CISSP interview prep: 10 common questions and answers

Certified Information Systems Security Professional (CISSP) holders are highly sought after in the cybersecurity space. They have exhibited proficiency in all eight CISSP exam domains and have five years or more of hands-on, security-related experience. 

Job interviews, in general, can be stressful, and interview preparation is never an exact science. Each company has its own specific job requirements based on its digital assets. Doing as much research as possible about the company you’ll be interviewing with is a good idea. This gives you a chance to brush up on technologies you think might be more relevant to their industry. It’s important to understand the interviewer is not always looking for you to know the exact answer. Sometimes, they want to gauge how well you can formulate a logical response to get some indication of how your thought process works. 

Learning how to approach these types of questions while remaining relaxed, calm and collected will go a long way towards making a lasting impression on your interviewer — and could help you land that dream job. 

Want more CISSP career advice? Download our free Cybersecurity salary guide and Cybersecurity career roadmap ebook.

Earn your CISSP, guaranteed!

Get live, expert CISSP training from anywhere. Enroll now to claim your Exam Pass Guarantee!

Get Pricing

Common CISSP interview questions 

Here are 10 CISSP-related questions to help you prepare for your next interview. 

1. What does your home network look like? 

This seems like a strange question for an interviewer to ask at first, but it does come up quite often. From an interviewer’s perspective, this question aims to see how much research and lab testing a candidate likes to do at home. Your answer isn’t likely to directly affect the outcome of the job interview, but the person asking the question will be able to gauge how seriously you take your studying and practice labs. 

They might post a follow-up question to see how you relate your home security setup to the work environment. Be prepared to go into detail about the technologies you’ve deployed around the house. Some companies are trying to get a feel for how passionate you are about technology in general, so include as much detail as you can. 

2. How would you secure a new server? What steps would you take? 

This is a bit of an open-ended question — and with good reason. The interviewer is looking to see what questions you will ask in return. Good counter questions to ask could include: 

• What operating system will the server be running? 
• Is this a production server? 
• What applications will the server be running? 
• Where on the network will the server be situated? 
• Will it have internet access? 

Through this question, the interviewer can assess what kinds of security concerns you give priority when protecting a new server. Be sure to mention user permissions and best practices, as well as network access and permission hierarchies. If you can show proficiency in both Windows and Linux system administration, you have a better chance of impressing the interviewer. Knowing how to secure a server is important, so be sure to mention all the fundamental steps you would take during the security implementation process. 

3. In what state do you leave your unused ports in your firewall? 

On the surface, the answer to this question seems relatively simple: If you’re not using a port on a firewall, you should leave it in a closed, rejected, or dropped state. But, most likely, the interviewer is looking for a slightly more detailed or nuanced answer. Their objective may be to determine if you understand how NMAP or similar scan tools identify the state of a port and how a potential intruder might try to gain access to their network. 

Mentioning details about how different scanning tools probe the state of a port and which methods you would use — and why — shows your prospective employer you have a deep understanding of firewalls, and how to lock them down with tight security. 

4. Do you think that DNS monitoring is important? 

The interviewer is trying to see how well you understand how DNS works and if you know how to detect breaches by searching through DNS logs. It’s worth mentioning to the interviewer that any irregular DNS entries can be quickly identified if DNS is monitored actively and regularly, especially if there is a DNS-based attack attempt. 

5. What port does ping work over? 

This is a favorite trick question in interviews, because ping uses ICMP echo request and reply packets, meaning there is no port associated with the action because it is a layer three protocol of the Open Systems Interconnection model (OSI model). 

Earn your CISSP, guaranteed!

Get live, expert CISSP training from anywhere. Enroll now to claim your Exam Pass Guarantee!

Get Pricing

6. What could you do to prevent a man-in-the-middle attack? 

You should recommend secure communication between the two parties, such as a VPN, to prevent unauthorized interception of communications. This will prevent the manipulation of data sent between the two parties. 

The interviewer will look to you to speak about encryption and how to ensure secure communications between two parties. 

7. Is there a difference between encoding, encryption and hashing? 

This is a straightforward question that deserves a detailed answer. The interviewer will appreciate a thoughtful response, so be sure to go into depth. For example, you could mention encoding can be thought of as a type of data preparation, where the information is compiled in such a way that enables a specific target to receive the data and then run, view or open it. The key thing to take away from this explanation is encoding is not necessarily done as a security measure, so letting the interviewer know you understand this key detail is important. 

Encryption uses a secret key in order to keep communications between two or more parties private. A cipher and algorithm are used together to create the encryption, forming a virtually unbreakable security lock on the data. 

Hashing can be seen as the means by which data integrity is checked and verified, acting as an authentication mechanism. 

All three of these methods can be used together depending on the desired implementation of the system in question, so understanding what each individual component is responsible for is important. 

8. What would you say is the most secure out of these options: SSL, TLS or HTTPS? 

This question has a relatively straightforward answer: TLS, but the interviewer doesn’t want you to stop there. They want to know if you understand the relationships between SSL, TLS and HTTPS. 

TLS is essentially a more up-to-date version of SSL, and HTTPS is just standard HTTP that’s combined with SSL/TLS to make it more secure. 

9. Would you encrypt and compress data during transmission? Which would you do first, and why? 

Compressing data before transmission is important as it reduces bandwidth requirements and speeds up the sending of data. Encrypting data prior to sending it is important from a security perspective as it prevents unauthorized access to the information contained within the data packets being sent. 

Encryption is essential, regardless of the type of information being sent. Data should be compressed first and then encrypted to ensure maximum security. This makes the information stored within the compressed archive even more difficult to decipher if it’s intercepted, which adds one more layer of security to your communication. 

10. What special considerations should be taken for cloud computing? 

This is a popular topic with hosting companies when they are looking to hire cybersecurity professionals. Increasing numbers of consumers and organizations are demanding cloud services, so companies looking to maintain a secure cloud presence will be interested in your security skills. The interviewer will look for answers focusing on consistent, reliable security best-practice routines that guarantee maximum uptime for their virtual platforms. 

Creating and maintaining a segmented network infrastructure is also essential when dealing with cloud-based security. This can prevent threats from contaminating the entire site in the event of an attack or malware infection. Lastly, you will want to mention how an ideal cloud solution also includes a centralized monitoring, incident response, and configuration management console. 

Earn your CISSP, guaranteed!

Get live, expert CISSP training from anywhere. Enroll now to claim your Exam Pass Guarantee!

Get Pricing

Preparing for your CISSP interview 

Preparing for your next interview is as simple as brushing up on your security knowledge and studying as many interview questions as possible. Make sure you’re relaxed and calm during your interview, and try not to panic if you don’t know the answer to a question. Think logically and take time to understand the question before answering. Keeping a clear head and using your CISSP knowledge will impress your potential employer. 

For more on the CISSP certification and related careers, check out our CISSP certification hub. And if you’re exploring your cybersecurity carer options, download our Cybersecurity certifications and skills for more insights.