{"id":22700,"date":"2022-07-24T19:06:19","date_gmt":"2022-07-24T19:06:19","guid":{"rendered":"https:\/\/devsec.smham2.org\/?page_id=22700"},"modified":"2022-08-11T16:56:09","modified_gmt":"2022-08-11T21:56:09","slug":"would-you-pass-the-technical-interview","status":"publish","type":"page","link":"https:\/\/devsec.smham2.org\/?page_id=22700","title":{"rendered":"Would you pass the technical interview?"},"content":{"rendered":"<p>Recently, I had a technical interview and these were some of the questions I was asked. Do you know the answers? Take a look and no peeking at the answers. In some areas I mentioned what my original response was. I will add other questions to the list as I encounter them. If you have a question you would like me to consider and add to the list, let me know.<\/p>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li>What is the location of system audit logs in Linux?<div class=\"claps-toggle-text\" data-title=\"&lt;strong&gt;ANSWER&lt;\/strong&gt;\" data-swaptitle=\"Collapse to read less\" data-icon=\"&#9660;\" data-swapicon=\"&#9650;\" data-ht=\"1px\" data-hf=\"50px\" data-above=\"0\"><div class=\"claps-text-inner claps-text-toggle-collapsed\"><span style=\"color: #008000;text-decoration: underline\"><strong>Answer:<\/strong><\/span> \/var\/log\/audit<br \/>\n<span style=\"color: #ff0000;text-decoration: underline\"><strong>My answer:<\/strong><\/span> \/var\/log Though this answer is not necessarily incorrect, in the mind of the interviewer it was since they were looking for the exact location as mentioned above.<\/div><\/div><\/li>\n<li>What are the files that make up the password in a Linux system?<div class=\"claps-toggle-text\" data-title=\"&lt;strong&gt;ANSWER&lt;\/strong&gt;\" data-swaptitle=\"Collapse to read less\" data-icon=\"&#9660;\" data-swapicon=\"&#9650;\" data-ht=\"1px\" data-hf=\"50px\" data-above=\"0\"><div class=\"claps-text-inner claps-text-toggle-collapsed\"><span style=\"color: #008000;text-decoration: underline\"><strong>Answer:<\/strong><\/span> \/etc\/passwd and \/etc\/shadow<br \/>\nThe \/etc\/passwd is like the user listing. The \/etc\/shadow contains the password hashes for these users.<\/div><\/div><\/li>\n<li>What is the security triad?<div class=\"claps-toggle-text\" data-title=\"&lt;strong&gt;ANSWER&lt;\/strong&gt;\" data-swaptitle=\"Collapse to read less\" data-icon=\"&#9660;\" data-swapicon=\"&#9650;\" data-ht=\"1px\" data-hf=\"50px\" data-above=\"0\"><div class=\"claps-text-inner claps-text-toggle-collapsed\"><span style=\"color: #008000;text-decoration: underline\"><strong>Answer:<\/strong><\/span> Confidentiality, Integrity and Availability<\/div><\/div><\/li>\n<li>Name a system that would be used to secure one aspect of the triad (include one within AWS).\n<ul>\n<li>Confidentiality<br \/>\n<div class=\"claps-toggle-text\" data-title=\"&lt;strong&gt;ANSWER&lt;\/strong&gt;\" data-swaptitle=\"Collapse to read less\" data-icon=\"&#9660;\" data-swapicon=\"&#9650;\" data-ht=\"1px\" data-hf=\"50px\" data-above=\"0\"><div class=\"claps-text-inner claps-text-toggle-collapsed\"><span style=\"color: #008000;text-decoration: underline\"><strong>Answer:<\/strong><\/span> An system that would encrypt the data during transit or at rest. Whole disk encryption (Bitlocker for Windows). Data Loss Prevention (DLP) systems for email and data in transit. Encrypted USB drives using biometrics, passcodes, etc.<\/div><\/div><\/li>\n<li>Integrity<br \/>\n<div class=\"claps-toggle-text\" data-title=\"&lt;strong&gt;ANSWER&lt;\/strong&gt;\" data-swaptitle=\"Collapse to read less\" data-icon=\"&#9660;\" data-swapicon=\"&#9650;\" data-ht=\"1px\" data-hf=\"50px\" data-above=\"0\"><div class=\"claps-text-inner claps-text-toggle-collapsed\"><span style=\"color: #008000;text-decoration: underline\"><strong>Answer:<\/strong><\/span> Using hashes to verify that data has not been altered from its last know original state. Audit trails to determine when files were created, modified or deleted. Validating that the data entering into a system is valid and does not compromise the system.<\/div><\/div><\/li>\n<li>Availability<br \/>\n<div class=\"claps-toggle-text\" data-title=\"&lt;strong&gt;ANSWER&lt;\/strong&gt;\" data-swaptitle=\"Collapse to read less\" data-icon=\"&#9660;\" data-swapicon=\"&#9650;\" data-ht=\"1px\" data-hf=\"50px\" data-above=\"0\"><div class=\"claps-text-inner claps-text-toggle-collapsed\"><span style=\"color: #008000;text-decoration: underline\"><strong>Answer:<\/strong><\/span> Data redundancy, multiple systems in a fail-over or high availability setup. In AWS, you can use load balancers, availability zones, and auto scaling. Both Google Cloud and Microsoft Azure have similar options.<\/div><\/div><\/li>\n<\/ul>\n<\/li>\n<li>What are the 5 things that should be done to secure a Linux system on creation?<div class=\"claps-toggle-text\" data-title=\"&lt;strong&gt;ANSWER&lt;\/strong&gt;\" data-swaptitle=\"Collapse to read less\" data-icon=\"&#9660;\" data-swapicon=\"&#9650;\" data-ht=\"1px\" data-hf=\"50px\" data-above=\"0\"><div class=\"claps-text-inner claps-text-toggle-collapsed\"><span style=\"color: #008000;text-decoration: underline\"><strong>Answer:<\/strong><\/span> (Yes, I know there are more than 5.)\n<ol>\n<li style=\"list-style-type: none\">\n<ol>\n<li>Update the system packages<\/li>\n<li>Create a non-root user and add to sudo group<\/li>\n<li>Disable root login<\/li>\n<li>Turn off unnecessary services<\/li>\n<li>Remove unnecessary applications<\/li>\n<li>Enable the firewall<\/li>\n<li>Disable password based logins with SSH (use keys)<\/li>\n<li>Close open ports (firewall helps with this, but it is good to be proactive)<\/li>\n<li>Enable 2FA<\/li>\n<li>Enable the use of only strong passwords<\/li>\n<li>Verify that logging and audit files are being generated and monitor them.<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n<p><\/div><\/div><\/li>\n<li>What would you used to ping a network segment? (specifically focusing on using ICMP)<div class=\"claps-toggle-text\" data-title=\"&lt;strong&gt;ANSWER&lt;\/strong&gt;\" data-swaptitle=\"Collapse to read less\" data-icon=\"&#9660;\" data-swapicon=\"&#9650;\" data-ht=\"1px\" data-hf=\"50px\" data-above=\"0\"><div class=\"claps-text-inner claps-text-toggle-collapsed\"><span style=\"color: #008000;text-decoration: underline\"><strong>Answer:<\/strong><\/span> The answer I found to this is using ping with option -b which pings the broadcast segment.<br \/>\n<span style=\"color: #ff0000;text-decoration: underline\"><strong>My answer:<\/strong><\/span> My answer was either nmap, masscan or scripting it. The nmap response brought a slight back and forth with the interviewer. They mentioned that we are not trying to discover host\/services on the network and use ICMP to do this. I mentioned that nmap can be used to only discover the host (what is alive) on the network, do it by sending ICMP packets and not return the services running on it.<\/div><\/div><\/li>\n<li>What is the difference between an IDS and IPS?<div class=\"claps-toggle-text\" data-title=\"&lt;strong&gt;ANSWER&lt;\/strong&gt;\" data-swaptitle=\"Collapse to read less\" data-icon=\"&#9660;\" data-swapicon=\"&#9650;\" data-ht=\"1px\" data-hf=\"50px\" data-above=\"0\"><div class=\"claps-text-inner claps-text-toggle-collapsed\"><span style=\"color: #008000;text-decoration: underline\"><strong>Answer:<\/strong><\/span> Intrusion Detection System (IDS) only reports on what anomalies it has seen on a network or system. An Intrusion Prevention System (IPS) will act upon the anomalies it has seen on a network or system.<\/div><\/div><\/li>\n<li>What are the two ways that IDS and IPS use for detection?<div class=\"claps-toggle-text\" data-title=\"&lt;strong&gt;ANSWER&lt;\/strong&gt;\" data-swaptitle=\"Collapse to read less\" data-icon=\"&#9660;\" data-swapicon=\"&#9650;\" data-ht=\"1px\" data-hf=\"50px\" data-above=\"0\"><div class=\"claps-text-inner claps-text-toggle-collapsed\"><span style=\"color: #008000;text-decoration: underline\"><strong>Answer:<\/strong><\/span> Signatures and Anomalies<\/div><\/div><\/li>\n<li>What is the difference between a threat, a vulnerability and risk?\n<ul>\n<li>Threat<br \/>\n<div class=\"claps-toggle-text\" data-title=\"&lt;strong&gt;ANSWER&lt;\/strong&gt;\" data-swaptitle=\"Collapse to read less\" data-icon=\"&#9660;\" data-swapicon=\"&#9650;\" data-ht=\"1px\" data-hf=\"50px\" data-above=\"0\"><div class=\"claps-text-inner claps-text-toggle-collapsed\"><span style=\"color: #008000;text-decoration: underline\"><strong>Answer:<\/strong><\/span> A threat is something that can negatively impact an organization. A threat does not have to be a person(s), groups or nation states, but can include natural events (hurricane, tornado, earthquake, etc.) among other things. The action can be intentional or accidental.<\/div><\/div><\/li>\n<li>Vulnerability<br \/>\n<div class=\"claps-toggle-text\" data-title=\"&lt;strong&gt;ANSWER&lt;\/strong&gt;\" data-swaptitle=\"Collapse to read less\" data-icon=\"&#9660;\" data-swapicon=\"&#9650;\" data-ht=\"1px\" data-hf=\"50px\" data-above=\"0\"><div class=\"claps-text-inner claps-text-toggle-collapsed\"><span style=\"color: #008000;text-decoration: underline\"><strong>Answer:<\/strong><\/span> A vulnerability is a flaw or weakness that can be exploited. It is includes flaws or weaknesses to a specific threat.<\/div><\/div><\/li>\n<li>Risk<br \/>\n<div class=\"claps-toggle-text\" data-title=\"&lt;strong&gt;ANSWER&lt;\/strong&gt;\" data-swaptitle=\"Collapse to read less\" data-icon=\"&#9660;\" data-swapicon=\"&#9650;\" data-ht=\"1px\" data-hf=\"50px\" data-above=\"0\"><div class=\"claps-text-inner claps-text-toggle-collapsed\"><span style=\"color: #008000;text-decoration: underline\"><strong>Answer:<\/strong><\/span> Risk is the possibility of something causing loss or damage. There is a formula that is used to calculate risk in basis terms:<br \/>\nRisk = Likelihood * Impact<br \/>\nCombining all three, risk would be the likelihood that a data center next to a lake (vulnerability) would get flooded after torrential rain (threat).<\/div><\/div><\/li>\n<\/ul>\n<\/li>\n<li>What are the incident response (IR) process steps?<div class=\"claps-toggle-text\" data-title=\"&lt;strong&gt;ANSWER&lt;\/strong&gt;\" data-swaptitle=\"Collapse to read less\" data-icon=\"&#9660;\" data-swapicon=\"&#9650;\" data-ht=\"1px\" data-hf=\"50px\" data-above=\"0\"><div class=\"claps-text-inner claps-text-toggle-collapsed\"><span style=\"color: #008000;text-decoration: underline\"><strong>Answer:<\/strong><\/span>\n<ol>\n<li>Preparation<\/li>\n<li>Identification<\/li>\n<li>Containment<\/li>\n<li>Eradication<\/li>\n<li>Recovery<\/li>\n<li>Lessons Learned<\/li>\n<\/ol>\n<p><\/div><\/div><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Recently, I had a technical interview and these were some of the questions I was asked. Do you know the answers? Take a look and no peeking at the answers. In some areas I mentioned what my original response was. I will add other questions to the list as I encounter them. If you have [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-22700","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/devsec.smham2.org\/index.php?rest_route=\/wp\/v2\/pages\/22700","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devsec.smham2.org\/index.php?rest_route=\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/devsec.smham2.org\/index.php?rest_route=\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/devsec.smham2.org\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/devsec.smham2.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=22700"}],"version-history":[{"count":12,"href":"https:\/\/devsec.smham2.org\/index.php?rest_route=\/wp\/v2\/pages\/22700\/revisions"}],"predecessor-version":[{"id":27880,"href":"https:\/\/devsec.smham2.org\/index.php?rest_route=\/wp\/v2\/pages\/22700\/revisions\/27880"}],"wp:attachment":[{"href":"https:\/\/devsec.smham2.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=22700"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}