Interview prep

Cybersecurity Interview Questions

Security interviews test threat modelling instincts and practical knowledge of identity, network and application controls.

Questions and answers

01Walk me through threat modelling a new feature.

Identify assets and trust boundaries, enumerate threats with a framework such as STRIDE, rate them by impact and likelihood, and attach concrete mitigations to the ones that matter.

02How does OAuth 2.0 differ from OIDC?

OAuth 2.0 is an authorisation framework issuing access tokens; OIDC layers authentication on top, adding an ID token that asserts who the user is.

03What are the OWASP Top 10 categories you see most in practice?

Broken access control and injection dominate real findings, followed by insecure design and vulnerable dependencies.

04How do you secure secrets and keys at scale?

Centralised secret storage, short-lived credentials, workload identity instead of static keys, automatic rotation and audit logging on access.

05What is defence in depth?

Layering independent controls so a single failure isn't a breach — network segmentation plus least-privilege identity plus application authorisation plus monitoring.

How to answer these well

Interviewers are not grading recall — they are checking whether you've hit the failure mode the question describes. Anchor every answer to something you actually shipped or debugged with Cybersecurity.

Say the trade-off out loud. "I'd use X here, but it costs Y under Z conditions" scores higher than a clean textbook definition every time.

Roles asking for Cybersecurity

Related prep