Free guides, interview Q&As, and job responsibility breakdowns — curated by industry veterans to help you crack MNC interviews
Figure 1: Defense-in-Depth — layered security from physical access down to encrypted data
Figure 2: Multi-Factor Authentication — three independent proofs of identity
Windows Server Security
Definition: The overall protection of servers, accounts, applications, and data from unauthorized access, malware, and system failure.
Day-to-Day Example: Like a bank's overall security program — vaults, guards, cameras, and procedures working together, not just one lock on the front door.
Malware
Definition: Malicious software designed to damage systems, steal information, or disrupt normal operations.
Day-to-Day Example: Like a con artist who sneaks into a building disguised as a delivery person, then causes damage or steals things once inside.
Ransomware
Definition: Malware that encrypts a victim's files and demands payment in exchange for restoring access.
Day-to-Day Example: Like a burglar who doesn't steal your belongings but instead changes all your locks and demands money for the new keys.
Defense-in-Depth
Definition: A security strategy using multiple independent layers of protection, so a single failure doesn't fully compromise the system.
Day-to-Day Example: Like a castle with a moat, high walls, and guards — even if an attacker crosses the moat, they still have to get past the walls and the guards.
Local Authentication
Definition: A method that verifies a user's identity using an account stored only on that specific computer.
Day-to-Day Example: Like a key that only opens the front door of one particular house, with no connection to any other property.
Domain Authentication
Definition: A method that verifies user identity centrally through Active Directory, enabling single sign-on across the network.
Day-to-Day Example: Like a company-wide employee badge that works at every office location, verified by one central security system.
Password Policy
Definition: A set of rules governing password length, complexity, expiration, and reuse to strengthen account security.
Day-to-Day Example: Like a landlord's rule that every new tenant must use a modern, hard-to-pick lock instead of a flimsy old one.
Account Lockout Policy
Definition: A setting that temporarily disables an account after a defined number of failed login attempts.
Day-to-Day Example: Like a bank vault that jams shut for 30 minutes after someone enters the wrong combination too many times, foiling anyone trying to guess it.
Multi-Factor Authentication (MFA)
Definition: A login method requiring two or more independent proofs of identity, such as a password plus a one-time code.
Day-to-Day Example: Like needing both a key and a fingerprint scan to open a safe — having only one of the two isn't enough to get in.
Role-Based Access Control (RBAC)
Definition: A method of granting permissions according to a user's job role rather than configuring access individually.
Day-to-Day Example: Like a hospital ID badge system where anyone with a "nurse" badge automatically gets nurse-level access, without custom-configuring each new hire.
Windows Defender Firewall
Definition: A host-based firewall built into Windows Server that filters inbound and outbound network traffic based on configured rules.
Day-to-Day Example: Like a doorperson at a building entrance who checks everyone coming in or going out against a list of who's allowed.
Inbound Rule
Definition: A firewall rule that controls traffic attempting to enter the server from outside.
Day-to-Day Example: Like a security checkpoint that decides who's allowed to walk into the building.
Outbound Rule
Definition: A firewall rule that controls traffic attempting to leave the server toward external destinations.
Day-to-Day Example: Like a checkpoint that controls what's allowed to be carried out of the building, preventing sensitive items from leaving.
Windows Defender
Definition: Microsoft's built-in antivirus and anti-malware solution offering real-time protection for Windows systems.
Day-to-Day Example: Like a live-in security guard who's always watching, instead of one who only checks in occasionally.
Real-Time Protection
Definition: A Windows Defender feature that continuously scans files and processes as the system runs, blocking threats immediately.
Day-to-Day Example: Like a smoke detector that reacts the instant it senses smoke, rather than someone checking the room for fire once a day.
Group Policy Security Settings
Definition: Centrally managed security configurations — like password and audit policies — applied automatically across domain computers.
Day-to-Day Example: Like a company issuing one standardized security handbook that automatically applies to every branch office at once.
Audit Policy
Definition: A Group Policy setting that records events such as logons, account changes, and file access for later review.
Day-to-Day Example: Like a building's sign-in log that records who entered, when, and which door they used.
Patch Management
Definition: The process of installing updates and security fixes on systems to close known vulnerabilities.
Day-to-Day Example: Like regularly repairing small cracks in a wall before they become large enough for someone to break through.
BitLocker
Definition: A Windows feature that encrypts an entire drive, protecting all its data even if the physical disk is removed or stolen.
Day-to-Day Example: Like sealing an entire filing cabinet in a safe, so removing the cabinet from the building doesn't give a thief access to its contents.
Encrypting File System (EFS)
Definition: A Windows feature that encrypts individual files or folders rather than an entire drive.
Day-to-Day Example: Like putting a single sensitive folder inside a locked drawer within an otherwise unlocked filing cabinet.
Figure 3: BitLocker (whole-drive encryption) vs. EFS (single-file encryption)
Figure 4: Security Threats & Defenses Cheat Sheet
1. Local Authentication vs. Domain Authentication
Feature Local Authentication Domain Authentication Account storage On the individual computer only Centralized in Active Directory Management No centralized management Centralized, single sign-on capable Best suited for Standalone systems Enterprise, networked environments
2. Malware vs. Ransomware
Feature Malware (general) Ransomware Goal Damage, steal, or disrupt Extort payment by denying data access Typical effect File corruption, slow systems, data theft Encrypted files, business downtime Common targets Any system File servers, backup servers, databases
3. Inbound Rules vs. Outbound Rules
Feature Inbound Rules Outbound Rules Controls Traffic coming into the server Traffic leaving the server Purpose Protect services, block unauthorized connections Prevent data leakage, restrict malware communication Example Allow HTTPS on port 443 Block access to suspicious external sites
4. Password Policy vs. Account Lockout Policy
Feature Password Policy Account Lockout Policy Focus Rules for password strength/format Response to repeated failed login attempts Example setting Minimum length, complexity Lockout threshold, lockout duration Main goal Make passwords harder to guess Stop brute-force guessing attempts
5. Quick Scan vs. Full Scan vs. Custom Scan
Aspect Quick Scan Full Scan Custom Scan Coverage Common target areas only Entire system, all drives Specific chosen files/folders Speed Fast Slow, resource-intensive Depends on selection Typical use Daily checks Weekly/monthly deep checks Scanning a suspicious file or USB drive
6. BitLocker vs. EFS
Feature BitLocker EFS Encryption type Full drive encryption File/folder encryption Protection scope Entire disk Selected files Best use case Device theft protection Individual file security Works on Entire volume NTFS files/folders
7. Full Backup vs. Incremental Backup vs. Differential Backup
Aspect Full Backup Incremental Backup Differential Backup What's copied All selected data Only data changed since the last backup Data changed since the last full backup Backup size Largest Smallest Grows until next full backup Restore speed Fastest (one backup set) Slowest (needs full + all increments) Moderate (needs full + latest differential)
8. Application Logs vs. Security Logs vs. System Logs
Log Type Contains Application Logs Events generated by installed applications Security Logs Logon events, audit records, security-related activity System Logs Operating system events and driver information
9. WSUS-Managed Updates vs. Individual Windows Update
Feature WSUS-Managed Updates Individual Windows Update Update source Downloaded once, distributed centrally Each device downloads separately Bandwidth use Lower, shared across the network Higher, repeated per device Administrative control Approve/reject updates centrally Limited central oversight
10. Physical vs. Network vs. OS Security
Layer Protects Against Example Controls Physical Security Unauthorized physical access to hardware Locks, CCTV, biometric access, guards Network Security Network-based attacks and unauthorized traffic Firewalls, VLAN segmentation, IDS/IPS, VPN OS Security Attacks against the server's operating system itself Updates, antivirus, password policy, audit logging
Q1. Why is Windows Server security especially critical in enterprise environments?
Answer: Servers store critical business data and often run Active Directory, so a single compromised server can expose the entire network, making strong server security essential.
Q2. What is Defense-in-Depth, and why is it effective?
Answer: Defense-in-Depth uses multiple independent security layers instead of a single protection mechanism, so if one layer fails or is bypassed, the remaining layers still protect the system.
Q3. What is the difference between Local Authentication and Domain Authentication?
Answer: Local Authentication verifies users against accounts stored only on one computer with no centralized management, while Domain Authentication uses Active Directory for centralized management and single sign-on.
Q4. What is the purpose of a Password Policy?
Answer: A Password Policy defines rules like minimum length, complexity, expiration, and history to make passwords harder to guess and reduce the risk of unauthorized access.
Q5. How does Account Lockout Policy help protect against attacks?
Answer: It temporarily locks an account after a set number of failed login attempts, which helps block brute-force password-guessing attacks.
Q6. What is Multi-Factor Authentication, and why is it stronger than a password alone?
Answer: MFA requires two or more proofs of identity — something you know, have, or are — so even if an attacker steals a password, they still lack the additional factor needed to log in.
Q7. What is Role-Based Access Control (RBAC), and what problem does it solve?
Answer: RBAC assigns permissions based on job role rather than configuring each user individually, which simplifies administration and prevents users from accumulating excessive, inconsistent permissions.
Q8. What is the difference between inbound and outbound firewall rules?
Answer: Inbound rules control traffic coming into the server from outside, while outbound rules control traffic leaving the server toward external destinations.
Q9. Why should administrators only open the ports required for business operations?
Answer: Every open port increases the attack surface; limiting open ports to only what's necessary reduces the opportunities attackers have to exploit the server.
Q10. What is the difference between Quick Scan, Full Scan, and Custom Scan in Windows Defender?
Answer: Quick Scan checks commonly targeted areas quickly, Full Scan checks the entire system in depth but takes longer, and Custom Scan lets administrators target specific files, folders, or drives.
Q11. What role does Group Policy play in enterprise security?
Answer: Group Policy lets administrators centrally configure and enforce security settings — like password policies, account lockout, and audit policies — consistently across all domain computers.
Q12. Why is patch management important, and what real-world incident illustrates the risk of skipping it?
Answer: Patch management closes known vulnerabilities before attackers can exploit them; the WannaCry ransomware attack spread widely specifically because many affected systems hadn't installed an available security patch.
Q13. What is the difference between BitLocker and EFS?
Answer: BitLocker encrypts an entire drive, protecting all its data even if physically removed, while EFS encrypts only specific files or folders selected by the user.
Q14. What is the 3-2-1 backup rule?
Answer: The 3-2-1 rule recommends keeping 3 copies of data, stored on 2 different types of storage, with 1 copy kept offsite, to improve resilience against data loss.
Q15. What is the difference between Application Logs, Security Logs, and System Logs in Event Viewer?
Answer: Application Logs record events from installed applications, Security Logs record logon and audit-related activity, and System Logs record operating system and driver events.
Q1. A company's domain controller is compromised by an attacker. Why is this especially dangerous compared to a single workstation being compromised?
Answer: The domain controller manages authentication for the entire domain, so compromising it can give attackers access to every system and account connected to that domain, not just one machine.
Q2. An organization's file servers were suddenly encrypted, and a message demands payment to restore access. What type of attack is this, and what should have been in place to reduce the impact?
Answer: This is a ransomware attack. Regular backups following the 3-2-1 rule, along with up-to-date patching, would allow the organization to restore data without paying, minimizing the damage.
Q3. A user's password was stolen through phishing, but the attacker still couldn't log into the VPN. What security feature likely prevented access?
Answer: Multi-Factor Authentication (MFA) likely blocked the attacker, since the stolen password alone wasn't enough without the additional verification factor, like a mobile OTP.
Q4. An administrator notices multiple failed login attempts from different systems targeting the same account in a short period. What does this suggest, and where would they check?
Answer: This pattern suggests a brute-force password attack. The administrator should check Security Logs in Event Viewer to confirm the failed attempts and consider whether Account Lockout Policy is properly configured.
Q5. A company wants HR employees to access employee records while IT administrators manage servers, without configuring permissions individually for each person. What approach should they use?
Answer: Implement Role-Based Access Control (RBAC), assigning permissions based on job role (HR Staff vs. IT Administrators) so each group automatically receives the appropriate access.
Q6. A laptop containing sensitive salary data is stolen from an employee's car. The data cannot be read by the thief. What security feature most likely prevented this, and why?
Answer: BitLocker most likely prevented data access, since it encrypts the entire drive — without the recovery key or proper authentication, the data remains unreadable even with physical access to the disk.
Q7. A company with 500 computers wants to deploy security patches efficiently without every machine downloading updates separately from the internet. What should they implement?
Answer: They should implement WSUS (Windows Server Update Services), which downloads updates once centrally and distributes them internally, saving bandwidth and improving update control.
Q8. An HR department wants only authorized HR staff to open a specific salary document stored in a shared folder used by multiple departments, without encrypting the entire drive. What feature fits this need?
Answer: Encrypting File System (EFS) fits this need, since it can encrypt just that specific file, restricting access to authorized users without affecting the rest of the shared drive.
