41⟩ Tell me what’s more secure, SSL or HTTPS?
Trick question: these are not mutually exclusive. Look for a smile like they caught you in the cookie jar. If they’re confused, then this should be for an extremely junior position.
System Auditor
Home Audit System Auditor
“System Auditor Frequently Asked Questions in various System Auditor job interviews by interviewer. The set of questions are here to ensures that you offer a perfect answer posed to you. So get preparation for your new job interview”
54 System Auditor Questions And Answers
42⟩ Suppose if you had to both encrypt and compress data during transmission, which would you do first, and why?
If they don’t know the answer immediately it’s ok. The key is how they react. Do they panic, or do they enjoy the challenge and think through it? I was asked this question during an interview at Cisco. I told the interviewer that I didn’t know the answer but that I needed just a few seconds to figure it out. I thought out loud and within 10 seconds gave him my answer: “Compress then encrypt. If you encrypt first you’ll have nothing but random data to work with, which will destroy any potential benefit from compression.
43⟩ Tell us what are the advantages offered by bug bounty programs over normal testing practices?
You should hear coverage of many testers vs. one, in centralization, focus on rare bugs, etc.
44⟩ Explain me how do you minimize the risk for errors in your work?
As an accountant, you are held to a high standard and the margin for error is tiny. Small mistakes can lead to large financial issues.
“Respond to this question by describing any times you’ve caught errors before submitting work,”. “Emphasize the importance of checking your work and establishing checks and balances within a team.”
45⟩ Explain me how do you feel your job as a government auditor differs from that of a private sector auditor?
First of all, there is a sense of working for the public good as a government auditor. I’ve also served as a private auditor and did many internal audits to ensure the business was in sound financial health. This served an important function in helping the business stay afloat, but it didn’t necessarily involve an entire population. There is a kind of sacred trust in dealing with public money, and perhaps, a greater propensity of some non-profits or government agencies, to lose track of money, because it is being provided. A government audit requires a certain amount of discipline in investigating whether funds earmarked for one purpose were used properly. Elections have been won and lost based on the use of public funds, so it is vital to our public life as citizens.
46⟩ Do you know what’s the goal of information security within an organization?
This is a big one. What I look for is one of two approaches; the first is the über-lockdown approach, i.e. “To control access to information as much as possible, sir!” While admirable, this again shows a bit of immaturity. Not really in a bad way, just not quite what I’m looking for. A much better answer in my view is something along the lines of, “To help the organization succeed.”
This type of response shows that the individual understands that business is there to make money, and that we are there to help them do that. It is this sort of perspective that I think represents the highest level of security understanding—-a realization that security is there for the company and not the other way around.
47⟩ Explain me if I started my career as an IT auditor, where might it lead?
As with most careers, it is difficult to predict where they will lead. Certainly it is common for CISA’s in public accounting firms to move into line management. Other possibilities are to move to industry and become an internal auditor, IT risk or IT security manager, or a CIO.
48⟩ Tell me how does one defend against CSRF?
Nonces required by the server for each page or each request is an accepted, albeit not foolproof, method. Again, we’re looking for recognition and basic understanding here–not a full, expert level dissertation on the subject. Adjust expectations according to the position you’re hiring for.
49⟩ Explain me what’s the difference between stored and reflected XSS?
Stored is on a static page or pulled from a database and displayed to the user directly. Reflected comes from the user in the form of a request (usually constructed by an attacker), and then gets run in the victim’s browser when the results are returned from the site.
50⟩ Explain me where do you get your security news from?
Here I’m looking to see how in tune they are with the security community. Answers I’m looking for include things like Team Cymru, Reddit, Twitter, etc. The exact sources don’t really matter. What does matter is that he doesn’t respond with, “I go to the CNET website.”, or, “I wait until someone tells me about events.”. It’s these types of answers that will tell you he’s likely not on top of things.
51⟩ Explain me a time when you made a mistake on the job?
Early in my career, I made a mistake on a report and denied a client their claim on the grounds that the car accident appeared to be a result of their negligence as opposed to the negligence of the other party. I found out later that I was too quick to make that decision. I had not spoken to the police first, who later informed me that the evidence I was looking at was taken after the vehicles had been moved from the scene. They showed me photographs of the vehicle immediately after it had happened, which clearly showed the other party was at fault. I was too quick on the draw, and I learned that every case requires due diligence.
52⟩ Explain me what’s the difference between a threat, vulnerability, and a risk?
As weak as the CISSP is as a security certification it does teach some good concepts. Knowing basics like risk, vulnerability, threat, exposure, etc. (and being able to differentiate them) is important for a security professional. Ask as many of these as you’d like, but keep in mind that there are a few differing schools on this. Just look for solid answers that are self-consistent.
53⟩ Please explain what is your experience with developing business metrics?
Keep your response brief, like you would for “Tell me about yourself,” but outline important experience you’ve had in this area.
By keeping your response brief, it can open up the conversation to be more like a dialogue about the employer’s business metrics rather than a Q&A
54⟩ Tell me what is salting, and why is it used?
You purposely want to give the question without context. If they know what salting is just by name, they’ve either studied well or have actually been exposed to this stuff for a while.
