Curated interview practice questions with answers. These are practice scenarios, not a verified list of past interview questions.
About Cognizant hiring for Cyber Security roles
Cognizant is a US-headquartered IT services and consulting company with most of its workforce based in India. It provides application development, testing, cloud, digital engineering and data analytics services, with strong practices in healthcare, insurance and banking. In India it hires for programmer analyst, quality engineer and data roles through campus and off-campus programmes such as GenC.
For Cyber Security roles, this Cognizant practice set focuses most on GRC and Compliance (7), Network Security (7), Security Fundamentals (5), SOC Operations and SIEM (3). It has 14 easy, 15 medium, 1 hard questions, so you can start easy and work up to the harder ones.
Company type
IT services
Headquarters
Teaneck, New Jersey, USA
Main India offices
Chennai, Bengaluru, Pune, Hyderabad, Kolkata
Cognizant Cyber Security interview process
Online assessment (aptitude + reasoning)
Coding assessment
Technical interview
HR round
Typical pattern based on public candidate experiences. Rounds vary by role, team and year.
Solved for CognizantStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
Mitigate by adding controls to reduce likelihood or impact, such as MFA. Transfer by shifting financial impact to others, like cyber insurance or contracts. Avoid by stopping the risky activity, for example retiring an old system. Accept when the risk is within appetite and formally documented with an owner and review date. Risk acceptance should be signed by a business owner, not just the security team.
02
What is the difference between hashing and encryption?
Encryption is reversible with the right key and protects confidentiality. Hashing is a one-way function that produces a fixed-length digest and is used for integrity checks and password storage. SHA-256 of a file lets you detect tampering, but you cannot get the file back from the hash. Passwords should be stored with slow salted hashes such as Argon2id or bcrypt, never encrypted or with plain SHA-256.
03
What is social engineering and what are its common forms?
Social engineering manipulates people rather than technology to gain access or information. Common forms are phishing emails, spear phishing aimed at specific staff, vishing over phone calls, smishing over SMS or WhatsApp, pretexting with a fake story, baiting with infected USB drives and tailgating into offices. Defences include awareness training, phishing simulations, call-back verification for payment changes, and technical controls such as MFA and email authentication.
A SOC is the team, processes and technology that monitor an organisation's environment around the clock, detect threats, triage alerts and coordinate response. Tier 1 analysts triage alerts, Tier 2 investigate and contain, and Tier 3 or threat hunters handle complex cases and build detections. A SOC can be in-house, outsourced to an MSSP or hybrid. Many Indian IT firms run global SOCs for international clients.
Single Loss Expectancy is asset value times exposure factor, and Annual Loss Expectancy is SLE times Annual Rate of Occurrence.
SLE = Asset Value x Exposure Factor
ALE = SLE x ARO
Example: a server worth 20 lakh rupees, 50 percent loss per incident, expected once in four years:
SLE = 20,00,000 x 0.5 = 10,00,000
ALE = 10,00,000 x 0.25 = 2,50,000 per year
The Digital Personal Data Protection Act 2023 governs digital personal data. Data fiduciaries need valid consent or a legitimate use, must give clear notice, protect data with reasonable safeguards, notify breaches to the Data Protection Board and affected people, and delete data when no longer needed. Data principals have rights to access, correction and erasure. Penalties go up to 250 crore rupees. The DPDP Rules 2025 phase in obligations.
07
How do you decode and check a JWT during troubleshooting?
A JWT has header, payload and signature separated by dots. Decode the first two parts to read claims, but never trust them without verifying the signature.
echo $TOKEN | cut -d. -f2 | base64 -d 2>/dev/null
Check iss, aud, exp and nbf claims. In code, verify with a library using the expected algorithm and issuer keys, and reject alg none.
PAM protects powerful accounts like domain admins, root, database admins and cloud owners. It includes a vault for credentials with automatic rotation, just-in-time elevation, session brokering with recording, approval workflows and alerts on unusual use. Tools include CyberArk, BeyondTrust and Delinea. PAM is important because attackers aim for privileged credentials to move laterally and deploy ransomware across the network.
ISO/IEC 27001 is the international standard for an Information Security Management System. The 2022 version has clauses 4 to 10 for the management system, such as context, leadership, risk assessment, internal audit and improvement, and Annex A with 93 controls grouped into Organisational, People, Physical and Technological themes. Companies get certified through an accredited body, which Indian IT services firms often need for client contracts.
Start from business needs and regulations, keep it short and clear, and state scope, purpose, roles, requirements and exceptions. Avoid technical detail that changes often; put that in standards. Get input from IT, HR and legal, then management approval. Publish it where staff can find it, train people, require acknowledgement and review it at least yearly or after major changes.
11
How do you scan your own network for open ports with Nmap, with permission?
Only scan networks you own or have written approval for. Start with host discovery, then service and version detection on key ports.
nmap -sn 10.10.0.0/24
nmap -sV -T3 -p 1-1000 10.10.0.15
nmap -sV --top-ports 100 -oA scan_results 10.10.0.0/24
Compare results with the approved service list and raise tickets for unexpected open ports.
12
Which Windows event IDs should a SOC analyst know?
Key Security log events are 4624 successful logon, 4625 failed logon, 4672 special privileges assigned, 4688 process creation, 4720 user created, 4728 and 4732 user added to privileged groups, 4740 account lockout, 1102 audit log cleared, 4698 scheduled task created and 7045 service installed in the System log. Logon type in 4624, such as 3 for network and 10 for RDP, adds important context.
13
Your SOC sees heavy DNS traffic with long random subdomains from one workstation. Which DNS attacks should you consider and what defences apply?
Key DNS attacks are cache poisoning, which inserts false records; DNS tunnelling, which hides data or command traffic inside queries; domain hijacking through registrar account takeover; and DNS amplification DDoS. Defences include DNSSEC to sign records, protective DNS resolvers that block malicious domains, monitoring for long or high-entropy subdomains, registrar lock with MFA, and rate limiting open resolvers.
14
What is the difference between a vulnerability assessment and a penetration test?
A vulnerability assessment uses scanners to find and rank as many known weaknesses as possible across many assets, and it is broad and frequent. A penetration test is a time-boxed, authorised attempt to exploit weaknesses and show real impact, such as reaching sensitive data. Assessments answer what is wrong; pen tests answer what an attacker could actually achieve. Most programmes run monthly scans and annual or release-based pen tests.
15
How would you run a data protection impact assessment under the DPDP Act?
Describe the processing: what personal data, purpose, legal basis, data flows, storage, retention and vendors. Assess risks to individuals, such as unauthorised access or excessive collection, and evaluate safeguards like encryption, access control and minimisation. Recommend changes, get sign-off from the data protection officer or privacy lead, and review it when processing changes. Significant data fiduciaries must perform periodic DPIAs and audits.
In BEC, attackers take over or impersonate an executive, vendor or finance mailbox to trick staff into making payments or changing bank details. It often uses no malware, just a compromised account, mailbox forwarding rules and convincing requests. Controls include MFA, DMARC enforcement, alerts on new inbox rules, and a mandatory call-back process on a known number for any change to payment details.
17
What is the difference between a policy, a standard, a procedure and a guideline?
A policy is a high-level management statement of intent, such as all data must be classified. A standard sets mandatory specific requirements, like AES-256 for confidential data. A procedure gives step-by-step instructions to meet the standard. A guideline is recommended but optional advice. This hierarchy lets policies stay stable while standards and procedures change with technology.
AWS IAM controls who can do what on which resources through users, groups, roles and JSON policies. Best practices are avoiding root account use and protecting it with MFA, using roles with temporary credentials instead of access keys, least privilege policies, permission boundaries, and Service Control Policies in AWS Organizations to set guardrails across accounts. IAM Access Analyzer helps find unused and external access.
An Intrusion Detection System monitors traffic or hosts and raises alerts but does not block. An Intrusion Prevention System sits inline and can drop malicious packets in real time. IDS is safer for tuning because false positives do not break traffic, while IPS gives active protection. Detection can be signature based, as in Snort and Suricata rules, or anomaly based using baselines of normal behaviour.
Zero Trust removes implicit trust based on network location. Every request is verified using identity, device health and context, access is least privilege and granted per session, and the environment is assumed to be already breached. NIST SP 800-207 describes the model. In practice it means strong MFA, device posture checks, identity-aware proxies instead of flat VPN access, micro-segmentation and continuous monitoring. It is a journey, not a single product.
21
Tell me about a time you worked with developers to fix a security finding.
Situation: a scan found a critical vulnerability in a library used by five microservices just before a release. Task: fix it without delaying the launch. Action: I paired with the lead developer, confirmed which services were truly exploitable, prepared tested upgrade pull requests and added a WAF rule as a temporary safeguard. Result: all services were patched in two days and release stayed on schedule.
NAC checks devices and users before allowing them on the network, typically using 802.1X with a RADIUS server. It can verify certificates, patch level, EDR presence and user identity, then assign a VLAN or policy. Unknown or non-compliant devices go to a quarantine or guest network. NAC is important in offices with many personal devices and IoT equipment such as printers and cameras.
23
What is malware and how do virus, worm, trojan and ransomware differ?
Malware is any software built to harm or misuse a system. A virus attaches to files and spreads when they run. A worm spreads by itself across networks, often using a vulnerability. A trojan pretends to be legitimate software to trick users into installing it. Ransomware encrypts or steals data and demands payment, and modern groups use double extortion by threatening to leak stolen data.
24
How would you capture and analyse suspicious traffic using tcpdump and Wireshark?
Capture on the right interface with a filter to limit size, save to a pcap file, then open it in Wireshark.
sudo tcpdump -i eth0 host 10.10.0.15 and port 53 -w dns.pcap
In Wireshark, use display filters such as dns, http.request or tls.handshake.type == 1, and Statistics > Conversations to spot top talkers. Protect pcaps because they may contain sensitive data.
25
During triage you notice a user logged in from Mumbai and then from Frankfurt 20 minutes later. How do you handle it?
This is an impossible travel alert. First rule out benign causes like corporate VPN, cloud proxy egress or mobile networks. Check device IDs, user agents and MFA results for both logins. If the second login is from an unknown device without MFA, or followed by mailbox rule creation or data download, revoke sessions, reset credentials, review MFA methods and contact the user through a separate channel.
26
What are the most common cloud security misconfigurations?
Frequent issues are publicly accessible storage buckets, overly permissive IAM policies with wildcards, long-lived access keys, security groups open to 0.0.0.0/0 on SSH, RDP or databases, disabled audit logging, unencrypted snapshots shared publicly, and exposed instance metadata. Cloud Security Posture Management tools and native services such as AWS Security Hub, Microsoft Defender for Cloud and Google Security Command Center detect them continuously.
Check supported protocol versions, ciphers and certificate details. OpenSSL gives a quick view, and tools like testssl.sh give a full report.
openssl s_client -connect example.com:443 -tls1_2
openssl s_client -connect example.com:443 -servername example.com | openssl x509 -noout -dates -issuer
./testssl.sh example.com
Disable TLS 1.0 and 1.1, weak ciphers like RC4 and 3DES, and fix expiring certificates.
28
What is the difference between TCP and UDP from a security point of view?
TCP is connection oriented with a three-way handshake, which makes it reliable but open to SYN flood attacks. UDP is connectionless, so it is easy to spoof source addresses and is abused in amplification attacks using DNS, NTP or memcached. Firewalls track TCP state easily, while UDP state is inferred from timeouts. Security monitoring must cover both, since DNS tunnelling uses UDP 53.
Conditional access applies policies based on signals at sign-in, such as user, group, device compliance, location, application and risk score. For example, allow finance apps only from managed devices with MFA, block legacy authentication, and require a password change when sign-in risk is high. It is a key Zero Trust building block in platforms like Microsoft Entra ID. Policies need testing in report-only mode first.
NIST SP 800-61 describes preparation; detection and analysis; containment, eradication and recovery; and post-incident activity. The 2025 revision aligns these with the NIST CSF 2.0 functions of Govern, Identify, Protect, Detect, Respond and Recover. Preparation includes playbooks, contacts and tools. Containment limits spread, eradication removes the attacker, recovery restores operations, and lessons learned improve controls and detections.
Tips to crack the Cognizant Cyber Security interview
Understand the GenC, GenC Next and GenC Elevate tracks so you know which skills and coding level each role expects.
Revise SQL queries, OOP concepts and basic testing terminology since many freshers are placed in development or QA projects.
Read about Cognizant's healthcare and life sciences domain work, which is a large part of its client base.
Keep a one-minute story ready for every project on your CV: problem, your part, tools, result.
Practise the hard questions on this page aloud; Cognizant interviewers usually ask follow-ups on your first answer.
Frequently asked questions
How many rounds are there in the Cognizant Cyber Security interview?
Candidates usually go through 4 stages: Online assessment (aptitude + reasoning); Coding assessment; Technical interview; HR round. The exact rounds change with the role, team, location and your experience, so confirm the process with the recruiter.
Which topics should I prepare for the Cognizant Cyber Security interview?
This practice set leans on GRC and Compliance (7), Network Security (7), Security Fundamentals (5), SOC Operations and SIEM (3). Revise those first, then practise explaining one or two of your own projects end to end, because most Cognizant interviewers ask you to walk through real work.
Are these the exact questions asked at Cognizant?
No. These are curated practice questions that match the skills and difficulty usually tested in it services interviews like Cognizant's. They are not a leaked or verified list of past questions.
Where does Cognizant hire Cyber Security professionals in India?
Cognizant has large teams in Chennai, Bengaluru, Pune, Hyderabad, Kolkata. Openings and locations change often, so check the Cognizant careers page and filter by city and experience.