Principal security consultant Interview Questions
54
Principal Security Consultant interview questions shared by candidates
How can you bypass CSRF protection?
2 Answers↳
Hacking the SSL - That was their answer.
↳
To not be confused, the question was how to bypass double cookie submit as CSRF mitigation. The answer - one possible way is to leverage non SSL protected webpage on the same domain to preset the cookie value. Less
All classic questions about attack techniques, detection and overall understanding of protocols.
1 Answers↳
Directly and honestly, which may be part of a problem here as candidates in the US tend to underline only their strong point and silence lack of experience in other fields. I have had international background where people are not afraid to admit they are not perfect and where they are not penalized for this. Less
Why have you moved around so much between jobs
1 Answers↳
Throughout my career like all of us recruiters all call and emailing continuously. While ignoring most, occasionally one has an interesting role description. The new & interesting work combined with the incumbent company's lack of vision to take security beyond the basics causes me to jump. It's about interesting work, not more money or lack of company loyalty. Less
When looking at PAN data, how would you separate data in the hypervisor?
1 Answers↳
Are you asking for storage or transmission in the CONTAINER? What are you using for east-west container firewall? Do you have a WAF in place? What about IAM processes? What have you done thus far in DevSecOps? I cannot be specific in your question without knowing what applications and technologies that your organization is currently employing. There are many ways to segregate data in transmission, storage is a different story, so I am unclear on which you are referring. Less
What would you do if you found an infected host on your network and how would you stop it's spread? (No details were given on what tools or equipment the customer may have)
1 Answers↳
I would isolate the host from the network so that it is unable to spread the infection. I would analyze the host to see if I could find the attack vector such as email virus, phishing attack, infected file, etc.). Check the firewalls for any logs that may show the attack vector. - (The manager kept saying I was wrong about this because I didn't specify the specific Cisco AMP threat detection product and simply mentioned firewall logs, but I didn't know that AMP was a part of their network. He kept beating me up on this point and we agreed to disagree) Less
How do I deal with difficult people?
1 Answers↳
I state the facts and explain my position and response