Cyber Security Interview Questions for 7 Years Experience
40 questions with answers for candidates with 7 years of experience — 20 medium, 20 hard.
What interviewers expect: 7 years experience
With seven years, interviews target lead, manager or architect roles. Expect questions on Zero Trust architecture, building or scaling a SOC, choosing between in-house and MSSP models, budgets, hiring and vendor management. You should discuss trade-offs in depth, show how you aligned security with business goals and describe major incidents or transformations you led.
This set is weighted towards Identity and Access Management (10), Cloud Security (8), Incident Response and Forensics (7), Network Security (5).
Architecture and Zero Trust Team leadership Vendor and budget decisions Business alignment
Solved at this levelStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
What are India's CERT-In incident reporting requirements?
Under the CERT-In directions issued in April 2022, service providers, intermediaries, data centres and body corporates must report specified cyber incidents to CERT-In within six hours of noticing them. They must also keep ICT system logs for 180 days within India and synchronise clocks with NTP servers of NIC or NPL. Reportable incidents include ransomware, data breaches, and attacks on servers and cloud systems.
02
A user on the office LAN reports repeated certificate warnings and you suspect ARP spoofing. What is happening and how do you stop it?
ARP has no authentication, so an attacker on the same LAN can send fake ARP replies linking their MAC address to the gateway's IP. Victims then send traffic through the attacker, enabling man-in-the-middle interception. Defences include Dynamic ARP Inspection with DHCP snooping on switches, port security, network access control, and encrypting traffic end to end with TLS so intercepted data is useless.
NAC checks devices and users before allowing them on the network, typically using 802.1X with a RADIUS server. It can verify certificates, patch level, EDR presence and user identity, then assign a VLAN or policy. Unknown or non-compliant devices go to a quarantine or guest network. NAC is important in offices with many personal devices and IoT equipment such as printers and cameras.
Role-Based Access Control grants permissions to roles such as Finance Analyst, and users get roles; it is simple to manage and audit. Attribute-Based Access Control decides using attributes of the user, resource and context, such as department, data classification, location and time. ABAC is more flexible but harder to reason about. Many organisations use RBAC as the base and add attribute conditions for sensitive cases.
05
Your company website is under an application layer DDoS attack. What actions do you take?
Confirm it is an attack and not a traffic spike by checking request patterns, user agents and source spread. Enable or tighten the CDN or WAF bot protection and rate limits on targeted URLs, add challenge pages for suspicious clients, and cache heavy pages. Inform the ISP or DDoS provider and management. After the attack, review logs, tune rules and update the runbook.
06
Management wants to replace the VPN with Zero Trust access. How would you plan it?
I would start by inventorying applications and who uses them, then pick a low-risk app group for a pilot with an identity-aware proxy or ZTNA service. Integrate it with the identity provider, enforce MFA and device posture checks, and monitor access logs. Expand app by app, keep the VPN for legacy needs during transition, and retire it once every app is covered and tested.
07
Your CISO asks whether the company needs to act on quantum computing risk now. What do you advise?
Large quantum computers could break RSA and elliptic curve cryptography using Shor's algorithm. NIST published post-quantum standards in 2024: ML-KEM for key exchange, and ML-DSA and SLH-DSA for signatures. Attackers can harvest encrypted traffic now and decrypt it later, so long-lived sensitive data is at risk. Organisations should inventory cryptography, prefer crypto agility, and test hybrid key exchange that browsers already support.
08
How do you replace static cloud keys in CI/CD pipelines?
Use workload identity federation with OIDC. The CI system issues a short-lived signed token for each job, and the cloud provider trusts that issuer and exchanges the token for temporary credentials of a narrow role. Restrict the trust policy to a specific repository and branch. This removes long-lived secrets from pipeline settings, so a leaked log or variable no longer gives permanent access.
09
An audit finds 200 active accounts belonging to employees who left. How do you fix it?
Disable the accounts immediately after confirming with HR, then check each for recent logins, since any use after the exit date is a potential incident. Find the root cause, usually manual offboarding or apps not connected to SSO. Integrate the HR system with the identity platform for automatic disabling, connect apps to SSO and SCIM provisioning, and run monthly orphan account reports.
10
Attackers bypassed MFA by sending repeated push notifications until a user approved. How do you prevent this?
This is MFA fatigue. Enable number matching and show app and location context in push requests, limit the number of prompts, and alert on repeated denials. Move high-risk users and admins to phishing-resistant methods such as FIDO2 keys or passkeys. Train users to report unexpected prompts. Also revoke the attacker's sessions and review what they accessed.
11
How do you build a cryptography inventory for an organisation?
Combine several sources: scan network services for TLS versions, ciphers and certificate keys; query CT logs and internal PKI for issued certificates; use code scanning to find crypto library calls and hardcoded keys; and export KMS and HSM key lists. Record algorithm, key length, owner, data sensitivity and expiry. This inventory supports compliance, certificate renewals and planning the post-quantum migration.
12
Your company is moving a banking application to the cloud. What security controls would you require?
I would require a landing zone with separate accounts, Indian region hosting for data residency, private networking with no public database endpoints, WAF and DDoS protection, customer managed KMS keys, PAM for admin access, central immutable logging to the SIEM, CSPM against CIS benchmarks, vulnerability scanning in CI, and a tested backup and disaster recovery plan. All mapped to RBI and audit requirements.
13
An employee who is leaving copied large volumes of data to a personal cloud drive. How do you handle it?
Treat it as a potential insider incident and involve HR and legal before contacting the employee. Preserve evidence such as DLP alerts, proxy logs, endpoint file activity and cloud app logs, and document what data was involved and its sensitivity. Restrict the user's access as advised. Legal decides on next steps, such as requesting deletion with an undertaking. Then improve DLP and offboarding controls.
14
What are the data residency rules relevant to cloud in India?
The DPDP Act 2023 allows cross-border transfer of personal data except to countries the government restricts, though sector rules can be stricter. RBI requires payment system data to be stored only in India. CERT-In requires ICT logs to be kept in India for 180 days. SEBI and IRDAI have their own requirements for regulated entities. Cloud architects choose Indian regions such as Mumbai or Hyderabad for compliance.
15
Why is a multi-account or multi-subscription structure important in the cloud?
Separate accounts or subscriptions for production, development, security tooling, logging and shared services create strong blast-radius boundaries and simpler permissions. A compromised dev account cannot touch production. Central guardrails like AWS Service Control Policies or Azure Policy enforce rules everywhere, and a dedicated log archive account protects audit logs. Landing zone frameworks automate this setup for new teams.
16
What is a man-in-the-middle attack on TLS and how do certificates prevent it?
In a MITM attack, an attacker intercepts traffic and pretends to be the server. Certificates prevent this because the client checks that the server certificate chains to a trusted root, matches the hostname and is valid. An attacker cannot produce a valid certificate without the private key or a compromised CA. Certificate warnings that users click through, and apps that skip validation, break this protection.
17
During a major breach, an engineer asks why legal and communications must join the war room. How do you explain?
Legal advises on regulatory notification, such as CERT-In within six hours and the Data Protection Board and affected people under the DPDP Act, contractual duties to clients, evidence handling and privilege. Communications manage messaging to customers, staff, media and investors so statements are accurate and consistent. Technical teams should involve them early, because poor communication can cause more damage than the incident itself.
NIST CSF 2.0, released in 2024, organises cyber security outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover. Govern was added to cover strategy, roles, policy and supply chain risk. Each function has categories and subcategories. Organisations create current and target profiles to find gaps and plan improvements. It is voluntary and widely used to report maturity to boards.
19
How do you find stale and privileged accounts in Active Directory with PowerShell?
Collect timestamps from many sources: Windows event logs, file system MFT records, prefetch, browser history, EDR telemetry, proxy, firewall and cloud logs. Normalise all of them to UTC, then merge them using tools like Plaso and Timeline Explorer. Mark key points such as initial access, privilege escalation, lateral movement and exfiltration. The timeline drives scoping, root cause and the incident report.
21
What is threat intelligence and what are IOCs and TTPs?
Threat intelligence is analysed information about adversaries, their tools and behaviour. Indicators of Compromise are artefacts like malicious IPs, domains and file hashes; they are easy to use but change quickly. TTPs, tactics, techniques and procedures, describe how attackers operate, and are harder for attackers to change. The Pyramid of Pain shows that detecting TTPs causes attackers more cost than blocking hashes.
Start with admins and remote access, then high-risk groups like finance. Pick methods, preferring authenticator app number matching and passkeys or FIDO2 keys for admins. Pilot with one department, prepare helpdesk scripts and self-service registration, and communicate clearly with deadlines. Use conditional access in report-only mode to find gaps, then enforce. Block legacy authentication and track registration rates weekly.
23
A firewall audit finds 40 percent of rules have not been hit in a year. What do you do?
Unused rules expand attack surface and slow audits. I would export rule hit counts, confirm no seasonal apps like year-end batch jobs depend on them, and contact rule owners listed in tickets. Rules with no owner are disabled first, not deleted, and monitored for a month. After that they are removed. I would also add rule expiry dates and quarterly reviews to the change process.
24
Write a least-privilege AWS IAM policy that allows reading one S3 bucket.
Allow only listing that bucket and reading its objects.
{
"Version": "2012-10-17",
"Statement": [
{"Effect": "Allow", "Action": "s3:ListBucket",
"Resource": "arn:aws:s3:::reports-prod"},
{"Effect": "Allow", "Action": "s3:GetObject",
"Resource": "arn:aws:s3:::reports-prod/*"}
]
}
Attach it to a role, not a user with long-lived keys.
CSPM, Cloud Security Posture Management, checks cloud configurations against benchmarks like CIS and flags risks. CWPP, Cloud Workload Protection Platform, protects running workloads such as VMs, containers and serverless with vulnerability scanning and runtime detection. CNAPP combines these with identity analysis, IaC scanning and attack path analysis in one platform. The goal is to prioritise risks that combine, like a public VM with a critical flaw and admin role.
26
Your company is acquiring another firm with its own Active Directory. How do you approach identity integration securely?
Start with assessment: their AD health, privileged accounts, trust relationships, MFA coverage and any signs of compromise. Avoid creating a full two-way forest trust early, as it can import their risks. Prefer bringing users into your cloud identity provider with B2B access or migration, with conditional access. Reset privileged credentials, apply your tiering model, and migrate application by application.
27
Which Indian regulators issue cyber security requirements for financial firms?
RBI issues directions for banks, NBFCs and payment operators, including the IT governance and risk management directions and the cyber security framework for banks. SEBI issued the Cybersecurity and Cyber Resilience Framework for regulated entities in 2024. IRDAI has information and cyber security guidelines for insurers. All require board-approved policies, SOC monitoring, incident reporting and periodic audits.
Common attacks are password spraying, Kerberoasting, which requests service tickets for accounts with SPNs and cracks them offline, AS-REP roasting on accounts without pre-authentication, pass-the-hash, DCSync to pull password hashes, and abusing misconfigured ACLs and delegation. Defences include long random service account passwords or gMSAs, tiered admin models, LAPS for local admin passwords, Protected Users group and monitoring ticket requests.
29
A private key for an internal code-signing certificate was found on a shared drive. What actions do you take?
Treat it as compromised. Revoke the certificate with the CA, issue a new one with the key generated and stored in an HSM or cloud key service, and restrict signing to the build pipeline. Search for any binaries signed with the old key after the exposure time and investigate them. Remove the file, check drive access logs to see who opened it, and update the key handling policy.
30
Tell me about a time you had to say no to a senior person's access request.
Situation: a senior manager asked for permanent admin rights on production to speed up reports. Task: protect production without blocking the work. Action: I explained the audit and breach risk, then offered a read-only reporting role and a scheduled export within a day. Result: the manager got the data faster than before, and the audit later had no finding on that system.
31
A ransomware attack has encrypted 50 servers. Walk through your response.
Activate the incident plan and set up a war room with a separate communication channel. Contain by isolating affected segments, disabling compromised accounts, and blocking known command and control. Preserve evidence from a few hosts. Identify initial access and scope, including data theft. Verify offline backups, rebuild from clean images, and restore by business priority. Report to CERT-In within six hours and involve legal before any ransom discussion.
PAM protects powerful accounts like domain admins, root, database admins and cloud owners. It includes a vault for credentials with automatic rotation, just-in-time elevation, session brokering with recording, approval workflows and alerts on unusual use. Tools include CyberArk, BeyondTrust and Delinea. PAM is important because attackers aim for privileged credentials to move laterally and deploy ransomware across the network.
33
How would you implement just-in-time privileged access in the cloud?
Remove standing admin roles. Make users eligible for roles through a PIM or PAM tool, so they request activation with justification, MFA and optional approval, for a limited time like two hours. Log every activation and alert on unusual ones. For automation, use workload identities with narrow roles instead of admin keys. Review eligible assignments quarterly to keep the list small.
34
A cloud access key was leaked and used to start crypto-mining instances. What is your response?
Deactivate the key immediately and check who owns it. Review cloud audit logs for every action taken with it, such as new instances, users, roles or policy changes, because attackers often create persistence. Terminate unauthorised resources, delete created users and keys, and check billing impact. Then find how it leaked, move workloads to roles with short-lived credentials and enable budget and anomaly alerts.
YARA matches files or memory by strings and conditions, and is used for hunting and classifying malware.
rule Suspicious_Invoice_Dropper
{
strings:
$a = "invoice_payload" ascii
$b = { 4D 5A 90 00 }
$c = "powershell -enc" nocase
condition:
$b at 0 and ($a or $c)
}
Test rules against clean files to avoid false positives.
36
Which cloud logs are essential for security monitoring?
Essential sources are control plane audit logs such as AWS CloudTrail, Azure Activity Log and Entra sign-in logs, and Google Cloud Audit Logs. Add network flow logs, DNS logs, load balancer and WAF logs, storage access logs for sensitive buckets, and Kubernetes audit logs. Send them to a central account or SIEM that workload owners cannot delete, and enable threat detection services like GuardDuty.
37
A pentest shows an SSRF flaw in your app can reach the cloud metadata endpoint. Why is that serious and how do you fix it?
Cloud VMs can query a local metadata endpoint at 169.254.169.254 to get instance details and temporary role credentials. If an application has a server-side request forgery flaw, an attacker can make it fetch these credentials. AWS IMDSv2 requires a session token obtained with a PUT request and limits hops, which blocks most SSRF abuse. Enforce IMDSv2 and give instance roles minimal permissions.
38
Tell me about a time you made a mistake at work and how you handled it.
Situation: as a Tier 1 analyst I closed an alert as false positive without checking the user's later activity. Task: my lead found it was a real phishing compromise. Action: I owned the mistake, helped contain it, and proposed a checklist for credential alerts that includes reviewing activity after login. Result: the checklist was adopted by the shift and similar misses stopped.
39
Your manager asks why the company needs security when it already has antivirus on every laptop. How do you explain?
I would explain that antivirus mainly blocks known malicious files, while most modern attacks use stolen credentials, phishing links, living-off-the-land tools like PowerShell, or cloud misconfigurations that antivirus never sees. I would map our top risks to missing controls, such as MFA, EDR, logging and backups, and use a recent real incident pattern to show business impact in downtime and regulatory reporting cost.
The Lockheed Martin Cyber Kill Chain describes seven stages of an intrusion: reconnaissance, weaponisation, delivery, exploitation, installation, command and control, and actions on objectives. Defenders use it to map controls to each stage, for example email filtering at delivery and egress filtering at command and control. Its weakness is a perimeter focus, so many teams pair it with MITRE ATT&CK for detailed techniques after initial access.
Frequently asked questions
What is asked in Cyber Security interviews for 7 years of experience?
With seven years, interviews target lead, manager or architect roles. Expect questions on Zero Trust architecture, building or scaling a SOC, choosing between in-house and MSSP models, budgets, hiring and vendor management. You should discuss trade-offs in depth, show how you aligned security with business goals and describe major incidents or transformations you led.
How many questions should I practise before a Cyber Security interview?
Work through all 40 questions here, then the company-wise sets for the employers you are targeting. Quality matters more than count: be able to explain why each answer is right.
Which topics matter most for 7 years of experience?
Focus first on Architecture and Zero Trust, Team leadership, Vendor and budget decisions, Business alignment.