Threat Hunting and Threat Intelligence Questions

Proactively pursuing adversaries and operationalizing knowledge of them. Covers threat hunting and hypothesis-driven investigation, threat intelligence collection and integration, indicators of compromise, the MITRE ATT&CK framework, advanced persistent threats, and situating activity within the current threat landscape. The 'go find what the alerts missed, informed by adversary knowledge' discipline.

HardSystem Design

26 practiced

Design a secure CI/CD supply chain architecture that defends against malicious commits, tainted build agents, and compromised third-party actions. Include artifact signing and verification (provenance), SLSA or similar attestation, ephemeral build runners with minimal privileges, RBAC for pipeline steps, SBOM generation, and runtime verification of deployed artifact integrity.

Sample Answer

HardTechnical

35 practiced

Design a detailed tabletop incident exercise simulating a coordinated multi-stage attack: initial spear-phishing leading to credential theft, privilege escalation, lateral movement, and data exfiltration. Include a timeline of injected events, detection milestones, decision points for containment vs deception, roles and responsibilities across SOC, IR, engineering, legal and communications, and metrics to evaluate tabletop effectiveness and readiness.

Sample Answer

EasyTechnical

18 practiced

Define supply chain attacks in a software context and enumerate the stages an adversary typically uses (compromise vendor, introduce malicious code, sign/publish malicious artifact, distribute via updates). As a cybersecurity engineer, present a supplier risk-management checklist that includes vendor vetting, SBOM consumption, artifact signing, CI/CD controls, and runtime protections you would implement.

EasyTechnical

25 practiced

In Python using psycopg2, show a short example of an insecure SQL query vulnerable to injection and then provide a secure parameterized version. After your code example, explain how you would detect SQL injection attempts via web and database logs and list quick containment actions when SQL injection is suspected in production.

Sample Answer

Insecure (vulnerable) example python# Python + psycopg2 — vulnerable to SQL injection user_input = "1 OR 1=1" cur.execute(f"SELECT id, username FROM users WHERE id = {user_input};") rows = cur.fetchall() Secure parameterized version python# Use parameterized queries to avoid injection user_input = "1 OR 1=1" cur.execute("SELECT id, username FROM users WHERE id = %s;", (user_input,)) rows = cur.fetchall() Why secure works psycopg2 parameterization sends values separately from SQL, preventing attacker-controlled text from becoming executable SQL. Detecting SQLi via logs Web logs: unusual query strings, repeated payload markers (', --, OR 1=1), multiple 500/400 responses, large parameter lengths, rapid repeat requests from same IP. Database logs: parse errors, unexpected long queries, frequent use of OR/UNION/SELECT in parameters, abnormal spikes in slow queries or row counts. Use IDS/IPS/WA﻿F alerts, anomaly detection (rate-based, regex), and correlation (web request → DB query). Quick containment actions Block offending IPs / rate-limit user agents at edge (WAF). Deploy WAF rules to drop common payloads and normalize inputs. Rotate/limit DB credentials used by app, revoke compromised sessions. Enable parameterized queries and roll back recent deploys if they introduced vulnerability. Snapshot logs and isolate affected services for forensic analysis; increase DB logging level. Patch code, run tests, and perform targeted pentest before re-enabling traffic.

MediumTechnical

22 practiced

Design a logging and monitoring approach to detect data exfiltration over encrypted channels (HTTPS/TLS) from internal hosts to external IPs. Specify network and host telemetry to collect (SNI, JA3, flow logs, process context), heuristics and correlation rules for detection (volume, unusual destinations, certificate anomalies), and the immediate steps you would take to confirm and contain suspected exfiltration.

Sample Answer

Unlock Full Question Bank

Get access to all 37 Threat Hunting and Threat Intelligence interview questions and detailed answers.

Join thousands of developers preparing for their dream job.