GRC analysts manage security policies, risk assessments, audits and compliance programmes. They maintain the risk register, prepare evidence for ISO 27001, SOC 2 or PCI DSS audits, review vendor security, track remediation and map controls to RBI, SEBI and DPDP requirements. The role suits people with strong writing and communication skills, and many consulting firms hire freshers for it. It is a strong long-term path too.
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
How do you check which ports are listening on a server you manage?
List listening sockets with the owning process, then compare against what the server should expose. Anything unexpected needs an owner or should be closed.
# Linux
sudo ss -tulpn
# Windows
netstat -ano | findstr LISTENING
Get-NetTCPConnection -State Listen
Map the PID to a process name in Task Manager or with ps to identify the service.
GRC is Governance, Risk and Compliance. Governance sets direction, policies, roles and accountability for security. Risk management identifies, assesses and treats risks to an acceptable level. Compliance ensures the organisation meets laws, regulations, contracts and standards such as the DPDP Act, RBI directions, ISO 27001 and PCI DSS. GRC analysts write policies, run risk assessments, manage audits and track remediation.
03
How would you capture and analyse suspicious traffic using tcpdump and Wireshark?
Capture on the right interface with a filter to limit size, save to a pcap file, then open it in Wireshark.
sudo tcpdump -i eth0 host 10.10.0.15 and port 53 -w dns.pcap
In Wireshark, use display filters such as dns, http.request or tls.handshake.type == 1, and Statistics > Conversations to spot top talkers. Protect pcaps because they may contain sensitive data.
The Digital Personal Data Protection Act 2023 governs digital personal data. Data fiduciaries need valid consent or a legitimate use, must give clear notice, protect data with reasonable safeguards, notify breaches to the Data Protection Board and affected people, and delete data when no longer needed. Data principals have rights to access, correction and erasure. Penalties go up to 250 crore rupees. The DPDP Rules 2025 phase in obligations.
05
Tell me about a time you learned a difficult technical topic quickly.
Situation: in my final year project I needed TLS mutual authentication for an IoT prototype within two weeks. Task: understand PKI enough to build it. Action: I read the TLS 1.3 overview, set up a small CA with OpenSSL, issued device certificates and tested failures deliberately. Result: the demo worked, and I documented the steps so classmates could reuse them, which helped our team score well.
06
How do you generate a strong random secret or password from the command line?
Use a cryptographically secure source, never a simple random function. OpenSSL and Python's secrets module both use the operating system CSPRNG.
openssl rand -base64 32
python3 -c "import secrets; print(secrets.token_urlsafe(32))"
Store the output in a password manager or secret vault, not in a text file or chat message.
07
Tell me about a time you explained a security risk to a non-technical person.
Situation: my team lead in a support role wanted to share admin passwords on a spreadsheet. Task: change this without slowing the team. Action: I explained the risk as a house key copied for everyone, showed how one leaked laptop exposes all systems, and proposed a password manager with shared vaults. Result: we adopted it within a week and audit findings dropped.
08
What is the difference between a vulnerability assessment and a penetration test?
A vulnerability assessment uses scanners to find and rank as many known weaknesses as possible across many assets, and it is broad and frequent. A penetration test is a time-boxed, authorised attempt to exploit weaknesses and show real impact, such as reaching sensitive data. Assessments answer what is wrong; pen tests answer what an attacker could actually achieve. Most programmes run monthly scans and annual or release-based pen tests.
The Lockheed Martin Cyber Kill Chain describes seven stages of an intrusion: reconnaissance, weaponisation, delivery, exploitation, installation, command and control, and actions on objectives. Defenders use it to map controls to each stage, for example email filtering at delivery and egress filtering at command and control. Its weakness is a perimeter focus, so many teams pair it with MITRE ATT&CK for detailed techniques after initial access.
The CIA triad is Confidentiality, Integrity and Availability, the three goals every control supports. Confidentiality keeps data away from unauthorised people, for example with encryption and access control. Integrity ensures data is not altered without detection, using hashes and digital signatures. Availability keeps systems usable when needed, through backups, redundancy and DDoS protection. Most security decisions are a trade-off between these three.
11
Describe a time you handled a stressful outage or security issue.
Situation: during my internship the office internet went down during a client demo because of a broadcast storm. Task: restore service quickly. Action: I checked switch logs, found a looped cable creating a loop, removed it, and then enabled spanning tree and storm control with my senior. Result: service returned in 20 minutes, and I wrote a short runbook so the team could resolve similar issues faster.
12
How would you design a joiner, mover, leaver process for a growing company?
JML is the identity lifecycle. Joiners get accounts and baseline access from HR data on day one. Movers change roles, and their old access must be removed, not just new access added, to avoid privilege creep. Leavers must be disabled promptly, ideally automatically when HR records their exit. Automating JML from the HR system to the identity platform reduces orphan accounts, which auditors frequently flag.
13
Explain the difference between symmetric and asymmetric encryption at a basic level.
Symmetric encryption uses one shared key for encryption and decryption, such as AES; it is fast and used for bulk data. Asymmetric encryption uses a public and private key pair, such as RSA or elliptic curve keys; it is slower but solves key distribution and enables digital signatures. Real protocols like TLS combine them: asymmetric methods agree on a session key, then AES encrypts the traffic.
Defence in depth means using several independent layers of controls so that one failure does not lead to a breach. A typical stack has perimeter firewalls, email filtering, endpoint EDR, MFA, network segmentation, least privilege, logging and backups. If a phishing email gets past the filter, MFA and EDR can still stop the attacker. The trade-off is cost and complexity, so layers should target the most likely attack paths.
15
What is the difference between an event, an alert and an incident?
An event is any observable occurrence, like a login or a file change. An alert is an event or pattern that a tool flags as possibly malicious. An incident is a confirmed or highly likely violation of security policy that needs response, such as a compromised account. Clear definitions matter because incidents trigger escalation, legal review and regulatory reporting timelines.
16
How do you prioritise 500 vulnerabilities found in a scan?
CVSS alone is not enough. I combine severity with exploitability and exposure: check the CISA Known Exploited Vulnerabilities list and EPSS score, whether the asset is internet facing, and how critical the business data on it is. Internet-facing systems with known exploited flaws are fixed first, often within days. Internal low-severity findings go into normal patch cycles. Group fixes by patch to reduce effort.
17
How do you design an access review for a critical application?
Define scope, such as all users with write or admin rights. Pull entitlements and last-login data from the app, and route each item to the user's manager and the app owner. Give clear choices of keep or revoke with a deadline, and revoke automatically if not reviewed. Capture evidence for auditors, and review exceptions with security. Run it quarterly for privileged access.
18
What is the difference between a threat, a vulnerability and a risk?
A vulnerability is a weakness, such as an unpatched server. A threat is anything that can exploit it, such as a ransomware group. Risk is the likelihood that the threat exploits the vulnerability multiplied by the business impact. For example, an unpatched internet-facing VPN is high risk, while the same flaw on an isolated lab machine is low risk because likelihood and impact are smaller.
19
Describe a time you had to admit you did not know something in a technical discussion.
Situation: in a design review, an architect asked me whether our VPN supported post-quantum key exchange. Task: give an accurate answer. Action: I said I did not know rather than guessing, checked the vendor documentation and release notes that afternoon and shared a short summary with options. Result: the team trusted my answers more, and the finding was added to our cryptography roadmap.
ISO/IEC 27001 is the international standard for an Information Security Management System. The 2022 version has clauses 4 to 10 for the management system, such as context, leadership, risk assessment, internal audit and improvement, and Annex A with 93 controls grouped into Organisational, People, Physical and Technological themes. Companies get certified through an accredited body, which Indian IT services firms often need for client contracts.
21
What is the difference between hashing and encryption?
Encryption is reversible with the right key and protects confidentiality. Hashing is a one-way function that produces a fixed-length digest and is used for integrity checks and password storage. SHA-256 of a file lets you detect tampering, but you cannot get the file back from the hash. Passwords should be stored with slow salted hashes such as Argon2id or bcrypt, never encrypted or with plain SHA-256.
22
What is business continuity and disaster recovery, and what are RTO and RPO?
Business continuity keeps critical business functions running during disruption, while disaster recovery restores IT systems. Recovery Time Objective is the maximum acceptable downtime, and Recovery Point Objective is the maximum acceptable data loss measured in time. A payments system may need an RTO of one hour and an RPO near zero, which needs replication, while an internal wiki may accept a day.
Role-Based Access Control grants permissions to roles such as Finance Analyst, and users get roles; it is simple to manage and audit. Attribute-Based Access Control decides using attributes of the user, resource and context, such as department, data classification, location and time. ABAC is more flexible but harder to reason about. Many organisations use RBAC as the base and add attribute conditions for sensitive cases.
Mitigate by adding controls to reduce likelihood or impact, such as MFA. Transfer by shifting financial impact to others, like cyber insurance or contracts. Avoid by stopping the risky activity, for example retiring an old system. Accept when the risk is within appetite and formally documented with an owner and review date. Risk acceptance should be signed by a business owner, not just the security team.
Passkeys are FIDO2 credentials that replace passwords. The device creates a key pair per website; the private key stays in the device or synced password manager, protected by biometrics or PIN, and the server stores only the public key. Login is a signature over a challenge tied to the real domain, so passkeys resist phishing and cannot be reused across sites. They also remove password reset load.
IAM is the set of processes and tools that manage digital identities and control their access to systems. It covers user provisioning and deprovisioning, authentication, authorisation, single sign-on, MFA, privileged access, access reviews and audit. Since most breaches involve stolen or misused credentials, IAM is a core security control. Common platforms include Microsoft Entra ID, Okta, Ping Identity and SailPoint for governance.
Single Loss Expectancy is asset value times exposure factor, and Annual Loss Expectancy is SLE times Annual Rate of Occurrence.
SLE = Asset Value x Exposure Factor
ALE = SLE x ARO
Example: a server worth 20 lakh rupees, 50 percent loss per incident, expected once in four years:
SLE = 20,00,000 x 0.5 = 10,00,000
ALE = 10,00,000 x 0.25 = 2,50,000 per year
28
How do you analyse a suspicious email reported by a user?
Get the original email with full headers. Check SPF, DKIM and DMARC results, the real sender and Reply-To, and the received path. Extract URLs and attachments without clicking, check them in a sandbox and reputation services, and compare the sender domain for lookalikes. If malicious, search for the same message across mailboxes, purge it, block indicators and check whether anyone clicked or entered credentials.
29
What is multi-factor authentication and which factors are strongest?
MFA requires two or more factor types: something you know like a password, something you have like a phone or security key, and something you are like a fingerprint. SMS OTPs are vulnerable to SIM swap and phishing, and push approvals to MFA fatigue. Phishing-resistant methods such as FIDO2 security keys, passkeys and certificate-based authentication are strongest because they are bound to the real site.
30
What is single sign-on and what protocols does it use?
SSO lets a user authenticate once with an identity provider and access many applications without separate passwords. SAML 2.0 uses signed XML assertions and is common for enterprise web apps. OpenID Connect, built on OAuth 2.0, uses JSON tokens and suits modern web and mobile apps. SSO reduces password reuse and helps central control, but makes the identity provider a high-value target that needs strong MFA.
Create a table where each risk has an ID, description written as cause, event and impact, asset, owner, inherent likelihood and impact, existing controls, residual rating, treatment decision, action plan, due date and review date. Gather risks through workshops, audits, incidents and threat intelligence. Review the register monthly with owners and report top risks to leadership quarterly.
32
A user reports a pop-up saying their files are encrypted. What are your first steps?
First, isolate the device from the network, ideally through EDR network containment, without powering it off so memory evidence is kept. Inform the incident lead and start a timeline. Check for the same indicators on other hosts, disable the user's sessions and reset credentials if needed, and identify the ransomware family from the note. Then confirm backups are intact and offline before any recovery begins.
33
How would you verify the integrity of a downloaded installer on Windows and Linux?
Compare the file's hash with the value published by the vendor over a trusted channel, or verify its digital signature. On Windows, use PowerShell and check the Authenticode signature. On Linux, use sha256sum and gpg for signed checksum files.
Get-FileHash .\setup.exe -Algorithm SHA256
Get-AuthenticodeSignature .\setup.exe
sha256sum tool.tar.gz
gpg --verify SHA256SUMS.asc SHA256SUMS
A DMZ, or perimeter network, is a separate zone between the internet and the internal network for public-facing services like web servers, mail relays and reverse proxies. Firewall rules allow internet traffic only to DMZ hosts and allow DMZ hosts only limited, specific connections inward. If a DMZ server is compromised, the attacker still faces another firewall layer before reaching internal systems.
35
What is social engineering and what are its common forms?
Social engineering manipulates people rather than technology to gain access or information. Common forms are phishing emails, spear phishing aimed at specific staff, vishing over phone calls, smishing over SMS or WhatsApp, pretexting with a fake story, baiting with infected USB drives and tailgating into offices. Defences include awareness training, phishing simulations, call-back verification for payment changes, and technical controls such as MFA and email authentication.
36
What is the difference between a policy, a standard, a procedure and a guideline?
A policy is a high-level management statement of intent, such as all data must be classified. A standard sets mandatory specific requirements, like AES-256 for confidential data. A procedure gives step-by-step instructions to meet the standard. A guideline is recommended but optional advice. This hierarchy lets policies stay stable while standards and procedures change with technology.
Start with admins and remote access, then high-risk groups like finance. Pick methods, preferring authenticator app number matching and passkeys or FIDO2 keys for admins. Pilot with one department, prepare helpdesk scripts and self-service registration, and communicate clearly with deadlines. Use conditional access in report-only mode to find gaps, then enforce. Block legacy authentication and track registration rates weekly.
38
A user's account shows sign-in risk high in your identity platform. What do you do?
Review the details: unfamiliar location, anonymous IP, leaked credentials or impossible travel. Check what happened after sign-in, such as MFA method registration, mailbox rules or data downloads. If compromise is likely, revoke sessions, reset the password, remove unknown MFA methods and contact the user out of band. Then confirm policies require MFA or block high-risk sign-ins automatically.
Start from business needs and regulations, keep it short and clear, and state scope, purpose, roles, requirements and exceptions. Avoid technical detail that changes often; put that in standards. Get input from IT, HR and legal, then management approval. Publish it where staff can find it, train people, require acknowledgement and review it at least yearly or after major changes.
40
An auditor finds that access reviews were not done for two quarters. What do you do?
Acknowledge the finding and agree a remediation plan. Immediately run the overdue reviews for in-scope systems, prioritising privileged access, and revoke unneeded access. Find the cause, such as no owner or a manual process, and fix it by assigning owners, automating campaigns in the IGA tool and adding reminders and escalations. Provide evidence of completed reviews to close the finding.
Frequently asked questions
What does a GRC Analyst do?
GRC analysts manage security policies, risk assessments, audits and compliance programmes. They maintain the risk register, prepare evidence for ISO 27001, SOC 2 or PCI DSS audits, review vendor security, track remediation and map controls to RBI, SEBI and DPDP requirements. The role suits people with strong writing and communication skills, and many consulting firms hire freshers for it. It is a strong long-term path too.
Which skills are tested in a GRC Analyst interview?
Expect questions on Risk assessment, ISO 27001, Audit evidence, Policy writing, Vendor risk review. Most rounds also ask you to explain a project and solve one practical problem live.
How do I prepare for a GRC Analyst interview?
Revise GRC and Compliance, Security Fundamentals, Identity and Access Management first using the topic sheets, practise the questions on this page aloud, then do one full mock interview to practise timing.