Cyber Security Interview Questions for 2 Years Experience
40 questions with answers for candidates with 2 years of experience — 4 easy, 33 medium, 3 hard.
What interviewers expect: 2 years experience
At two years, you should investigate independently and contain threats. Interviews dig into full investigations you led, EDR process tree analysis, false positive reduction, MITRE ATT&CK mapping and playbooks. Some questions cover cloud logs and identity attacks. You may be asked to design a detection rule end to end or explain how you improved a SOC process.
This set is weighted towards GRC and Compliance (9), SOC Operations and SIEM (7), Identity and Access Management (6), Network Security (6).
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
What is the order of volatility in evidence collection?
Collect the most volatile evidence first because it disappears quickly. The order is CPU registers and cache, memory including running processes and network connections, temporary files, disk, remote logs, and finally archived media. That is why responders capture RAM before shutting down a machine, since malware running only in memory, decrypted keys and active connections are lost at power off.
02
How do you decode and check a JWT during troubleshooting?
A JWT has header, payload and signature separated by dots. Decode the first two parts to read claims, but never trust them without verifying the signature.
echo $TOKEN | cut -d. -f2 | base64 -d 2>/dev/null
Check iss, aud, exp and nbf claims. In code, verify with a library using the expected algorithm and issuer keys, and reject alg none.
03
How do you design an access review for a critical application?
Define scope, such as all users with write or admin rights. Pull entitlements and last-login data from the app, and route each item to the user's manager and the app owner. Give clear choices of keep or revoke with a deadline, and revoke automatically if not reviewed. Capture evidence for auditors, and review exceptions with security. Run it quarterly for privileged access.
04
A new vendor will process customer personal data. What checks do you perform before onboarding?
Classify the vendor as high risk. Review their security questionnaire, ISO 27001 certificate or SOC 2 Type II report, data location, subprocessors, encryption, access controls and incident response capability. Under the DPDP Act, we remain responsible as data fiduciary, so the contract needs data processing terms, breach notification timelines, deletion on exit and audit rights. Track any gaps with deadlines.
Sigma is a generic YAML detection format that converts to SIEM queries.
title: Office Spawning PowerShell
logsource:
product: windows
category: process_creation
detection:
selection:
ParentImage|endswith: ['\winword.exe', '\excel.exe']
Image|endswith: '\powershell.exe'
condition: selection
level: high
tags: [attack.execution, attack.t1059.001]
Forward secrecy means that if a server's long-term private key is stolen later, previously recorded sessions still cannot be decrypted. It is achieved with ephemeral key exchange, such as ECDHE, where a new key pair is created for each session and discarded. TLS 1.3 makes forward secrecy mandatory by removing static RSA key exchange, which is one reason older TLS configurations are considered weak.
07
Which Windows event IDs should a SOC analyst know?
Key Security log events are 4624 successful logon, 4625 failed logon, 4672 special privileges assigned, 4688 process creation, 4720 user created, 4728 and 4732 user added to privileged groups, 4740 account lockout, 1102 audit log cleared, 4698 scheduled task created and 7045 service installed in the System log. Logon type in 4624, such as 3 for network and 10 for RDP, adds important context.
AWS IAM controls who can do what on which resources through users, groups, roles and JSON policies. Best practices are avoiding root account use and protecting it with MFA, using roles with temporary credentials instead of access keys, least privilege policies, permission boundaries, and Service Control Policies in AWS Organizations to set guardrails across accounts. IAM Access Analyzer helps find unused and external access.
09
What is the difference between a vulnerability assessment and a penetration test?
A vulnerability assessment uses scanners to find and rank as many known weaknesses as possible across many assets, and it is broad and frequent. A penetration test is a time-boxed, authorised attempt to exploit weaknesses and show real impact, such as reaching sensitive data. Assessments answer what is wrong; pen tests answer what an attacker could actually achieve. Most programmes run monthly scans and annual or release-based pen tests.
10
A business unit wants to accept a high risk instead of fixing it. How do you handle it?
Risk acceptance is a business decision, but it must be informed. I would document the risk, likely impact, cost of fixing and compensating controls, and confirm it exceeds or meets risk appetite. If it is high, escalate to the right authority, such as the CISO or risk committee, for formal sign-off with an expiry date. I record it in the risk register and review it on schedule.
The Digital Personal Data Protection Act 2023 governs digital personal data. Data fiduciaries need valid consent or a legitimate use, must give clear notice, protect data with reasonable safeguards, notify breaches to the Data Protection Board and affected people, and delete data when no longer needed. Data principals have rights to access, correction and erasure. Penalties go up to 250 crore rupees. The DPDP Rules 2025 phase in obligations.
Detection engineering treats detections like software: rules are written from threat models and ATT&CK techniques, stored in version control, tested with attack simulations, peer reviewed and measured for false positive rate. Formats like Sigma let rules be shared across SIEMs. Teams track coverage, tune noisy rules and retire obsolete ones. This replaces ad hoc rule creation that leads to noisy, untested alerts.
13
What is the difference between OAuth 2.0 and OpenID Connect?
OAuth 2.0 is an authorisation framework; it lets an app get an access token to call an API on a user's behalf, without the user's password. It does not define who the user is. OpenID Connect adds an identity layer with an ID token, a signed JWT containing user claims, and a userinfo endpoint. Use OIDC for login, and OAuth access tokens for API authorisation.
14
What is the difference between a policy, a standard, a procedure and a guideline?
A policy is a high-level management statement of intent, such as all data must be classified. A standard sets mandatory specific requirements, like AES-256 for confidential data. A procedure gives step-by-step instructions to meet the standard. A guideline is recommended but optional advice. This hierarchy lets policies stay stable while standards and procedures change with technology.
15
Describe a time you dealt with a user who was upset about losing access.
Situation: after an access review removed a sales manager's export rights, he escalated angrily before a client deadline. Task: solve his need while keeping the control. Action: I listened, explained why bulk exports were restricted, and arranged a time-bound approved export through his manager within an hour. Result: he met the deadline, and we added a documented request path for such cases.
16
An auditor finds that access reviews were not done for two quarters. What do you do?
Acknowledge the finding and agree a remediation plan. Immediately run the overdue reviews for in-scope systems, prioritising privileged access, and revoke unneeded access. Find the cause, such as no owner or a manual process, and fix it by assigning owners, automating campaigns in the IGA tool and adding reminders and escalations. Provide evidence of completed reviews to close the finding.
17
An alert shows Microsoft Word spawning PowerShell with an encoded command. What does it mean and what do you do?
Office apps rarely start PowerShell, so this usually means a malicious macro or document exploit. Decode the Base64 command to see what it does, check the process tree and any network connections for downloads, and find the source email. Isolate the host through EDR, block the sender and URLs, search for the same email in other mailboxes and hunt for the same command line elsewhere.
Check supported protocol versions, ciphers and certificate details. OpenSSL gives a quick view, and tools like testssl.sh give a full report.
openssl s_client -connect example.com:443 -tls1_2
openssl s_client -connect example.com:443 -servername example.com | openssl x509 -noout -dates -issuer
./testssl.sh example.com
Disable TLS 1.0 and 1.1, weak ciphers like RC4 and 3DES, and fix expiring certificates.
Passkeys are FIDO2 credentials that replace passwords. The device creates a key pair per website; the private key stays in the device or synced password manager, protected by biometrics or PIN, and the server stores only the public key. Login is a signature over a challenge tied to the real domain, so passkeys resist phishing and cannot be reused across sites. They also remove password reset load.
NIST CSF 2.0, released in 2024, organises cyber security outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover. Govern was added to cover strategy, roles, policy and supply chain risk. Each function has categories and subcategories. Organisations create current and target profiles to find gaps and plan improvements. It is voluntary and widely used to report maturity to boards.
21
What is a man-in-the-middle attack on TLS and how do certificates prevent it?
In a MITM attack, an attacker intercepts traffic and pretends to be the server. Certificates prevent this because the client checks that the server certificate chains to a trusted root, matches the hostname and is valid. An attacker cannot produce a valid certificate without the private key or a compromised CA. Certificate warnings that users click through, and apps that skip validation, break this protection.
22
Your manager asks why the company needs security when it already has antivirus on every laptop. How do you explain?
I would explain that antivirus mainly blocks known malicious files, while most modern attacks use stolen credentials, phishing links, living-off-the-land tools like PowerShell, or cloud misconfigurations that antivirus never sees. I would map our top risks to missing controls, such as MFA, EDR, logging and backups, and use a recent real incident pattern to show business impact in downtime and regulatory reporting cost.
23
A developer has hardcoded database passwords in a public code repository. What do you do?
Treat the secret as compromised immediately, even if the commit is removed, because public repos are scraped within minutes. Rotate the password and any related keys, check database logs for unknown logins since the commit time, and remove the secret from git history. Then fix the root cause by moving secrets to a vault or cloud secret manager and adding secret scanning to pre-commit hooks and the CI pipeline.
24
What is threat intelligence and what are IOCs and TTPs?
Threat intelligence is analysed information about adversaries, their tools and behaviour. Indicators of Compromise are artefacts like malicious IPs, domains and file hashes; they are easy to use but change quickly. TTPs, tactics, techniques and procedures, describe how attackers operate, and are harder for attackers to change. The Pyramid of Pain shows that detecting TTPs causes attackers more cost than blocking hashes.
25
Tell me about a time you had to convince a team to follow a compliance requirement they disliked.
Situation: developers resisted mandatory code review evidence for SOC 2, seeing it as paperwork. Task: get compliance without slowing releases. Action: I explained the audit risk to customer deals and showed that branch protection rules could create evidence automatically. Result: we enabled required reviews in the repository settings, evidence became automatic and the audit passed with no finding.
26
How do you handle a network team that refuses a security change you recommended?
Situation: the network team rejected my request to block outbound SMB at the firewall, fearing outages. Task: reduce the risk without damaging the relationship. Action: I shared flow data showing only two servers needed it, proposed an allowlist for them and a one-week monitor-only phase. Result: the team agreed, the rule went live with zero incidents, and we now review rules together monthly.
27
How would you capture and analyse suspicious traffic using tcpdump and Wireshark?
Capture on the right interface with a filter to limit size, save to a pcap file, then open it in Wireshark.
sudo tcpdump -i eth0 host 10.10.0.15 and port 53 -w dns.pcap
In Wireshark, use display filters such as dns, http.request or tls.handshake.type == 1, and Statistics > Conversations to spot top talkers. Protect pcaps because they may contain sensitive data.
28
During triage you notice a user logged in from Mumbai and then from Frankfurt 20 minutes later. How do you handle it?
This is an impossible travel alert. First rule out benign causes like corporate VPN, cloud proxy egress or mobile networks. Check device IDs, user agents and MFA results for both logins. If the second login is from an unknown device without MFA, or followed by mailbox rule creation or data download, revoke sessions, reset credentials, review MFA methods and contact the user through a separate channel.
29
A guest Wi-Fi user can reach internal printers. What is wrong and how do you fix it?
Guest traffic is not properly isolated, likely because the guest SSID shares a VLAN with internal devices or the firewall allows inter-VLAN routing. Fix by placing guests on a separate VLAN with internet-only access, applying ACLs that deny all RFC 1918 internal ranges, and enabling client isolation on the wireless controller. Then test from a guest device and document the design.
30
You are asked to prepare the company for its first ISO 27001 certification in nine months. How do you plan it?
Get leadership sponsorship and define the ISMS scope. Run a gap assessment against clauses and Annex A, then do the risk assessment and build the risk treatment plan and Statement of Applicability. Write core policies, implement missing controls, and train staff. Collect evidence for a few months, run an internal audit and management review, fix findings, then book stage 1 and stage 2 audits.
31
A key log source stopped sending data to the SIEM two days ago. Why does it matter and what do you do?
Silent log gaps create blind spots where attacks go undetected, and they can also break compliance. Raise it as a priority issue, check the forwarder or agent health, network path, licence limits and parsing errors, and restore ingestion. Check whether the gap overlapped any suspicious activity. Then add log source health monitoring that alerts when expected volume drops, so gaps are found in hours, not days.
Use a dedicated password hashing library with Argon2id, which handles salts and parameters automatically.
from argon2 import PasswordHasher
ph = PasswordHasher()
stored = ph.hash(password)
try:
ph.verify(stored, attempt)
if ph.check_needs_rehash(stored):
stored = ph.hash(attempt)
except Exception:
deny_login()
Never use plain SHA-256 or MD5 for passwords.
A DMZ, or perimeter network, is a separate zone between the internet and the internal network for public-facing services like web servers, mail relays and reverse proxies. Firewall rules allow internet traffic only to DMZ hosts and allow DMZ hosts only limited, specific connections inward. If a DMZ server is compromised, the attacker still faces another firewall layer before reaching internal systems.
Zero Trust removes implicit trust based on network location. Every request is verified using identity, device health and context, access is least privilege and granted per session, and the environment is assumed to be already breached. NIST SP 800-207 describes the model. In practice it means strong MFA, device posture checks, identity-aware proxies instead of flat VPN access, micro-segmentation and continuous monitoring. It is a journey, not a single product.
35
Users complain that a new firewall rule broke an application. How do you troubleshoot?
First check the firewall logs for denied traffic from the affected users or servers around the change time. Compare the change ticket with actual app requirements, since apps often use extra ports or dependencies. Use packet capture or a test connection to confirm. Then add a narrow rule for the real need, not an any-any rule, and update documentation so the next change does not repeat the problem.
36
Developers share one admin account for a production database. What do you propose?
Shared accounts break accountability and are hard to rotate. Give each person an individual named account with least privilege, and provide admin access through PAM with just-in-time approval and session recording. Store the remaining break-glass credential in the vault with alerts on use. Use read-only roles for daily troubleshooting. Roll out with the team so it does not slow urgent fixes.
Map each control to the evidence an auditor will request, such as screenshots of configurations, system exports, tickets, logs and signed approvals. Keep a central evidence library organised by control ID with dates. Automate collection where possible through GRC tools that pull data from cloud, identity and ticketing systems. Sample in advance to confirm evidence covers the full audit period.
Pick a realistic scenario, such as ransomware on a weekend, and invite IT, security, legal, communications and business leaders. A facilitator releases injects step by step, like a ransom note appearing or a journalist calling, and participants explain decisions using the real plan. Record gaps in contacts, authority, backups and reporting timelines. Share findings and track fixes, and repeat at least twice a year.
39
Describe a time you had to admit you did not know something in a technical discussion.
Situation: in a design review, an architect asked me whether our VPN supported post-quantum key exchange. Task: give an accurate answer. Action: I said I did not know rather than guessing, checked the vendor documentation and release notes that afternoon and shared a short summary with options. Result: the team trusted my answers more, and the finding was added to our cryptography roadmap.
40
Leadership wants to block all USB drives tomorrow. How would you handle this request?
I would support the goal but plan the rollout to avoid breaking business work. First, find who genuinely needs USB, such as field engineers, using endpoint logs. Then apply a device control policy through EDR or Intune that blocks mass storage by default, allows approved encrypted devices by serial number, and logs exceptions. Communicate the change, pilot it with one department, then enforce company wide.
Frequently asked questions
What is asked in Cyber Security interviews for 2 years of experience?
At two years, you should investigate independently and contain threats. Interviews dig into full investigations you led, EDR process tree analysis, false positive reduction, MITRE ATT&CK mapping and playbooks. Some questions cover cloud logs and identity attacks. You may be asked to design a detection rule end to end or explain how you improved a SOC process.
How many questions should I practise before a Cyber Security interview?
Work through all 40 questions here, then the company-wise sets for the employers you are targeting. Quality matters more than count: be able to explain why each answer is right.
Which topics matter most for 2 years of experience?
Focus first on Investigation depth, Detection tuning, MITRE ATT&CK mapping, Identity and cloud alerts.