Curated interview practice questions with answers. These are practice scenarios, not a verified list of past interview questions.
About Cisco hiring for Cyber Security roles
Cisco is a networking and security company making routers, switches, security products, collaboration tools such as Webex, and observability software including Splunk. Its Bengaluru campus is one of its largest R&D centres outside the US. It hires in India for software engineers, test and validation engineers, network engineers and data analysts.
For Cyber Security roles, this Cisco practice set focuses most on Incident Response and Forensics (6), Network Security (6), Cloud Security (5), SOC Operations and SIEM (4). It has 22 medium, 8 hard questions, so you can start easy and work up to the harder ones.
Typical pattern based on public candidate experiences. Rounds vary by role, team and year.
Solved for CiscoStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
What is threat intelligence and what are IOCs and TTPs?
Threat intelligence is analysed information about adversaries, their tools and behaviour. Indicators of Compromise are artefacts like malicious IPs, domains and file hashes; they are easy to use but change quickly. TTPs, tactics, techniques and procedures, describe how attackers operate, and are harder for attackers to change. The Pyramid of Pain shows that detecting TTPs causes attackers more cost than blocking hashes.
02
What is the order of volatility in evidence collection?
Collect the most volatile evidence first because it disappears quickly. The order is CPU registers and cache, memory including running processes and network connections, temporary files, disk, remote logs, and finally archived media. That is why responders capture RAM before shutting down a machine, since malware running only in memory, decrypted keys and active connections are lost at power off.
03
An employee who is leaving copied large volumes of data to a personal cloud drive. How do you handle it?
Treat it as a potential insider incident and involve HR and legal before contacting the employee. Preserve evidence such as DLP alerts, proxy logs, endpoint file activity and cloud app logs, and document what data was involved and its sensitivity. Restrict the user's access as advised. Legal decides on next steps, such as requesting deletion with an undertaking. Then improve DLP and offboarding controls.
04
A finance employee transferred money after a fake email from the CEO. What do you do?
Contact the bank immediately to try to stop or recall the transfer; speed matters most. Report to the cybercrime portal and police. Investigate the email: was the CEO mailbox compromised or spoofed? Check sign-in logs, forwarding rules and other targeted staff. Reset credentials, enforce MFA and DMARC, and add a call-back rule for payment changes. Include legal and management throughout.
05
A TLS certificate expired on the main customer portal and caused an outage. How do you prevent this in future?
First renew and deploy the certificate to restore service. For prevention, build a certificate inventory from scanning and CT logs, automate issuance and renewal with ACME where possible, and set alerts at 30, 14 and 7 days before expiry to a team mailbox, not an individual. Assign an owner per certificate and add expiry checks to monitoring dashboards, since shorter lifetimes are coming.
06
How do you create a forensic disk image and verify it?
Use a write blocker or a forensic tool, image the whole disk, and hash both source and image.
sudo dc3dd if=/dev/sdb of=/evidence/case12.img hash=sha256 log=/evidence/case12.log
sha256sum /evidence/case12.img
Record the hashes, time, examiner and device details in the chain of custody form. Analyse a working copy, never the original.
07
You find an application storing user passwords as unsalted MD5. What do you recommend?
MD5 is fast and broken, so these hashes can be cracked quickly if leaked. Recommend Argon2id or bcrypt with proper cost settings. To migrate without forcing resets, wrap existing hashes: compute Argon2id over the MD5 value now, and on next login replace it with a direct Argon2id hash of the password. Also check whether the database was ever exposed, and enforce MFA.
Threat hunting is proactive searching for attackers who evaded existing detections. Hunters start from a hypothesis, for example that attackers use scheduled tasks for persistence, then query EDR and SIEM data to confirm or reject it. Findings become new detection rules. Hunting requires good data retention, knowledge of normal behaviour and frameworks like MITRE ATT&CK to guide hypotheses.
Map each control to the evidence an auditor will request, such as screenshots of configurations, system exports, tickets, logs and signed approvals. Keep a central evidence library organised by control ID with dates. Automate collection where possible through GRC tools that pull data from cloud, identity and ticketing systems. Sample in advance to confirm evidence covers the full audit period.
Secure Access Service Edge combines networking, such as SD-WAN, with cloud-delivered security services: secure web gateway, CASB, ZTNA and firewall as a service. Users connect to the nearest provider point of presence, and policy follows them anywhere. It suits Indian companies with many branches and hybrid workers because traffic no longer has to backhaul to a head office data centre. Vendor lock-in and migration effort are the trade-offs.
11
A cloud access key was leaked and used to start crypto-mining instances. What is your response?
Deactivate the key immediately and check who owns it. Review cloud audit logs for every action taken with it, such as new instances, users, roles or policy changes, because attackers often create persistence. Terminate unauthorised resources, delete created users and keys, and check billing impact. Then find how it leaked, move workloads to roles with short-lived credentials and enable budget and anomaly alerts.
Short-term containment stops the spread quickly, for example isolating hosts through EDR, disabling accounts, blocking IPs or domains and segmenting networks. Long-term containment keeps business running while preparing clean systems, such as rebuilding servers in a separate network. Responders must balance speed with evidence preservation and avoid alerting a sophisticated attacker too early if they need to understand the full scope.
13
Tell me about a time you had to say no to a senior person's access request.
Situation: a senior manager asked for permanent admin rights on production to speed up reports. Task: protect production without blocking the work. Action: I explained the audit and breach risk, then offered a read-only reporting role and a scheduled export within a day. Result: the manager got the data faster than before, and the audit later had no finding on that system.
14
A US customer asks your Indian SaaS company for a SOC 2 report. What is it and which type should you aim for?
SOC 2 is an attestation report by an independent auditor on a service organisation's controls against the AICPA Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy. A Type I report checks control design at a point in time; a Type II checks operating effectiveness over a period, typically 6 to 12 months. Indian SaaS companies selling to US customers commonly need SOC 2 Type II.
15
How do you write a Splunk search to find brute-force attempts on Windows?
Search failed logon events, count per account and source, and filter high counts.
index=wineventlog EventCode=4625
| stats count AS failures dc(TargetUserName) AS users BY IpAddress
| where failures > 50
| sort - failures
A high distinct user count from one IP points to password spraying rather than a single account brute force.
16
A scan shows an S3 bucket with customer documents is publicly readable. What do you do?
Block public access on the bucket immediately and confirm with the owner whether any public access was intended. Check access logs and CloudTrail data events, if enabled, to see who downloaded files and when. If personal data was accessed, start the incident and breach notification process with legal. Then enable account-level block public access, add a preventive guardrail and alert on policy changes.
17
What are the data residency rules relevant to cloud in India?
The DPDP Act 2023 allows cross-border transfer of personal data except to countries the government restricts, though sector rules can be stricter. RBI requires payment system data to be stored only in India. CERT-In requires ICT logs to be kept in India for 180 days. SEBI and IRDAI have their own requirements for regulated entities. Cloud architects choose Indian regions such as Mumbai or Hyderabad for compliance.
18
A user on the office LAN reports repeated certificate warnings and you suspect ARP spoofing. What is happening and how do you stop it?
ARP has no authentication, so an attacker on the same LAN can send fake ARP replies linking their MAC address to the gateway's IP. Victims then send traffic through the attacker, enabling man-in-the-middle interception. Defences include Dynamic ARP Inspection with DHCP snooping on switches, port security, network access control, and encrypting traffic end to end with TLS so intercepted data is useless.
19
What is network segmentation and why is it important?
Segmentation splits a network into zones such as user, server, OT, guest and management, with controlled traffic between them using VLANs, firewalls and ACLs. It limits lateral movement, so ransomware on one laptop cannot reach every server. It also reduces compliance scope, for example isolating the cardholder data environment for PCI DSS. Micro-segmentation goes further with per-workload policies in data centres and cloud.
CSPM, Cloud Security Posture Management, checks cloud configurations against benchmarks like CIS and flags risks. CWPP, Cloud Workload Protection Platform, protects running workloads such as VMs, containers and serverless with vulnerability scanning and runtime detection. CNAPP combines these with identity analysis, IaC scanning and attack path analysis in one platform. The goal is to prioritise risks that combine, like a public VM with a critical flaw and admin role.
21
A pentest shows an SSRF flaw in your app can reach the cloud metadata endpoint. Why is that serious and how do you fix it?
Cloud VMs can query a local metadata endpoint at 169.254.169.254 to get instance details and temporary role credentials. If an application has a server-side request forgery flaw, an attacker can make it fetch these credentials. AWS IMDSv2 requires a session token obtained with a PUT request and limits hops, which blocks most SSRF abuse. Enforce IMDSv2 and give instance roles minimal permissions.
22
What is the difference between OAuth 2.0 and OpenID Connect?
OAuth 2.0 is an authorisation framework; it lets an app get an access token to call an API on a user's behalf, without the user's password. It does not define who the user is. OpenID Connect adds an identity layer with an ID token, a signed JWT containing user claims, and a userinfo endpoint. Use OIDC for login, and OAuth access tokens for API authorisation.
23
Your IDS alerts on outbound traffic from a database server to an unknown IP on port 443 at 3 AM. How do you investigate?
Database servers rarely need internet access, so this is suspicious. I would check the destination's reputation and WHOIS, look at flow data for volume and duration, and identify the process making the connection using EDR. Then I review recent logins, scheduled tasks and new binaries on the server. If data volume is large or the process is unknown, I contain the host and escalate as a possible exfiltration.
Sigma is a generic YAML detection format that converts to SIEM queries.
title: Office Spawning PowerShell
logsource:
product: windows
category: process_creation
detection:
selection:
ParentImage|endswith: ['\winword.exe', '\excel.exe']
Image|endswith: '\powershell.exe'
condition: selection
level: high
tags: [attack.execution, attack.t1059.001]
25
How do you write basic Linux host firewall rules with nftables?
TPRM assesses and monitors the security of vendors that access your data or systems, since many breaches start with a supplier. It includes tiering vendors by risk, security questionnaires, reviewing SOC 2 or ISO 27001 reports, contract clauses for breach notification and audit rights, and continuous monitoring. High-risk vendors such as payroll or cloud providers get deeper reviews and annual reassessment.
AWS IAM controls who can do what on which resources through users, groups, roles and JSON policies. Best practices are avoiding root account use and protecting it with MFA, using roles with temporary credentials instead of access keys, least privilege policies, permission boundaries, and Service Control Policies in AWS Organizations to set guardrails across accounts. IAM Access Analyzer helps find unused and external access.
28
Users complain that a new firewall rule broke an application. How do you troubleshoot?
First check the firewall logs for denied traffic from the affected users or servers around the change time. Compare the change ticket with actual app requirements, since apps often use extra ports or dependencies. Use packet capture or a test connection to confirm. Then add a narrow rule for the real need, not an any-any rule, and update documentation so the next change does not repeat the problem.
29
How would you set up envelope encryption for application data in the cloud?
Create a customer managed key in the cloud KMS with strict IAM so only the app role can use it. The app asks KMS for a data key, encrypts records locally with AES-GCM using the plaintext data key, stores the encrypted data key next to the data, and discards the plaintext key. To decrypt, it sends the encrypted data key to KMS. Enable key rotation and audit logging.
30
A new vendor will process customer personal data. What checks do you perform before onboarding?
Classify the vendor as high risk. Review their security questionnaire, ISO 27001 certificate or SOC 2 Type II report, data location, subprocessors, encryption, access controls and incident response capability. Under the DPDP Act, we remain responsible as data fiduciary, so the contract needs data processing terms, breach notification timelines, deletion on exit and audit rights. Track any gaps with deadlines.
Tips to crack the Cisco Cyber Security interview
Revise computer networking deeply, including OSI layers, TCP/IP, subnetting, routing protocols and VLANs.
For test roles, be ready to explain how you would test a network feature, including traffic tools and automation with Python.
Read about Cisco's security and Splunk observability products, which have become a growing focus area.
Keep a one-minute story ready for every project on your CV: problem, your part, tools, result.
Practise the hard questions on this page aloud; Cisco interviewers usually ask follow-ups on your first answer.
Frequently asked questions
How many rounds are there in the Cisco Cyber Security interview?
Candidates usually go through 5 stages: Online assessment (aptitude + networking + coding); Technical round 1; Technical round 2; Managerial round; HR round. The exact rounds change with the role, team, location and your experience, so confirm the process with the recruiter.
Which topics should I prepare for the Cisco Cyber Security interview?
This practice set leans on Incident Response and Forensics (6), Network Security (6), Cloud Security (5), SOC Operations and SIEM (4). Revise those first, then practise explaining one or two of your own projects end to end, because most Cisco interviewers ask you to walk through real work.
Are these the exact questions asked at Cisco?
No. These are curated practice questions that match the skills and difficulty usually tested in hardware & semiconductors interviews like Cisco's. They are not a leaked or verified list of past questions.
Where does Cisco hire Cyber Security professionals in India?
Cisco has large teams in Bengaluru, Pune, Chennai. Openings and locations change often, so check the Cisco careers page and filter by city and experience.