Security Engineering Fundamentals Knowledge Map

🔐 Encryption, Authentication & Access

1. What is a three-way handshake? A process (SYN → SYN-ACK → ACK) used by TCP to establish a reliable connection between two devices before data transfer.

2. How do cookies work? Cookies are small pieces of data stored in your browser to remember information like login sessions or preferences.

3. How do sessions work? Sessions temporarily store user data on the server to maintain state across multiple requests (e.g., staying logged in).

4. Explain how OAuth works. OAuth allows a user to grant limited access to their resources on one site to another app — without sharing passwords.

5. Explain how JWT works. JWT (JSON Web Token) is a compact, signed token used to securely transmit identity information between systems.

6. What is a PKI flow? Public Key Infrastructure manages digital certificates and keys for secure communication — using a Certificate Authority (CA) to verify identities.

7. Synchronous vs Asynchronous encryption?

• Symmetric (synchronous): Same key for encryption and decryption.

• Asymmetric (asynchronous): Uses public and private key pairs.

8. Describe the SSL handshake. It’s the process where a client and server exchange certificates and keys to establish an encrypted HTTPS connection.

9. How does HMAC work? It combines a secret key with a message and hashes them to verify data integrity and authenticity.

10. Why is HMAC designed that way? To ensure messages are authentic and haven’t been tampered with, even if the attacker sees the message.

11. Authentication vs Authorization?

• Authentication: Verifies who you are.

• Authorization: Determines what you can access.

12. Diffie-Hellman vs RSA?

• Diffie-Hellman: Used for key exchange.

• RSA: Used for both encryption and digital signatures.

13. How does Kerberos work? Uses a trusted third party (KDC) to issue time-limited tickets, allowing secure authentication without repeatedly sending passwords.

14. Compress then encrypt or encrypt then compress? Always compress first, then encrypt. Encryption randomizes data, making compression ineffective afterward.

15. How do I authenticate you and know you sent the message? Through digital signatures or message authentication codes (MAC/HMAC).

16. Should you encrypt all data at rest? Yes — especially sensitive or regulated data — to prevent unauthorized access.

17. What is Perfect Forward Secrecy (PFS)? A property ensuring that past encrypted sessions remain secure even if long-term keys are later compromised.

🌐 Network Security, Protocols & Logging

18. Common security-related ports and risks:

• 22 (SSH) – brute-force attacks → use key pairs

• 80 (HTTP) – unencrypted → use HTTPS

• 443 (HTTPS) – encrypted web traffic

• 53 (DNS) – spoofing → use DNSSEC

19. Which port is used for DNS? Port 53 (UDP/TCP).

20. Describe HTTPS. It’s HTTP over TLS/SSL — providing encrypted communication between browser and server.

21. Difference between HTTPS and SSL? SSL/TLS is the encryption protocol; HTTPS is HTTP that uses it for secure communication.

22. How does threat modeling work? Identifies possible threats, attack paths, and mitigations for a system before deployment.

23. What is a subnet and why useful? A subnet divides a large network into smaller segments for better security and performance.

24. What is a subnet mask? Defines which portion of an IP address identifies the network vs the host.

25. What is traceroute? A diagnostic tool showing the path packets take to reach a destination and where delays occur.

26. Network troubleshooting scenario: Visualize routers, switches, and firewalls, then use ping/traceroute/logs to identify where communication fails.

27. Cisco ASA firewall config: ACLs (Access Control Lists) define which IPs and ports are allowed, denied, or logged.

28. Explain TCP/IP concepts. TCP ensures reliable delivery; IP handles addressing and routing between hosts.

29. What is the OSI model? A 7-layer conceptual model explaining how data moves (Physical → Application layer).

30. Router vs Switch?

• Router: Connects multiple networks.

• Switch: Connects devices within one network.

31. Risk Management Framework (RMF): A structured process to categorize, assess, authorize, and monitor system risks.

32. How does a packet travel on same network? Through ARP (Address Resolution Protocol) — finding MAC address and sending data directly.

33. TCP vs UDP — which is more secure? TCP, as it establishes a connection and ensures delivery. UDP is faster but unreliable.

34. TCP three-way handshake: SYN → SYN-ACK → ACK — ensures both parties are ready before data exchange.

🧠 System, Application & Cloud Security

35. DNS poisoning: Corrupting DNS cache so users are redirected to malicious sites.

36. ARP spoofing: Attacker sends fake ARP messages to intercept network traffic.

37. Man-in-the-middle attack: Intercepting and possibly altering communication between two systems.

38. IDS vs IPS:

• IDS: Detects suspicious traffic.

• IPS: Detects and blocks it.

39. WAF (Web Application Firewall): Filters and monitors web traffic to protect against attacks like SQL injection and XSS.

40. SQL injection: Injecting malicious SQL commands into input fields to access or modify databases.

41. XSS (Cross-Site Scripting): Injecting malicious scripts into web pages that run in users’ browsers.

42. CSRF (Cross-Site Request Forgery): Tricking users into performing unintended actions (e.g., changing password) while authenticated.

43. Input validation: Ensuring user inputs are correct and safe before processing.

44. Vulnerability vs Exploit vs Payload:

• Vulnerability: A weakness.

• Exploit: The method to take advantage of it.

• Payload: The malicious code executed after exploitation.

45. Patch management: Regularly updating software to fix vulnerabilities.

46. Least privilege: Users or systems get only the minimum access necessary.

47. Defense in depth: Multiple security layers — if one fails, others protect the system.

48. Network segmentation: Dividing networks into zones to reduce the impact of breaches.

49. Honeypot: A decoy system used to detect or distract attackers.

50. Zero Trust: No implicit trust; verify every user, device, and connection continuously.

51. MFA (Multi-Factor Authentication): Requires two or more verification methods (password + token).

52. SSO (Single Sign-On): One login grants access to multiple systems securely.

53. IAM (Identity and Access Management): Framework for managing digital identities and their access rights.

54. Separation of duties: Split responsibilities so no one person can misuse power alone.

55. Logging and monitoring: Recording and reviewing system activities to detect suspicious events.

56. SIEM: Security Information and Event Management — aggregates and analyzes logs across systems.

57. DDoS attack: Flooding a server with traffic to make it unavailable.

58. DDoS prevention: Rate limiting, load balancers, CDNs, and firewall filtering.

59. Vulnerability scan vs Pen test:

• Scan: Finds weaknesses automatically.

• Pen test: Actively exploits them like a hacker would.

60. System hardening: Reducing attack surface by disabling unused services and applying security settings.

61. Security baseline: The minimum set of configurations required to secure systems.

62. Encryption in transit vs at rest:

• Transit: Protects data while moving.

• At rest: Protects stored data.

63. Cloud shared responsibility model: Cloud providers secure infrastructure; customers secure their data and configurations.

64. Container security: Protecting applications running inside containers through image scanning and isolation.

65. Kubernetes: Orchestrates and manages multiple containers for scaling and resilience.

66. Cloud misconfiguration: Incorrect settings (like open S3 buckets) that expose data publicly.

67. IAM role vs policy:

• Role: Identity with permissions.

• Policy: Set of rules defining what actions are allowed.

68. EDR/XDR:

• EDR: Endpoint detection and response.

• XDR: Extended detection across endpoints, network, and cloud.

69. DLP (Data Loss Prevention): Prevents sensitive data from being leaked or sent outside the organization.

70. Ransomware: Malware that encrypts data and demands payment to unlock it.

71. Phishing: Deceptive messages tricking users into revealing sensitive information.

72. Social engineering: Manipulating people into giving access or information.

73. Insider threat: An internal user misusing access intentionally or accidentally.

74. Supply chain attack: Compromising a trusted vendor or software dependency to target victims.

75. Sandboxing: Running code in an isolated environment to safely test or observe it.

76. Malware vs Virus vs Worm:

• Malware: Any malicious software.

• Virus: Spreads by attaching to files.

• Worm: Self-replicates over networks.

77. Hashing: Converting data into a fixed-size string (hash) — used for integrity checks.

78. Salt in hashing: Random value added to hashes to make them unique and resistant to precomputed attacks.

79. Digital signature: Proves authenticity and integrity using cryptographic signing.

80. Certificate pinning: Forcing an application to trust only a specific server certificate.

81. Lateral movement: When attackers move within a network after gaining initial access.

82. Privilege escalation: Gaining higher permissions than originally allowed.

83. Incident response: Steps taken to detect, contain, and recover from a cyber incident.

84. Incident response phases: Preparation → Detection → Containment → Eradication → Recovery → Lessons learned.

85. DFIR: Digital Forensics and Incident Response — investigates, analyzes, and responds to breaches.

86. Log correlation: Linking related log events from multiple systems to identify incidents.

87. SOC (Security Operations Center): A team and facility monitoring and managing security incidents.

88. Threat hunting: Proactively searching for hidden or emerging threats.

89. MITRE ATT&CK framework: A knowledge base of adversary tactics and techniques used for threat analysis and defense planning.

90. Kill chain: A model describing the stages of a cyberattack — from reconnaissance to data exfiltration.