Cyber Security Interview Questions for 10 Years Experience
40 questions with answers for candidates with 10+ years of experience — 10 medium, 30 hard.
What interviewers expect: 10 years experience
At ten years and beyond, roles include head of security operations, security architect lead, deputy CISO or CISO. Interviews focus on strategy, risk appetite, board reporting, regulatory relationships, crisis leadership and building culture. Expect questions about presenting cyber risk to the board, handling a public breach, managing large teams and setting multi-year roadmaps aligned with NIST CSF 2.0.
This set is weighted towards Incident Response and Forensics (8), Cryptography and PKI (7), Identity and Access Management (6), Cloud Security (5).
Security strategy Board and regulator communication Crisis leadership Organisation building
Solved at this levelStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
A firewall audit finds 40 percent of rules have not been hit in a year. What do you do?
Unused rules expand attack surface and slow audits. I would export rule hit counts, confirm no seasonal apps like year-end batch jobs depend on them, and contact rule owners listed in tickets. Rules with no owner are disabled first, not deleted, and monitored for a month. After that they are removed. I would also add rule expiry dates and quarterly reviews to the change process.
The Lockheed Martin Cyber Kill Chain describes seven stages of an intrusion: reconnaissance, weaponisation, delivery, exploitation, installation, command and control, and actions on objectives. Defenders use it to map controls to each stage, for example email filtering at delivery and egress filtering at command and control. Its weakness is a perimeter focus, so many teams pair it with MITRE ATT&CK for detailed techniques after initial access.
03
How do you collect basic triage data from a suspected compromised Windows host?
Collect volatile data first, ideally with EDR live response or a trusted triage tool. Useful built-in commands:
tasklist /v
netstat -ano
schtasks /query /fo LIST /v
wmic service get name,pathname,startmode
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run
wevtutil epl Security C:\IR\security.evtx
Save output to external media and hash every file.
04
An audit finds hundreds of service accounts with no owner and keys older than three years. What are the risks and which controls do you put in place?
Service accounts and API keys often have broad privileges, never expire, are shared among teams and are excluded from MFA. Machine identities now outnumber human ones in cloud environments. Risks include hardcoded secrets and silent abuse. Controls are an inventory with owners, least privilege, managed identities or workload identity federation instead of static keys, secret rotation, and monitoring for interactive logins.
05
What are the data residency rules relevant to cloud in India?
The DPDP Act 2023 allows cross-border transfer of personal data except to countries the government restricts, though sector rules can be stricter. RBI requires payment system data to be stored only in India. CERT-In requires ICT logs to be kept in India for 180 days. SEBI and IRDAI have their own requirements for regulated entities. Cloud architects choose Indian regions such as Mumbai or Hyderabad for compliance.
Common attacks are password spraying, Kerberoasting, which requests service tickets for accounts with SPNs and cracks them offline, AS-REP roasting on accounts without pre-authentication, pass-the-hash, DCSync to pull password hashes, and abusing misconfigured ACLs and delegation. Defences include long random service account passwords or gMSAs, tiered admin models, LAPS for local admin passwords, Protected Users group and monitoring ticket requests.
07
Your company website is under an application layer DDoS attack. What actions do you take?
Confirm it is an attack and not a traffic spike by checking request patterns, user agents and source spread. Enable or tighten the CDN or WAF bot protection and rate limits on targeted URLs, add challenge pages for suspicious clients, and cache heavy pages. Inform the ISP or DDoS provider and management. After the attack, review logs, tune rules and update the runbook.
Key management covers generating, distributing, storing, rotating, backing up and destroying keys. It is hard because strong encryption is useless if keys sit in code, config files or shared drives. Good practice is a central KMS or vault, envelope encryption with data keys wrapped by master keys, automatic rotation, strict IAM on key usage and logging every decrypt call. Losing keys can also mean losing data permanently.
09
How would you set up envelope encryption for application data in the cloud?
Create a customer managed key in the cloud KMS with strict IAM so only the app role can use it. The app asks KMS for a data key, encrypts records locally with AES-GCM using the plaintext data key, stores the encrypted data key next to the data, and discards the plaintext key. To decrypt, it sends the encrypted data key to KMS. Enable key rotation and audit logging.
10
During a major breach, an engineer asks why legal and communications must join the war room. How do you explain?
Legal advises on regulatory notification, such as CERT-In within six hours and the Data Protection Board and affected people under the DPDP Act, contractual duties to clients, evidence handling and privilege. Communications manage messaging to customers, staff, media and investors so statements are accurate and consistent. Technical teams should involve them early, because poor communication can cause more damage than the incident itself.
11
How do you onboard a new log source into a SIEM properly?
Define why the source is needed and which detections it supports. Configure collection through an agent, syslog or API, verify time sync and time zone, and ensure parsing maps fields to the SIEM's data model. Check volume and licence impact, set retention, and test with sample events. Finally build or enable detections and add health monitoring so the team knows if it stops.
12
How would you run a data protection impact assessment under the DPDP Act?
Describe the processing: what personal data, purpose, legal basis, data flows, storage, retention and vendors. Assess risks to individuals, such as unauthorised access or excessive collection, and evaluate safeguards like encryption, access control and minimisation. Recommend changes, get sign-off from the data protection officer or privacy lead, and review it when processing changes. Significant data fiduciaries must perform periodic DPIAs and audits.
Detection engineering treats detections like software: rules are written from threat models and ATT&CK techniques, stored in version control, tested with attack simulations, peer reviewed and measured for false positive rate. Formats like Sigma let rules be shared across SIEMs. Teams track coverage, tune noisy rules and retire obsolete ones. This replaces ad hoc rule creation that leads to noisy, untested alerts.
14
Developers share one admin account for a production database. What do you propose?
Shared accounts break accountability and are hard to rotate. Give each person an individual named account with least privilege, and provide admin access through PAM with just-in-time approval and session recording. Store the remaining break-glass credential in the vault with alerts on use. Use read-only roles for daily troubleshooting. Roll out with the team so it does not slow urgent fixes.
15
The board asks how secure the company is. How would you answer?
I would avoid a single score and present risk in business terms: the top five cyber risks, such as ransomware and third-party breach, with likelihood, impact and trend. Show maturity against NIST CSF 2.0 with current and target levels, key metrics like MFA coverage, patch timeliness and incident response times, and the investments needed to close gaps. Keep it to a few slides.
16
How do you build a cryptography inventory for an organisation?
Combine several sources: scan network services for TLS versions, ciphers and certificate keys; query CT logs and internal PKI for issued certificates; use code scanning to find crypto library calls and hardcoded keys; and export KMS and HSM key lists. Record algorithm, key length, owner, data sensitivity and expiry. This inventory supports compliance, certificate renewals and planning the post-quantum migration.
17
Tell me about a time you followed process even though a shortcut was tempting.
Situation: during a suspected malware case, a senior engineer wanted to wipe the laptop immediately to save time. Task: contain the threat while preserving evidence. Action: I explained that we needed a memory capture and EDR timeline first, which would take 20 minutes, and isolated the laptop meanwhile. Result: the capture revealed stolen browser credentials, so we reset them before they were misused.
18
Your CISO asks whether the company needs to act on quantum computing risk now. What do you advise?
Large quantum computers could break RSA and elliptic curve cryptography using Shor's algorithm. NIST published post-quantum standards in 2024: ML-KEM for key exchange, and ML-DSA and SLH-DSA for signatures. Attackers can harvest encrypted traffic now and decrypt it later, so long-lived sensitive data is at risk. Organisations should inventory cryptography, prefer crypto agility, and test hybrid key exchange that browsers already support.
Secure Access Service Edge combines networking, such as SD-WAN, with cloud-delivered security services: secure web gateway, CASB, ZTNA and firewall as a service. Users connect to the nearest provider point of presence, and policy follows them anywhere. It suits Indian companies with many branches and hybrid workers because traffic no longer has to backhaul to a head office data centre. Vendor lock-in and migration effort are the trade-offs.
AES-GCM is an authenticated encryption mode, so it gives confidentiality and integrity together, detecting any tampering through its authentication tag. AES-CBC gives only confidentiality and needs a separate MAC; mistakes in combining them caused padding oracle attacks. GCM is also fast with hardware support. Its main rule is never reusing a nonce with the same key, because reuse breaks both confidentiality and integrity.
21
Developers want admin access in the cloud to move fast. How do you balance speed and security?
Give them freedom inside guardrails. Provide sandbox accounts where they have broad rights, but production changes go through IaC pipelines with scanning and review. Use permission boundaries and SCPs to block dangerous actions like disabling logging or making resources public. Offer pre-approved modules for common patterns. This keeps speed high while preventing the riskiest mistakes.
MITRE ATT&CK is a public knowledge base of adversary tactics and techniques observed in real attacks, organised in matrices for Enterprise, Mobile and ICS. Tactics are the goal, such as Persistence, and techniques are the method, such as T1053 Scheduled Task. Teams use it to map detection coverage, write threat-informed detections, plan red and purple team exercises, and describe incidents in a common language.
23
How would you build a forensic timeline of an incident?
Collect timestamps from many sources: Windows event logs, file system MFT records, prefetch, browser history, EDR telemetry, proxy, firewall and cloud logs. Normalise all of them to UTC, then merge them using tools like Plaso and Timeline Explorer. Mark key points such as initial access, privilege escalation, lateral movement and exfiltration. The timeline drives scoping, root cause and the incident report.
24
How do you prioritise 500 vulnerabilities found in a scan?
CVSS alone is not enough. I combine severity with exploitability and exposure: check the CISA Known Exploited Vulnerabilities list and EPSS score, whether the asset is internet facing, and how critical the business data on it is. Internet-facing systems with known exploited flaws are fixed first, often within days. Internal low-severity findings go into normal patch cycles. Group fixes by patch to reduce effort.
25
Which Indian regulators issue cyber security requirements for financial firms?
RBI issues directions for banks, NBFCs and payment operators, including the IT governance and risk management directions and the cyber security framework for banks. SEBI issued the Cybersecurity and Cyber Resilience Framework for regulated entities in 2024. IRDAI has information and cyber security guidelines for insurers. All require board-approved policies, SOC monitoring, incident reporting and periodic audits.
Short-term containment stops the spread quickly, for example isolating hosts through EDR, disabling accounts, blocking IPs or domains and segmenting networks. Long-term containment keeps business running while preparing clean systems, such as rebuilding servers in a separate network. Responders must balance speed with evidence preservation and avoid alerting a sophisticated attacker too early if they need to understand the full scope.
27
Your EDR shows the same suspicious hash on 30 machines. How do you scope the incident?
Search the hash, file name and parent process across all endpoints, and look for related indicators like network destinations and persistence mechanisms. Build a timeline to find patient zero and the delivery method, for example an email attachment or a compromised software update. Group affected hosts by criticality, isolate them, and check whether any credentials were stolen to plan resets broadly.
28
Your company is moving a banking application to the cloud. What security controls would you require?
I would require a landing zone with separate accounts, Indian region hosting for data residency, private networking with no public database endpoints, WAF and DDoS protection, customer managed KMS keys, PAM for admin access, central immutable logging to the SIEM, CSPM against CIS benchmarks, vulnerability scanning in CI, and a tested backup and disaster recovery plan. All mapped to RBI and audit requirements.
CSPM, Cloud Security Posture Management, checks cloud configurations against benchmarks like CIS and flags risks. CWPP, Cloud Workload Protection Platform, protects running workloads such as VMs, containers and serverless with vulnerability scanning and runtime detection. CNAPP combines these with identity analysis, IaC scanning and attack path analysis in one platform. The goal is to prioritise risks that combine, like a public VM with a critical flaw and admin role.
30
A ransomware attack has encrypted 50 servers. Walk through your response.
Activate the incident plan and set up a war room with a separate communication channel. Contain by isolating affected segments, disabling compromised accounts, and blocking known command and control. Preserve evidence from a few hosts. Identify initial access and scope, including data theft. Verify offline backups, rebuild from clean images, and restore by business priority. Report to CERT-In within six hours and involve legal before any ransom discussion.
Create two cloud-only emergency accounts excluded from normal conditional access but protected by FIDO2 keys stored in a safe. Use long random passwords, store them split between two senior people or in a sealed vault, and give them the minimum emergency role. Alert the SOC on any sign-in, and test them every quarter. They exist for identity provider outages or misconfigured policies.
An HSM is tamper-resistant hardware that generates, stores and uses cryptographic keys without exposing them. Keys never leave the device in plain form. Banks and payment processors use HSMs for PIN processing, card keys and signing, and CAs protect root keys with them. Cloud offerings include managed HSM and KMS services. HSMs are often required for compliance standards such as PCI DSS and certified to FIPS 140-3.
33
Describe a time you dealt with a user who was upset about losing access.
Situation: after an access review removed a sales manager's export rights, he escalated angrily before a client deadline. Task: solve his need while keeping the control. Action: I listened, explained why bulk exports were restricted, and arranged a time-bound approved export through his manager within an hour. Result: he met the deadline, and we added a documented request path for such cases.
34
Write a KQL query in Microsoft Sentinel to find sign-ins from many countries for one user.
Use SigninLogs, summarise distinct countries per user over a day and flag outliers.
SigninLogs
| where TimeGenerated > ago(1d)
| where ResultType == 0
| summarize Countries = dcount(Location), List = make_set(Location) by UserPrincipalName
| where Countries > 2
| order by Countries desc
Review results with known travel and VPN egress points before escalating.
35
A vendor announces a zero-day in your internet-facing appliance with no patch yet. What does that mean and how do you protect the company?
A zero-day is a flaw that the vendor does not know about or has not yet patched, so defenders have had zero days to fix it. Exploits for zero-days are valuable and often used in targeted attacks. Since patches are unavailable, defence relies on layered controls: EDR behaviour detection, network segmentation, least privilege, virtual patching with WAF or IPS rules, and fast patching once a fix is released.
36
Write a least-privilege AWS IAM policy that allows reading one S3 bucket.
Allow only listing that bucket and reading its objects.
{
"Version": "2012-10-17",
"Statement": [
{"Effect": "Allow", "Action": "s3:ListBucket",
"Resource": "arn:aws:s3:::reports-prod"},
{"Effect": "Allow", "Action": "s3:GetObject",
"Resource": "arn:aws:s3:::reports-prod/*"}
]
}
Attach it to a role, not a user with long-lived keys.
37
A private key for an internal code-signing certificate was found on a shared drive. What actions do you take?
Treat it as compromised. Revoke the certificate with the CA, issue a new one with the key generated and stored in an HSM or cloud key service, and restrict signing to the build pipeline. Search for any binaries signed with the old key after the exposure time and investigate them. Remove the file, check drive access logs to see who opened it, and update the key handling policy.
38
A cloud access key was leaked and used to start crypto-mining instances. What is your response?
Deactivate the key immediately and check who owns it. Review cloud audit logs for every action taken with it, such as new instances, users, roles or policy changes, because attackers often create persistence. Terminate unauthorised resources, delete created users and keys, and check billing impact. Then find how it leaked, move workloads to roles with short-lived credentials and enable budget and anomaly alerts.
39
Your company is acquiring another firm with its own Active Directory. How do you approach identity integration securely?
Start with assessment: their AD health, privileged accounts, trust relationships, MFA coverage and any signs of compromise. Avoid creating a full two-way forest trust early, as it can import their risks. Prefer bringing users into your cloud identity provider with B2B access or migration, with conditional access. Reset privileged credentials, apply your tiering model, and migrate application by application.
40
Your SOC receives 4000 alerts a day and analysts are overwhelmed. How do you fix this?
Analyse alert data to find the top noisy rules, which usually create most of the volume. Tune them with context and allowlists, or turn low-value ones into dashboards. Add enrichment and automated closure for known benign patterns using SOAR, group related alerts into incidents and add risk-based alerting that scores entities. Track false positive rate per rule weekly and require testing for new rules.
Frequently asked questions
What is asked in Cyber Security interviews for 10+ years of experience?
At ten years and beyond, roles include head of security operations, security architect lead, deputy CISO or CISO. Interviews focus on strategy, risk appetite, board reporting, regulatory relationships, crisis leadership and building culture. Expect questions about presenting cyber risk to the board, handling a public breach, managing large teams and setting multi-year roadmaps aligned with NIST CSF 2.0.
How many questions should I practise before a Cyber Security interview?
Work through all 40 questions here, then the company-wise sets for the employers you are targeting. Quality matters more than count: be able to explain why each answer is right.
Which topics matter most for 10+ years of experience?
Focus first on Security strategy, Board and regulator communication, Crisis leadership, Organisation building.