Top 50 Cybersecurity Interview Questions 2026

The 2026 security job market is bifurcated. Generalist security analyst roles are getting compressed by automation. Specialist roles - cloud security, AppSec, detection engineering, ML/LLM security - are paying record total comp. The interview loops have evolved to match: less trivia, more "here is a real artifact, walk me through it."

This list covers the 50 questions that show up most often, weighted toward what 2026 hiring managers actually probe. AppSec, cloud, IAM, incident response, and the new AI/LLM security questions that nobody was asking three years ago.

Part 1: Fundamentals (1-10)

1. Walk me through the CIA triad.

Confidentiality, Integrity, Availability. The frame for assessing any security control: "what does this protect?" Encryption protects confidentiality. Hashing and signatures protect integrity. Redundancy and DDoS mitigation protect availability. Most real-world incidents touch more than one.

2. What is the difference between authentication and authorization?

Authentication = who are you. Authorization = what can you do. They are independent: a system can authenticate strongly and authorize sloppily (the most common breach pattern).

3. What is defense in depth?

Layered controls so that the failure of any single layer does not compromise the system. Network segmentation + WAF + input validation + parameterized queries + least-privilege DB user + audit logging is defense in depth for an SQL injection scenario.

4. What is the principle of least privilege?

Every identity (user, service, role) gets the minimum permissions necessary. Implementing it well is harder than it sounds because permissions creep. A real answer in interview should mention how you would actually enforce it: regular access reviews, IAM Access Analyzer, time-bound credentials, just-in-time elevation.

5. What is the difference between a vulnerability, exploit, and threat?

Vulnerability = a weakness. Exploit = code or technique that uses the weakness. Threat = a person or thing with intent to use the exploit. Risk = vulnerability x threat x impact.

6. What does "shift left" mean in security?

Move security activities earlier in the SDLC. Catch issues at design and code review, not in penetration testing the week before launch. In 2026 this includes SAST in IDE, secret scanning in pre-commit, IaC scanning in CI, and SBOM generation as part of build.

7. What is the difference between symmetric and asymmetric encryption?

Symmetric = same key encrypts and decrypts (AES). Fast, but key distribution is hard. Asymmetric = public/private keypair (RSA, Ed25519). Slow, used to bootstrap symmetric keys (TLS handshake, signing).

8. What is a hash function and what makes one cryptographically strong?

Maps arbitrary input to a fixed-size output. Strong properties: pre-image resistance, second pre-image resistance, collision resistance. SHA-256 and BLAKE3 are good choices. MD5 and SHA-1 are broken; do not use them for security.

9. What is salting and why does it matter?

Adding a random per-user value to a password before hashing. Defeats rainbow tables and ensures two users with the same password get different hashes. Use a memory-hard KDF (Argon2id, scrypt) - not raw SHA-256 - for password storage.

10. Walk me through how TLS 1.3 differs from TLS 1.2.

TLS 1.3 is faster (one round trip instead of two), stricter (no broken ciphers, no renegotiation, no CBC-mode), and has forward secrecy by default. RSA key exchange is dead - everything is ECDHE. TLS 1.0 and 1.1 are deprecated. In 2026, the answer to "what TLS version should I support" is "1.2 minimum, 1.3 preferred."

Part 2: Application Security (11-20)

11. What is SQL injection and how do you prevent it?

User input concatenated into a SQL query, allowing attackers to alter the query. Prevention: parameterized queries (prepared statements). ORMs help, but only when you use them correctly - raw query strings inside an ORM are still vulnerable.

12. What is the difference between stored, reflected, and DOM-based XSS?

• Stored XSS - attacker payload saved to server (e.g., in a comment), served to other users.
• Reflected XSS - payload in the request URL or form, echoed back unescaped.
• DOM-based XSS - payload manipulates the page's DOM client-side, never touches the server.

Prevention: contextual output encoding, Content Security Policy, framework escaping (React, modern Angular escape by default).

13. What is CSRF and how do you prevent it?

Cross-Site Request Forgery: an attacker tricks a user's browser into submitting an authenticated request to your site. Prevention: SameSite cookies (Lax or Strict), CSRF tokens for state-changing operations, Origin/Referer header validation.

14. What is SSRF and why is it dangerous in cloud environments?

Server-Side Request Forgery: an attacker makes the server fetch URLs of their choice. Especially dangerous on AWS/GCP/Azure because the metadata service (169.254.169.254 on AWS, IMDSv1) returns credentials to anything that asks. Use IMDSv2, block egress to metadata IPs, validate URLs server-side.

15. What is an IDOR?

Insecure Direct Object Reference. The app uses an identifier (user ID, document ID) without verifying the requester is allowed to access it. GET /api/orders/12345 returns someone else's order. Prevention: authorization checks on every object access, not just on the route.

16. What is the OWASP Top 10 and which entries should I know cold?

A list of the most common web vulnerabilities. Top entries to know: Broken Access Control, Cryptographic Failures, Injection, Insecure Design, Security Misconfiguration, Vulnerable Components, Authentication Failures, SSRF. The 2021 list is still the canonical reference; 2025 update is similar.

17. What is XXE?

XML External Entity attack. An attacker injects external entity references into XML, causing the parser to fetch arbitrary files or URLs. Prevention: disable external entity processing in your XML parser. JSON has equivalents (prototype pollution, deserialization attacks).

18. What is a deserialization vulnerability?

When untrusted data is deserialized into objects, an attacker can craft payloads that trigger code execution. Particularly bad in Java (Apache Commons), Python (pickle), Ruby (Marshal). Avoid deserializing untrusted data; if you must, use safe formats like JSON or msgpack.

19. What is Content Security Policy?

A response header (Content-Security-Policy: ...) that tells the browser which sources of scripts, styles, fonts, etc. are allowed. Aggressive CSP blocks many XSS payloads even if injection succeeds. The hard part is auditing your dependencies to write a policy that does not break the app.

20. What is the difference between authentication tokens: JWT, opaque tokens, and session cookies?

• Session cookies - server stores session state, cookie is just a session ID. Easy to revoke.
• Opaque tokens - random strings, server-side lookup. Same revocation story.
• JWTs - signed/encrypted claims, self-contained. Hard to revoke without an allowlist or short expiration. Easier to scale, harder to manage. In 2026 the trend is "short-lived JWTs + refresh tokens" rather than long-lived JWTs.

Part 3: Network Security (21-28)

21. What is the difference between IDS and IPS?

IDS = Intrusion Detection System (alerts only). IPS = Intrusion Prevention System (blocks). The trade-off: IPS can break legitimate traffic on a false positive; IDS can let attacks through while you look at the alert.

22. What is a stateful vs stateless firewall?

Stateless inspects each packet in isolation against rules. Stateful tracks connections, so reply traffic on an established connection is allowed automatically. Modern firewalls (nftables, AWS security groups) are stateful.

23. Walk me through a TLS handshake.

ClientHello with supported versions and cipher suites. ServerHello selecting the version and cipher, plus certificate. Key exchange (ECDHE in TLS 1.3). Finished messages on both sides. Application data flows encrypted. In TLS 1.3 the handshake is one round trip; 0-RTT is possible with prior session resumption.

24. What is mutual TLS (mTLS) and when do you use it?

Both client and server authenticate each other with certificates. Use when you control both ends and want strong authentication without secrets in code. Common in service mesh (Istio, Linkerd) and B2B APIs.

25. What is DNS exfiltration?

An attacker encodes data into DNS queries (e.g., <base64-data>.attacker.com) to bypass egress filters that allow DNS but block HTTP. Defense: monitor DNS for unusually long queries, high entropy, or high volume to unfamiliar domains.

26. What is a SYN flood?

A DDoS technique where the attacker sends many SYN packets without completing the handshake, exhausting the server's connection table. Defenses: SYN cookies, rate limiting at the firewall, upstream DDoS protection.

27. What is BGP hijacking?

Announcing IP prefixes you do not own at the BGP level, causing internet traffic to route to you. Mitigations: RPKI, prefix filtering. As an applicant, you do not need deep BGP knowledge unless you are interviewing for a network security role - but you should know the term.

28. What is network segmentation and why is it a security control?

Dividing networks into zones with controlled traffic between them. Limits blast radius: a compromised host in one segment cannot pivot freely. In cloud: VPCs, subnets, security groups. In containers: NetworkPolicies, service mesh authorization.

Part 4: Cloud Security (29-37)

29. What is the AWS Shared Responsibility Model?

AWS secures the cloud (hardware, hypervisors, region infrastructure). The customer secures what is in the cloud (IAM, app code, data, network config). The line moves depending on the service: more responsibility on you for EC2, less for managed databases, almost none for SaaS-style services.

30. What is IMDSv1 vs IMDSv2 and why does it matter?

IMDSv1 returns instance metadata (including IAM credentials) to any HTTP request from the instance. SSRF vulnerabilities in apps running on EC2 can steal credentials. IMDSv2 requires a session token obtained via PUT, which most SSRF payloads cannot perform. Always use IMDSv2.

31. What is least privilege in IAM, and how do you actually implement it?

Grant only the permissions a role needs. Implementation: start with no permissions, add as needed, use IAM Access Analyzer to find unused permissions, apply permission boundaries to limit blast radius. Audit roles quarterly.

32. What is an IAM role assumption chain and where does it go wrong?

A role can assume another role, which can assume another. Useful for cross-account access. Goes wrong when trust policies are too permissive (Principal: "*") or when intermediate roles have more permissions than the final caller needs. AWS calls the worst version "confused deputy."

33. What is S3 misconfiguration and why is it the most common cloud breach?

Public bucket policies, public ACLs, or open bucket-level CORS. Cause of countless data leaks. In 2026 you should know: enable Block Public Access at the account level, audit with aws s3api get-bucket-policy-status, rely on CloudFront + signed URLs for public-facing content.

34. What are the differences between security groups and NACLs?

Security groups are stateful, evaluate at the instance level, and are allow-only. NACLs are stateless, evaluate at the subnet level, and support deny rules. Use security groups as your primary control; reach for NACLs for blanket subnet-level blocks.

35. What is KMS and how do you use it?

AWS Key Management Service. Stores encryption keys with audit logging. You don't see the key material. Encrypt at rest with KMS-managed keys (S3, EBS, RDS, DynamoDB). For envelope encryption, KMS encrypts a data key, you use the data key to encrypt your data.

36. What is an EKS pod's "real" identity from AWS's perspective?

The pod's service account, mapped to an IAM role via IRSA (IAM Roles for Service Accounts). Without IRSA, pods inherit the node's IAM role, which is a least-privilege violation. In 2026, EKS Pod Identity is the modern alternative with simpler setup.

37. What is CSPM and CWPP?

• CSPM (Cloud Security Posture Management) - continuous check of cloud configurations against best practices. Tools: Wiz, Prisma, Orca.
• CWPP (Cloud Workload Protection Platform) - runtime protection for workloads. Tools: Aqua, Sysdig.

In 2026 the lines are blurring; many vendors do both.

Part 5: Detection, Response, and Red Team (38-44)

38. Walk me through the incident response lifecycle.

NIST framing: Preparation → Detection & Analysis → Containment → Eradication → Recovery → Post-Incident Review. The post-incident review is where most teams underinvest. Without a real lessons-learned process, the same incident recurs.

39. What is the MITRE ATT&CK framework?

A taxonomy of adversary tactics, techniques, and procedures. Used by detection engineers to map their alerts to coverage gaps and by red teams to plan engagements. You do not need to memorize all 200+ techniques; you should know it exists and roughly how it is structured.

40. What is the difference between a SOC analyst and a detection engineer?

SOC analyst triages alerts. Detection engineer writes the rules that generate the alerts. In 2026, detection engineering is the higher-leverage role and pays more, because tooling is reducing the number of hands-on triage analysts needed.

41. What is a "threat hunting" engagement?

Proactive search for adversary activity that has not (yet) tripped an alert. Hypothesis-driven: "if an attacker pivoted from machine A to machine B, what artifacts would we expect to see, and do we?" Outputs: new detections, hardening recommendations.

42. What is the "Pyramid of Pain"?

A model for ranking detection signals by how costly they are for an attacker to change. From easy (hash values, IP addresses) to hard (TTPs - tactics, techniques, procedures). Investing in TTP-based detection is more valuable than IOC-based detection.

43. What is a purple team exercise?

Red team and blue team collaborate. Red team executes specific TTPs, blue team observes whether their detection picks them up, gaps are documented and closed. More productive than adversarial red-vs-blue in most environments.

44. What is a tabletop exercise?

A structured walkthrough of an incident scenario with all relevant teams. No real systems are touched. Goal is to find process gaps: who calls whom, who has authority to take systems offline, where are the runbooks. Required practice for any mature security program.

Part 6: AI and LLM Security (45-50)

45. What is prompt injection?

An attacker crafts input that overrides or subverts the system prompt of an LLM. Direct ("ignore previous instructions and ...") or indirect (data fetched by the model contains injected instructions). One of the most active 2026 attack categories.

46. How do you defend against prompt injection?

There is no perfect defense. Mitigations: separate trusted vs untrusted content in the prompt, refuse to take destructive actions without user confirmation, run output through guardrails, treat tool calls as privileged operations subject to authorization. Assume injection will succeed sometimes and design the blast radius accordingly.

47. What is "data exfiltration via LLM"?

Untrusted content fetched by the model contains instructions to encode sensitive data into a URL or tool call back to the attacker. Mitigations: domain allowlists for any tool call that egresses, output filtering, never put high-sensitivity context in prompts that ingest untrusted content.

48. What is model inversion?

An attack that extracts training data from a model by querying it. Mitigations: differential privacy during training, query rate limits, monitoring for unusual query patterns. Specifically dangerous for models trained on PII or proprietary code.

49. What is the OWASP Top 10 for LLMs?

A list maintained by OWASP covering LLM-specific risks: prompt injection, insecure output handling, training data poisoning, model denial of service, supply chain vulnerabilities, sensitive information disclosure, insecure plugin design, excessive agency, overreliance, model theft. Read it before any 2026 AI security interview.

50. How do you secure an AI agent that has tool access?

Treat the agent as a confused deputy. Apply least privilege per tool, require explicit user confirmation for high-risk actions (writes, payments, sends), log every tool call, sandbox file system and network access, monitor for unusual tool-call patterns, and design the agent so a fully compromised prompt cannot do irreversible damage.

How to Drill These

Security interviews are unusual: depth matters more than breadth. Pick a specialty (AppSec, cloud, detection) and go deep. Be honest about what you know and do not know - "I have not done much red team work, but here is what I would research before walking in" is a better answer than bluffing.

Practical reps:

• Spin up a deliberately vulnerable cloud account (AWS GruntWorks, OWASP Cloud Goat) and exploit it end-to-end.
• Set up a personal CTF practice schedule: HackTheBox, TryHackMe, PortSwigger Web Security Academy.
• Read post-mortems. Real incidents teach more than any course.

If you want to drill these under interview pressure, gitGood has a Security question bank covering this material, plus a chat-based AI mock interview where an AI interviewer presses you on the depth of your answers.

#cybersecurity #appsec #cloudsecurity #interviews #career #security