24 Unisys Interview Questions & Answers
Below is a list of our Unisys interview questions. Click on any interview question to view our answer advice and answer examples. You may view 5 answer examples before our paywall loads. Afterwards, you'll be asked to upgrade to view the rest of our answers.
1. One of the most prevalent types of attempts at intrusions we see when monitoring our clients' networks is a Distributed Denial of Service (DDoS) attack. Can you explain what a DDoS is and what you would recommend to clients to prevent it?
How to Answer
The interviewer is testing your knowledge of cybersecurity and attempting to ensure that you will be able to interface with clients on both a business and technical level when presenting them with the services their company offers. This type of question is best answered with a direct answer describing the topic and how you would discuss it with a client.
Written by William Swansen on March 26th, 2019
1st Answer Example
"DDoS is an attack by someone attempting to compromise your network by flooding it with a large number of requests. Many networks are unable to handle this and respond by denying service to all users, even legitimate ones. It is called a 'Distributed' attack since the flood of requests can come from many different sources. The best way to defend against a DDoS attack is to analyze and filter network traffic using 'scrubbing centers.' These are servers on the network dedicated to analyzing network traffic and removing malicious requests. Our company offers this service as part of your network security package."
Written by William Swansen on March 26th, 2019
2nd Answer Example
"A Distributed Denial of Service or DDoS attack is when a threat emanates from multiple sources and attempts to overwhelm a network by creating more requests than the servers can respond to. The response is for the servers to deny all requests, both real and malicious, thereby shutting down the network. The purpose of this type of intrusion is not to hijack data, but rather to take the company offline for a period of time, which can be just as costly. The best way to defend against this type of attack is to set up scrubbing centers, which are servers that are dedicated to analyzing network traffic and blocking malicious requests while allowing legitimate traffic to cross the network. Reputable service providers like ours offer this service as part of their security package."
2. What is the differences between 'scalability' and 'elasticity' when speaking in terms of cloud hosting?
How to Answer
If you are asked this type of question, the interviewer is attempting to confirm that you really understand the concepts of cloud hosting. They may also be genuinely trying to clarify this information for their own benefit. You should answer the question as clearly and succinctly as possible.
Written by William Swansen on March 26th, 2019
1st Answer Example
"Scalability is a characteristic of cloud computing which is used to handle the escalating workload by escalating in proportion amount of resource capacity. Using scalability, the service provider can easily and quickly add resources when the requirements are being raised by the client. On the other hand, Elasticity is a characteristic that provides for the concept of provisioning and de-provisioning a large amount of resource capacity dynamically. It is usually measured by the speed by which the resources are coming on demand and the usage of those resources. Scalability often refers to a permanent increase in resources whereas Elasticity is temporary, based on fluctuating demands or business activity."
Written by William Swansen on March 26th, 2019
2nd Answer Example
"That's a great question. People often confuse the concepts of scalability and elasticity. Scalability refers to the ability to easily increase the IT resources used by the organization. This is accomplished by using technology that can be increased quickly and with no disruption in service or downtime. Another characteristic of scalability is that it is typically permanent, and based on the growth of the organizations business. On the other hand, elasticity refers to the ability to dynamically add (provision) or remove (de-provision) IT resources based on fluctuations in business cycles or customer activity. Service providers in hosted clouds accomplish this by having "standby" resources on hand which can be turned on or off as needed. These resources are typically shared by multiple clients, who are only billed when they actually use them."
3. There are different levels of data classification, how are they structured, and why are they required?
How to Answer
With a heightened level of data security taking place throughout the world, protecting customer data has never been more important. In this day and age, data has become a valuable commodity, and companies go to great lengths to protect it at all costs. When asked by the hiring manager, don't be afraid to offer examples of how you set data classification policies or reclassified data to a classified status with access limited to administrators for example. Also, highlight your knowledge about the different levels of data classification too (IE. Restricted, Private and Public).
Written by Tom Dushaj on March 26th, 2019
1st Answer Example
"Setting data classification policy if very important, because if you don't have a policy in place, you won't know what your level of sensitivity is, which means you have no baseline or security controls to protect your data. This is an important topic to me, and I take it very seriously. My involvement goes deeper into data classification than any other team member, so I typically take the lead for data classification in three main levels. Restricted Data, Private Data, and Public Data classification. Here's how I classify these three into workable tasks.
1. Restricted Data - I apply the highest level of security to a restricted classification, because it has the highest level of risk.
2. Private Data - This one is a moderate risk level, but should still be treated as private data and protected nonetheless.
3. Public Data - Normally this level is low or no risk. While there are still controls in place, some level of control is still required."
Written by Tom Dushaj on March 26th, 2019
2nd Answer Example
"There are a number of different ways that classification of data can be performed. I've always had an interest in data collection and classification, which has led me into a Cyber Security occupation. Interestingly enough, many organizations collect and classify data in different ways. As a Data Steward, it is my obligation to reclassify data - this is conducted periodically - determine what frequency is most appropriate based on available - if after doing a data reclassification, it is determined that the data has changed or was modified, then I look at whether existing controls are consistent with the new data classification. If gaps are found within existing controls, they are immediately corrected."
4. At Unisys we believe in continued education of our employees. If you could take a course or workshop on any topic, what would you choose?
How to Answer
Working for a company which emphasizes the importance of continued education can be an enriching opportunity. Be prepared to talk to the interviewer about your interest in growing your knowledge base. You may want to push your existing knowledge into the expert range, or perhaps there is a current hot topic on which you would like to learn. Whatever your answer may be, ensure that you express to the interviewer your appreciation for continued education opportunities.
1st Answer Example
"I love that Unisys emphasizes continued education. This offering is one of the qualities I was looking for, in my next opportunity. If I could take a course or workshop on any topic I would choose to focus on IT Management. My goal is to grow into a management level position, and that would be a great stepping stone to get there."
2nd Answer Example
"That is very exciting news to hear. I value continued education as well. If I could continue my education in any area, I would do a deeper dive into IT Security and IT Security Management."
5. Our company provides customers with details of our policies, processes, and guidelines for setting up and managing their hosted resources. However, often the clients are confused by this information. How would you help them better understand it?
How to Answer
By asking this question, the interviewer is seeking to understand how you define these three categories of information. They also want to determine if you can communicate each type of information to their clients to avoid issues down the road based on any misunderstandings the client may have had. An excellent way to address this is by defining each type of information, then describing how you would communicate this clearly to the clients.
Written by William Swansen on March 26th, 2019
1st Answer Example
"There are distinct differences between policies, processes, and guidelines and each one has a different impact on how service providers and their clients work together. Policies define both the security objectives and framework a company employs to protect its data. Processes, on the other hand, are step-by-step descriptions of the actions taken to secure the data. Finally, guidelines are recommendations and can be tailored to each company's specific situation. Policies are concrete and must be adhered to. Processes can be modified, but only to the extent that they don't violate the policies. Guidelines are suggestions and subject to changed based on the client's requirements, resources, and budget."
Written by William Swansen on March 26th, 2019
2nd Answer Example
"When onboarding a new client, it is important to make sure they clearly understand the service provider's policies, processes and guidelines, and their requirement to comply with each one of these. Policies are rules which define how the client's data is secured and must be adhered to if SLAs are to be met. Processes, on the other hand, are descriptions of the steps taken to enforce the policies. These can be modified to fit individual client requirements, but only to the extent that they don't violate the security policies. Guidelines are suggestions for best practices, based on the service provider's expertise and experience. Clients can either follow these or modify them to suit their specific needs and the resources they have."
6. During the implementation of a hosted cloud environment, our IT team emphasizes that the most insecure component of a cloud infrastructure is the data transmission process. How do you recommend customers secure data while transferring it to the cloud?
How to Answer
A critical aspect of Unisys's cloud security service is transferring or having knowledge of, transferring data to the cloud. In order to recommend the best approach to a client, you must be experienced in this area.
Providing a direct answer and citing your cloud security certifications is the right approach to answering this question.
Written by William Swansen on March 26th, 2019
1st Answer Example
"You are correct in your statement that data is at most risk while being transferred to and from the cloud. This is why measures must be taken to ensure that there is no leakage in the transmission. The best ways to accomplish this is to use strong encryption keys when transmitting data and to perform periodic audits to ensure the data in is the same as the data out. I learned how to work with clients to help them manage this during my preparation for my Certification of Cloud Security Knowledge exam preparation."
Written by William Swansen on March 26th, 2019
2nd Answer Example
"During my preparation for my Certification of Cloud Security Knowledge exam, I learned that data transmission is where most security breaches occur. It is easier for hackers to hijack the data while it is en route to the could than it is for them to breach the security perimeters provided by firewalls and user authentication measures. To prevent data leakage during transmission, I advise my customers that strong encryption keys be used to protect the data during transit. The effectiveness of their encryption measures can be verified by performing audits which compare the data into the data out."
7. Can you explain the security requirements we must adhere to in order to confirm that our customers' data is secure in the cloud?
How to Answer
It is likely that the interviewer already knows these regulations or has been briefed on them enough to ask the question. You should be prepared to address this question directly with the specific requirements.
Written by William Swansen on March 26th, 2019
1st Answer Example
"There are a total of four security requirements that are generally implemented in order to be compliant with user privacy laws. These are:
- Validation of input; The input data must be controlled and transmitted securely
-Backup and Security; The data is stored and secured and not open to access from unauthorized parties
- Output reconciliation; Audits must be performed that the data output is the same as the data input
- Processing; Data used by an application is controlled throughout the process and not exposed to unauthorized users."
Written by William Swansen on March 26th, 2019
2nd Answer Example
"Data security is a key component of cloud security. Companies must comply with international data security regulations or they may be subject to fines or injunctions, which could ultimately cause the company to cease operations for a period of time or even permanently. Remaining in compliance with these laws is not difficult if you understand the four basic requirements common to all the laws. These are;
- Validation of input; The input data must be controlled and transmitted securely
-Backup and Security; The data is stored and secured and not open to access from unauthorized parties
- Output reconciliation; Audits must be performed that the data output is the same as the data input
- Processing; Data used by an application is controlled throughout the process and not exposed to unauthorized users"
8. Even though we have taken measures to protect our client's data and create a secure cloud environment, some of our clients have had incidents of potential intrusion from unauthorized sources. Tell me how you advise clients to prevent intrusions.
How to Answer
Since the word 'incident' can have many meanings, it is best to first define your interpretation of an incident, and then describe the steps you would take to address it. This will provide the interviewer with a context for your answer and will demonstrate that you have experience in this area. You should describe a process you recommend which can be replicated each time an incident occurs.
Written by William Swansen on March 26th, 2019
1st Answer Example
"As I understand it, you are using the word 'incident' to describe an event which may lead to a compromise in the security of your data. I recommend using a step-by-step process to respond to incidents and to make sure nothing is overlooked. The first step is to confirm that an incident has occurred. Next, I log it so other members of the team are aware of it and they have a record of it. Then I suggest the team investigate the incident and perform a root cause analysis. If necessary, they should escalate the incident to their management or other resources. This leads to recommendations for remediation of the incident and preventing from it recurring. Finally, a report should be generated with all of the above information and the status moved to closed."
Written by William Swansen on March 26th, 2019
2nd Answer Example
"I use the word 'incident' to describe an event which may lead to a compromise in the security of a company's data. I have found that is is easier and more effective to develop a process to respond to incidents which can be used repeatedly. First I recommend confirming that an incident has occurred. Then I suggest creating a log of the incident so there is a record of it, and the team can determine if it is part of a trend. Next, I suggest they perform a root cause analysis to determine the causes and identify potential solutions. If necessary, they should escalate the incident to management to make them aware of it. The next step is to draft recommendations to resolve the incident and prevent from it recurring. Finally, a closure report is generated."
9. Can you describe the difference between a Black Hat, White Hat and Grey Hat hacker?
How to Answer
When it comes to cyber hackers, you will hear three terms used for hackers. They are Black Hat, White Hat, and Gray Hat hackers. These terms are also synonymous with Search Engine Optimization as well. For informational purposes, here's an overview of all three: Black Hat Hacker - Someone who has knowledge about breaking into or breaching computer systems and bypassing their security protocols. Their primary motivation is to financial or personal gain, and to spread malware or viruses in order to gain access to these computer systems. White Hat Hacker - Someone who is known to use their skills for good rather than evil. They typically work as Cyber Security consultants that are paid to find security vulnerabilities in systems, and work to strengthen those security holes for clients. In A hiring manager might pose a carefully crafted question to determine how well you know each one, and if you fall into one of the three categories. They want to know will you be able to defend against a cyber attack, and how you handle threats from hackers.
Written by Tom Dushaj on March 26th, 2019
1st Answer Example
"When I think of Black Hat Hackers, a few things come to mind. An individual or group of hackers whose intent is to either maliciously penetrate a company's system by writing and distributing malware that leaves a company vulnerable and susceptible to further attacks. The others are cyber espionage and political persuasion. I am directly responsible for following our company protocol when we are alerted that a Black Hat attack is in progress. Much like a chess game, I carefully engage and monitor the activities of the Black Hat Hacker to see what steps and moves I must execute to prevent loss of data or a breach. One of the biggest motivations for Black Hat hackers is personal or financial gain."
Written by Tom Dushaj on March 26th, 2019
2nd Answer Example
"On the flip side of Black Hat Hackers is White Hat Hackers, which serve a completely different purpose and role. White Hat Hackers are what's called ethical hackers. I worked with a company that employed a White Hat Hacker, and I was assigned to work with this individual on a project to perform penetration testing and vulnerability assessments on the security systems to attempt to find weak spots and holes in our system via various hacking methods. I'm also familiar with how Gray Hat Hackers work, and I'm careful how I work and interface with them. The reason being is they don't fall within the Black Hat or White Hat Hacker category, thus the name Gray Hat hacker. I've found that they tend to look for vulnerabilities in a system without notifying the owner of the systems knowledge, and offer to fix those issues for a small fee. There are also instances where I have seen Gray Hat Hackers where Gray Hat hackers post a company's vulnerability in a public forum or social media platform for all to see. I've found that not all hackers are created equal, but I do take precautions with all hackers anyway."
10. There are many different definitions of a 'Cloud' in the IT industry. In order to make sure we are on the same page can you provide your definition of a cloud hosting environment and describe its components?
How to Answer
The purpose of this question is to make sure you define a cloud hosting environment in the same way the employer does and that you have familiarity with what elements constitute an IT cloud.
Written by William Swansen on March 26th, 2019
1st Answer Example
"A cloud is an amalgamation of computer hardware, software, network, storage, and services. It can be managed by the organization or by a third-party service provider, such as Amazon or Microsoft. It is also known as 'computing as a service'. End users are unaware of where the components are located and where their applications and data reside. They access the cloud via an interface. This creates an environment in which they do their work."
Written by William Swansen on March 26th, 2019
2nd Answer Example
"A cloud environment is a collection of IT assets and services that are accessed by the users through a portal or dedicated interface. The cloud can reside or be hosted on the same physical premise as the users, offsite or by a third-party service provider. The components of the cloud are the same as a standard data center. They include hardware, software, storage, network, applications, and services. Many cloud environments are designed for specific businesses, including customer service, financial services, application development, and healthcare, to name just a few. These are typically hosted by third party service providers who specialize in the individual market segments."
11. We recently had a situation occur where a security problem occurred on our network and the person who detected it wasn't directly responsible for resolving it, even though they had the skills to do so. How would you have handled this situation?
How to Answer
This type of question is known as a 'behavioral question'. It is meant to determine how you react to a common scenario and if your response is compatible with the company's policies. The best way to answer this type of question is to describe how you performed in a similar situation in your current or previous position. You can use the 'STAR' method to answer this - Situation, Tactic, Action, Result.
Written by William Swansen on March 26th, 2019
1st Answer Example
"I had to face a similar situation recently at my current job. I discovered a threat to one of our customer's network security, but it wasn't within the scope of my job to notify the network administrator since they worked on another team. I could have easily just asked one of our team members to log in and fix the problem, but this would have gone against our company's policy. Instead, I notified the manager of the other team, identified the issue and suggested a way to resolve it. The manager appreciated my help, and his team quickly fixed the problem. He even let my manager know how I had helped."
Written by William Swansen on March 26th, 2019
2nd Answer Example
"When I encounter an issue outside my sphere of influence, I always follow company protocol. This is not always the quickest way to address the issue, but the final results usually justify the slight delay. I recently discovered a hole in our network security that could have easily been patched by one of our network administrators, but it was on a piece of equipment our team wasn't responsible for. Since there was no immediate threat, I notified the Sys Admin from another group who was responsible for the hardware of the issue. They immediately fixed the problem and thanked me for bringing it to their attention. "
12. If a client is considering moving from an internal data center environment to our platform. What are the key issues you would recommend them addressing before making this move?
How to Answer
By asking this question, the interviewer is attempting to understand the depth of your knowledge about a hosted cloud computing environment and your ability to plan and manage client's transitions to the cloud without causing any disruption in their business.
Written by William Swansen on March 26th, 2019
1st Answer Example
"When transitioning to a hosted cloud environment, there are several things you need to consider. The first and most important is business continuity. You need to make sure that there is no downtime during and after moving to the cloud and that no data is lost or compromised. Another key consideration it the integrity of the data; you don't want it to be hacked or lost between the user and the cloud. Maintaining availability and access to the cloud is also important. Capacity planning is critical, and measures need to be taken to ensure there are enough computing and storage resources available to the users, and that additional resources can be provisioned or de-provisioned as needed. Finally, the company needs to be aware of any regulatory or compliance issues around data integrity and privacy when utilizing cloud hosting."
Written by William Swansen on March 26th, 2019
2nd Answer Example
"The key considerations when moving to a cloud hosted environment center around data integrity, availability, and compliance. You need to take measures to ensure that the company's data is secure, can't be compromised when communicating with the cloud, and can be recovered if lost. Most cloud hosting service providers can assist with this through the transition planning and execution process. Having a good backup and disaster recovery plan is also important. Availability of the information, applications and computing resources is the next most critical issue. Selecting the right cloud hosting service provider is the first step. They should offer SLA guarantees and have contingencies in place when issues occur. Finally, it is the company's responsibility to make sure that they are in compliance with any regulations and customer privacy requirements when they move to a cloud environment. Again, although not primarily responsible, the service provider can assist in providing the guarantees and documentation necessary to address this issue."
13. In addition to monitoring our customer's online security, we provide them with periodic reports about threats and attempts to penetrate their network. What objects do you feel should be included in a security penetration report?
How to Answer
The purpose of this question is to make sure you have experience with security-related reporting and can have a dialog with your customers about their network security and the company's monitoring services. You should answer this question by providing an overview of a good security penetration report.
Written by William Swansen on March 26th, 2019
1st Answer Example
"A quality Vulnerability and Penetration Testing (VAPT) report should begin with an executive summary which explains the scope, testing process and period the report covers and a general assessment of the client's security status. Next, there should be details of the results of the tests, categorized by the level of the threat (low to high.) There should be a section about the type of tests performed and what they measured. Finally, there should be a set of recommendations for remediation of any threats which were discovered. Some reports also contain screenshots of the test results. "
Written by William Swansen on March 26th, 2019
2nd Answer Example
"Clients expect network security providers to perform periodic Vulnerability and Penetration Tests (VAPT) and provide reports of the results. The report should describe the type of tests performed, the results and recommendations for remediation of any threats which were discovered. The structure of the report is an executive overview summarizing the tests, results, and recommendations, followed by details of the tests and results. The details section should list the scope of the tests, what processes were used, the period the report covers and specific steps needed to address any threats or actual penetrations which were discovered during the testing. Some service providers include screenshots of the testing process in their reports. There are several software products which can be used for testing and which will generate the appropriate reports for the clients."
14. What different types of network monitoring tools have you worked with, and which one do you consider yourself an expert?
How to Answer
There are dozens of network performance monitoring tools in the market with different price points for all of them. Working with Unisys, you should be familiar with at least several top players in the market in case the interviewer asks if you used them, and which one you consider yourself an expert. Before we jump into possible questions and responses, let's look at the top 5 in the market right now. 1. Solar Winds, 2. OpManager, 3. PRTG Network Monitor, 4. Zabbix, and 5. Nagios XI. Theoretically, most of these tools work in a similar fashion. They provide behavioral analytics, hybrid visibility, dependency mapping, data flow collection, and what-if-analysis among other things.
An interviewer will want to know how familiar you are with the top brands and which ones you are most familiar with. You can start with some facts surrounding the basics on how these tools work, with examples of the ones you used, and your opinion on their performance based on experience from the environments you worked in. Next, you should hone in on one or two performance tools that you know well and talk about why you consider yourself an expert in these tools. Great examples to use are how you were able to optimize the performance of your employer's client networks and save them money in the process.
Written by Tom Dushaj on March 26th, 2019
1st Answer Example
"Generally speaking, I've used several network performance monitoring tools including OpManager, PRTG, Nagios, and others when I perform work at a client site. I consider myself an expert in three of the top five network monitoring tools in the market. My experience with these tools has allowed me to gain expert level knowledge and expertise which I have used over the years at client sites to optimize and secure these networks. Some of the client networks that I apply these tools are in PAN, LAN, HAN, WAN, GAN and CAN environments. My role as an on-site consultant for my company is to provide the client with visibility in performance optimization and network stabilization."
Written by Tom Dushaj on March 26th, 2019
2nd Answer Example
"Although my experience with several network monitoring tools is vast, I have used a couple that I feel perform better than others in my opinion. Most large clients I have worked with on-site use well-known network monitoring tools that I'm already familiar with, so there's no learning curve for me. As a consultant, I always look to improve my skills and learn new ones all the time. I've started working with a couple other network performance tools that provide advanced analytics, dependency reporting, data flow collection, and performance analysis as well."
15. Can you name some open source cloud computing platform databases?
How to Answer
By asking this question, the interviewer is testing your knowledge of open source cloud databases and trying to learn if you are familiar with and can offer options to your customers. The best way to answer this question is to name the databases you have knowledge of and recommending which one is best for your customer's requirements.
Written by William Swansen on March 26th, 2019
1st Answer Example
"There are three main open source cloud computing databases. They are Couch, Lucid and Mongo. These differ from proprietary databases based on there being no licenses required to use them and the ability of the IT community to make revisions in them to improve their performance. Of these, I believe (insert the name of the one you recommend here) is best suited for most client's needs. Not only does it have the features they require, but they won't have to pay any licensing fees, and they can upgrade it at any time."
Written by William Swansen on March 26th, 2019
2nd Answer Example
"The three main open source cloud databases are Couch DB, Lucid DB, and Mongo DB. For most situations I recommend (insert the one you recommend here.) In addition to having experience with this open-sourced cloud database, I have also worked with Oracle and SQL. This has given me a good perspective on the differences between these such as licensing requirements, scalability, reliability and stability of the platform. I'm comfortable recommending this one to my clients, but if you'd like, I can also discuss either open source or proprietary cloud databases with them."
16. What questions do you have for me about Unisys?
How to Answer
It's always a great idea to have questions ready for the interviewer. Review the company website and other online resources to ensure the questions you are asking are not mundane, or redundant. The last thing an interviewer wants to hear is a list of items you could have found the answers to from merely watching a video on their company site!
Here are some sample questions:
- When would you like to have this position filled?
- How long has this role been vacant?
- Is this a replacement search or a newly created role?
- What is your favorite part about working here?
- What is the company's primary goal for this position in the next 12 months?
- Is there anything from my background and experience that I can clarify for you?
- What do you see as the most significant change in this industry over the past three years?
- Is there any reason why you would not hire me?
Answer Example
"Thank you for asking - I do have a few questions. What is top of mind when it comes to filling this role? Also, what types of career growth opportunities would follow this position? And lastly, do you have internal candidates who are also interviewing for this position?"
17. Many companies are new to the cloud computing environment. How do you brief them about what security aspects come with a cloud?
How to Answer
The interviewer is testing your knowledge of security measures associated with the cloud environment and your ability to help customers manage their company's cloud.
Knowing how to advise Unisys's clients on the benefits of the cloud, specifically on security issues, will be a huge selling point for you landing the job.
Written by William Swansen on March 26th, 2019
1st Answer Example
"Cloud environments can be as secure as computing environments hosted on-premise based on two key attributes. These are Authentication and authorization, and Control of access. Authentication allows only those users who are authorized to access the resources hosted in the cloud. These include data, applications, and storage. Control of access is a system administrator tool which enables them to allow or deny access to specific users. Together, these tools provide a safe and secure cloud environment."
Written by William Swansen on March 26th, 2019
2nd Answer Example
"There are two control mechanisms which keep hosted cloud compute environments safe and secure. These are Authentication and authorization, and Control of access. Authentication and authorization prevent unauthorized parties from accessing a company's data and applications. This is also known as 'Hacking." Control of access is the methodology system administrators use to provide authorization to known users. By only allowing authorized users to enter the system and then requiring them to authenticate themselves, companies can be assured their data and other computing resources are safe from theft and misuse."
18. What is the difference between Asymmetric and Symmetric encryption and which one is better?
How to Answer
When comparing Asymmetric and Symmetric encryption, there are many things you need to be aware of. Not only will you need to know the difference between the two, but how they are used, and which one is better in a particular situation. It's important that you can articulate to the hiring manager examples of how you used both in specific situations and what you did to put an air-tight security solution in place that is impenetrable. Cyber Security has become one of the most important topics in technology today. Anytime you're processing credit card transactions through a payment gateway online, or at a brick and mortar retail store, you're dealing with vital consumer information, and hiring managers are going to want to hear how you keep these things protected.
Written by Tom Dushaj on March 26th, 2019
1st Answer Example
"When I work with Asymmetric encryption, I always take into account that there has to be a private key and a public key for anyone sending a message. I have to adhere to a decryption policy for where and how the public and private is stored and shared. The way I view the differences between the two are the execution of asymmetric encryption algorithms is slower than symmetric encryption algorithms. Although the asymmetric encryption is mostly used for exchanging keys in a secure manner, it is used for establishing a secure channel over a non-secure medium such as the internet. The most common form of an encryption algorithm is Diffie-Hellman."
Written by Tom Dushaj on March 26th, 2019
2nd Answer Example
"In my current role I do work with Symmetric encryption. Since Symmetric encryption which uses a single key for encryption and decryption, I am responsible for monitoring the data transmission of those communication messages to prevent a potential intrusion or breach alert. As with many symmetric encryption algorithms, they execute faster, and are less complex than Asymmetric encryption, and are a preferred method of encryption communication. The most commonly used symmetric encryption algorithms are 3 DES, AES, DES, and RC4."
19. Can you explain to me the basic characteristics of a hosted cloud?
How to Answer
Unisys offers cloud hosting and wants candidates who understand the essential characteristics of a hosted cloud. It's key in your answer to point out the advantages of cloud hosting and how it is superior to standard server hosting.
If you are interviewing for a sales position at Unisys. Knowledge of the cloud vs on-premise hosting will come with training, but it is important to have a basic understanding of the differences before your interview.
Written by William Swansen on March 26th, 2019
1st Answer Example
"The basic characteristics of a hosted cloud are Provisioning, Scalability, Billing, and Interfaces. Provisioning refers to the ability to add additional services including computer and storage when necessary to support the company's business activity, and then remove them when they are not needed. Scalability is growing the hosted services as the business grows, without any interruptions or downtime. Billing is important because it needs to be flexible and adjust according to what services are provisioned during the billing period and what volume discounts are applied as the environment scales. Finally, the interface is how the users access computing services and resources. It needs to be both user-friendly and compatible with a variety of devices, including computers with different operating systems and mobile devices, from anywhere across the globe."
Written by William Swansen on March 26th, 2019
2nd Answer Example
"There are four basic characteristics of a hosted cloud. The first is Provisioning, which refers to adding or removing computing resources based on the needs of the organization. This eliminates the need to provision for peak operational periods which results in the resources being underutilized during off-peak periods. This is one of the key advantages of cloud computing. Another characteristic, Scalability is similar to provisioning but refers to the ability to permanently grow the environment without business interruption. Billing is the third characteristic and relates to both of the previous ones. The organization should only pay for the computing assets and services it is using and should receive a volume-based discount when they add additional resources. Finally, and most importantly is the User Interface. This is how the business accesses its applications and data, and manages the resources. Ideally, the interface is transparent to the users and they are unable to determine that the applications and data are being managed in a cloud hosted environment."
20. At Unisys we deal with sensitive and confidential client information. Are you willing to complete a full background check?
How to Answer
Most companies in the IT and IT Services industry need to be very cautious about who they hire. There is a chance that much of the information you are going to access could be confidential and harmful if put into the wrong hands. Assure the interviewer that you are most willing to comply with any form of background check they require.
1st Answer Example
"I am happy to comply with any background check required. My record is clean, and I have a strong credit history. I do not participate in drug use, either. You can be assured that if you hire me for this role with Unisys, I will maintain a clean record."
2nd Answer Example
"Yes, I can certainly complete a full background check. I should disclose to you ahead of time that I have a mark on my record from about eight years ago, for a DUI. I am still able to travel, and no longer have restrictions on my drivers' license."
21. Can you tell me the different factors that affect the performance and reliability of a client network, and how network monitoring tools might help?
How to Answer
Many things can affect the performance of a network. It could be something as small as a hardware failure, outdated software, downtime, or something more serious such as a security breach or network reliability issues. An interviewer that knows what a client needs are is going to ask specific questions that relate to the duties you will have as a consultant at a client site.
Here are a few things that you should research ahead of time, and be ready to answer. The interviewer will likely ask about your experience with the performance of hardware maintenance, how frequently you do software updates and when you run a performance analysis on the systems using network performance tools, assessments done of the reliability of the client network, downtime schedules, failure frequency, and unforeseen catastrophic failures. Research all these areas because these all affect the performance and reliability of a network.
Written by Tom Dushaj on March 26th, 2019
1st Answer Example
"Having worked at many client sites over the years, I have learned to use a number of different network monitoring tools to optimize the performance of client networks. There are a number of different factors that affect the performance and reliability of a client network. Here are some that I have come across that have been pretty consistent from client to client. For me, the important ones are hardware failure, outdated software patches, security breaches, and user abuse and carelessness. There are some network monitoring tools that I use that help with most if not all of these issues. OpManager is a tool that I use which helps consultants target poor performance by providing a visual dashboard of real-time utilization throughout the network, which helps me monitor traffic and usage throughout the system."
Written by Tom Dushaj on March 26th, 2019
2nd Answer Example
"When I am assigned to a client site, I always assess the current state of their network and identify what network performance tools they are using. I typically get a heads up from my direct manager at my company before going on-site. There are several reliability issues that I address when I do an assessment. The first thing I will look at is how the network is performing now, and what deficiencies it currently has. As part of my assessment, I will also look at hardware/software failures that have recently happened, and if those were corrected or updated. Lastly, I will talk to the current network administrators to get an idea of what they have performed over a specific period of time to optimize their networks."
22. What is a false positive and false negative alert in the case of Intrusion Detection Systems?
How to Answer
Every company that has a intrusion detection system will likely come across a false positive and/or false negative. If you've ever did test cases for your company, and the results gave you a false positive or false negative, could be because of a bug in the software, a failure in the hardware, or perhaps the functionality is not working properly. In any case, the hiring manager will ask this question to gauge if this problem is caused by manual intervention, or a failure of the systems. It's important to highlight your knowledge and understanding of this topic by talking about the steps you take to monitor the reliability of the hardware and software and use corrective actions to prevent future alerts of this kind. For example, did you have to do further testing or change the code or functionality in the software to correct this problem?
Written by Tom Dushaj on March 26th, 2019
1st Answer Example
"While we try to protect any sort of intrusion or hacking of our systems, we do get the occasional attempted intrusion alerts that tell us where the intrusion is coming from and how they are able to get through a first level of security. This is where we implement a false positive and false negative to give them the impression that they are penetrating our system, but in reality we are watching them to monitor which areas of our network they are attempting to attack, so that we can strengthen that area, and other areas of attempted attacks."
Written by Tom Dushaj on March 26th, 2019
2nd Answer Example
"I've worked with intrusion detection software, anti-virus, and malware software for many years, and have found that even when you test your system, you might get a false positive or false negative. It's not uncommon for this to happen, and I've always proactively planned for it since it's very likely to happen. My approach is to explore why it happens, or what might have caused it to happen, and work towards a preemptive strike to prevent it from happening again. Since both are damaging, and they create a false sense of security, it makes it even more important to me to address it very early in the process. One of the areas I look closely at is test cases. I tend to break them down to the granular level and analyze every detail to get to the core of the problem. I do this by using different test data, metrics and analysis to review test cases, and I do this process manually and also use automation scanning tools as well."
23. As I understand it, the network is the most vulnerable part of a company's IT infrastructure. What is your opinion of this and how would you define the threat and risk to a company in terms of network security?
How to Answer
This is a 'set the table' question which provides the interviewer with an overview of your knowledge of and perspective on network security.
Written by William Swansen on March 26th, 2019
1st Answer Example
"The network infrastructure is the most vulnerable part of the IT system because it is the easiest part to access. Since all the company's data is transmitted via the network, hackers focus on this to get the data for malevolent uses. This is the threat to the system. The risk is the company's responsibility to secure their users' and customers' information or be subject to fines, injunctions or even shut down. Measures need to be taken to minimize both the threats and the risks related to network security. I am well versed in these and can expound on them if you would like me to."
Written by William Swansen on March 26th, 2019
2nd Answer Example
"I agree with you that the greatest threat to a company's IT infrastructure is the network. Hackers target the network because it is the easiest part of the system to access and because all the data is transmitted over the network. It's the data that hackers want and can cause the most disruption with. The risk to the company if the data is compromised is the loss of business, fines and injunctions and the possibility of being shut down. While the threat associated with network security will always remain, the risk can be minimized through prudent network security practices and procedures."
24. Although you are not an experienced network administrator, you should be fluent in the terminology used in our industry. Can you explain to me the difference between symmetric and asymmetric encryption and the benefits of each one?
How to Answer
This is a direct question meant to test your knowledge of network security management and determine if you are qualified to make recommendations to the customers of the firm you are interviewing with. You should answer this directly and succinctly.
Written by William Swansen on March 26th, 2019
1st Answer Example
"Sure, I'd be happy to. Symmetric encryption uses the same key at both ends of the packet transmission. The two processes involve encrypting and then decrypting the packet. Asymmetric encryption employs two different keys for the two processes. Symmetric encryption is faster but poses a bigger risk since the channel the packet is sent through is unencrypted."
Written by William Swansen on March 26th, 2019
2nd Answer Example
"Symmetric and asymmetric encryption differ in terms of the keys used to encrypt the data packets. Symmetric encryption involves using a signal key to encrypt and decrypt the packet. This is faster but increases the risk of data loss due to the channel being unencrypted. Asymmetric encryption uses two keys' one to encrypt the packet and a different one to decrypt it. This is a more secure method to transmit data, but the additional key slows the process down. Symmetric encryption is best for low-risk, low-latency applications while asymmetric is best for more secure situations."