Cyber Security Interview Questions for 5 Years Experience
40 questions with answers for candidates with 5 years of experience — 2 easy, 20 medium, 18 hard.
What interviewers expect: 5 years experience
At five years, you are expected to own a domain such as detection engineering, cloud security or IR. Interviews include design questions, like building a detection programme or securing a multi-account cloud, plus metrics, tool selection and stakeholder management. Regulatory knowledge such as CERT-In, DPDP and RBI requirements becomes important, along with examples of measurable improvements you delivered.
This set is weighted towards Cryptography and PKI (7), Incident Response and Forensics (7), Network Security (6), Identity and Access Management (5).
Security programme design Metrics and reporting Regulatory requirements Stakeholder management
Solved at this levelStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
MITRE ATT&CK is a public knowledge base of adversary tactics and techniques observed in real attacks, organised in matrices for Enterprise, Mobile and ICS. Tactics are the goal, such as Persistence, and techniques are the method, such as T1053 Scheduled Task. Teams use it to map detection coverage, write threat-informed detections, plan red and purple team exercises, and describe incidents in a common language.
02
How would you run a basic threat model for a new web application?
Draw a data flow diagram showing users, the web app, APIs, databases and third parties, and mark trust boundaries. Then apply STRIDE to each element: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service and Elevation of privilege. For each threat, record the existing control, a risk rating and an owner. Repeat the model whenever the architecture changes, ideally during design reviews.
PAM protects powerful accounts like domain admins, root, database admins and cloud owners. It includes a vault for credentials with automatic rotation, just-in-time elevation, session brokering with recording, approval workflows and alerts on unusual use. Tools include CyberArk, BeyondTrust and Delinea. PAM is important because attackers aim for privileged credentials to move laterally and deploy ransomware across the network.
An HSM is tamper-resistant hardware that generates, stores and uses cryptographic keys without exposing them. Keys never leave the device in plain form. Banks and payment processors use HSMs for PIN processing, card keys and signing, and CAs protect root keys with them. Cloud offerings include managed HSM and KMS services. HSMs are often required for compliance standards such as PCI DSS and certified to FIPS 140-3.
05
How does a VPN protect traffic and what are its limits?
A VPN creates an encrypted tunnel, using IPsec, WireGuard or TLS, between a client and a network, protecting data on untrusted networks. Its limits are important: once connected, users often get broad network access, and VPN appliances are a frequent target for exploited vulnerabilities. That is why many companies move to Zero Trust Network Access, which grants per-application access after identity and device checks.
AES-GCM is an authenticated encryption mode, so it gives confidentiality and integrity together, detecting any tampering through its authentication tag. AES-CBC gives only confidentiality and needs a separate MAC; mistakes in combining them caused padding oracle attacks. GCM is also fast with hardware support. Its main rule is never reusing a nonce with the same key, because reuse breaks both confidentiality and integrity.
07
A US customer asks your Indian SaaS company for a SOC 2 report. What is it and which type should you aim for?
SOC 2 is an attestation report by an independent auditor on a service organisation's controls against the AICPA Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy. A Type I report checks control design at a point in time; a Type II checks operating effectiveness over a period, typically 6 to 12 months. Indian SaaS companies selling to US customers commonly need SOC 2 Type II.
08
Developers want admin access in the cloud to move fast. How do you balance speed and security?
Give them freedom inside guardrails. Provide sandbox accounts where they have broad rights, but production changes go through IaC pipelines with scanning and review. Use permission boundaries and SCPs to block dangerous actions like disabling logging or making resources public. Offer pre-approved modules for common patterns. This keeps speed high while preventing the riskiest mistakes.
09
Tell me about a time you had to say no to a senior person's access request.
Situation: a senior manager asked for permanent admin rights on production to speed up reports. Task: protect production without blocking the work. Action: I explained the audit and breach risk, then offered a read-only reporting role and a scheduled export within a day. Result: the manager got the data faster than before, and the audit later had no finding on that system.
10
How would you build a forensic timeline of an incident?
Collect timestamps from many sources: Windows event logs, file system MFT records, prefetch, browser history, EDR telemetry, proxy, firewall and cloud logs. Normalise all of them to UTC, then merge them using tools like Plaso and Timeline Explorer. Mark key points such as initial access, privilege escalation, lateral movement and exfiltration. The timeline drives scoping, root cause and the incident report.
11
How would you set up envelope encryption for application data in the cloud?
Create a customer managed key in the cloud KMS with strict IAM so only the app role can use it. The app asks KMS for a data key, encrypts records locally with AES-GCM using the plaintext data key, stores the encrypted data key next to the data, and discards the plaintext key. To decrypt, it sends the encrypted data key to KMS. Enable key rotation and audit logging.
12
How do you replace static cloud keys in CI/CD pipelines?
Use workload identity federation with OIDC. The CI system issues a short-lived signed token for each job, and the cloud provider trusts that issuer and exchanges the token for temporary credentials of a narrow role. Restrict the trust policy to a specific repository and branch. This removes long-lived secrets from pipeline settings, so a leaked log or variable no longer gives permanent access.
13
How do you prioritise 500 vulnerabilities found in a scan?
CVSS alone is not enough. I combine severity with exploitability and exposure: check the CISA Known Exploited Vulnerabilities list and EPSS score, whether the asset is internet facing, and how critical the business data on it is. Internet-facing systems with known exploited flaws are fixed first, often within days. Internal low-severity findings go into normal patch cycles. Group fixes by patch to reduce effort.
14
Your EDR shows the same suspicious hash on 30 machines. How do you scope the incident?
Search the hash, file name and parent process across all endpoints, and look for related indicators like network destinations and persistence mechanisms. Build a timeline to find patient zero and the delivery method, for example an email attachment or a compromised software update. Group affected hosts by criticality, isolate them, and check whether any credentials were stolen to plan resets broadly.
15
How would you implement just-in-time privileged access in the cloud?
Remove standing admin roles. Make users eligible for roles through a PIM or PAM tool, so they request activation with justification, MFA and optional approval, for a limited time like two hours. Log every activation and alert on unusual ones. For automation, use workload identities with narrow roles instead of admin keys. Review eligible assignments quarterly to keep the list small.
16
Your company is acquiring another firm with its own Active Directory. How do you approach identity integration securely?
Start with assessment: their AD health, privileged accounts, trust relationships, MFA coverage and any signs of compromise. Avoid creating a full two-way forest trust early, as it can import their risks. Prefer bringing users into your cloud identity provider with B2B access or migration, with conditional access. Reset privileged credentials, apply your tiering model, and migrate application by application.
17
You are asked to prepare the company for its first ISO 27001 certification in nine months. How do you plan it?
Get leadership sponsorship and define the ISMS scope. Run a gap assessment against clauses and Annex A, then do the risk assessment and build the risk treatment plan and Statement of Applicability. Write core policies, implement missing controls, and train staff. Collect evidence for a few months, run an internal audit and management review, fix findings, then book stage 1 and stage 2 audits.
Start from business needs and regulations, keep it short and clear, and state scope, purpose, roles, requirements and exceptions. Avoid technical detail that changes often; put that in standards. Get input from IT, HR and legal, then management approval. Publish it where staff can find it, train people, require acknowledgement and review it at least yearly or after major changes.
Pick a realistic scenario, such as ransomware on a weekend, and invite IT, security, legal, communications and business leaders. A facilitator releases injects step by step, like a ransom note appearing or a journalist calling, and participants explain decisions using the real plan. Record gaps in contacts, authority, backups and reporting timelines. Share findings and track fixes, and repeat at least twice a year.
20
Which cloud logs are essential for security monitoring?
Essential sources are control plane audit logs such as AWS CloudTrail, Azure Activity Log and Entra sign-in logs, and Google Cloud Audit Logs. Add network flow logs, DNS logs, load balancer and WAF logs, storage access logs for sensitive buckets, and Kubernetes audit logs. Send them to a central account or SIEM that workload owners cannot delete, and enable threat detection services like GuardDuty.
21
Your CISO asks whether the company needs to act on quantum computing risk now. What do you advise?
Large quantum computers could break RSA and elliptic curve cryptography using Shor's algorithm. NIST published post-quantum standards in 2024: ML-KEM for key exchange, and ML-DSA and SLH-DSA for signatures. Attackers can harvest encrypted traffic now and decrypt it later, so long-lived sensitive data is at risk. Organisations should inventory cryptography, prefer crypto agility, and test hybrid key exchange that browsers already support.
22
How do you keep your cloud security skills updated?
I follow provider security blogs and release notes, since services change monthly, and read incident write-ups to learn real attack paths. I practise in personal free-tier accounts with budget alerts, using deliberately vulnerable labs. I hold a cloud security certification and plan the next one. I also share short notes with my team, which helps me learn more deeply.
23
A TLS certificate expired on the main customer portal and caused an outage. How do you prevent this in future?
First renew and deploy the certificate to restore service. For prevention, build a certificate inventory from scanning and CT logs, automate issuance and renewal with ACME where possible, and set alerts at 30, 14 and 7 days before expiry to a team mailbox, not an individual. Assign an owner per certificate and add expiry checks to monitoring dashboards, since shorter lifetimes are coming.
24
What is the difference between OAuth 2.0 and OpenID Connect?
OAuth 2.0 is an authorisation framework; it lets an app get an access token to call an API on a user's behalf, without the user's password. It does not define who the user is. OpenID Connect adds an identity layer with an ID token, a signed JWT containing user claims, and a userinfo endpoint. Use OIDC for login, and OAuth access tokens for API authorisation.
25
A vendor announces a zero-day in your internet-facing appliance with no patch yet. What does that mean and how do you protect the company?
A zero-day is a flaw that the vendor does not know about or has not yet patched, so defenders have had zero days to fix it. Exploits for zero-days are valuable and often used in targeted attacks. Since patches are unavailable, defence relies on layered controls: EDR behaviour detection, network segmentation, least privilege, virtual patching with WAF or IPS rules, and fast patching once a fix is released.
26
A new vendor will process customer personal data. What checks do you perform before onboarding?
Classify the vendor as high risk. Review their security questionnaire, ISO 27001 certificate or SOC 2 Type II report, data location, subprocessors, encryption, access controls and incident response capability. Under the DPDP Act, we remain responsible as data fiduciary, so the contract needs data processing terms, breach notification timelines, deletion on exit and audit rights. Track any gaps with deadlines.
27
A cloud access key was leaked and used to start crypto-mining instances. What is your response?
Deactivate the key immediately and check who owns it. Review cloud audit logs for every action taken with it, such as new instances, users, roles or policy changes, because attackers often create persistence. Terminate unauthorised resources, delete created users and keys, and check billing impact. Then find how it leaked, move workloads to roles with short-lived credentials and enable budget and anomaly alerts.
28
Users complain that a new firewall rule broke an application. How do you troubleshoot?
First check the firewall logs for denied traffic from the affected users or servers around the change time. Compare the change ticket with actual app requirements, since apps often use extra ports or dependencies. Use packet capture or a test connection to confirm. Then add a narrow rule for the real need, not an any-any rule, and update documentation so the next change does not repeat the problem.
29
A business unit wants to accept a high risk instead of fixing it. How do you handle it?
Risk acceptance is a business decision, but it must be informed. I would document the risk, likely impact, cost of fixing and compensating controls, and confirm it exceeds or meets risk appetite. If it is high, escalate to the right authority, such as the CISO or risk committee, for formal sign-off with an expiry date. I record it in the risk register and review it on schedule.
Forward secrecy means that if a server's long-term private key is stolen later, previously recorded sessions still cannot be decrypted. It is achieved with ephemeral key exchange, such as ECDHE, where a new key pair is created for each session and discarded. TLS 1.3 makes forward secrecy mandatory by removing static RSA key exchange, which is one reason older TLS configurations are considered weak.
31
How do you create a forensic disk image and verify it?
Use a write blocker or a forensic tool, image the whole disk, and hash both source and image.
sudo dc3dd if=/dev/sdb of=/evidence/case12.img hash=sha256 log=/evidence/case12.log
sha256sum /evidence/case12.img
Record the hashes, time, examiner and device details in the chain of custody form. Analyse a working copy, never the original.
32
Management wants to replace the VPN with Zero Trust access. How would you plan it?
I would start by inventorying applications and who uses them, then pick a low-risk app group for a pilot with an identity-aware proxy or ZTNA service. Integrate it with the identity provider, enforce MFA and device posture checks, and monitor access logs. Expand app by app, keep the VPN for legacy needs during transition, and retire it once every app is covered and tested.
YARA matches files or memory by strings and conditions, and is used for hunting and classifying malware.
rule Suspicious_Invoice_Dropper
{
strings:
$a = "invoice_payload" ascii
$b = { 4D 5A 90 00 }
$c = "powershell -enc" nocase
condition:
$b at 0 and ($a or $c)
}
Test rules against clean files to avoid false positives.
34
How do you communicate technical incident details to senior management?
I lead with business impact: what is affected, current status, risk to customers or data, and decisions needed from them. Technical details go in an appendix. For example, in a past incident I gave updates every two hours in a fixed format: what we know, what we are doing, what we need, next update time. This kept leaders calm and decisions quick.
35
Describe a time you handled a stressful outage or security issue.
Situation: during my internship the office internet went down during a client demo because of a broadcast storm. Task: restore service quickly. Action: I checked switch logs, found a looped cable creating a loop, removed it, and then enabled spanning tree and storm control with my senior. Result: service returned in 20 minutes, and I wrote a short runbook so the team could resolve similar issues faster.
AWS IAM controls who can do what on which resources through users, groups, roles and JSON policies. Best practices are avoiding root account use and protecting it with MFA, using roles with temporary credentials instead of access keys, least privilege policies, permission boundaries, and Service Control Policies in AWS Organizations to set guardrails across accounts. IAM Access Analyzer helps find unused and external access.
A Distributed Denial of Service attack floods a target from many sources to exhaust bandwidth, connection tables or application resources. Types are volumetric floods, protocol attacks like SYN floods, and application layer floods hitting costly pages. Mitigation uses upstream scrubbing services or CDN providers, anycast networks, rate limiting, SYN cookies, autoscaling, and a tested runbook agreed with the ISP before an attack.
Certificate Transparency requires publicly trusted CAs to log every issued certificate in public append-only logs. Browsers require proof of logging before trusting a certificate. Domain owners can monitor these logs to detect certificates issued for their domains without permission, for example by a compromised CA or a phishing actor. Security teams also use CT logs for subdomain discovery and asset inventory.
39
Your servers can reach any internet destination freely. Why is this a problem and how do you introduce egress filtering?
Egress filtering controls outbound traffic, allowing only needed destinations and ports. It blocks malware call-backs, data exfiltration and servers reaching the internet directly. Many networks allow all outbound traffic because it is easier and legacy apps have undocumented dependencies. A practical approach is forcing web traffic through a proxy, blocking direct outbound from servers, and allowing exceptions only with business justification.
40
Write a KQL query in Microsoft Sentinel to find sign-ins from many countries for one user.
Use SigninLogs, summarise distinct countries per user over a day and flag outliers.
SigninLogs
| where TimeGenerated > ago(1d)
| where ResultType == 0
| summarize Countries = dcount(Location), List = make_set(Location) by UserPrincipalName
| where Countries > 2
| order by Countries desc
Review results with known travel and VPN egress points before escalating.
Frequently asked questions
What is asked in Cyber Security interviews for 5 years of experience?
At five years, you are expected to own a domain such as detection engineering, cloud security or IR. Interviews include design questions, like building a detection programme or securing a multi-account cloud, plus metrics, tool selection and stakeholder management. Regulatory knowledge such as CERT-In, DPDP and RBI requirements becomes important, along with examples of measurable improvements you delivered.
How many questions should I practise before a Cyber Security interview?
Work through all 40 questions here, then the company-wise sets for the employers you are targeting. Quality matters more than count: be able to explain why each answer is right.
Which topics matter most for 5 years of experience?
Focus first on Security programme design, Metrics and reporting, Regulatory requirements, Stakeholder management.