012; its stated aim is to help organisations reduce the number and impact of incidents (NIST, April 2025). In CSF terms, Respond covers actions taken once an incident is detected and Recover covers restoring affected assets and operations. A strong answer names who you tell, what evidence you preserve and how you decide to restore service. The SOC analyst page has worked triage questions.
How to answer cyber security interview questions
Answer a security scenario in a fixed order and say it aloud. First restate the scope: what system, what data, who uses it. Then name the assets and what matters most about each. Then list the likely threats, using STRIDE or the OWASP list as a prompt. Then give controls in three kinds: prevent, detect and respond. Finish with the trade-off and the risk you accept, and what you would monitor. Keep each answer short and offer to go deeper. If you do not know a detail, say what you would check. The interview loops page shows where security rounds sit, and the behavioral interviews hub covers the stories security teams also ask for.
Questions interviewers ask on cyber security
These ten questions are in our own words, with what each tests; we make no claim about how often each is asked. Our full answered list is the application security interview questions and answers index.
| Question (our wording) | What it tests |
|---|---|
| What are confidentiality, integrity and availability? | Fundamentals |
| What is the difference between authentication and authorisation? | Fundamentals |
| How would you secure a login page? | Applied reasoning |
| Explain one OWASP category with an example. | Web security |
| How does TLS protect a connection? | Cryptography |
| Symmetric or asymmetric encryption, and when? | Cryptography |
| Threat-model a file-upload feature. | Threat modelling |
| What do you do in the first hour of a suspected breach? | Incident response |
| How would you tell a real alert from a false alarm? | Judgement |
| Tell me about a time you found a security problem. | Behaviour |
Follow-up questions
How to answer cyber security interview questions?
Restate the scope, name the assets, list threats, give preventive, detective and response controls, then state the trade-off and the residual risk. Practise saying it in a minute; see the section above and the behavioral interviews hub for the stories.
What is tokenization in cyber security?
Tokenization is a process in which a primary account number (PAN) is replaced with a surrogate value called a token, and de-tokenization is the reverse, according to the Payment Card Industry (PCI) Security Standards Council, which publishes the Payment Card Industry Data Security Standard (DSS) (Tokenization Guidelines, version 2.0, August 2011). The token's security rests on the infeasibility of working out the original number from the token alone. Do not confuse it with tokenization of text for language models, which is a different idea; see byte pair encoding.
Is tokenization the same as encryption?
No, though they can overlap. The PCI guidance notes that when a token is derived from the original number with an encryption algorithm and key, the token is an encrypted number and may stay in compliance scope. A vault-based system keeps a mapping between tokens and numbers in a card data vault, which the guidance calls often the most attractive target for attackers. Tokenization may reduce the systems in scope but does not remove the need for compliance.
Do I need to memorise the OWASP Top 10?
No. Know each category by name and one example, and be ready to explain what goes wrong. OWASP calls it an awareness document, and the list is revised between versions, so say which version you mean.
Which security frameworks should I know?
Know NIST CSF 2.0 and its six functions, the OWASP Top 10 for web applications and STRIDE for threat modelling, and say which fits the question. For payment systems, tokenization shows up in the payment system design page, and for system-wide questions the system design hub covers the architecture side.
- Frame a security question with confidentiality, integrity and availability, then with the six NIST functions.
- Know the OWASP Top 10 by category and one example each; it is a shared vocabulary.
- Use STRIDE to check each part of a system for six kinds of threat.
- Tokenization swaps a card number for a surrogate that only the tokenization system can map back; encryption can be reversed by anyone holding the key.
- Answer in a fixed order: scope, assets, threats, controls, trade-off, residual risk.
Sources
- OWASP Top 10:2025 — OWASP Foundation (date = read date), 24 Oct 2026
- The NIST Cybersecurity Framework (CSF) 2.0 — NIST (CSWP 29), 26 Feb 2024
- Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile (SP 800-61 Rev. 3) — NIST, 3 Apr 2025
- RFC 9846: The Transport Layer Security (TLS) Protocol Version 1.3 — IETF (date = read date; copyright 2026), 24 Oct 2026
- RFC 8446: The Transport Layer Security (TLS) Protocol Version 1.3 — IETF (Rescorla), 1 Aug 2018
- Threats - Microsoft Threat Modeling Tool (STRIDE model) — Microsoft Learn (page updated March 2026), 4 Mar 2026
- PCI DSS Tokenization Guidelines, Information Supplement, version 2.0 — PCI Security Standards Council, 1 Aug 2011
