Systems security interview questions

Questions and answers

5 questions with model answers

Rewrite each answer in your own words before the loop — interviewers can tell a memorized paragraph from one you can defend under a follow-up.

1. Question 1

   What does least privilege look like at the operating system level?

   It means users and services run with the smallest set of rights that lets them work, and elevation is deliberate and auditable rather than ambient. On Windows that means separate administrative accounts rather than daily-driver admins, understanding that access tokens carry privileges such as SeDebugPrivilege and SeImpersonatePrivilege that are effectively administrative, and treating UAC as a convenience boundary rather than a security boundary. On Linux it means avoiding blanket sudo, using narrowly scoped sudoers entries, granting specific capabilities instead of setuid root binaries, and confining services with systemd sandboxing or SELinux/AppArmor policy. Service accounts are where this usually breaks in practice: they get local administrator or root because it made an install work, and nobody revisits it.

2. Question 2

   How do attackers escalate privileges on a host, and how do you close those paths?

   The common paths are credentials sitting on the host — cached secrets, scripts with embedded passwords, tokens of a more privileged user in memory — followed by misconfigurations such as writable service binaries or unquoted service paths on Windows, and setuid binaries or writable cron and PATH entries on Linux. Unpatched local kernel or driver vulnerabilities are the third bucket, including bring-your-own-vulnerable-driver attacks that disable security tooling. Fixes track the cause: remove local admin rights and unnecessary privileges, credential-guard style protections and no reusable local admin passwords across machines (LAPS-style unique passwords), fix filesystem and service permissions, and patch. Detection matters too, because token manipulation, LSASS access, and new service creation are all observable behaviors.

3. Question 3

   How would you build a hardening baseline for a fleet of servers?

   Start from a published benchmark such as CIS or the vendor's own security baseline rather than inventing one, then decide which controls are non-negotiable and which need exceptions for the workload. Turn it into code — configuration management or golden images — so a rebuilt host is compliant by default and drift is detectable rather than discovered during an incident. Prioritize the controls that break real attack paths: remove legacy protocols and default credentials, disable unnecessary services, enforce disk encryption and secure boot, require MFA on administrative access, and make sure logging and EDR are installed and reporting. Then measure compliance continuously and let exceptions expire, because a baseline nobody enforces is documentation, not a control.

4. Question 4

   How do you prioritize patching when you cannot patch everything at once?

   By combining exploitability with exposure and asset value rather than sorting a CVSS column. Anything on CISA's Known Exploited Vulnerabilities list, or with a high EPSS probability, on an internet-facing or identity-critical system goes first — those are the ones actually used in intrusions. Next come internal systems that reach sensitive data, then everything else on the normal maintenance cycle. Where patching is blocked by a vendor or an uptime constraint, I document a compensating control — network restriction, feature disable, additional monitoring — with an owner and an expiry date, so the risk stays visible instead of quietly becoming permanent.

5. Question 5

   Give a concrete example of defense in depth.

   Take credential theft on a workstation. Prevention layers reduce the chance it happens at all: no local administrator rights, application control so arbitrary binaries do not run, and phishing-resistant MFA so a stolen password alone is worthless. Containment layers assume it happened anyway: unique local admin passwords so one host does not unlock the fleet, network segmentation so the host cannot reach the domain controllers directly, and tiered administration so privileged credentials never touch a workstation. Detection layers catch it in progress: alerting on LSASS access, on unusual authentication patterns, and on new administrative sessions. No single layer is expected to hold — the value is that an attacker has to defeat controls owned by different systems and different teams.