Cyber Security Intern Questions

Possible Questions I NEED to know the answer to.

Name an OSI Model Layer (7 Layers)

Physical – Hardware transmission of raw data (cables, switches).

Name an OSI Model Layer (7 Layers)

Data Link – Handles MAC addresses and frames (Ethernet).

Name an OSI Model Layer (7 Layers)

Network – IP addressing and routing (IP, routers).

Name an OSI Model Layer (7 Layers)

Transport – End-to-end delivery and error recovery (TCP/UDP).

Name an OSI Model Layer (7 Layers)

Session – Manages sessions between applications.

Name an OSI Model Layer (7 Layers)

Presentation – Data translation, encryption, compression.

Name an OSI Model Layer (7 Layers)

Application – Interface for user applications (HTTP, FTP, DNS).

Name a type of XSS (Cross-Site Scripting)

Stored XSS – Malicious script is stored on the server and served to users.

Name a type of XSS (Cross-Site Scripting)

Reflected XSS – Script is reflected off a web server (e.g., via URL).

Name a type of XSS (Cross-Site Scripting)

DOM-based XSS – Client-side JavaScript modifies the DOM using unsanitized input.

Name a way Information can be gained from an XSS attack

Session cookies (for hijacking sessions)

Name a way Information can be gained from an XSS attack

Credentials via phishing prompts

Name a way Information can be gained from an XSS attack

Keystrokes or browser history

Name a way Information can be gained from an XSS attack

Redirecting users to malicious sites

Name a Method of External Attackers Use

Phishing emails

Name a Method of External Attackers Use

Malware (via trojans, spyware)

Name a Method of External Attackers Use

Exploiting unpatched software (vulnerabilities)

Name a Method of External Attackers Use

Social engineering

Name a Method of External Attackers Use

Brute-force or dictionary attacks

Name a Method of External Attackers Use

DDoS (Denial of Service)

Name a Common Port Number

80 – HTTP

Name a Common Port Number

443 – HTTPS

Name a Common Port Number

21 – FTP

Name a Common Port Number

22 – SSH

Name a Common Port Number

25 – SMTP

Name a Common Port Number

53 – DNS

Name a Common Port Number

110/995 – POP3/secure

Name a Common Port Number

143/993 – IMAP/secure

Name a Common Port Number

3389 – RDP

Name a Common Port Number

23 – Telnet

Name a Common Port Number

Ping – ICMP (not a port, but protocol)

What is the “C” in CIA Cybersecurity mean?

Confidentiality – Prevent unauthorized access

What is the “I” in CIA Cybersecurity mean?

Integrity – Ensure data is unaltered

What is the “A” in CIA Cybersecurity mean?

Availability – Systems/services remain accessible

What does the first “A” in AAA Cybersecurity mean?

Authentication – Verifying identity

What does the second “A” in AAA Cybersecurity mean?

Authorization – Granting access based on permissions

What does the third “A” in AAA Cybersecurity mean?

Accounting – Logging and monitoring user actions

How Does a Search Engine Work?

Crawling – Bots discover web pages,

Indexing – Pages are stored and organized,

Ranking/Querying – Pages ranked and returned for a search based on relevance

What is a TCP Handshake?

A three-step process for establishing a TCP connection:

1. SYN – Client requests a connection.

2. SYN-ACK – Server acknowledges.

3. ACK – Client confirms

Name an Encryption Standard

AES (Advanced Encryption Standard) – Symmetric

Name an Encryption Standard

RSA – Asymmetric (public/private keys)

Name an Encryption Standard

SHA – Hashing (not encryption)

Name an Encryption Standard

TLS/SSL – Encrypt web traffic

Name a Common Analyst Tool

Wireshark – Packet analysis

Name a Common Analyst Tool

Nmap – Port scanning

Name a Common Analyst Tool

Metasploit – Exploitation framework

Name a Common Analyst Tool

Burp Suite – Web vulnerability scanner

Name a Common Analyst Tool

Splunk/ELK – Log analysis

Name a Common Analyst Tool

Nessus/OpenVAS – Vulnerability scanning

What is DoD Cybersecurity?

Based on standards like RMF (Risk Management Framework), STIGs, and compliance with 8570.01-M/8140.01

What is DoD 8570.01-M?

Manual defining certification requirements for Information Assurance (IA) roles. Lists approved certs (e.g., Security+, CISSP)

What is DoD 8140.01

Newer policy replacing 8570.01-M. Broader focus: includes cyber workforce structure and training (cybersecurity, IT, cyber effects)

What is one of OWASP’s Top 10? (top 10 most critical web application security risks)

Injection

What is one of OWASP’s Top 10? (top 10 most critical web application security risks)

Broken Authentication

What is one of OWASP’s Top 10? (top 10 most critical web application security risks)

Sensitive Data Exposure

What is one of OWASP’s Top 10? (top 10 most critical web application security risks)

XML External Entities (XXE)

What is one of OWASP’s Top 10? (top 10 most critical web application security risks)

Broken Access Control

What is one of OWASP’s Top 10? (top 10 most critical web application security risks)

Security Misconfiguration

What is one of OWASP’s Top 10? (top 10 most critical web application security risks)

Cross-Site Scripting (XSS)

What is one of OWASP’s Top 10? (top 10 most critical web application security risks)

Insecure Deserialization

What is one of OWASP’s Top 10? (top 10 most critical web application security risks)

Using Components with Known Vulnerabilities

What is one of OWASP’s Top 10? (top 10 most critical web application security risks)

Insufficient Logging & Monitoring

What is the Port Number for Ping?

Ping uses ICMP, not a port. ICMP operates directly over IP

What is ICMP?

Internet Control Message Protocol – Used for diagnostic or control purposes (e.g., ping, traceroute)

What is Risk in Cybersecurity?

The potential for loss or damage when a threat exploits a vulnerability

What is a Threat in Cybersecurity?

Anything that can exploit a vulnerability and cause harm (e.g., hacker, malware)

What is a Vulnerability in Cybersecurity?

A weakness that can be exploited (e.g., outdated software, weak passwords)

Name a way to Manage Vulnerabilities at Home

Enable automatic updates (OS, software)

Name a way to Manage Vulnerabilities at Home

Use antivirus/anti-malware

Name a way to Manage Vulnerabilities at Home

Enable firewalls

Name a way to Manage Vulnerabilities at Home

Change default passwords

Name a way to Manage Vulnerabilities at Home

Scan for vulnerabilities (e.g., with tools like Nessus Home)