Security, Risk, and Compliance
Frame everything as risk
Security questions here are usually risk questions in disguise. Anchor on the CIA triad (confidentiality, integrity, availability) and on AAA (authentication, authorization, accounting). Least privilege and defense in depth are the default postures; segmentation limits blast radius.
Precise definitions carry the marks. A threat is an actor or event that could cause harm; a vulnerability is a weakness; an exploit is the method that weaponizes the weakness; risk is the combination of likelihood and impact. A finding is not a risk until you attach impact. Risk treatment options are mitigate, transfer, avoid, and accept - residual risk remains after any control. Controls are preventive, detective, corrective, or compensating.
Cryptography basics. Symmetric encryption is fast and key-distribution heavy; asymmetric solves key exchange and enables signatures. Hashing is one-way and provides integrity, not confidentiality. Encoding (Base64) is not encryption - expect this trap. Certificates bind identity to a public key through a trusted CA.
Incident response order. Preparation, detection and analysis, containment, eradication, recovery, and lessons learned. Candidates routinely pick eradication before containment; isolate first when spread is possible.
Compliance is not security. A framework such as PCI DSS, HIPAA, or GDPR defines a minimum, not a guarantee. Policies are management intent, standards are mandatory specifics, procedures are step-by-step, guidelines are recommended.
Worked example
A vulnerability has a 40% annual likelihood and a $50,000 impact: annualized loss expectancy is $20,000. A control costing $8,000 per year is economically justified; one costing $25,000 should be reconsidered or the residual risk formally accepted.
Rule of thumb
If an answer says compliance alone makes you secure, or that encryption is the same as hashing, it is wrong.