Top 10 CISSP interview questions [Updated 2022]

Certified Information Systems Security Professional (CISSP) holders are highly sought after in the cybersecurity space. This is because they have exhibited proficiency in all of the eight CISSP exam domains and also have around five years of hands-on, security-related experience.

Job interviews, in general, can be stressful, and interview preparation is never an exact science; each company has its own specific job requirements based on its environment. It is a good idea to do as much research as possible about the company that is interviewing you, so you can brush up on technologies you think might be more relevant to their industry. It is important to understand the interviewer is not always looking for you to know the exact answer. Sometimes, they want to gauge how well you can formulate a logical response to get some indication of how your thought process works.

Earn your CISSP, guaranteed!

Get live, expert CISSP training from anywhere. Enroll now to claim your Exam Pass Guarantee!

Get Pricing

Learning how to approach these types of questions while remaining relaxed, calm and collected will go a long way towards making a lasting impression on your interviewer and could help you land that dream job.

Common CISSP interview questions

Here are ten CISSP interview questions to help you prepare for your next career move.

1. What does your home network look like?

This seems like a strange question for an interviewer to ask at first, but it does come up quite often. The aim of this question, from an interviewer’s perspective, is to see how much research and lab testing a candidate likes to do at home. Your answer isn’t likely to directly affect the outcome of the job interview, but the person asking the question will be able to gauge how seriously you take your studying and practice labs.

They might post a follow-up question to see how you relate your home security setup to the work environment, so be prepared to go into detail about the technologies you have deployed around the house. Some companies are trying to get a feel for how passionate you are about technology in general, so include as much detail as you can.

2. How would you secure a new server? What steps would you take?

This is a bit of an open-ended question, and with good reason. The interviewer is looking to see what questions you will ask in return. Good counter questions for the candidate to ask could be:

• What operating system will the server be running?
• Is this a production server?
• What applications will the server be running?
• Where on the network will the server be situated?
• Will it have Internet access?

Through this question, the interviewer can assess what kinds of security concerns you give priority when implementing a new server. Be sure to mention user permissions and best practices, as well as network share access and permission hierarchies. If you can show proficiency in both Windows and Linux system administration, then you have a better chance of impressing the interviewer. Knowing how to secure a server is important, so be sure to mention all of the fundamental steps you would take when carrying out the commissioning of a new server.

3. In what state do you leave your unused ports in on your firewall?

This is a question that is usually directed at finding out if you prefer to filter their ports or close their ports on a firewall. The idea here is to find out if you understand how NMAP or similar scan tools identify the state of a port, and how a potential intruder might try to gain access to their network.

Mentioning details about how different scanning tools probe the state of a port and what alternative methods you would use shows your prospective employer you have a deep understanding of firewalls in general, and how to lock them down with tight security.

4. Do you think that DNS monitoring is important?

The interviewer is trying to see how well you understand the way that DNS works, and if you know how to detect breaches by searching through DNS logs. It is worth mentioning to the interviewer that any irregular DNS entries can be quickly identified if DNS is monitored actively and regularly, especially if there is a DNS-based attack attempt.

5. What port does ping work over?

This is a favorite trick question in interviews, because ping uses ICMP echo request and reply packets, meaning there is no port associated with the action because it is a layer three protocol of the Open Systems Interconnection model (OSI model).

6. What could you do to prevent a man-in-the-middle attack?

You should recommend secure communication between the two parties, such as a VPN or tunneling, to prevent unauthorized interception of communication. This will prevent the manipulation of data sent between the two parties.

The interviewer will look to you to speak about encryption and how to ensure secure communications between two parties.

7. Is there a difference between encoding, encryption and hashing?

This is a straightforward question that deserves to be answered in detail. The interviewer will appreciate a thoughtful response, so be sure to mention key details. For example, you could mention encoding can be thought of as a type of data preparation, where the information is compiled in such a way so a specific target can receive the data and then run, view or open it. The key thing to take away from this explanation is encoding is not necessarily done as a security measure, so conveying your understanding in this regard is important.

Encryption uses a secret key in order to keep communications between two or more parties private. A cipher and algorithm are used together to create the encryption, creating a virtually unbreakable security lock on the data.

Hashing can be seen as the means by which data integrity is checked and verified, acting as an authentication mechanism.

All three of these methods can be used together depending on the desired implementation of the system in question, so understanding what each individual component is responsible for is important.

8. What would you say is the most secure out of these options: SSL, TLS or HTTPS?

This is another trick question that candidates should be ready for. SSL, TLS and HTTPS all refer to the same technology. TLS is essentially a more up-to-date version of SSL, and HTTPS is just standard HTTP that is tunneled through an SSL/TLS connection.

9. Would you encrypt and compress data during transmission? Which would you do first, and why?

Compressing data before transmission is important as it reduces bandwidth requirements and speeds up sending of data. Encrypting data prior to sending it is important from a security perspective as it prevents unauthorized access to the information contained within the data packets being sent.

Encryption is essential, regardless of the type of information being sent. To ensure maximum security, data should be compressed first and then encrypted afterward. This makes the information stored within the compressed archive even more difficult to decipher if it is intercepted, which adds one more layer of security to your communication.

10. What special considerations should be taken for cloud computing?

This is a popular topic with hosting companies when they are looking to hire cybersecurity professionals. Cloud service demand is at an all-time high with consumers, and companies that are looking to maintain a secure online presence will be interested in your security skills. The interviewer will look for answers focusing on consistent, reliable security best-practice routines that guarantee maximum uptime for their virtual platforms.

Earn your CISSP, guaranteed!

Get live, expert CISSP training from anywhere. Enroll now to claim your Exam Pass Guarantee!

Get Pricing

Creating and maintaining a segmented network infrastructure is also essential when dealing with cloud-based security, as threats should not be allowed to contaminate the entire site in the event of an attack or malware infection. Lastly, you will want to mention how a cloud platform can be centrally managed across the different segments of the network from one point, both client-facing and enterprise-facing.

Preparing for your CISSP interview

Preparing for your next interview is as simple as brushing up on your study notes and looking at as many interview questions as possible. Make sure you are relaxed and calm during your interview and try not to panic if you don’t know the answer to a question. Think logically and make sure you understand the question before answering. Keeping a clear head and using your CISSP knowledge is sure to impress your potential employer.

For more on the CISSP certification and related careers, check out our CISSP certification hub.