Security Fundamentals

About these security fundamentals questions

This is a practice topic, not a vendor exam. The questions cover the security basics that every IT, developer and cloud role is expected to know before touching production systems. They suit interview preparation for junior security, support and engineering jobs, and they make a good warm-up before an entry-level security certification or the security domains of a cloud exam, which assume these ideas and build on them.

The questions use vendor-neutral terms taken from NIST definitions and IETF standards, so the vocabulary matches what certification bodies and security teams use. Many are short scenarios: an attack is described and you name which property it breaks, or a design is shown and you spot the weakness. The wrong options are the misunderstandings that cause real incidents, such as treating encoding as encryption or trusting a site because it shows a padlock.

What the questions cover

There is one 10-question test so far. It covers:

• Core security principles. The confidentiality, integrity and availability triad, and least privilege applied to something concrete like a service account.
• Identity and access management. The difference between authentication and authorisation, and what counts as a genuine second factor in multi-factor authentication.
• Cryptography basics. Why Base64 is encoding and not encryption, how TLS combines asymmetric and symmetric cryptography, and how passwords should be stored with a slow, salted hash rather than encrypted.
• Application security. How parameterised queries stop SQL injection, and how to recognise a cross-site request forgery.
• Social engineering and trust. Why a valid TLS certificate proves who owns a domain, not that the site is honest, and how phishing exploits that confusion.

How to use them

• For each attack, name the property it targets first: confidentiality, integrity or availability. Many questions get easier once you do.
• Separate the terms people mix up: authentication and authorisation, hashing, encoding and encryption, and identity and trust. Interviewers test those distinctions directly.
• Try things safely. Decode a Base64 string in a terminal, inspect a site's certificate in the browser, and compare a parameterised query with string concatenation in a toy app.
• Read the explanations for the wrong options. Each describes a defence that sounds plausible but doesn't address the actual problem, which is the trap in most real security decisions.
• Move on to the security domain of your cloud certification once these feel easy. IAM policies, key management and network controls there all rest on these principles.

These questions are original, written from public NIST and IETF documents and other open references. They are not taken from any exam or interview question bank.