Curated interview practice questions with answers. These are practice scenarios, not a verified list of past interview questions.
About Airtel hiring for Cyber Security roles
Bharti Airtel is an Indian telecom company providing mobile, broadband, DTH, enterprise connectivity and digital services such as Airtel Thanks and Airtel Payments Bank. Its digital and analytics teams work on network data, customer analytics and app development. It hires for software engineers, testers, network engineers and data professionals.
For Cyber Security roles, this Airtel practice set focuses most on SOC Operations and SIEM (6), Cloud Security (5), Identity and Access Management (4), Security Fundamentals (4). It has 8 easy, 22 medium questions, so you can start easy and work up to the harder ones.
Company type
Telecom
Headquarters
New Delhi, India
Main India offices
Gurugram, Bengaluru, Mumbai, Pune
Airtel Cyber Security interview process
Online assessment (aptitude + technical)
Technical interview
Managerial round
HR round
Typical pattern based on public candidate experiences. Rounds vary by role, team and year.
Solved for AirtelStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
How would you design a joiner, mover, leaver process for a growing company?
JML is the identity lifecycle. Joiners get accounts and baseline access from HR data on day one. Movers change roles, and their old access must be removed, not just new access added, to avoid privilege creep. Leavers must be disabled promptly, ideally automatically when HR records their exit. Automating JML from the HR system to the identity platform reduces orphan accounts, which auditors frequently flag.
02
A user's account shows sign-in risk high in your identity platform. What do you do?
Review the details: unfamiliar location, anonymous IP, leaked credentials or impossible travel. Check what happened after sign-in, such as MFA method registration, mailbox rules or data downloads. If compromise is likely, revoke sessions, reset the password, remove unknown MFA methods and contact the user out of band. Then confirm policies require MFA or block high-risk sign-ins automatically.
Threat hunting is proactive searching for attackers who evaded existing detections. Hunters start from a hypothesis, for example that attackers use scheduled tasks for persistence, then query EDR and SIEM data to confirm or reject it. Findings become new detection rules. Hunting requires good data retention, knowledge of normal behaviour and frameworks like MITRE ATT&CK to guide hypotheses.
04
What is the shared responsibility model in cloud security?
The cloud provider secures the infrastructure: data centres, hardware, hypervisors and managed service internals. The customer secures what they put in the cloud: identities, data, configurations, network rules and their applications. The split changes by service type; with IaaS you patch the OS, with SaaS you mainly manage users and data settings. Most cloud breaches come from customer-side misconfiguration, not provider failures.
Conditional access applies policies based on signals at sign-in, such as user, group, device compliance, location, application and risk score. For example, allow finance apps only from managed devices with MFA, block legacy authentication, and require a password change when sign-in risk is high. It is a key Zero Trust building block in platforms like Microsoft Entra ID. Policies need testing in report-only mode first.
06
You receive an alert for 300 failed logins on one account followed by a success. How do you triage it?
This pattern suggests brute force or password spraying that succeeded. Check source IPs, location and logon type, and whether MFA was used for the success. Review what the account did after login, such as mailbox rules, file access or new tokens. If suspicious, disable the account or revoke sessions, reset the password, block source IPs and check whether the same IPs targeted other accounts.
07
What are the most common cloud security misconfigurations?
Frequent issues are publicly accessible storage buckets, overly permissive IAM policies with wildcards, long-lived access keys, security groups open to 0.0.0.0/0 on SSH, RDP or databases, disabled audit logging, unencrypted snapshots shared publicly, and exposed instance metadata. Cloud Security Posture Management tools and native services such as AWS Security Hub, Microsoft Defender for Cloud and Google Security Command Center detect them continuously.
Zero Trust removes implicit trust based on network location. Every request is verified using identity, device health and context, access is least privilege and granted per session, and the environment is assumed to be already breached. NIST SP 800-207 describes the model. In practice it means strong MFA, device posture checks, identity-aware proxies instead of flat VPN access, micro-segmentation and continuous monitoring. It is a journey, not a single product.
User and Entity Behaviour Analytics builds baselines of normal behaviour for users, hosts and service accounts, then flags anomalies such as logging in from a new country, accessing far more files than usual or a service account doing interactive logins. It helps detect insider threats and stolen credentials that look like normal logins. It needs good identity data and careful tuning to avoid noisy alerts.
10
What is the difference between a threat, a vulnerability and a risk?
A vulnerability is a weakness, such as an unpatched server. A threat is anything that can exploit it, such as a ransomware group. Risk is the likelihood that the threat exploits the vulnerability multiplied by the business impact. For example, an unpatched internet-facing VPN is high risk, while the same flaw on an isolated lab machine is low risk because likelihood and impact are smaller.
11
Which cloud logs are essential for security monitoring?
Essential sources are control plane audit logs such as AWS CloudTrail, Azure Activity Log and Entra sign-in logs, and Google Cloud Audit Logs. Add network flow logs, DNS logs, load balancer and WAF logs, storage access logs for sensitive buckets, and Kubernetes audit logs. Send them to a central account or SIEM that workload owners cannot delete, and enable threat detection services like GuardDuty.
12
Developers want admin access in the cloud to move fast. How do you balance speed and security?
Give them freedom inside guardrails. Provide sandbox accounts where they have broad rights, but production changes go through IaC pipelines with scanning and review. Use permission boundaries and SCPs to block dangerous actions like disabling logging or making resources public. Offer pre-approved modules for common patterns. This keeps speed high while preventing the riskiest mistakes.
TPRM assesses and monitors the security of vendors that access your data or systems, since many breaches start with a supplier. It includes tiering vendors by risk, security questionnaires, reviewing SOC 2 or ISO 27001 reports, contract clauses for breach notification and audit rights, and continuous monitoring. High-risk vendors such as payroll or cloud providers get deeper reviews and annual reassessment.
14
How do you design an access review for a critical application?
Define scope, such as all users with write or admin rights. Pull entitlements and last-login data from the app, and route each item to the user's manager and the app owner. Give clear choices of keep or revoke with a deadline, and revoke automatically if not reviewed. Capture evidence for auditors, and review exceptions with security. Run it quarterly for privileged access.
15
What are India's CERT-In incident reporting requirements?
Under the CERT-In directions issued in April 2022, service providers, intermediaries, data centres and body corporates must report specified cyber incidents to CERT-In within six hours of noticing them. They must also keep ICT system logs for 180 days within India and synchronise clocks with NTP servers of NIC or NPL. Reportable incidents include ransomware, data breaches, and attacks on servers and cloud systems.
Defence in depth means using several independent layers of controls so that one failure does not lead to a breach. A typical stack has perimeter firewalls, email filtering, endpoint EDR, MFA, network segmentation, least privilege, logging and backups. If a phishing email gets past the filter, MFA and EDR can still stop the attacker. The trade-off is cost and complexity, so layers should target the most likely attack paths.
17
What is memory forensics and which tool is commonly used?
Memory forensics analyses a RAM capture to find running processes, injected code, network connections, loaded DLLs, command history and encryption keys. It reveals fileless malware that leaves little on disk. Volatility 3 is the common open source framework, with plugins such as windows.pslist, windows.netscan and windows.malfind. Captures are taken with tools like WinPmem or through EDR live response.
18
A firewall audit finds 40 percent of rules have not been hit in a year. What do you do?
Unused rules expand attack surface and slow audits. I would export rule hit counts, confirm no seasonal apps like year-end batch jobs depend on them, and contact rule owners listed in tickets. Rules with no owner are disabled first, not deleted, and monitored for a month. After that they are removed. I would also add rule expiry dates and quarterly reviews to the change process.
19
How do you write a Splunk search to find brute-force attempts on Windows?
Search failed logon events, count per account and source, and filter high counts.
index=wineventlog EventCode=4625
| stats count AS failures dc(TargetUserName) AS users BY IpAddress
| where failures > 50
| sort - failures
A high distinct user count from one IP points to password spraying rather than a single account brute force.
20
How does encryption work for data at rest in the cloud?
Most cloud storage, databases and disks encrypt data at rest by default with provider-managed keys. For more control, use customer managed keys in KMS, with key policies, rotation and logs of every use, or bring and hold your own keys for strict regulatory needs. Encryption at rest protects against physical media theft, but not against someone with valid IAM permissions, so access control remains critical.
21
What is business continuity and disaster recovery, and what are RTO and RPO?
Business continuity keeps critical business functions running during disruption, while disaster recovery restores IT systems. Recovery Time Objective is the maximum acceptable downtime, and Recovery Point Objective is the maximum acceptable data loss measured in time. A payments system may need an RTO of one hour and an RPO near zero, which needs replication, while an internal wiki may accept a day.
22
A user reports a pop-up saying their files are encrypted. What are your first steps?
First, isolate the device from the network, ideally through EDR network containment, without powering it off so memory evidence is kept. Inform the incident lead and start a timeline. Check for the same indicators on other hosts, disable the user's sessions and reset credentials if needed, and identify the ransomware family from the note. Then confirm backups are intact and offline before any recovery begins.
A SIEM collects and correlates logs to detect threats. SOAR, Security Orchestration, Automation and Response, takes alerts and runs playbooks that enrich, decide and act, for example looking up an IP's reputation, querying EDR, disabling a user and opening a ticket. SIEM answers what is happening; SOAR speeds up the response. Many platforms now combine both, but automation still needs human approval for disruptive actions.
24
What is network segmentation and why is it important?
Segmentation splits a network into zones such as user, server, OT, guest and management, with controlled traffic between them using VLANs, firewalls and ACLs. It limits lateral movement, so ransomware on one laptop cannot reach every server. It also reduces compliance scope, for example isolating the cardholder data environment for PCI DSS. Micro-segmentation goes further with per-workload policies in data centres and cloud.
A blameless review covers the timeline, root cause, how the attacker got in, what detected it, what slowed response, business impact and decisions made. It ends with specific actions that have owners and dates, such as enabling MFA on all VPN users or adding a detection rule. Tracking these actions to completion matters more than the report itself, otherwise the same incident repeats.
26
Users complain that a new firewall rule broke an application. How do you troubleshoot?
First check the firewall logs for denied traffic from the affected users or servers around the change time. Compare the change ticket with actual app requirements, since apps often use extra ports or dependencies. Use packet capture or a test connection to confirm. Then add a narrow rule for the real need, not an any-any rule, and update documentation so the next change does not repeat the problem.
27
What is the order of volatility in evidence collection?
Collect the most volatile evidence first because it disappears quickly. The order is CPU registers and cache, memory including running processes and network connections, temporary files, disk, remote logs, and finally archived media. That is why responders capture RAM before shutting down a machine, since malware running only in memory, decrypted keys and active connections are lost at power off.
28
During triage you notice a user logged in from Mumbai and then from Frankfurt 20 minutes later. How do you handle it?
This is an impossible travel alert. First rule out benign causes like corporate VPN, cloud proxy egress or mobile networks. Check device IDs, user agents and MFA results for both logins. If the second login is from an unknown device without MFA, or followed by mailbox rule creation or data download, revoke sessions, reset credentials, review MFA methods and contact the user through a separate channel.
29
What is certificate revocation and how is it checked?
Revocation invalidates a certificate before expiry, for example when its private key leaks. Methods are CRLs, which are signed lists of revoked serial numbers, and OCSP, where the client asks a responder about one certificate. OCSP stapling lets the server attach a fresh response to the handshake. Because revocation checking is unreliable, the industry is moving to much shorter certificate lifetimes, which reduces exposure.
30
How do you handle a network team that refuses a security change you recommended?
Situation: the network team rejected my request to block outbound SMB at the firewall, fearing outages. Task: reduce the risk without damaging the relationship. Action: I shared flow data showing only two servers needed it, proposed an allowlist for them and a one-week monitor-only phase. Result: the team agreed, the rule went live with zero incidents, and we now review rules together monthly.
Tips to crack the Airtel Cyber Security interview
Learn telecom basics like ARPU, churn, 4G and 5G networks, and broadband rollout for case discussions.
Prepare analytics cases on reducing customer churn or improving network quality using data.
Read about Airtel's digital products like Airtel Thanks and Xstream, and its enterprise business Airtel Business.
Keep a one-minute story ready for every project on your CV: problem, your part, tools, result.
Practise the hard questions on this page aloud; Airtel interviewers usually ask follow-ups on your first answer.
Frequently asked questions
How many rounds are there in the Airtel Cyber Security interview?
Candidates usually go through 4 stages: Online assessment (aptitude + technical); Technical interview; Managerial round; HR round. The exact rounds change with the role, team, location and your experience, so confirm the process with the recruiter.
Which topics should I prepare for the Airtel Cyber Security interview?
This practice set leans on SOC Operations and SIEM (6), Cloud Security (5), Identity and Access Management (4), Security Fundamentals (4). Revise those first, then practise explaining one or two of your own projects end to end, because most Airtel interviewers ask you to walk through real work.
Are these the exact questions asked at Airtel?
No. These are curated practice questions that match the skills and difficulty usually tested in telecom interviews like Airtel's. They are not a leaked or verified list of past questions.
Where does Airtel hire Cyber Security professionals in India?
Airtel has large teams in Gurugram, Bengaluru, Mumbai, Pune. Openings and locations change often, so check the Airtel careers page and filter by city and experience.