devops-interview-handbook

Security Interview Questions

Table of Contents

Security Fundamentals

Q1: Explain the CIA triad and its importance.

Difficulty: Junior

Answer:

CIA Triad is the foundation of information security:

Confidentiality:

Integrity:

Availability:

Real-world Context:

Follow-up: How do you balance CIA? (Trade-offs: More encryption = confidentiality but may impact availability. More redundancy = availability but cost)

Q2: What is defense in depth and how do you implement it?

Difficulty: Mid

Answer:

Defense in depth uses multiple layers of security controls.

Layers:

1. Physical Security:

2. Network Security:

3. Host Security:

4. Application Security:

5. Data Security:

6. Policies and Procedures:

Real-world Context: Web application: Firewall → WAF → Load balancer → Application servers (hardened) → Database (encrypted) → Backups (encrypted).

Follow-up: What’s the difference between defense in depth and single point of failure? (Defense in depth: multiple layers, Single point: one failure breaks everything)

Q3: Explain the principle of least privilege.

Difficulty: Mid

Answer:

Principle of least privilege: Grant minimum permissions necessary to perform tasks.

Implementation:

1. User Accounts:

2. IAM Policies:

3. Service Accounts:

4. Network Access:

5. Application Permissions:

Benefits:

Real-world Context: Application needs S3 read access. Grant s3:GetObject on specific bucket, not s3:* on all buckets.

Follow-up: How do you implement least privilege in cloud? (IAM roles with specific permissions, resource-based policies, regular access reviews)

Encryption

Q4: Explain symmetric vs asymmetric encryption.

Difficulty: Mid

Answer:

Symmetric Encryption:

Asymmetric Encryption:

Hybrid Approach:

Example:

Real-world Context: HTTPS: Server sends public key, client encrypts symmetric key with it, both use symmetric key for data. Fast and secure.

Follow-up: Why not use asymmetric for everything? (Too slow for large data, symmetric is 1000x faster)

Q5: Explain SSL/TLS and how it works.

Difficulty: Mid

Answer:

SSL/TLS provides encrypted communication over network.

TLS Handshake:

  1. Client Hello: Client sends supported cipher suites, TLS version
  2. Server Hello: Server chooses cipher suite, sends certificate
  3. Certificate Verification: Client verifies server certificate
  4. Key Exchange: Client encrypts pre-master secret with server’s public key
  5. Cipher Change: Both switch to symmetric encryption
  6. Encrypted Communication: Data encrypted with symmetric key

Certificate Components:

Certificate Authorities (CA):

Types:

Real-world Context: Website uses TLS certificate. Browser verifies certificate, establishes encrypted connection. Data encrypted in transit.

Follow-up: What’s the difference between SSL and TLS? (SSL deprecated, TLS is modern version. People say SSL but mean TLS)

Q6: Explain encryption at rest vs in transit.

Difficulty: Mid

Answer:

Encryption in Transit:

Encryption at Rest:

Both Needed:

Implementation:

At Rest:

In Transit:

Key Management:

Real-world Context: Database: Encrypt connections (in transit) and encrypt data on disk (at rest). Both required for complete protection.

Follow-up: What happens if you only encrypt in transit? (Data vulnerable if attacker gains disk access or database backup is stolen)

Authentication & Authorization

Q7: Explain OAuth 2.0 and how it works.

Difficulty: Senior

Answer:

OAuth 2.0 is authorization framework for delegated access.

Roles:

Flow (Authorization Code):

  1. User clicks “Login with Google”
  2. Redirected to authorization server
  3. User authenticates and grants permission
  4. Authorization server redirects back with code
  5. Client exchanges code for access token
  6. Client uses access token to access resources

Grant Types:

Tokens:

Real-world Context: Mobile app wants user’s Google photos. User grants permission via OAuth. App gets token, accesses photos on user’s behalf.

Follow-up: What’s the difference between OAuth and OIDC? (OAuth: authorization, OIDC: authentication + identity information)

Q8: Explain JWT (JSON Web Tokens) and their use cases.

Difficulty: Mid

Answer:

JWT is compact, URL-safe token format for securely transmitting information.

Structure:

Format:

header.payload.signature

Characteristics:

Use Cases:

Example Flow:

  1. User logs in
  2. Server validates credentials
  3. Server creates JWT with user info
  4. Client stores JWT (localStorage, cookie)
  5. Client sends JWT in Authorization header
  6. Server validates signature and extracts claims

Security Considerations:

Real-world Context: API authentication: User logs in, gets JWT. Subsequent requests include JWT. Server validates and processes request.

Follow-up: What’s the difference between JWT and session cookies? (JWT: stateless, scalable. Sessions: stateful, require server storage)

Q9: Explain MFA (Multi-Factor Authentication) and its importance.

Difficulty: Mid

Answer:

MFA requires multiple authentication factors.

Factors:

  1. Something you know: Password, PIN
  2. Something you have: Phone, hardware token, smart card
  3. Something you are: Biometric (fingerprint, face)

Types:

Methods:

Importance:

Best Practices:

Real-world Context: AWS account: Password + MFA code from authenticator app. Even if password stolen, attacker can’t access without phone.

Follow-up: Why is SMS less secure than TOTP? (SMS can be intercepted, SIM swapping attacks. TOTP is local, can’t be intercepted)

Network Security

Q10: Explain firewalls, WAF, and their differences.

Difficulty: Mid

Answer:

Firewall (Network Firewall):

WAF (Web Application Firewall):

Differences:

Feature Firewall WAF
Layer 3/4 7
Inspection IP, port HTTP content
Protection Network attacks Application attacks
Rules IP/port based URL, headers, body

Use Both:

Real-world Context: Web application: Network firewall allows port 443, WAF inspects HTTP requests, blocks SQL injection attempts.

Follow-up: Can a WAF replace a firewall? (No, different layers. WAF protects applications, firewall protects network)

Q11: Explain DDoS attacks and mitigation strategies.

Difficulty: Senior

Answer:

DDoS (Distributed Denial of Service) overwhelms target with traffic.

Types:

1. Volume-Based:

2. Protocol-Based:

3. Application-Based:

Mitigation Strategies:

1. CDN/DDoS Protection:

2. Rate Limiting:

3. Scaling:

4. Monitoring:

5. Blacklisting:

Real-world Context: Website under DDoS. Use Cloudflare to filter, rate limit per IP, scale infrastructure, monitor and block malicious IPs.

Follow-up: What’s the difference between DDoS and DoS? (DoS: single source, DDoS: multiple sources, harder to block)

Cloud Security

Q12: Explain IAM best practices in cloud.

Difficulty: Mid

Answer:

1. Principle of Least Privilege:

2. Use Roles, Not Users:

3. Enable MFA:

4. Rotate Credentials:

5. Separate Accounts:

6. Audit and Monitor:

7. Use Policy Conditions:

8. Avoid Hardcoded Credentials:

Real-world Context: EC2 instance needs S3 access. Use IAM role attached to instance, not access keys. Regular access reviews, MFA for console.

Follow-up: How do you audit IAM permissions? (Use IAM Access Analyzer, CloudTrail, policy simulator, regular reviews)

Q13: Explain secrets management best practices.

Difficulty: Mid

Answer:

Secrets Management:

Secrets Include:

Best Practices:

1. Use Secrets Management Service:

2. Never Commit Secrets:

3. Rotate Regularly:

4. Least Privilege Access:

5. Encrypt at Rest:

6. Audit and Monitor:

Example:

# Bad: Hardcoded
DB_PASSWORD="secret123"

# Good: Secrets Manager
aws secretsmanager get-secret-value --secret-id db-password

Real-world Context: Application needs database password. Store in AWS Secrets Manager. Application retrieves at runtime. Rotate every 90 days.

Follow-up: What’s the difference between Secrets Manager and Parameter Store? (Secrets Manager: automatic rotation, higher cost. Parameter Store: simpler, lower cost, manual rotation)

Q14: Explain security groups and network ACLs in cloud.

Difficulty: Mid

Answer:

Security Groups (AWS):

Network ACLs (AWS):

Differences:

Feature Security Groups NACLs
Level Instance Subnet
Stateful Yes No
Rules Allow only Allow/Deny
Default Deny all Allow all (can change)

Use Cases:

Best Practice:

Real-world Context: Web server: Security Group allows 80/443 from internet, 22 from office IP. NACL adds subnet-level protection, blocks specific IPs.

Follow-up: What happens if you block port 80 in NACL but allow in Security Group? (Traffic blocked - NACL evaluated first)

Compliance & Best Practices

Q15: Explain security compliance: SOC 2, PCI DSS, GDPR.

Difficulty: Senior

Answer:

SOC 2 (Service Organization Control 2):

PCI DSS (Payment Card Industry Data Security Standard):

GDPR (General Data Protection Regulation):

Key Requirements:

SOC 2:

PCI DSS:

GDPR:

Real-world Context: E-commerce: PCI DSS for payment processing, SOC 2 for overall security, GDPR for EU customers’ data protection.

Follow-up: How do you prepare for compliance audits? (Document controls, implement security measures, regular assessments, maintain evidence)

Q16: Explain security incident response process.

Difficulty: Senior

Answer:

Incident Response Phases:

1. Preparation:

2. Identification:

3. Containment:

4. Eradication:

5. Recovery:

6. Lessons Learned:

Real-world Context: Data breach detected: Contain (isolate systems, block IPs), Eradicate (remove malware, patch), Recover (restore, monitor), Learn (review, improve).

Follow-up: What’s the difference between incident and event? (Event: something happened, Incident: security impact, requires response)

Q17: Explain security scanning and vulnerability management.

Difficulty: Mid

Answer:

Vulnerability Management Process:

1. Discovery:

2. Assessment:

3. Prioritization:

4. Remediation:

5. Verification:

Scanning Types:

1. Network Scanning:

2. Application Scanning:

3. Container Scanning:

4. Infrastructure Scanning:

Real-world Context: Regular scans: Network (monthly), Application (in CI/CD), Containers (on build), Infrastructure (on changes). Prioritize and patch.

Follow-up: How do you prioritize vulnerabilities? (CVSS score, exploitability, business impact, patch availability, compensating controls)

Q18: Explain zero trust security model.

Difficulty: Senior

Answer:

Zero Trust: Never trust, always verify. Assume breach, verify explicitly.

Principles:

1. Verify Explicitly:

2. Use Least Privilege:

3. Assume Breach:

Components:

1. Identity:

2. Devices:

3. Networks:

4. Applications:

5. Data:

Implementation:

Real-world Context: Traditional: Trust internal network. Zero Trust: Verify every access, even internal. Segment networks, encrypt everything, monitor continuously.

Follow-up: How is zero trust different from traditional security? (Traditional: Trust internal, protect perimeter. Zero Trust: No implicit trust, verify everything)

Summary

Security is critical in DevOps. Understand encryption, authentication, network security, cloud security, and compliance. Implement defense in depth and follow security best practices.

Next Steps:

This site is open source. Improve this page.