Interview Answer Bank

Each answer follows the same pattern: what the question is really testing, a model answer, what interviewers listen for, and the weak answer to avoid.

Example"What is the difference between an event and an incident?"

Model answerAn event is anything observable that happens on a system, such as a login or a file change. An incident is an event, or group of events, that harms or threatens the confidentiality, integrity or availability of systems or data. Most events are normal; my job is to find the few that are incidents.

ExpectedInterviewers listen for the link to confidentiality, integrity and availability, and for the idea that most events are harmless.

Example"A user reports a suspicious email. What do you do first?"

Model answerI ask the user not to click anything and to report it through the phishing button. I check the sender, the reply-to address and any links or attachments in a safe way, then search for other people who got the same email so we can remove it everywhere.

MistakeOpening the link yourself on your work laptop to "see what happens".

TaskAnswer this one yourself, out loud, in under 60 seconds: "What does least privilege mean?" Then compare with the model answer in the full pack.