Curated interview practice questions with answers. These are practice scenarios, not a verified list of past interview questions.
About Deloitte hiring for Cyber Security roles
Deloitte is one of the Big Four professional services networks, offering audit, tax, consulting, risk advisory and financial advisory services. Its Indian entities, including Deloitte USI, support global clients with technology consulting, analytics, cyber and testing work. It hires in India for analyst and consultant roles in data analytics, business intelligence, QA, ERP and risk advisory.
For Cyber Security roles, this Deloitte practice set focuses most on SOC Operations and SIEM (6), GRC and Compliance (5), Incident Response and Forensics (5), Network Security (4). It has 5 easy, 20 medium, 5 hard questions, so you can start easy and work up to the harder ones.
Company type
Consulting
Headquarters
London, United Kingdom
Main India offices
Hyderabad, Bengaluru, Mumbai, Gurugram, Pune
Deloitte Cyber Security interview process
Online assessment (aptitude + technical)
Group discussion or case discussion
Technical interview
Partner or HR round
Typical pattern based on public candidate experiences. Rounds vary by role, team and year.
Solved for DeloitteStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
Your SOC sees heavy DNS traffic with long random subdomains from one workstation. Which DNS attacks should you consider and what defences apply?
Key DNS attacks are cache poisoning, which inserts false records; DNS tunnelling, which hides data or command traffic inside queries; domain hijacking through registrar account takeover; and DNS amplification DDoS. Defences include DNSSEC to sign records, protective DNS resolvers that block malicious domains, monitoring for long or high-entropy subdomains, registrar lock with MFA, and rate limiting open resolvers.
Map each control to the evidence an auditor will request, such as screenshots of configurations, system exports, tickets, logs and signed approvals. Keep a central evidence library organised by control ID with dates. Automate collection where possible through GRC tools that pull data from cloud, identity and ticketing systems. Sample in advance to confirm evidence covers the full audit period.
The Payment Card Industry Data Security Standard applies to any organisation that stores, processes or transmits cardholder data. Version 4.0.1 is current, and its future-dated requirements became mandatory from March 2025. It has 12 requirement areas, including network security controls, protecting stored data, encryption in transit, vulnerability management, access control, logging and testing. Reducing scope through tokenisation and segmentation lowers compliance effort.
04
What are key container and Kubernetes security practices?
Use minimal, scanned base images and sign them. Run containers as non-root with read-only filesystems and dropped capabilities. In Kubernetes, enforce Pod Security Standards, use RBAC with least privilege, network policies to restrict pod traffic, secrets from an external store, and keep the API server private. Enable audit logs and runtime detection such as Falco, and patch clusters regularly.
05
A user's account shows sign-in risk high in your identity platform. What do you do?
Review the details: unfamiliar location, anonymous IP, leaked credentials or impossible travel. Check what happened after sign-in, such as MFA method registration, mailbox rules or data downloads. If compromise is likely, revoke sessions, reset the password, remove unknown MFA methods and contact the user out of band. Then confirm policies require MFA or block high-risk sign-ins automatically.
NAC checks devices and users before allowing them on the network, typically using 802.1X with a RADIUS server. It can verify certificates, patch level, EDR presence and user identity, then assign a VLAN or policy. Unknown or non-compliant devices go to a quarantine or guest network. NAC is important in offices with many personal devices and IoT equipment such as printers and cameras.
07
How do you design an access review for a critical application?
Define scope, such as all users with write or admin rights. Pull entitlements and last-login data from the app, and route each item to the user's manager and the app owner. Give clear choices of keep or revoke with a deadline, and revoke automatically if not reviewed. Capture evidence for auditors, and review exceptions with security. Run it quarterly for privileged access.
Short-term containment stops the spread quickly, for example isolating hosts through EDR, disabling accounts, blocking IPs or domains and segmenting networks. Long-term containment keeps business running while preparing clean systems, such as rebuilding servers in a separate network. Responders must balance speed with evidence preservation and avoid alerting a sophisticated attacker too early if they need to understand the full scope.
NIST SP 800-61 describes preparation; detection and analysis; containment, eradication and recovery; and post-incident activity. The 2025 revision aligns these with the NIST CSF 2.0 functions of Govern, Identify, Protect, Detect, Respond and Recover. Preparation includes playbooks, contacts and tools. Containment limits spread, eradication removes the attacker, recovery restores operations, and lessons learned improve controls and detections.
10
How do you write basic Linux host firewall rules with nftables?
Use SigninLogs, summarise distinct countries per user over a day and flag outliers.
SigninLogs
| where TimeGenerated > ago(1d)
| where ResultType == 0
| summarize Countries = dcount(Location), List = make_set(Location) by UserPrincipalName
| where Countries > 2
| order by Countries desc
Review results with known travel and VPN egress points before escalating.
Create a table where each risk has an ID, description written as cause, event and impact, asset, owner, inherent likelihood and impact, existing controls, residual rating, treatment decision, action plan, due date and review date. Gather risks through workshops, audits, incidents and threat intelligence. Review the register monthly with owners and report top risks to leadership quarterly.
Use a dedicated password hashing library with Argon2id, which handles salts and parameters automatically.
from argon2 import PasswordHasher
ph = PasswordHasher()
stored = ph.hash(password)
try:
ph.verify(stored, attempt)
if ph.check_needs_rehash(stored):
stored = ph.hash(attempt)
except Exception:
deny_login()
Never use plain SHA-256 or MD5 for passwords.
14
Describe a time you handled a stressful outage or security issue.
Situation: during my internship the office internet went down during a client demo because of a broadcast storm. Task: restore service quickly. Action: I checked switch logs, found a looped cable creating a loop, removed it, and then enabled spanning tree and storm control with my senior. Result: service returned in 20 minutes, and I wrote a short runbook so the team could resolve similar issues faster.
15
What is a man-in-the-middle attack on TLS and how do certificates prevent it?
In a MITM attack, an attacker intercepts traffic and pretends to be the server. Certificates prevent this because the client checks that the server certificate chains to a trusted root, matches the hostname and is valid. An attacker cannot produce a valid certificate without the private key or a compromised CA. Certificate warnings that users click through, and apps that skip validation, break this protection.
16
Tell me about a time you had to say no to a senior person's access request.
Situation: a senior manager asked for permanent admin rights on production to speed up reports. Task: protect production without blocking the work. Action: I explained the audit and breach risk, then offered a read-only reporting role and a scheduled export within a day. Result: the manager got the data faster than before, and the audit later had no finding on that system.
17
What is threat intelligence and what are IOCs and TTPs?
Threat intelligence is analysed information about adversaries, their tools and behaviour. Indicators of Compromise are artefacts like malicious IPs, domains and file hashes; they are easy to use but change quickly. TTPs, tactics, techniques and procedures, describe how attackers operate, and are harder for attackers to change. The Pyramid of Pain shows that detecting TTPs causes attackers more cost than blocking hashes.
18
You are asked to prepare the company for its first ISO 27001 certification in nine months. How do you plan it?
Get leadership sponsorship and define the ISMS scope. Run a gap assessment against clauses and Annex A, then do the risk assessment and build the risk treatment plan and Statement of Applicability. Write core policies, implement missing controls, and train staff. Collect evidence for a few months, run an internal audit and management review, fix findings, then book stage 1 and stage 2 audits.
19
A key log source stopped sending data to the SIEM two days ago. Why does it matter and what do you do?
Silent log gaps create blind spots where attacks go undetected, and they can also break compliance. Raise it as a priority issue, check the forwarder or agent health, network path, licence limits and parsing errors, and restore ingestion. Check whether the gap overlapped any suspicious activity. Then add log source health monitoring that alerts when expected volume drops, so gaps are found in hours, not days.
20
A scan shows an S3 bucket with customer documents is publicly readable. What do you do?
Block public access on the bucket immediately and confirm with the owner whether any public access was intended. Check access logs and CloudTrail data events, if enabled, to see who downloaded files and when. If personal data was accessed, start the incident and breach notification process with legal. Then enable account-level block public access, add a preventive guardrail and alert on policy changes.
21
Tell me about a time you explained a security risk to a non-technical person.
Situation: my team lead in a support role wanted to share admin passwords on a spreadsheet. Task: change this without slowing the team. Action: I explained the risk as a house key copied for everyone, showed how one leaked laptop exposes all systems, and proposed a password manager with shared vaults. Result: we adopted it within a week and audit findings dropped.
22
You receive an alert for 300 failed logins on one account followed by a success. How do you triage it?
This pattern suggests brute force or password spraying that succeeded. Check source IPs, location and logon type, and whether MFA was used for the success. Review what the account did after login, such as mailbox rules, file access or new tokens. If suspicious, disable the account or revoke sessions, reset the password, block source IPs and check whether the same IPs targeted other accounts.
23
How do you onboard a new log source into a SIEM properly?
Define why the source is needed and which detections it supports. Configure collection through an agent, syslog or API, verify time sync and time zone, and ensure parsing maps fields to the SIEM's data model. Check volume and licence impact, set retention, and test with sample events. Finally build or enable detections and add health monitoring so the team knows if it stops.
24
Your manager asks why the company needs security when it already has antivirus on every laptop. How do you explain?
I would explain that antivirus mainly blocks known malicious files, while most modern attacks use stolen credentials, phishing links, living-off-the-land tools like PowerShell, or cloud misconfigurations that antivirus never sees. I would map our top risks to missing controls, such as MFA, EDR, logging and backups, and use a recent real incident pattern to show business impact in downtime and regulatory reporting cost.
25
You find a web shell on a public web server. What steps do you take?
Do not just delete it. Capture the file, web logs and a memory image if possible, then identify when it was created and which request uploaded it. Search logs for commands executed through it and lateral movement from the server. Contain by isolating the server or blocking the path at the WAF, then patch the vulnerable application, rebuild from a clean image and rotate any credentials stored on it.
A SIEM collects and correlates logs to detect threats. SOAR, Security Orchestration, Automation and Response, takes alerts and runs playbooks that enrich, decide and act, for example looking up an IP's reputation, querying EDR, disabling a user and opening a ticket. SIEM answers what is happening; SOAR speeds up the response. Many platforms now combine both, but automation still needs human approval for disruptive actions.
In BEC, attackers take over or impersonate an executive, vendor or finance mailbox to trick staff into making payments or changing bank details. It often uses no malware, just a compromised account, mailbox forwarding rules and convincing requests. Controls include MFA, DMARC enforcement, alerts on new inbox rules, and a mandatory call-back process on a known number for any change to payment details.
28
What is multi-factor authentication and which factors are strongest?
MFA requires two or more factor types: something you know like a password, something you have like a phone or security key, and something you are like a fingerprint. SMS OTPs are vulnerable to SIM swap and phishing, and push approvals to MFA fatigue. Phishing-resistant methods such as FIDO2 security keys, passkeys and certificate-based authentication are strongest because they are bound to the real site.
29
A new vendor will process customer personal data. What checks do you perform before onboarding?
Classify the vendor as high risk. Review their security questionnaire, ISO 27001 certificate or SOC 2 Type II report, data location, subprocessors, encryption, access controls and incident response capability. Under the DPDP Act, we remain responsible as data fiduciary, so the contract needs data processing terms, breach notification timelines, deletion on exit and audit rights. Track any gaps with deadlines.
30
Your EDR shows the same suspicious hash on 30 machines. How do you scope the incident?
Search the hash, file name and parent process across all endpoints, and look for related indicators like network destinations and persistence mechanisms. Build a timeline to find patient zero and the delivery method, for example an email attachment or a compromised software update. Group affected hosts by criticality, isolate them, and check whether any credentials were stolen to plan resets broadly.
Tips to crack the Deloitte Cyber Security interview
Practise guesstimates and simple business cases, since consulting interviews often test structured thinking alongside technical skills.
Be ready to explain dashboards or analyses you built in Excel, SQL, Power BI or Tableau and the business decisions they supported.
Read about Deloitte's service lines such as Risk Advisory and Consulting so you can say which practice suits you.
Keep a one-minute story ready for every project on your CV: problem, your part, tools, result.
Practise the hard questions on this page aloud; Deloitte interviewers usually ask follow-ups on your first answer.
Frequently asked questions
How many rounds are there in the Deloitte Cyber Security interview?
Candidates usually go through 4 stages: Online assessment (aptitude + technical); Group discussion or case discussion; Technical interview; Partner or HR round. The exact rounds change with the role, team, location and your experience, so confirm the process with the recruiter.
Which topics should I prepare for the Deloitte Cyber Security interview?
This practice set leans on SOC Operations and SIEM (6), GRC and Compliance (5), Incident Response and Forensics (5), Network Security (4). Revise those first, then practise explaining one or two of your own projects end to end, because most Deloitte interviewers ask you to walk through real work.
Are these the exact questions asked at Deloitte?
No. These are curated practice questions that match the skills and difficulty usually tested in consulting interviews like Deloitte's. They are not a leaked or verified list of past questions.
Where does Deloitte hire Cyber Security professionals in India?
Deloitte has large teams in Hyderabad, Bengaluru, Mumbai, Gurugram, Pune. Openings and locations change often, so check the Deloitte careers page and filter by city and experience.