Skip to content
Cyber Security
All coursesPlacement Report
‹ Back to previous sectionCourse homeAll page URLs

Cyber Security Interview Questions & Answers

All 200 unique questions in one place — 58 easy, 95 medium, 47 hard — grouped by topic.

Practise by topic

Security Fundamentals · 26Network Security · 25Cryptography and PKI · 24SOC Operations and SIEM · 25Incident Response and Forensics · 26Identity and Access Management · 24Cloud Security · 25GRC and Compliance · 25

Practise the way your interview works

Company-wise Cyber Security questionsExperience-wise Cyber Security questionsRole-wise Cyber Security questionsCity-wise Cyber Security questionsMost asked Cyber Security questionsScenario-based questionsPractical / hands-on questionsHR & behavioural questionsCyber Security mock interviewOnline assessment questionsTechnical round questionsManagerial round questionsCyber Security topic sheets
Solved overallStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
3 questions free Unlock the rest in seconds
01

What is the CIA triad in cyber security?

Security FundamentalsEasy
Save to ▾
Show answer
The CIA triad is Confidentiality, Integrity and Availability, the three goals every control supports. Confidentiality keeps data away from unauthorised people, for example with encryption and access control. Integrity ensures data is not altered without detection, using hashes and digital signatures. Availability keeps systems usable when needed, through backups, redundancy and DDoS protection. Most security decisions are a trade-off between these three.
02

What is the difference between a threat, a vulnerability and a risk?

Security FundamentalsEasy
Save to ▾
Show answer
A vulnerability is a weakness, such as an unpatched server. A threat is anything that can exploit it, such as a ransomware group. Risk is the likelihood that the threat exploits the vulnerability multiplied by the business impact. For example, an unpatched internet-facing VPN is high risk, while the same flaw on an isolated lab machine is low risk because likelihood and impact are smaller.
03

What is defence in depth?

Security FundamentalsEasy
Save to ▾
Show answer
Defence in depth means using several independent layers of controls so that one failure does not lead to a breach. A typical stack has perimeter firewalls, email filtering, endpoint EDR, MFA, network segmentation, least privilege, logging and backups. If a phishing email gets past the filter, MFA and EDR can still stop the attacker. The trade-off is cost and complexity, so layers should target the most likely attack paths.
04

What is the principle of least privilege?

Security FundamentalsEasy
Save to ▾
Show answer
Least privilege means every user, service and application gets only the minimum access needed for its job, and only for as long as needed. It limits the damage from compromised accounts and insider mistakes. Examples are giving developers read-only production access, using separate admin accounts, and just-in-time elevation that expires after a few hours. Regular access reviews are needed because permissions tend to grow over time.
05

Explain the difference between symmetric and asymmetric encryption at a basic level.

Security FundamentalsEasy
Save to ▾
Show answer
Symmetric encryption uses one shared key for encryption and decryption, such as AES; it is fast and used for bulk data. Asymmetric encryption uses a public and private key pair, such as RSA or elliptic curve keys; it is slower but solves key distribution and enables digital signatures. Real protocols like TLS combine them: asymmetric methods agree on a session key, then AES encrypts the traffic.
06

What is the difference between hashing and encryption?

Security FundamentalsEasy
Save to ▾
Show answer
Encryption is reversible with the right key and protects confidentiality. Hashing is a one-way function that produces a fixed-length digest and is used for integrity checks and password storage. SHA-256 of a file lets you detect tampering, but you cannot get the file back from the hash. Passwords should be stored with slow salted hashes such as Argon2id or bcrypt, never encrypted or with plain SHA-256.
07

What is social engineering and what are its common forms?

Security FundamentalsEasy
Save to ▾
Show answer
Social engineering manipulates people rather than technology to gain access or information. Common forms are phishing emails, spear phishing aimed at specific staff, vishing over phone calls, smishing over SMS or WhatsApp, pretexting with a fake story, baiting with infected USB drives and tailgating into offices. Defences include awareness training, phishing simulations, call-back verification for payment changes, and technical controls such as MFA and email authentication.
08

What is malware and how do virus, worm, trojan and ransomware differ?

Security FundamentalsEasy
Save to ▾
Show answer
Malware is any software built to harm or misuse a system. A virus attaches to files and spreads when they run. A worm spreads by itself across networks, often using a vulnerability. A trojan pretends to be legitimate software to trick users into installing it. Ransomware encrypts or steals data and demands payment, and modern groups use double extortion by threatening to leak stolen data.
09

What is the difference between a vulnerability assessment and a penetration test?

Security FundamentalsEasy
Save to ▾
Show answer
A vulnerability assessment uses scanners to find and rank as many known weaknesses as possible across many assets, and it is broad and frequent. A penetration test is a time-boxed, authorised attempt to exploit weaknesses and show real impact, such as reaching sensitive data. Assessments answer what is wrong; pen tests answer what an attacker could actually achieve. Most programmes run monthly scans and annual or release-based pen tests.
10

What is the difference between authentication, authorisation and accounting?

Security FundamentalsEasy
Save to ▾
Show answer
Authentication proves who you are, for example password plus an OTP or passkey. Authorisation decides what you are allowed to do after login, such as read-only access to a finance folder. Accounting, or auditing, records what you actually did, like logins, file access and admin changes. Together they are called AAA. Weak accounting is a common gap, because without logs an incident cannot be investigated.
11

Tell me about a time you found a security issue that nobody asked you to look at.

Security FundamentalsEasy
Save to ▾
Show answer
Situation: while setting up a college lab server, I noticed the admin panel of our event website was reachable without login. Task: report it responsibly. Action: I confirmed the issue without accessing any data, wrote a short note with steps and impact, and shared it privately with the faculty in charge. Result: it was fixed in two days and I was asked to review the next release.
12

How would you verify the integrity of a downloaded installer on Windows and Linux?

Security FundamentalsEasy
Save to ▾
Show answer
Compare the file's hash with the value published by the vendor over a trusted channel, or verify its digital signature. On Windows, use PowerShell and check the Authenticode signature. On Linux, use sha256sum and gpg for signed checksum files. Get-FileHash .\setup.exe -Algorithm SHA256 Get-AuthenticodeSignature .\setup.exe sha256sum tool.tar.gz gpg --verify SHA256SUMS.asc SHA256SUMS
13

How do you generate a strong random secret or password from the command line?

Security FundamentalsEasy
Save to ▾
Show answer
Use a cryptographically secure source, never a simple random function. OpenSSL and Python's secrets module both use the operating system CSPRNG. openssl rand -base64 32 python3 -c "import secrets; print(secrets.token_urlsafe(32))" Store the output in a password manager or secret vault, not in a text file or chat message.
14

How do you check which ports are listening on a server you manage?

Security FundamentalsEasy
Save to ▾
Show answer
List listening sockets with the owning process, then compare against what the server should expose. Anything unexpected needs an owner or should be closed. # Linux sudo ss -tulpn # Windows netstat -ano | findstr LISTENING Get-NetTCPConnection -State Listen Map the PID to a process name in Task Manager or with ps to identify the service.
15

Why do you want to build a career in cyber security?

Security FundamentalsEasy
Save to ▾
Show answer
A good answer links genuine interest to evidence. For example: I got interested after investigating a phishing email that reached my college group, which led me to study networking and complete Security+. I built a home lab with a SIEM and wrote detections for brute-force logins. I enjoy problem solving under pressure, and I want to grow in a SOC, then specialise in incident response.
16

What is the Cyber Kill Chain?

Security FundamentalsMedium
Save to ▾
Show answer
The Lockheed Martin Cyber Kill Chain describes seven stages of an intrusion: reconnaissance, weaponisation, delivery, exploitation, installation, command and control, and actions on objectives. Defenders use it to map controls to each stage, for example email filtering at delivery and egress filtering at command and control. Its weakness is a perimeter focus, so many teams pair it with MITRE ATT&CK for detailed techniques after initial access.
17

What is MITRE ATT&CK and how is it used?

Security FundamentalsMedium
Save to ▾
Show answer
MITRE ATT&CK is a public knowledge base of adversary tactics and techniques observed in real attacks, organised in matrices for Enterprise, Mobile and ICS. Tactics are the goal, such as Persistence, and techniques are the method, such as T1053 Scheduled Task. Teams use it to map detection coverage, write threat-informed detections, plan red and purple team exercises, and describe incidents in a common language.
18

What is Zero Trust security?

Security FundamentalsMedium
Save to ▾
Show answer
Zero Trust removes implicit trust based on network location. Every request is verified using identity, device health and context, access is least privilege and granted per session, and the environment is assumed to be already breached. NIST SP 800-207 describes the model. In practice it means strong MFA, device posture checks, identity-aware proxies instead of flat VPN access, micro-segmentation and continuous monitoring. It is a journey, not a single product.
19

Your manager asks why the company needs security when it already has antivirus on every laptop. How do you explain?

Security FundamentalsMedium
Save to ▾
Show answer
I would explain that antivirus mainly blocks known malicious files, while most modern attacks use stolen credentials, phishing links, living-off-the-land tools like PowerShell, or cloud misconfigurations that antivirus never sees. I would map our top risks to missing controls, such as MFA, EDR, logging and backups, and use a recent real incident pattern to show business impact in downtime and regulatory reporting cost.
20

A user reports a pop-up saying their files are encrypted. What are your first steps?

Security FundamentalsMedium
Save to ▾
Show answer
First, isolate the device from the network, ideally through EDR network containment, without powering it off so memory evidence is kept. Inform the incident lead and start a timeline. Check for the same indicators on other hosts, disable the user's sessions and reset credentials if needed, and identify the ransomware family from the note. Then confirm backups are intact and offline before any recovery begins.
21

A developer has hardcoded database passwords in a public code repository. What do you do?

Security FundamentalsMedium
Save to ▾
Show answer
Treat the secret as compromised immediately, even if the commit is removed, because public repos are scraped within minutes. Rotate the password and any related keys, check database logs for unknown logins since the commit time, and remove the secret from git history. Then fix the root cause by moving secrets to a vault or cloud secret manager and adding secret scanning to pre-commit hooks and the CI pipeline.
22

Leadership wants to block all USB drives tomorrow. How would you handle this request?

Security FundamentalsMedium
Save to ▾
Show answer
I would support the goal but plan the rollout to avoid breaking business work. First, find who genuinely needs USB, such as field engineers, using endpoint logs. Then apply a device control policy through EDR or Intune that blocks mass storage by default, allows approved encrypted devices by serial number, and logs exceptions. Communicate the change, pilot it with one department, then enforce company wide.
23

How would you run a basic threat model for a new web application?

Security FundamentalsMedium
Save to ▾
Show answer
Draw a data flow diagram showing users, the web app, APIs, databases and third parties, and mark trust boundaries. Then apply STRIDE to each element: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service and Elevation of privilege. For each threat, record the existing control, a risk rating and an owner. Repeat the model whenever the architecture changes, ideally during design reviews.
24

Tell me about a time you explained a security risk to a non-technical person.

Security FundamentalsMedium
Save to ▾
Show answer
Situation: my team lead in a support role wanted to share admin passwords on a spreadsheet. Task: change this without slowing the team. Action: I explained the risk as a house key copied for everyone, showed how one leaked laptop exposes all systems, and proposed a password manager with shared vaults. Result: we adopted it within a week and audit findings dropped.
25

A vendor announces a zero-day in your internet-facing appliance with no patch yet. What does that mean and how do you protect the company?

Security FundamentalsHard
Save to ▾
Show answer
A zero-day is a flaw that the vendor does not know about or has not yet patched, so defenders have had zero days to fix it. Exploits for zero-days are valuable and often used in targeted attacks. Since patches are unavailable, defence relies on layered controls: EDR behaviour detection, network segmentation, least privilege, virtual patching with WAF or IPS rules, and fast patching once a fix is released.
26

How do you prioritise 500 vulnerabilities found in a scan?

Security FundamentalsHard
Save to ▾
Show answer
CVSS alone is not enough. I combine severity with exploitability and exposure: check the CISA Known Exploited Vulnerabilities list and EPSS score, whether the asset is internet facing, and how critical the business data on it is. Internet-facing systems with known exploited flaws are fixed first, often within days. Internal low-severity findings go into normal patch cycles. Group fixes by patch to reduce effort.
27

What is the difference between TCP and UDP from a security point of view?

Network SecurityEasy
Save to ▾
Show answer
TCP is connection oriented with a three-way handshake, which makes it reliable but open to SYN flood attacks. UDP is connectionless, so it is easy to spoof source addresses and is abused in amplification attacks using DNS, NTP or memcached. Firewalls track TCP state easily, while UDP state is inferred from timeouts. Security monitoring must cover both, since DNS tunnelling uses UDP 53.
28

What is a firewall and what types exist?

Network SecurityEasy
Save to ▾
Show answer
A firewall enforces rules on traffic between networks. Packet-filtering firewalls check IP, port and protocol. Stateful firewalls track connections and allow return traffic automatically. Next-generation firewalls add application awareness, user identity, TLS inspection, IPS and URL filtering. Web application firewalls protect HTTP applications from attacks such as SQL injection. Host firewalls like Windows Defender Firewall or nftables protect individual machines.
29

What is the difference between IDS and IPS?

Network SecurityEasy
Save to ▾
Show answer
An Intrusion Detection System monitors traffic or hosts and raises alerts but does not block. An Intrusion Prevention System sits inline and can drop malicious packets in real time. IDS is safer for tuning because false positives do not break traffic, while IPS gives active protection. Detection can be signature based, as in Snort and Suricata rules, or anomaly based using baselines of normal behaviour.
30

What is a DMZ?

Network SecurityEasy
Save to ▾
Show answer
A DMZ, or perimeter network, is a separate zone between the internet and the internal network for public-facing services like web servers, mail relays and reverse proxies. Firewall rules allow internet traffic only to DMZ hosts and allow DMZ hosts only limited, specific connections inward. If a DMZ server is compromised, the attacker still faces another firewall layer before reaching internal systems.
31

How do you scan your own network for open ports with Nmap, with permission?

Network SecurityEasy
Save to ▾
Show answer
Only scan networks you own or have written approval for. Start with host discovery, then service and version detection on key ports. nmap -sn 10.10.0.0/24 nmap -sV -T3 -p 1-1000 10.10.0.15 nmap -sV --top-ports 100 -oA scan_results 10.10.0.0/24 Compare results with the approved service list and raise tickets for unexpected open ports.
32

What is network segmentation and why is it important?

Network SecurityMedium
Save to ▾
Show answer
Segmentation splits a network into zones such as user, server, OT, guest and management, with controlled traffic between them using VLANs, firewalls and ACLs. It limits lateral movement, so ransomware on one laptop cannot reach every server. It also reduces compliance scope, for example isolating the cardholder data environment for PCI DSS. Micro-segmentation goes further with per-workload policies in data centres and cloud.
33

How does a VPN protect traffic and what are its limits?

Network SecurityMedium
Save to ▾
Show answer
A VPN creates an encrypted tunnel, using IPsec, WireGuard or TLS, between a client and a network, protecting data on untrusted networks. Its limits are important: once connected, users often get broad network access, and VPN appliances are a frequent target for exploited vulnerabilities. That is why many companies move to Zero Trust Network Access, which grants per-application access after identity and device checks.
34

Your SOC sees heavy DNS traffic with long random subdomains from one workstation. Which DNS attacks should you consider and what defences apply?

Network SecurityMedium
Save to ▾
Show answer
Key DNS attacks are cache poisoning, which inserts false records; DNS tunnelling, which hides data or command traffic inside queries; domain hijacking through registrar account takeover; and DNS amplification DDoS. Defences include DNSSEC to sign records, protective DNS resolvers that block malicious domains, monitoring for long or high-entropy subdomains, registrar lock with MFA, and rate limiting open resolvers.
35

A user on the office LAN reports repeated certificate warnings and you suspect ARP spoofing. What is happening and how do you stop it?

Network SecurityMedium
Save to ▾
Show answer
ARP has no authentication, so an attacker on the same LAN can send fake ARP replies linking their MAC address to the gateway's IP. Victims then send traffic through the attacker, enabling man-in-the-middle interception. Defences include Dynamic ARP Inspection with DHCP snooping on switches, port security, network access control, and encrypting traffic end to end with TLS so intercepted data is useless.
36

What is a DDoS attack and how is it mitigated?

Network SecurityMedium
Save to ▾
Show answer
A Distributed Denial of Service attack floods a target from many sources to exhaust bandwidth, connection tables or application resources. Types are volumetric floods, protocol attacks like SYN floods, and application layer floods hitting costly pages. Mitigation uses upstream scrubbing services or CDN providers, anycast networks, rate limiting, SYN cookies, autoscaling, and a tested runbook agreed with the ISP before an attack.
37

What is TLS and what does the handshake achieve?

Network SecurityMedium
Save to ▾
Show answer
TLS secures data in transit. In the TLS 1.3 handshake the client and server agree on cipher suites, perform an ephemeral key exchange such as X25519 for forward secrecy, and the server proves its identity with a certificate signed by a trusted CA. Both derive session keys, then traffic is encrypted with an AEAD cipher like AES-GCM. TLS 1.0 and 1.1 are deprecated and should be disabled.
38

What is Network Access Control?

Network SecurityMedium
Save to ▾
Show answer
NAC checks devices and users before allowing them on the network, typically using 802.1X with a RADIUS server. It can verify certificates, patch level, EDR presence and user identity, then assign a VLAN or policy. Unknown or non-compliant devices go to a quarantine or guest network. NAC is important in offices with many personal devices and IoT equipment such as printers and cameras.
39

How do you handle a network team that refuses a security change you recommended?

Network SecurityMedium
Save to ▾
Show answer
Situation: the network team rejected my request to block outbound SMB at the firewall, fearing outages. Task: reduce the risk without damaging the relationship. Action: I shared flow data showing only two servers needed it, proposed an allowlist for them and a one-week monitor-only phase. Result: the team agreed, the rule went live with zero incidents, and we now review rules together monthly.
40

Your IDS alerts on outbound traffic from a database server to an unknown IP on port 443 at 3 AM. How do you investigate?

Network SecurityMedium
Save to ▾
Show answer
Database servers rarely need internet access, so this is suspicious. I would check the destination's reputation and WHOIS, look at flow data for volume and duration, and identify the process making the connection using EDR. Then I review recent logins, scheduled tasks and new binaries on the server. If data volume is large or the process is unknown, I contain the host and escalate as a possible exfiltration.
41

Users complain that a new firewall rule broke an application. How do you troubleshoot?

Network SecurityMedium
Save to ▾
Show answer
First check the firewall logs for denied traffic from the affected users or servers around the change time. Compare the change ticket with actual app requirements, since apps often use extra ports or dependencies. Use packet capture or a test connection to confirm. Then add a narrow rule for the real need, not an any-any rule, and update documentation so the next change does not repeat the problem.
42

A firewall audit finds 40 percent of rules have not been hit in a year. What do you do?

Network SecurityMedium
Save to ▾
Show answer
Unused rules expand attack surface and slow audits. I would export rule hit counts, confirm no seasonal apps like year-end batch jobs depend on them, and contact rule owners listed in tickets. Rules with no owner are disabled first, not deleted, and monitored for a month. After that they are removed. I would also add rule expiry dates and quarterly reviews to the change process.
43

A guest Wi-Fi user can reach internal printers. What is wrong and how do you fix it?

Network SecurityMedium
Save to ▾
Show answer
Guest traffic is not properly isolated, likely because the guest SSID shares a VLAN with internal devices or the firewall allows inter-VLAN routing. Fix by placing guests on a separate VLAN with internet-only access, applying ACLs that deny all RFC 1918 internal ranges, and enabling client isolation on the wireless controller. Then test from a guest device and document the design.
44

How would you capture and analyse suspicious traffic using tcpdump and Wireshark?

Network SecurityMedium
Save to ▾
Show answer
Capture on the right interface with a filter to limit size, save to a pcap file, then open it in Wireshark. sudo tcpdump -i eth0 host 10.10.0.15 and port 53 -w dns.pcap In Wireshark, use display filters such as dns, http.request or tls.handshake.type == 1, and Statistics > Conversations to spot top talkers. Protect pcaps because they may contain sensitive data.
45

How do you write basic Linux host firewall rules with nftables?

Network SecurityMedium
Save to ▾
Show answer
Default deny inbound, allow established traffic, loopback and only required services. nft add table inet filter nft add chain inet filter input '{ type filter hook input priority 0; policy drop; }' nft add rule inet filter input ct state established,related accept nft add rule inet filter input iif lo accept nft add rule inet filter input tcp dport 22 ip saddr 10.10.1.0/24 accept nft add rule inet filter input tcp dport 443 accept Save the ruleset so it persists after reboot.
46

How do you check a server's TLS configuration?

Network SecurityMedium
Save to ▾
Show answer
Check supported protocol versions, ciphers and certificate details. OpenSSL gives a quick view, and tools like testssl.sh give a full report. openssl s_client -connect example.com:443 -tls1_2 openssl s_client -connect example.com:443 -servername example.com | openssl x509 -noout -dates -issuer ./testssl.sh example.com Disable TLS 1.0 and 1.1, weak ciphers like RC4 and 3DES, and fix expiring certificates.
47

Describe a time you handled a stressful outage or security issue.

Network SecurityMedium
Save to ▾
Show answer
Situation: during my internship the office internet went down during a client demo because of a broadcast storm. Task: restore service quickly. Action: I checked switch logs, found a looped cable creating a loop, removed it, and then enabled spanning tree and storm control with my senior. Result: service returned in 20 minutes, and I wrote a short runbook so the team could resolve similar issues faster.
48

What is SASE?

Network SecurityHard
Save to ▾
Show answer
Secure Access Service Edge combines networking, such as SD-WAN, with cloud-delivered security services: secure web gateway, CASB, ZTNA and firewall as a service. Users connect to the nearest provider point of presence, and policy follows them anywhere. It suits Indian companies with many branches and hybrid workers because traffic no longer has to backhaul to a head office data centre. Vendor lock-in and migration effort are the trade-offs.
49

Your servers can reach any internet destination freely. Why is this a problem and how do you introduce egress filtering?

Network SecurityHard
Save to ▾
Show answer
Egress filtering controls outbound traffic, allowing only needed destinations and ports. It blocks malware call-backs, data exfiltration and servers reaching the internet directly. Many networks allow all outbound traffic because it is easier and legacy apps have undocumented dependencies. A practical approach is forcing web traffic through a proxy, blocking direct outbound from servers, and allowing exceptions only with business justification.
50

Your company website is under an application layer DDoS attack. What actions do you take?

Network SecurityHard
Save to ▾
Show answer
Confirm it is an attack and not a traffic spike by checking request patterns, user agents and source spread. Enable or tighten the CDN or WAF bot protection and rate limits on targeted URLs, add challenge pages for suspicious clients, and cache heavy pages. Inform the ISP or DDoS provider and management. After the attack, review logs, tune rules and update the runbook.
51

Management wants to replace the VPN with Zero Trust access. How would you plan it?

Network SecurityHard
Save to ▾
Show answer
I would start by inventorying applications and who uses them, then pick a low-risk app group for a pilot with an identity-aware proxy or ZTNA service. Integrate it with the identity provider, enforce MFA and device posture checks, and monitor access logs. Expand app by app, keep the VPN for legacy needs during transition, and retire it once every app is covered and tested.
52

What is PKI?

Cryptography and PKIEasy
Save to ▾
Show answer
Public Key Infrastructure is the system of certificate authorities, certificates, policies and revocation services that binds public keys to identities. A CA signs a certificate saying this public key belongs to this domain or user. Browsers and operating systems trust a set of root CAs, which sign intermediate CAs, which sign end-entity certificates. Enterprises run internal PKI for device certificates, VPN, Wi-Fi 802.1X and code signing.
53

What is a digital signature and how does it work?

Cryptography and PKIEasy
Save to ▾
Show answer
A digital signature proves who created data and that it has not changed. The signer hashes the data and signs the hash with their private key using algorithms like RSA-PSS, ECDSA or Ed25519. Anyone with the public key can verify it. Signatures give integrity, authentication and non-repudiation, and are used in software updates, TLS certificates, e-sign documents and signed emails.
54

What is a salt and why is it used in password hashing?

Cryptography and PKIEasy
Save to ▾
Show answer
A salt is a unique random value stored with each password hash. It makes identical passwords produce different hashes, so precomputed rainbow tables are useless and attackers must crack each hash separately. Salts are not secret. A pepper is an additional secret kept outside the database. Combined with slow algorithms like Argon2id, bcrypt or scrypt, salting makes offline cracking much more expensive.
55

What is the difference between encoding, encryption and obfuscation?

Cryptography and PKIEasy
Save to ▾
Show answer
Encoding, like Base64 or URL encoding, changes data format for transport and is reversible by anyone, so it gives no security. Encryption makes data unreadable without a key. Obfuscation makes code or data harder to understand but does not use a secret key, so a determined analyst can reverse it. A common mistake is treating Base64 credentials in config files as protected.
56

A developer wants to write their own encryption algorithm for customer data. How do you respond?

Cryptography and PKIEasy
Save to ▾
Show answer
I would advise against it. Custom cryptography almost always has flaws that experts would find, and it fails audits. Instead, use well-reviewed libraries such as libsodium, platform crypto APIs, or the cloud KMS with AES-GCM and envelope encryption. I would offer to help choose the right library and key management design, and include a security review in the feature's pull request.
57

How do you inspect a certificate and check its chain?

Cryptography and PKIEasy
Save to ▾
Show answer
Use OpenSSL to view the fields and verify the chain against the CA bundle. openssl x509 -in cert.pem -noout -subject -issuer -dates -ext subjectAltName openssl verify -CAfile chain.pem cert.pem openssl s_client -connect portal.example.in:443 -showcerts Check the SAN matches the hostname, the dates are valid, and the server sends intermediate certificates.
58

How do you encrypt and decrypt a file using GPG?

Cryptography and PKIEasy
Save to ▾
Show answer
For sharing, use the recipient's public key; for personal storage, use symmetric mode with a strong passphrase. gpg --encrypt --recipient analyst@example.in report.pdf gpg --output report.pdf --decrypt report.pdf.gpg gpg --symmetric --cipher-algo AES256 backup.tar Verify the recipient key fingerprint out of band before trusting it.
59

Tell me about a time you learned a difficult technical topic quickly.

Cryptography and PKIEasy
Save to ▾
Show answer
Situation: in my final year project I needed TLS mutual authentication for an IoT prototype within two weeks. Task: understand PKI enough to build it. Action: I read the TLS 1.3 overview, set up a small CA with OpenSSL, issued device certificates and tested failures deliberately. Result: the demo worked, and I documented the steps so classmates could reuse them, which helped our team score well.
60

Describe a time you had to admit you did not know something in a technical discussion.

Cryptography and PKIEasy
Save to ▾
Show answer
Situation: in a design review, an architect asked me whether our VPN supported post-quantum key exchange. Task: give an accurate answer. Action: I said I did not know rather than guessing, checked the vendor documentation and release notes that afternoon and shared a short summary with options. Result: the team trusted my answers more, and the finding was added to our cryptography roadmap.
61

What is forward secrecy?

Cryptography and PKIMedium
Save to ▾
Show answer
Forward secrecy means that if a server's long-term private key is stolen later, previously recorded sessions still cannot be decrypted. It is achieved with ephemeral key exchange, such as ECDHE, where a new key pair is created for each session and discarded. TLS 1.3 makes forward secrecy mandatory by removing static RSA key exchange, which is one reason older TLS configurations are considered weak.
62

What is certificate revocation and how is it checked?

Cryptography and PKIMedium
Save to ▾
Show answer
Revocation invalidates a certificate before expiry, for example when its private key leaks. Methods are CRLs, which are signed lists of revoked serial numbers, and OCSP, where the client asks a responder about one certificate. OCSP stapling lets the server attach a fresh response to the handshake. Because revocation checking is unreliable, the industry is moving to much shorter certificate lifetimes, which reduces exposure.
63

What is a man-in-the-middle attack on TLS and how do certificates prevent it?

Cryptography and PKIMedium
Save to ▾
Show answer
In a MITM attack, an attacker intercepts traffic and pretends to be the server. Certificates prevent this because the client checks that the server certificate chains to a trusted root, matches the hostname and is valid. An attacker cannot produce a valid certificate without the private key or a compromised CA. Certificate warnings that users click through, and apps that skip validation, break this protection.
64

A TLS certificate expired on the main customer portal and caused an outage. How do you prevent this in future?

Cryptography and PKIMedium
Save to ▾
Show answer
First renew and deploy the certificate to restore service. For prevention, build a certificate inventory from scanning and CT logs, automate issuance and renewal with ACME where possible, and set alerts at 30, 14 and 7 days before expiry to a team mailbox, not an individual. Assign an owner per certificate and add expiry checks to monitoring dashboards, since shorter lifetimes are coming.
65

How do you create a private key and CSR with OpenSSL?

Cryptography and PKIMedium
Save to ▾
Show answer
Generate a key, then a certificate signing request to send to a CA. openssl ecparam -genkey -name prime256v1 -out server.key openssl req -new -key server.key -out server.csr \ -subj "/CN=portal.example.in" \ -addext "subjectAltName=DNS:portal.example.in" openssl req -in server.csr -noout -text Keep server.key private with restricted file permissions.
66

How would you hash passwords correctly in Python?

Cryptography and PKIMedium
Save to ▾
Show answer
Use a dedicated password hashing library with Argon2id, which handles salts and parameters automatically. from argon2 import PasswordHasher ph = PasswordHasher() stored = ph.hash(password) try: ph.verify(stored, attempt) if ph.check_needs_rehash(stored): stored = ph.hash(attempt) except Exception: deny_login() Never use plain SHA-256 or MD5 for passwords.
67

Why is AES-GCM preferred over AES-CBC?

Cryptography and PKIHard
Save to ▾
Show answer
AES-GCM is an authenticated encryption mode, so it gives confidentiality and integrity together, detecting any tampering through its authentication tag. AES-CBC gives only confidentiality and needs a separate MAC; mistakes in combining them caused padding oracle attacks. GCM is also fast with hardware support. Its main rule is never reusing a nonce with the same key, because reuse breaks both confidentiality and integrity.
68

What is the role of a Hardware Security Module?

Cryptography and PKIHard
Save to ▾
Show answer
An HSM is tamper-resistant hardware that generates, stores and uses cryptographic keys without exposing them. Keys never leave the device in plain form. Banks and payment processors use HSMs for PIN processing, card keys and signing, and CAs protect root keys with them. Cloud offerings include managed HSM and KMS services. HSMs are often required for compliance standards such as PCI DSS and certified to FIPS 140-3.
69

What is key management and why is it hard?

Cryptography and PKIHard
Save to ▾
Show answer
Key management covers generating, distributing, storing, rotating, backing up and destroying keys. It is hard because strong encryption is useless if keys sit in code, config files or shared drives. Good practice is a central KMS or vault, envelope encryption with data keys wrapped by master keys, automatic rotation, strict IAM on key usage and logging every decrypt call. Losing keys can also mean losing data permanently.
70

Your CISO asks whether the company needs to act on quantum computing risk now. What do you advise?

Cryptography and PKIHard
Save to ▾
Show answer
Large quantum computers could break RSA and elliptic curve cryptography using Shor's algorithm. NIST published post-quantum standards in 2024: ML-KEM for key exchange, and ML-DSA and SLH-DSA for signatures. Attackers can harvest encrypted traffic now and decrypt it later, so long-lived sensitive data is at risk. Organisations should inventory cryptography, prefer crypto agility, and test hybrid key exchange that browsers already support.
71

What is Certificate Transparency?

Cryptography and PKIHard
Save to ▾
Show answer
Certificate Transparency requires publicly trusted CAs to log every issued certificate in public append-only logs. Browsers require proof of logging before trusting a certificate. Domain owners can monitor these logs to detect certificates issued for their domains without permission, for example by a compromised CA or a phishing actor. Security teams also use CT logs for subdomain discovery and asset inventory.
72

You find an application storing user passwords as unsalted MD5. What do you recommend?

Cryptography and PKIHard
Save to ▾
Show answer
MD5 is fast and broken, so these hashes can be cracked quickly if leaked. Recommend Argon2id or bcrypt with proper cost settings. To migrate without forcing resets, wrap existing hashes: compute Argon2id over the MD5 value now, and on next login replace it with a direct Argon2id hash of the password. Also check whether the database was ever exposed, and enforce MFA.
73

A private key for an internal code-signing certificate was found on a shared drive. What actions do you take?

Cryptography and PKIHard
Save to ▾
Show answer
Treat it as compromised. Revoke the certificate with the CA, issue a new one with the key generated and stored in an HSM or cloud key service, and restrict signing to the build pipeline. Search for any binaries signed with the old key after the exposure time and investigate them. Remove the file, check drive access logs to see who opened it, and update the key handling policy.
74

How do you build a cryptography inventory for an organisation?

Cryptography and PKIHard
Save to ▾
Show answer
Combine several sources: scan network services for TLS versions, ciphers and certificate keys; query CT logs and internal PKI for issued certificates; use code scanning to find crypto library calls and hardcoded keys; and export KMS and HSM key lists. Record algorithm, key length, owner, data sensitivity and expiry. This inventory supports compliance, certificate renewals and planning the post-quantum migration.
75

How would you set up envelope encryption for application data in the cloud?

Cryptography and PKIHard
Save to ▾
Show answer
Create a customer managed key in the cloud KMS with strict IAM so only the app role can use it. The app asks KMS for a data key, encrypts records locally with AES-GCM using the plaintext data key, stores the encrypted data key next to the data, and discards the plaintext key. To decrypt, it sends the encrypted data key to KMS. Enable key rotation and audit logging.
76

What is a Security Operations Center?

SOC Operations and SIEMEasy
Save to ▾
Show answer
A SOC is the team, processes and technology that monitor an organisation's environment around the clock, detect threats, triage alerts and coordinate response. Tier 1 analysts triage alerts, Tier 2 investigate and contain, and Tier 3 or threat hunters handle complex cases and build detections. A SOC can be in-house, outsourced to an MSSP or hybrid. Many Indian IT firms run global SOCs for international clients.
77

What is a SIEM and what does it do?

SOC Operations and SIEMEasy
Save to ▾
Show answer
A Security Information and Event Management platform collects logs from firewalls, endpoints, servers, cloud and applications, normalises them, stores them for search and correlates events to raise alerts. Examples are Splunk, Microsoft Sentinel, IBM QRadar, Elastic Security and Google Security Operations. A SIEM supports detection, investigation, dashboards and compliance reporting. Its value depends on good log sources, parsing and tuned rules.
78

What is the difference between a SIEM and a SOAR?

SOC Operations and SIEMEasy
Save to ▾
Show answer
A SIEM collects and correlates logs to detect threats. SOAR, Security Orchestration, Automation and Response, takes alerts and runs playbooks that enrich, decide and act, for example looking up an IP's reputation, querying EDR, disabling a user and opening a ticket. SIEM answers what is happening; SOAR speeds up the response. Many platforms now combine both, but automation still needs human approval for disruptive actions.
79

What is EDR and how is it different from antivirus?

SOC Operations and SIEMEasy
Save to ▾
Show answer
Endpoint Detection and Response records detailed endpoint activity, like process creation, command lines, network connections and registry changes, and detects suspicious behaviour, not just known files. Analysts can investigate a process tree, isolate a host and remove malware remotely. Traditional antivirus mainly blocks known signatures. XDR extends EDR by correlating endpoint, email, identity and cloud signals in one platform.
80

What is a false positive and a false negative in SOC alerts?

SOC Operations and SIEMEasy
Save to ▾
Show answer
A false positive is an alert on benign activity, such as an admin running a legitimate script flagged as malicious. A false negative is a real attack that produced no alert, which is more dangerous. Too many false positives cause alert fatigue and missed real incidents. Analysts tune rules with allowlists, thresholds and context, and test detections against simulated attacks to find false negatives.
81

How do you analyse a suspicious email reported by a user?

SOC Operations and SIEMEasy
Save to ▾
Show answer
Get the original email with full headers. Check SPF, DKIM and DMARC results, the real sender and Reply-To, and the received path. Extract URLs and attachments without clicking, check them in a sandbox and reputation services, and compare the sender domain for lookalikes. If malicious, search for the same message across mailboxes, purge it, block indicators and check whether anyone clicked or entered credentials.
82

How would you build a basic home SOC lab?

SOC Operations and SIEMEasy
Save to ▾
Show answer
Use a laptop with virtualisation, run a Windows VM with Sysmon, a Linux server and a free SIEM such as Elastic or Splunk Free, or Wazuh as an open source option. Forward logs, then simulate attacks safely with Atomic Red Team tests on your own VMs. Write detections for each test, document them on GitHub and explain them in interviews.
83

How do you handle night shifts and rotating schedules in a SOC?

SOC Operations and SIEMEasy
Save to ▾
Show answer
A good answer shows realism and discipline. For example: I understand SOCs run 24x7 and night shifts are common early in a career. I keep a fixed sleep routine, prepare handover notes carefully and read previous shift notes before starting. During quiet hours I study detections or practise queries. I communicate early if a schedule conflict arises so the team can plan cover.
84

Which Windows event IDs should a SOC analyst know?

SOC Operations and SIEMMedium
Save to ▾
Show answer
Key Security log events are 4624 successful logon, 4625 failed logon, 4672 special privileges assigned, 4688 process creation, 4720 user created, 4728 and 4732 user added to privileged groups, 4740 account lockout, 1102 audit log cleared, 4698 scheduled task created and 7045 service installed in the System log. Logon type in 4624, such as 3 for network and 10 for RDP, adds important context.
85

How would you use Sysmon to improve endpoint visibility on Windows?

SOC Operations and SIEMMedium
Save to ▾
Show answer
Sysmon is a free Microsoft Sysinternals tool that logs detailed endpoint events to the Windows event log. Useful events are ID 1 process creation with hashes and command line, ID 3 network connection, ID 11 file creation, ID 13 registry changes and ID 22 DNS queries. With a tuned configuration, it gives rich telemetry for SIEM detections when a full EDR is not available or as an extra source.
86

What is threat intelligence and what are IOCs and TTPs?

SOC Operations and SIEMMedium
Save to ▾
Show answer
Threat intelligence is analysed information about adversaries, their tools and behaviour. Indicators of Compromise are artefacts like malicious IPs, domains and file hashes; they are easy to use but change quickly. TTPs, tactics, techniques and procedures, describe how attackers operate, and are harder for attackers to change. The Pyramid of Pain shows that detecting TTPs causes attackers more cost than blocking hashes.
87

What is threat hunting?

SOC Operations and SIEMMedium
Save to ▾
Show answer
Threat hunting is proactive searching for attackers who evaded existing detections. Hunters start from a hypothesis, for example that attackers use scheduled tasks for persistence, then query EDR and SIEM data to confirm or reject it. Findings become new detection rules. Hunting requires good data retention, knowledge of normal behaviour and frameworks like MITRE ATT&CK to guide hypotheses.
88

What SOC metrics matter most?

SOC Operations and SIEMMedium
Save to ▾
Show answer
Important metrics are mean time to detect, mean time to respond, alert volume per analyst, false positive rate per rule, percentage of alerts closed within SLA, detection coverage against priority ATT&CK techniques and log source health. Metrics should drive improvement, not punish analysts. For example, a rule with 95 percent false positives should be tuned, and long response times may point to missing automation.
89

What is UEBA?

SOC Operations and SIEMMedium
Save to ▾
Show answer
User and Entity Behaviour Analytics builds baselines of normal behaviour for users, hosts and service accounts, then flags anomalies such as logging in from a new country, accessing far more files than usual or a service account doing interactive logins. It helps detect insider threats and stolen credentials that look like normal logins. It needs good identity data and careful tuning to avoid noisy alerts.
90

You receive an alert for 300 failed logins on one account followed by a success. How do you triage it?

SOC Operations and SIEMMedium
Save to ▾
Show answer
This pattern suggests brute force or password spraying that succeeded. Check source IPs, location and logon type, and whether MFA was used for the success. Review what the account did after login, such as mailbox rules, file access or new tokens. If suspicious, disable the account or revoke sessions, reset the password, block source IPs and check whether the same IPs targeted other accounts.
91

An alert shows Microsoft Word spawning PowerShell with an encoded command. What does it mean and what do you do?

SOC Operations and SIEMMedium
Save to ▾
Show answer
Office apps rarely start PowerShell, so this usually means a malicious macro or document exploit. Decode the Base64 command to see what it does, check the process tree and any network connections for downloads, and find the source email. Isolate the host through EDR, block the sender and URLs, search for the same email in other mailboxes and hunt for the same command line elsewhere.
92

During triage you notice a user logged in from Mumbai and then from Frankfurt 20 minutes later. How do you handle it?

SOC Operations and SIEMMedium
Save to ▾
Show answer
This is an impossible travel alert. First rule out benign causes like corporate VPN, cloud proxy egress or mobile networks. Check device IDs, user agents and MFA results for both logins. If the second login is from an unknown device without MFA, or followed by mailbox rule creation or data download, revoke sessions, reset credentials, review MFA methods and contact the user through a separate channel.
93

A key log source stopped sending data to the SIEM two days ago. Why does it matter and what do you do?

SOC Operations and SIEMMedium
Save to ▾
Show answer
Silent log gaps create blind spots where attacks go undetected, and they can also break compliance. Raise it as a priority issue, check the forwarder or agent health, network path, licence limits and parsing errors, and restore ingestion. Check whether the gap overlapped any suspicious activity. Then add log source health monitoring that alerts when expected volume drops, so gaps are found in hours, not days.
94

How do you write a Splunk search to find brute-force attempts on Windows?

SOC Operations and SIEMMedium
Save to ▾
Show answer
Search failed logon events, count per account and source, and filter high counts. index=wineventlog EventCode=4625 | stats count AS failures dc(TargetUserName) AS users BY IpAddress | where failures > 50 | sort - failures A high distinct user count from one IP points to password spraying rather than a single account brute force.
95

How do you onboard a new log source into a SIEM properly?

SOC Operations and SIEMMedium
Save to ▾
Show answer
Define why the source is needed and which detections it supports. Configure collection through an agent, syslog or API, verify time sync and time zone, and ensure parsing maps fields to the SIEM's data model. Check volume and licence impact, set retention, and test with sample events. Finally build or enable detections and add health monitoring so the team knows if it stops.
96

Tell me about a time you made a mistake at work and how you handled it.

SOC Operations and SIEMMedium
Save to ▾
Show answer
Situation: as a Tier 1 analyst I closed an alert as false positive without checking the user's later activity. Task: my lead found it was a real phishing compromise. Action: I owned the mistake, helped contain it, and proposed a checklist for credential alerts that includes reviewing activity after login. Result: the checklist was adopted by the shift and similar misses stopped.
97

What is detection engineering?

SOC Operations and SIEMHard
Save to ▾
Show answer
Detection engineering treats detections like software: rules are written from threat models and ATT&CK techniques, stored in version control, tested with attack simulations, peer reviewed and measured for false positive rate. Formats like Sigma let rules be shared across SIEMs. Teams track coverage, tune noisy rules and retire obsolete ones. This replaces ad hoc rule creation that leads to noisy, untested alerts.
98

Your SOC receives 4000 alerts a day and analysts are overwhelmed. How do you fix this?

SOC Operations and SIEMHard
Save to ▾
Show answer
Analyse alert data to find the top noisy rules, which usually create most of the volume. Tune them with context and allowlists, or turn low-value ones into dashboards. Add enrichment and automated closure for known benign patterns using SOAR, group related alerts into incidents and add risk-based alerting that scores entities. Track false positive rate per rule weekly and require testing for new rules.
99

Write a KQL query in Microsoft Sentinel to find sign-ins from many countries for one user.

SOC Operations and SIEMHard
Save to ▾
Show answer
Use SigninLogs, summarise distinct countries per user over a day and flag outliers. SigninLogs | where TimeGenerated > ago(1d) | where ResultType == 0 | summarize Countries = dcount(Location), List = make_set(Location) by UserPrincipalName | where Countries > 2 | order by Countries desc Review results with known travel and VPN egress points before escalating.
100

What does a Sigma rule look like?

SOC Operations and SIEMHard
Save to ▾
Show answer
Sigma is a generic YAML detection format that converts to SIEM queries. title: Office Spawning PowerShell logsource: product: windows category: process_creation detection: selection: ParentImage|endswith: ['\winword.exe', '\excel.exe'] Image|endswith: '\powershell.exe' condition: selection level: high tags: [attack.execution, attack.t1059.001]
101

What are the phases of incident response?

Incident Response and ForensicsEasy
Save to ▾
Show answer
NIST SP 800-61 describes preparation; detection and analysis; containment, eradication and recovery; and post-incident activity. The 2025 revision aligns these with the NIST CSF 2.0 functions of Govern, Identify, Protect, Detect, Respond and Recover. Preparation includes playbooks, contacts and tools. Containment limits spread, eradication removes the attacker, recovery restores operations, and lessons learned improve controls and detections.
102

What is the difference between an event, an alert and an incident?

Incident Response and ForensicsEasy
Save to ▾
Show answer
An event is any observable occurrence, like a login or a file change. An alert is an event or pattern that a tool flags as possibly malicious. An incident is a confirmed or highly likely violation of security policy that needs response, such as a compromised account. Clear definitions matter because incidents trigger escalation, legal review and regulatory reporting timelines.
103

What is chain of custody in digital forensics?

Incident Response and ForensicsEasy
Save to ▾
Show answer
Chain of custody is the documented record of who collected evidence, when, how, where it was stored and every person who handled it. It proves evidence was not altered, which is essential if the case goes to court or regulators. Practices include hashing disk images at acquisition, using write blockers, storing evidence securely and logging every transfer with signatures and timestamps.
104

What should a post-incident review include?

Incident Response and ForensicsEasy
Save to ▾
Show answer
A blameless review covers the timeline, root cause, how the attacker got in, what detected it, what slowed response, business impact and decisions made. It ends with specific actions that have owners and dates, such as enabling MFA on all VPN users or adding a detection rule. Tracking these actions to completion matters more than the report itself, otherwise the same incident repeats.
105

What are India's CERT-In incident reporting requirements?

Incident Response and ForensicsMedium
Save to ▾
Show answer
Under the CERT-In directions issued in April 2022, service providers, intermediaries, data centres and body corporates must report specified cyber incidents to CERT-In within six hours of noticing them. They must also keep ICT system logs for 180 days within India and synchronise clocks with NTP servers of NIC or NPL. Reportable incidents include ransomware, data breaches, and attacks on servers and cloud systems.
106

What is the order of volatility in evidence collection?

Incident Response and ForensicsMedium
Save to ▾
Show answer
Collect the most volatile evidence first because it disappears quickly. The order is CPU registers and cache, memory including running processes and network connections, temporary files, disk, remote logs, and finally archived media. That is why responders capture RAM before shutting down a machine, since malware running only in memory, decrypted keys and active connections are lost at power off.
107

What are the main containment strategies?

Incident Response and ForensicsMedium
Save to ▾
Show answer
Short-term containment stops the spread quickly, for example isolating hosts through EDR, disabling accounts, blocking IPs or domains and segmenting networks. Long-term containment keeps business running while preparing clean systems, such as rebuilding servers in a separate network. Responders must balance speed with evidence preservation and avoid alerting a sophisticated attacker too early if they need to understand the full scope.
108

What is memory forensics and which tool is commonly used?

Incident Response and ForensicsMedium
Save to ▾
Show answer
Memory forensics analyses a RAM capture to find running processes, injected code, network connections, loaded DLLs, command history and encryption keys. It reveals fileless malware that leaves little on disk. Volatility 3 is the common open source framework, with plugins such as windows.pslist, windows.netscan and windows.malfind. Captures are taken with tools like WinPmem or through EDR live response.
109

What is the difference between static and dynamic malware analysis?

Incident Response and ForensicsMedium
Save to ▾
Show answer
Static analysis examines a sample without running it: hashes, strings, imports, PE headers, YARA rule matches and disassembly. Dynamic analysis runs it in an isolated sandbox to observe processes, file changes, registry edits and network calls. Static is safe and fast but defeated by packing; dynamic shows real behaviour but malware may detect sandboxes. Analysts usually combine both in a controlled lab.
110

What is a business email compromise attack?

Incident Response and ForensicsMedium
Save to ▾
Show answer
In BEC, attackers take over or impersonate an executive, vendor or finance mailbox to trick staff into making payments or changing bank details. It often uses no malware, just a compromised account, mailbox forwarding rules and convincing requests. Controls include MFA, DMARC enforcement, alerts on new inbox rules, and a mandatory call-back process on a known number for any change to payment details.
111

A finance employee transferred money after a fake email from the CEO. What do you do?

Incident Response and ForensicsMedium
Save to ▾
Show answer
Contact the bank immediately to try to stop or recall the transfer; speed matters most. Report to the cybercrime portal and police. Investigate the email: was the CEO mailbox compromised or spoofed? Check sign-in logs, forwarding rules and other targeted staff. Reset credentials, enforce MFA and DMARC, and add a call-back rule for payment changes. Include legal and management throughout.
112

An employee who is leaving copied large volumes of data to a personal cloud drive. How do you handle it?

Incident Response and ForensicsMedium
Save to ▾
Show answer
Treat it as a potential insider incident and involve HR and legal before contacting the employee. Preserve evidence such as DLP alerts, proxy logs, endpoint file activity and cloud app logs, and document what data was involved and its sensitivity. Restrict the user's access as advised. Legal decides on next steps, such as requesting deletion with an undertaking. Then improve DLP and offboarding controls.
113

How do you collect basic triage data from a suspected compromised Windows host?

Incident Response and ForensicsMedium
Save to ▾
Show answer
Collect volatile data first, ideally with EDR live response or a trusted triage tool. Useful built-in commands: tasklist /v netstat -ano schtasks /query /fo LIST /v wmic service get name,pathname,startmode reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run wevtutil epl Security C:\IR\security.evtx Save output to external media and hash every file.
114

How do you create a forensic disk image and verify it?

Incident Response and ForensicsMedium
Save to ▾
Show answer
Use a write blocker or a forensic tool, image the whole disk, and hash both source and image. sudo dc3dd if=/dev/sdb of=/evidence/case12.img hash=sha256 log=/evidence/case12.log sha256sum /evidence/case12.img Record the hashes, time, examiner and device details in the chain of custody form. Analyse a working copy, never the original.
115

How do you run a tabletop exercise?

Incident Response and ForensicsMedium
Save to ▾
Show answer
Pick a realistic scenario, such as ransomware on a weekend, and invite IT, security, legal, communications and business leaders. A facilitator releases injects step by step, like a ransom note appearing or a journalist calling, and participants explain decisions using the real plan. Record gaps in contacts, authority, backups and reporting timelines. Share findings and track fixes, and repeat at least twice a year.
116

Describe a time you worked under pressure during an incident.

Incident Response and ForensicsMedium
Save to ▾
Show answer
Situation: during a phishing campaign, 40 users received a credential-harvesting email on a Friday evening. Task: contain it before attackers used stolen accounts. Action: I purged the email across mailboxes, identified six users who clicked, reset their passwords, revoked sessions and blocked the domain, while updating my lead every 30 minutes. Result: no account misuse was found and the playbook was updated.
117

How do you communicate technical incident details to senior management?

Incident Response and ForensicsMedium
Save to ▾
Show answer
I lead with business impact: what is affected, current status, risk to customers or data, and decisions needed from them. Technical details go in an appendix. For example, in a past incident I gave updates every two hours in a fixed format: what we know, what we are doing, what we need, next update time. This kept leaders calm and decisions quick.
118

Tell me about a time you followed process even though a shortcut was tempting.

Incident Response and ForensicsHard
Save to ▾
Show answer
Situation: during a suspected malware case, a senior engineer wanted to wipe the laptop immediately to save time. Task: contain the threat while preserving evidence. Action: I explained that we needed a memory capture and EDR timeline first, which would take 20 minutes, and isolated the laptop meanwhile. Result: the capture revealed stolen browser credentials, so we reset them before they were misused.
119

During a major breach, an engineer asks why legal and communications must join the war room. How do you explain?

Incident Response and ForensicsHard
Save to ▾
Show answer
Legal advises on regulatory notification, such as CERT-In within six hours and the Data Protection Board and affected people under the DPDP Act, contractual duties to clients, evidence handling and privilege. Communications manage messaging to customers, staff, media and investors so statements are accurate and consistent. Technical teams should involve them early, because poor communication can cause more damage than the incident itself.
120

A ransomware attack has encrypted 50 servers. Walk through your response.

Incident Response and ForensicsHard
Save to ▾
Show answer
Activate the incident plan and set up a war room with a separate communication channel. Contain by isolating affected segments, disabling compromised accounts, and blocking known command and control. Preserve evidence from a few hosts. Identify initial access and scope, including data theft. Verify offline backups, rebuild from clean images, and restore by business priority. Report to CERT-In within six hours and involve legal before any ransom discussion.
121

You find a web shell on a public web server. What steps do you take?

Incident Response and ForensicsHard
Save to ▾
Show answer
Do not just delete it. Capture the file, web logs and a memory image if possible, then identify when it was created and which request uploaded it. Search logs for commands executed through it and lateral movement from the server. Contain by isolating the server or blocking the path at the WAF, then patch the vulnerable application, rebuild from a clean image and rotate any credentials stored on it.
122

Your EDR shows the same suspicious hash on 30 machines. How do you scope the incident?

Incident Response and ForensicsHard
Save to ▾
Show answer
Search the hash, file name and parent process across all endpoints, and look for related indicators like network destinations and persistence mechanisms. Build a timeline to find patient zero and the delivery method, for example an email attachment or a compromised software update. Group affected hosts by criticality, isolate them, and check whether any credentials were stolen to plan resets broadly.
123

A cloud access key was leaked and used to start crypto-mining instances. What is your response?

Incident Response and ForensicsHard
Save to ▾
Show answer
Deactivate the key immediately and check who owns it. Review cloud audit logs for every action taken with it, such as new instances, users, roles or policy changes, because attackers often create persistence. Terminate unauthorised resources, delete created users and keys, and check billing impact. Then find how it leaked, move workloads to roles with short-lived credentials and enable budget and anomaly alerts.
124

How do you analyse a memory dump with Volatility 3?

Incident Response and ForensicsHard
Save to ▾
Show answer
Run plugins to list processes, network connections and injected code, then dig into suspicious items. vol -f mem.raw windows.info vol -f mem.raw windows.pstree vol -f mem.raw windows.netscan vol -f mem.raw windows.cmdline vol -f mem.raw windows.malfind Look for unusual parent-child processes, processes in odd paths and connections to unknown IPs.
125

What does a simple YARA rule look like?

Incident Response and ForensicsHard
Save to ▾
Show answer
YARA matches files or memory by strings and conditions, and is used for hunting and classifying malware. rule Suspicious_Invoice_Dropper { strings: $a = "invoice_payload" ascii $b = { 4D 5A 90 00 } $c = "powershell -enc" nocase condition: $b at 0 and ($a or $c) } Test rules against clean files to avoid false positives.
126

How would you build a forensic timeline of an incident?

Incident Response and ForensicsHard
Save to ▾
Show answer
Collect timestamps from many sources: Windows event logs, file system MFT records, prefetch, browser history, EDR telemetry, proxy, firewall and cloud logs. Normalise all of them to UTC, then merge them using tools like Plaso and Timeline Explorer. Mark key points such as initial access, privilege escalation, lateral movement and exfiltration. The timeline drives scoping, root cause and the incident report.
127

What is Identity and Access Management?

Identity and Access ManagementEasy
Save to ▾
Show answer
IAM is the set of processes and tools that manage digital identities and control their access to systems. It covers user provisioning and deprovisioning, authentication, authorisation, single sign-on, MFA, privileged access, access reviews and audit. Since most breaches involve stolen or misused credentials, IAM is a core security control. Common platforms include Microsoft Entra ID, Okta, Ping Identity and SailPoint for governance.
128

What is multi-factor authentication and which factors are strongest?

Identity and Access ManagementEasy
Save to ▾
Show answer
MFA requires two or more factor types: something you know like a password, something you have like a phone or security key, and something you are like a fingerprint. SMS OTPs are vulnerable to SIM swap and phishing, and push approvals to MFA fatigue. Phishing-resistant methods such as FIDO2 security keys, passkeys and certificate-based authentication are strongest because they are bound to the real site.
129

What is single sign-on and what protocols does it use?

Identity and Access ManagementEasy
Save to ▾
Show answer
SSO lets a user authenticate once with an identity provider and access many applications without separate passwords. SAML 2.0 uses signed XML assertions and is common for enterprise web apps. OpenID Connect, built on OAuth 2.0, uses JSON tokens and suits modern web and mobile apps. SSO reduces password reuse and helps central control, but makes the identity provider a high-value target that needs strong MFA.
130

A user's account shows sign-in risk high in your identity platform. What do you do?

Identity and Access ManagementEasy
Save to ▾
Show answer
Review the details: unfamiliar location, anonymous IP, leaked credentials or impossible travel. Check what happened after sign-in, such as MFA method registration, mailbox rules or data downloads. If compromise is likely, revoke sessions, reset the password, remove unknown MFA methods and contact the user out of band. Then confirm policies require MFA or block high-risk sign-ins automatically.
131

What are passkeys?

Identity and Access ManagementMedium
Save to ▾
Show answer
Passkeys are FIDO2 credentials that replace passwords. The device creates a key pair per website; the private key stays in the device or synced password manager, protected by biometrics or PIN, and the server stores only the public key. Login is a signature over a challenge tied to the real domain, so passkeys resist phishing and cannot be reused across sites. They also remove password reset load.
132

What is the difference between OAuth 2.0 and OpenID Connect?

Identity and Access ManagementMedium
Save to ▾
Show answer
OAuth 2.0 is an authorisation framework; it lets an app get an access token to call an API on a user's behalf, without the user's password. It does not define who the user is. OpenID Connect adds an identity layer with an ID token, a signed JWT containing user claims, and a userinfo endpoint. Use OIDC for login, and OAuth access tokens for API authorisation.
133

What is RBAC and ABAC?

Identity and Access ManagementMedium
Save to ▾
Show answer
Role-Based Access Control grants permissions to roles such as Finance Analyst, and users get roles; it is simple to manage and audit. Attribute-Based Access Control decides using attributes of the user, resource and context, such as department, data classification, location and time. ABAC is more flexible but harder to reason about. Many organisations use RBAC as the base and add attribute conditions for sensitive cases.
134

What is Privileged Access Management?

Identity and Access ManagementMedium
Save to ▾
Show answer
PAM protects powerful accounts like domain admins, root, database admins and cloud owners. It includes a vault for credentials with automatic rotation, just-in-time elevation, session brokering with recording, approval workflows and alerts on unusual use. Tools include CyberArk, BeyondTrust and Delinea. PAM is important because attackers aim for privileged credentials to move laterally and deploy ransomware across the network.
135

How would you design a joiner, mover, leaver process for a growing company?

Identity and Access ManagementMedium
Save to ▾
Show answer
JML is the identity lifecycle. Joiners get accounts and baseline access from HR data on day one. Movers change roles, and their old access must be removed, not just new access added, to avoid privilege creep. Leavers must be disabled promptly, ideally automatically when HR records their exit. Automating JML from the HR system to the identity platform reduces orphan accounts, which auditors frequently flag.
136

Describe a time you dealt with a user who was upset about losing access.

Identity and Access ManagementMedium
Save to ▾
Show answer
Situation: after an access review removed a sales manager's export rights, he escalated angrily before a client deadline. Task: solve his need while keeping the control. Action: I listened, explained why bulk exports were restricted, and arranged a time-bound approved export through his manager within an hour. Result: he met the deadline, and we added a documented request path for such cases.
137

What is conditional access?

Identity and Access ManagementMedium
Save to ▾
Show answer
Conditional access applies policies based on signals at sign-in, such as user, group, device compliance, location, application and risk score. For example, allow finance apps only from managed devices with MFA, block legacy authentication, and require a password change when sign-in risk is high. It is a key Zero Trust building block in platforms like Microsoft Entra ID. Policies need testing in report-only mode first.
138

Attackers bypassed MFA by sending repeated push notifications until a user approved. How do you prevent this?

Identity and Access ManagementMedium
Save to ▾
Show answer
This is MFA fatigue. Enable number matching and show app and location context in push requests, limit the number of prompts, and alert on repeated denials. Move high-risk users and admins to phishing-resistant methods such as FIDO2 keys or passkeys. Train users to report unexpected prompts. Also revoke the attacker's sessions and review what they accessed.
139

An audit finds 200 active accounts belonging to employees who left. How do you fix it?

Identity and Access ManagementMedium
Save to ▾
Show answer
Disable the accounts immediately after confirming with HR, then check each for recent logins, since any use after the exit date is a potential incident. Find the root cause, usually manual offboarding or apps not connected to SSO. Integrate the HR system with the identity platform for automatic disabling, connect apps to SSO and SCIM provisioning, and run monthly orphan account reports.
140

Developers share one admin account for a production database. What do you propose?

Identity and Access ManagementMedium
Save to ▾
Show answer
Shared accounts break accountability and are hard to rotate. Give each person an individual named account with least privilege, and provide admin access through PAM with just-in-time approval and session recording. Store the remaining break-glass credential in the vault with alerts on use. Use read-only roles for daily troubleshooting. Roll out with the team so it does not slow urgent fixes.
141

How do you find stale and privileged accounts in Active Directory with PowerShell?

Identity and Access ManagementMedium
Save to ▾
Show answer
Use the ActiveDirectory module. Search-ADAccount -AccountInactive -TimeSpan 90.00:00:00 -UsersOnly | Select Name, LastLogonDate Get-ADGroupMember 'Domain Admins' -Recursive | Select Name, SamAccountName Get-ADUser -Filter {PasswordNeverExpires -eq $true} | Select Name Review results with owners before disabling anything.
142

How do you decode and check a JWT during troubleshooting?

Identity and Access ManagementMedium
Save to ▾
Show answer
A JWT has header, payload and signature separated by dots. Decode the first two parts to read claims, but never trust them without verifying the signature. echo $TOKEN | cut -d. -f2 | base64 -d 2>/dev/null Check iss, aud, exp and nbf claims. In code, verify with a library using the expected algorithm and issuer keys, and reject alg none.
143

How would you roll out MFA to 5000 employees?

Identity and Access ManagementMedium
Save to ▾
Show answer
Start with admins and remote access, then high-risk groups like finance. Pick methods, preferring authenticator app number matching and passkeys or FIDO2 keys for admins. Pilot with one department, prepare helpdesk scripts and self-service registration, and communicate clearly with deadlines. Use conditional access in report-only mode to find gaps, then enforce. Block legacy authentication and track registration rates weekly.
144

How do you design an access review for a critical application?

Identity and Access ManagementMedium
Save to ▾
Show answer
Define scope, such as all users with write or admin rights. Pull entitlements and last-login data from the app, and route each item to the user's manager and the app owner. Give clear choices of keep or revoke with a deadline, and revoke automatically if not reviewed. Capture evidence for auditors, and review exceptions with security. Run it quarterly for privileged access.
145

Tell me about a time you had to say no to a senior person's access request.

Identity and Access ManagementMedium
Save to ▾
Show answer
Situation: a senior manager asked for permanent admin rights on production to speed up reports. Task: protect production without blocking the work. Action: I explained the audit and breach risk, then offered a read-only reporting role and a scheduled export within a day. Result: the manager got the data faster than before, and the audit later had no finding on that system.
146

What are common Active Directory attacks?

Identity and Access ManagementHard
Save to ▾
Show answer
Common attacks are password spraying, Kerberoasting, which requests service tickets for accounts with SPNs and cracks them offline, AS-REP roasting on accounts without pre-authentication, pass-the-hash, DCSync to pull password hashes, and abusing misconfigured ACLs and delegation. Defences include long random service account passwords or gMSAs, tiered admin models, LAPS for local admin passwords, Protected Users group and monitoring ticket requests.
147

An audit finds hundreds of service accounts with no owner and keys older than three years. What are the risks and which controls do you put in place?

Identity and Access ManagementHard
Save to ▾
Show answer
Service accounts and API keys often have broad privileges, never expire, are shared among teams and are excluded from MFA. Machine identities now outnumber human ones in cloud environments. Risks include hardcoded secrets and silent abuse. Controls are an inventory with owners, least privilege, managed identities or workload identity federation instead of static keys, secret rotation, and monitoring for interactive logins.
148

Your company is acquiring another firm with its own Active Directory. How do you approach identity integration securely?

Identity and Access ManagementHard
Save to ▾
Show answer
Start with assessment: their AD health, privileged accounts, trust relationships, MFA coverage and any signs of compromise. Avoid creating a full two-way forest trust early, as it can import their risks. Prefer bringing users into your cloud identity provider with B2B access or migration, with conditional access. Reset privileged credentials, apply your tiering model, and migrate application by application.
149

How do you set up a break-glass account safely?

Identity and Access ManagementHard
Save to ▾
Show answer
Create two cloud-only emergency accounts excluded from normal conditional access but protected by FIDO2 keys stored in a safe. Use long random passwords, store them split between two senior people or in a sealed vault, and give them the minimum emergency role. Alert the SOC on any sign-in, and test them every quarter. They exist for identity provider outages or misconfigured policies.
150

How would you implement just-in-time privileged access in the cloud?

Identity and Access ManagementHard
Save to ▾
Show answer
Remove standing admin roles. Make users eligible for roles through a PIM or PAM tool, so they request activation with justification, MFA and optional approval, for a limited time like two hours. Log every activation and alert on unusual ones. For automation, use workload identities with narrow roles instead of admin keys. Review eligible assignments quarterly to keep the list small.
151

What is the shared responsibility model in cloud security?

Cloud SecurityEasy
Save to ▾
Show answer
The cloud provider secures the infrastructure: data centres, hardware, hypervisors and managed service internals. The customer secures what they put in the cloud: identities, data, configurations, network rules and their applications. The split changes by service type; with IaaS you patch the OS, with SaaS you mainly manage users and data settings. Most cloud breaches come from customer-side misconfiguration, not provider failures.
152

What are the most common cloud security misconfigurations?

Cloud SecurityEasy
Save to ▾
Show answer
Frequent issues are publicly accessible storage buckets, overly permissive IAM policies with wildcards, long-lived access keys, security groups open to 0.0.0.0/0 on SSH, RDP or databases, disabled audit logging, unencrypted snapshots shared publicly, and exposed instance metadata. Cloud Security Posture Management tools and native services such as AWS Security Hub, Microsoft Defender for Cloud and Google Security Command Center detect them continuously.
153

How do you scan a container image for vulnerabilities in CI?

Cloud SecurityEasy
Save to ▾
Show answer
Use a scanner like Trivy or Grype and fail the build on serious findings. trivy image --severity HIGH,CRITICAL --exit-code 1 myapp:1.4.2 trivy config ./terraform Run it on every build, rescan images in the registry daily because new CVEs appear, and prefer minimal base images to reduce findings.
154

How would you check a cloud account against CIS benchmarks?

Cloud SecurityEasy
Save to ▾
Show answer
Enable the native posture service, such as AWS Security Hub with the CIS AWS Foundations standard, Microsoft Defender for Cloud with the CIS Azure benchmark, or Security Command Center on Google Cloud. Open source tools like Prowler or ScoutSuite also work. Export findings, prioritise critical ones like root MFA, public storage and open admin ports, assign owners and track remediation over time.
155

How do you keep your cloud security skills updated?

Cloud SecurityEasy
Save to ▾
Show answer
I follow provider security blogs and release notes, since services change monthly, and read incident write-ups to learn real attack paths. I practise in personal free-tier accounts with budget alerts, using deliberately vulnerable labs. I hold a cloud security certification and plan the next one. I also share short notes with my team, which helps me learn more deeply.
156

What is the role of IAM in AWS security?

Cloud SecurityMedium
Save to ▾
Show answer
AWS IAM controls who can do what on which resources through users, groups, roles and JSON policies. Best practices are avoiding root account use and protecting it with MFA, using roles with temporary credentials instead of access keys, least privilege policies, permission boundaries, and Service Control Policies in AWS Organizations to set guardrails across accounts. IAM Access Analyzer helps find unused and external access.
157

Which cloud logs are essential for security monitoring?

Cloud SecurityMedium
Save to ▾
Show answer
Essential sources are control plane audit logs such as AWS CloudTrail, Azure Activity Log and Entra sign-in logs, and Google Cloud Audit Logs. Add network flow logs, DNS logs, load balancer and WAF logs, storage access logs for sensitive buckets, and Kubernetes audit logs. Send them to a central account or SIEM that workload owners cannot delete, and enable threat detection services like GuardDuty.
158

What is Infrastructure as Code security scanning?

Cloud SecurityMedium
Save to ▾
Show answer
IaC scanning checks Terraform, CloudFormation, Bicep or Kubernetes manifests for misconfigurations before deployment, such as public buckets or unencrypted databases. Tools include Checkov, tfsec in Trivy, and KICS. It shifts security left, so issues are fixed in a pull request rather than in production. Combine it with policy as code, like OPA, and drift detection to catch manual changes made in the console.
159

Tell me about a time you worked with developers to fix a security finding.

Cloud SecurityMedium
Save to ▾
Show answer
Situation: a scan found a critical vulnerability in a library used by five microservices just before a release. Task: fix it without delaying the launch. Action: I paired with the lead developer, confirmed which services were truly exploitable, prepared tested upgrade pull requests and added a WAF rule as a temporary safeguard. Result: all services were patched in two days and release stayed on schedule.
160

How does encryption work for data at rest in the cloud?

Cloud SecurityMedium
Save to ▾
Show answer
Most cloud storage, databases and disks encrypt data at rest by default with provider-managed keys. For more control, use customer managed keys in KMS, with key policies, rotation and logs of every use, or bring and hold your own keys for strict regulatory needs. Encryption at rest protects against physical media theft, but not against someone with valid IAM permissions, so access control remains critical.
161

A scan shows an S3 bucket with customer documents is publicly readable. What do you do?

Cloud SecurityMedium
Save to ▾
Show answer
Block public access on the bucket immediately and confirm with the owner whether any public access was intended. Check access logs and CloudTrail data events, if enabled, to see who downloaded files and when. If personal data was accessed, start the incident and breach notification process with legal. Then enable account-level block public access, add a preventive guardrail and alert on policy changes.
162

Developers want admin access in the cloud to move fast. How do you balance speed and security?

Cloud SecurityMedium
Save to ▾
Show answer
Give them freedom inside guardrails. Provide sandbox accounts where they have broad rights, but production changes go through IaC pipelines with scanning and review. Use permission boundaries and SCPs to block dangerous actions like disabling logging or making resources public. Offer pre-approved modules for common patterns. This keeps speed high while preventing the riskiest mistakes.
163

GuardDuty reports an EC2 instance communicating with a known crypto-mining pool. How do you respond?

Cloud SecurityMedium
Save to ▾
Show answer
Isolate the instance by changing its security group to a quarantine group with no traffic, and snapshot its volumes for analysis. Check how it was compromised: exposed SSH, vulnerable app or leaked key. Review CloudTrail for actions by its instance role. Terminate and rebuild from a clean image, rotate secrets the instance could access, and fix the root cause, such as closing public ports.
164

How do you find overly permissive security groups with the AWS CLI?

Cloud SecurityMedium
Save to ▾
Show answer
Query security groups that allow ingress from anywhere, then review each. aws ec2 describe-security-groups \ --filters Name=ip-permission.cidr,Values=0.0.0.0/0 \ --query 'SecurityGroups[*].[GroupId,GroupName]' --output table Pay attention to ports 22, 3389, 3306 and 5432. Replace them with VPN, bastion or session manager access.
165

Write a least-privilege AWS IAM policy that allows reading one S3 bucket.

Cloud SecurityMedium
Save to ▾
Show answer
Allow only listing that bucket and reading its objects. { "Version": "2012-10-17", "Statement": [ {"Effect": "Allow", "Action": "s3:ListBucket", "Resource": "arn:aws:s3:::reports-prod"}, {"Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::reports-prod/*"} ] } Attach it to a role, not a user with long-lived keys.
166

Tell me about a time you improved a process with automation.

Cloud SecurityMedium
Save to ▾
Show answer
Situation: our team checked cloud accounts manually every week for public buckets, which took hours. Task: make it faster and continuous. Action: I wrote a small script using the cloud CLI, scheduled it, and sent findings to a team channel with owner tags, then moved it into the CSPM tool. Result: checks ran hourly and average exposure time dropped from days to under an hour.
167

What is CSPM, CWPP and CNAPP?

Cloud SecurityHard
Save to ▾
Show answer
CSPM, Cloud Security Posture Management, checks cloud configurations against benchmarks like CIS and flags risks. CWPP, Cloud Workload Protection Platform, protects running workloads such as VMs, containers and serverless with vulnerability scanning and runtime detection. CNAPP combines these with identity analysis, IaC scanning and attack path analysis in one platform. The goal is to prioritise risks that combine, like a public VM with a critical flaw and admin role.
168

A pentest shows an SSRF flaw in your app can reach the cloud metadata endpoint. Why is that serious and how do you fix it?

Cloud SecurityHard
Save to ▾
Show answer
Cloud VMs can query a local metadata endpoint at 169.254.169.254 to get instance details and temporary role credentials. If an application has a server-side request forgery flaw, an attacker can make it fetch these credentials. AWS IMDSv2 requires a session token obtained with a PUT request and limits hops, which blocks most SSRF abuse. Enforce IMDSv2 and give instance roles minimal permissions.
169

What are key container and Kubernetes security practices?

Cloud SecurityHard
Save to ▾
Show answer
Use minimal, scanned base images and sign them. Run containers as non-root with read-only filesystems and dropped capabilities. In Kubernetes, enforce Pod Security Standards, use RBAC with least privilege, network policies to restrict pod traffic, secrets from an external store, and keep the API server private. Enable audit logs and runtime detection such as Falco, and patch clusters regularly.
170

Why is a multi-account or multi-subscription structure important in the cloud?

Cloud SecurityHard
Save to ▾
Show answer
Separate accounts or subscriptions for production, development, security tooling, logging and shared services create strong blast-radius boundaries and simpler permissions. A compromised dev account cannot touch production. Central guardrails like AWS Service Control Policies or Azure Policy enforce rules everywhere, and a dedicated log archive account protects audit logs. Landing zone frameworks automate this setup for new teams.
171

What are the data residency rules relevant to cloud in India?

Cloud SecurityHard
Save to ▾
Show answer
The DPDP Act 2023 allows cross-border transfer of personal data except to countries the government restricts, though sector rules can be stricter. RBI requires payment system data to be stored only in India. CERT-In requires ICT logs to be kept in India for 180 days. SEBI and IRDAI have their own requirements for regulated entities. Cloud architects choose Indian regions such as Mumbai or Hyderabad for compliance.
172

Your company is moving a banking application to the cloud. What security controls would you require?

Cloud SecurityHard
Save to ▾
Show answer
I would require a landing zone with separate accounts, Indian region hosting for data residency, private networking with no public database endpoints, WAF and DDoS protection, customer managed KMS keys, PAM for admin access, central immutable logging to the SIEM, CSPM against CIS benchmarks, vulnerability scanning in CI, and a tested backup and disaster recovery plan. All mapped to RBI and audit requirements.
173

A Kubernetes pod in production is running a cryptominer. How do you investigate?

Cloud SecurityHard
Save to ▾
Show answer
Capture the pod spec, image digest, logs and runtime alerts before deleting anything. Check how it got in: a vulnerable app, a compromised image in the registry or an exposed dashboard or kubelet. Review Kubernetes audit logs for who created the workload and what service account it used. Cordon affected nodes, rotate service account tokens and secrets, patch the entry point and enforce image signing.
174

How do you enable organisation-wide audit logging in AWS?

Cloud SecurityHard
Save to ▾
Show answer
Create a multi-region organisation trail that sends logs to a bucket in a dedicated log archive account. aws cloudtrail create-trail --name org-trail \ --s3-bucket-name central-ct-logs --is-multi-region-trail \ --is-organization-trail --enable-log-file-validation aws cloudtrail start-logging --name org-trail Protect the bucket with Object Lock and an SCP that denies stopping CloudTrail.
175

How do you replace static cloud keys in CI/CD pipelines?

Cloud SecurityHard
Save to ▾
Show answer
Use workload identity federation with OIDC. The CI system issues a short-lived signed token for each job, and the cloud provider trusts that issuer and exchanges the token for temporary credentials of a narrow role. Restrict the trust policy to a specific repository and branch. This removes long-lived secrets from pipeline settings, so a leaked log or variable no longer gives permanent access.
176

What does GRC stand for in cyber security?

GRC and ComplianceEasy
Save to ▾
Show answer
GRC is Governance, Risk and Compliance. Governance sets direction, policies, roles and accountability for security. Risk management identifies, assesses and treats risks to an acceptable level. Compliance ensures the organisation meets laws, regulations, contracts and standards such as the DPDP Act, RBI directions, ISO 27001 and PCI DSS. GRC analysts write policies, run risk assessments, manage audits and track remediation.
177

What is ISO/IEC 27001?

GRC and ComplianceEasy
Save to ▾
Show answer
ISO/IEC 27001 is the international standard for an Information Security Management System. The 2022 version has clauses 4 to 10 for the management system, such as context, leadership, risk assessment, internal audit and improvement, and Annex A with 93 controls grouped into Organisational, People, Physical and Technological themes. Companies get certified through an accredited body, which Indian IT services firms often need for client contracts.
178

What are the four risk treatment options?

GRC and ComplianceEasy
Save to ▾
Show answer
Mitigate by adding controls to reduce likelihood or impact, such as MFA. Transfer by shifting financial impact to others, like cyber insurance or contracts. Avoid by stopping the risky activity, for example retiring an old system. Accept when the risk is within appetite and formally documented with an owner and review date. Risk acceptance should be signed by a business owner, not just the security team.
179

What is the difference between a policy, a standard, a procedure and a guideline?

GRC and ComplianceEasy
Save to ▾
Show answer
A policy is a high-level management statement of intent, such as all data must be classified. A standard sets mandatory specific requirements, like AES-256 for confidential data. A procedure gives step-by-step instructions to meet the standard. A guideline is recommended but optional advice. This hierarchy lets policies stay stable while standards and procedures change with technology.
180

What is business continuity and disaster recovery, and what are RTO and RPO?

GRC and ComplianceEasy
Save to ▾
Show answer
Business continuity keeps critical business functions running during disruption, while disaster recovery restores IT systems. Recovery Time Objective is the maximum acceptable downtime, and Recovery Point Objective is the maximum acceptable data loss measured in time. A payments system may need an RTO of one hour and an RPO near zero, which needs replication, while an internal wiki may accept a day.
181

How do you write an effective security policy?

GRC and ComplianceEasy
Save to ▾
Show answer
Start from business needs and regulations, keep it short and clear, and state scope, purpose, roles, requirements and exceptions. Avoid technical detail that changes often; put that in standards. Get input from IT, HR and legal, then management approval. Publish it where staff can find it, train people, require acknowledgement and review it at least yearly or after major changes.
182

How do you build a risk register?

GRC and ComplianceEasy
Save to ▾
Show answer
Create a table where each risk has an ID, description written as cause, event and impact, asset, owner, inherent likelihood and impact, existing controls, residual rating, treatment decision, action plan, due date and review date. Gather risks through workshops, audits, incidents and threat intelligence. Review the register monthly with owners and report top risks to leadership quarterly.
183

Where do you see yourself in five years in cyber security?

GRC and ComplianceEasy
Save to ▾
Show answer
A strong answer is specific yet flexible. For example: in five years I want to lead incident response or security engineering work for a large environment. I plan to master SOC operations first, then specialise through hands-on cloud and IR projects and certifications such as CySA+ and later CISSP. I also want to mentor junior analysts, since teaching strengthens my own skills.
184

What is the NIST Cybersecurity Framework 2.0?

GRC and ComplianceMedium
Save to ▾
Show answer
NIST CSF 2.0, released in 2024, organises cyber security outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover. Govern was added to cover strategy, roles, policy and supply chain risk. Each function has categories and subcategories. Organisations create current and target profiles to find gaps and plan improvements. It is voluntary and widely used to report maturity to boards.
185

What are the key points of India's DPDP Act?

GRC and ComplianceMedium
Save to ▾
Show answer
The Digital Personal Data Protection Act 2023 governs digital personal data. Data fiduciaries need valid consent or a legitimate use, must give clear notice, protect data with reasonable safeguards, notify breaches to the Data Protection Board and affected people, and delete data when no longer needed. Data principals have rights to access, correction and erasure. Penalties go up to 250 crore rupees. The DPDP Rules 2025 phase in obligations.
186

What is the difference between qualitative and quantitative risk assessment?

GRC and ComplianceMedium
Save to ▾
Show answer
Qualitative assessment rates likelihood and impact on scales like low, medium and high, and is quick and easy to communicate. Quantitative assessment uses numbers, such as single loss expectancy times annual rate of occurrence to get annual loss expectancy, or FAIR models. Quantitative helps justify budgets but needs data that is often uncertain. Many teams start qualitative and quantify the top risks.
187

What is PCI DSS?

GRC and ComplianceMedium
Save to ▾
Show answer
The Payment Card Industry Data Security Standard applies to any organisation that stores, processes or transmits cardholder data. Version 4.0.1 is current, and its future-dated requirements became mandatory from March 2025. It has 12 requirement areas, including network security controls, protecting stored data, encryption in transit, vulnerability management, access control, logging and testing. Reducing scope through tokenisation and segmentation lowers compliance effort.
188

What is third-party or vendor risk management?

GRC and ComplianceMedium
Save to ▾
Show answer
TPRM assesses and monitors the security of vendors that access your data or systems, since many breaches start with a supplier. It includes tiering vendors by risk, security questionnaires, reviewing SOC 2 or ISO 27001 reports, contract clauses for breach notification and audit rights, and continuous monitoring. High-risk vendors such as payroll or cloud providers get deeper reviews and annual reassessment.
189

A US customer asks your Indian SaaS company for a SOC 2 report. What is it and which type should you aim for?

GRC and ComplianceMedium
Save to ▾
Show answer
SOC 2 is an attestation report by an independent auditor on a service organisation's controls against the AICPA Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy. A Type I report checks control design at a point in time; a Type II checks operating effectiveness over a period, typically 6 to 12 months. Indian SaaS companies selling to US customers commonly need SOC 2 Type II.
190

A business unit wants to accept a high risk instead of fixing it. How do you handle it?

GRC and ComplianceMedium
Save to ▾
Show answer
Risk acceptance is a business decision, but it must be informed. I would document the risk, likely impact, cost of fixing and compensating controls, and confirm it exceeds or meets risk appetite. If it is high, escalate to the right authority, such as the CISO or risk committee, for formal sign-off with an expiry date. I record it in the risk register and review it on schedule.
191

An auditor finds that access reviews were not done for two quarters. What do you do?

GRC and ComplianceMedium
Save to ▾
Show answer
Acknowledge the finding and agree a remediation plan. Immediately run the overdue reviews for in-scope systems, prioritising privileged access, and revoke unneeded access. Find the cause, such as no owner or a manual process, and fix it by assigning owners, automating campaigns in the IGA tool and adding reminders and escalations. Provide evidence of completed reviews to close the finding.
192

A new vendor will process customer personal data. What checks do you perform before onboarding?

GRC and ComplianceMedium
Save to ▾
Show answer
Classify the vendor as high risk. Review their security questionnaire, ISO 27001 certificate or SOC 2 Type II report, data location, subprocessors, encryption, access controls and incident response capability. Under the DPDP Act, we remain responsible as data fiduciary, so the contract needs data processing terms, breach notification timelines, deletion on exit and audit rights. Track any gaps with deadlines.
193

How do you calculate annual loss expectancy?

GRC and ComplianceMedium
Save to ▾
Show answer
Single Loss Expectancy is asset value times exposure factor, and Annual Loss Expectancy is SLE times Annual Rate of Occurrence. SLE = Asset Value x Exposure Factor ALE = SLE x ARO Example: a server worth 20 lakh rupees, 50 percent loss per incident, expected once in four years: SLE = 20,00,000 x 0.5 = 10,00,000 ALE = 10,00,000 x 0.25 = 2,50,000 per year
194

How do you collect audit evidence efficiently?

GRC and ComplianceMedium
Save to ▾
Show answer
Map each control to the evidence an auditor will request, such as screenshots of configurations, system exports, tickets, logs and signed approvals. Keep a central evidence library organised by control ID with dates. Automate collection where possible through GRC tools that pull data from cloud, identity and ticketing systems. Sample in advance to confirm evidence covers the full audit period.
195

Tell me about a time you had to convince a team to follow a compliance requirement they disliked.

GRC and ComplianceMedium
Save to ▾
Show answer
Situation: developers resisted mandatory code review evidence for SOC 2, seeing it as paperwork. Task: get compliance without slowing releases. Action: I explained the audit risk to customer deals and showed that branch protection rules could create evidence automatically. Result: we enabled required reviews in the repository settings, evidence became automatic and the audit passed with no finding.
196

How do you manage many audit and compliance deadlines at the same time?

GRC and ComplianceHard
Save to ▾
Show answer
Situation: in one quarter I had an ISO surveillance audit, a client security questionnaire backlog and a regulator report due. Task: deliver all without missing dates. Action: I listed every deliverable with owners and deadlines in a tracker, reused a central evidence library for overlapping requests, and gave weekly status to my manager. Result: everything was delivered on time with no major findings.
197

Which Indian regulators issue cyber security requirements for financial firms?

GRC and ComplianceHard
Save to ▾
Show answer
RBI issues directions for banks, NBFCs and payment operators, including the IT governance and risk management directions and the cyber security framework for banks. SEBI issued the Cybersecurity and Cyber Resilience Framework for regulated entities in 2024. IRDAI has information and cyber security guidelines for insurers. All require board-approved policies, SOC monitoring, incident reporting and periodic audits.
198

You are asked to prepare the company for its first ISO 27001 certification in nine months. How do you plan it?

GRC and ComplianceHard
Save to ▾
Show answer
Get leadership sponsorship and define the ISMS scope. Run a gap assessment against clauses and Annex A, then do the risk assessment and build the risk treatment plan and Statement of Applicability. Write core policies, implement missing controls, and train staff. Collect evidence for a few months, run an internal audit and management review, fix findings, then book stage 1 and stage 2 audits.
199

The board asks how secure the company is. How would you answer?

GRC and ComplianceHard
Save to ▾
Show answer
I would avoid a single score and present risk in business terms: the top five cyber risks, such as ransomware and third-party breach, with likelihood, impact and trend. Show maturity against NIST CSF 2.0 with current and target levels, key metrics like MFA coverage, patch timeliness and incident response times, and the investments needed to close gaps. Keep it to a few slides.
200

How would you run a data protection impact assessment under the DPDP Act?

GRC and ComplianceHard
Save to ▾
Show answer
Describe the processing: what personal data, purpose, legal basis, data flows, storage, retention and vendors. Assess risks to individuals, such as unauthorised access or excessive collection, and evaluate safeguards like encryption, access control and minimisation. Recommend changes, get sign-off from the data protection officer or privacy lead, and review it when processing changes. Significant data fiduciaries must perform periodic DPIAs and audits.

Frequently asked questions

What jobs can I get after learning cyber security?

Freshers usually start as SOC analysts, security operations associates, GRC or audit analysts, or vulnerability management analysts. With two to four years of experience you can move into incident response, network security, cloud security, detection engineering or security consulting. Senior paths include security architect, SOC manager and CISO. IT services firms, banks, fintechs, telecoms, consulting firms and product companies in India all hire for these roles, and many global SOCs are based in Indian cities.

Who is eligible to learn cyber security?

Graduates in computer science, IT, electronics or BCA and MCA have the easiest start, but students from other backgrounds can also enter, especially in GRC roles. You need basic computer skills, curiosity and willingness to learn networking, Linux and Windows. Working professionals in IT support, networking, system administration or development often switch successfully because they already understand how systems work. No prior security experience is required to begin.

How long does it take to become job ready in cyber security?

With focused study of two to three hours a day, most learners become ready for entry-level SOC or GRC roles in four to six months. That includes networking and OS basics, SIEM practice, incident response fundamentals and one certification. Deeper specialisations like cloud security or forensics take another year of hands-on work. Building a home lab and documenting projects speeds up the process because interviewers value practical evidence.

Which certifications are useful for a cyber security career?

For beginners, CompTIA Security+ and ISC2 Certified in Cybersecurity build strong foundations. For SOC roles, CompTIA CySA+ and vendor SIEM certifications such as Splunk or Microsoft SC-200 help. Cloud roles benefit from AWS Security Specialty or Azure AZ-500. GRC professionals often pursue ISO 27001 Lead Auditor or Lead Implementer. Senior professionals target CISSP or CISM, which require several years of experience. Certifications help shortlisting, but skills decide interviews.

Do I need coding skills for cyber security?

Many defensive roles need only basic scripting, not full software development. Writing SIEM queries, small Python or PowerShell scripts for automation and reading code during investigations are very useful. GRC roles need almost no coding. Cloud security, detection engineering and application security need stronger scripting and infrastructure as code skills. Starting with Python basics and SQL-like query languages such as SPL or KQL is a practical path.

Is cyber security a good career in India in 2026?

Yes. Regulations like the DPDP Act, CERT-In directions and RBI and SEBI cyber frameworks require companies to invest in monitoring, incident response and compliance. Cloud adoption, digital payments and frequent ransomware attacks keep demand high, and global companies run SOCs from India. There is a shortage of skilled, hands-on professionals, so learners who build practical skills and keep updating them find steady growth opportunities.