Curated interview practice questions with answers. These are practice scenarios, not a verified list of past interview questions.
About HCLTech hiring for Cyber Security roles
HCLTech is an Indian multinational IT services and consulting company providing digital engineering, cloud, infrastructure, software products and data services. It works with clients in sectors such as financial services, manufacturing, life sciences and telecom. In India it hires for software engineers, test engineers, data analysts and data engineers through campus drives and programmes like TechBee.
For Cyber Security roles, this HCLTech practice set focuses most on GRC and Compliance (7), Security Fundamentals (7), SOC Operations and SIEM (4), Identity and Access Management (3). It has 17 easy, 12 medium, 1 hard questions, so you can start easy and work up to the harder ones.
Company type
IT services
Headquarters
Noida, India
Main India offices
Noida, Chennai, Bengaluru, Hyderabad, Lucknow
HCLTech Cyber Security interview process
Online assessment (aptitude + technical)
Technical interview
Managerial round
HR round
Typical pattern based on public candidate experiences. Rounds vary by role, team and year.
Solved for HCLTechStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
What is business continuity and disaster recovery, and what are RTO and RPO?
Business continuity keeps critical business functions running during disruption, while disaster recovery restores IT systems. Recovery Time Objective is the maximum acceptable downtime, and Recovery Point Objective is the maximum acceptable data loss measured in time. A payments system may need an RTO of one hour and an RPO near zero, which needs replication, while an internal wiki may accept a day.
02
How do you design an access review for a critical application?
Define scope, such as all users with write or admin rights. Pull entitlements and last-login data from the app, and route each item to the user's manager and the app owner. Give clear choices of keep or revoke with a deadline, and revoke automatically if not reviewed. Capture evidence for auditors, and review exceptions with security. Run it quarterly for privileged access.
03
What is the difference between encoding, encryption and obfuscation?
Encoding, like Base64 or URL encoding, changes data format for transport and is reversible by anyone, so it gives no security. Encryption makes data unreadable without a key. Obfuscation makes code or data harder to understand but does not use a secret key, so a determined analyst can reverse it. A common mistake is treating Base64 credentials in config files as protected.
04
Your IDS alerts on outbound traffic from a database server to an unknown IP on port 443 at 3 AM. How do you investigate?
Database servers rarely need internet access, so this is suspicious. I would check the destination's reputation and WHOIS, look at flow data for volume and duration, and identify the process making the connection using EDR. Then I review recent logins, scheduled tasks and new binaries on the server. If data volume is large or the process is unknown, I contain the host and escalate as a possible exfiltration.
05
What is the difference between a vulnerability assessment and a penetration test?
A vulnerability assessment uses scanners to find and rank as many known weaknesses as possible across many assets, and it is broad and frequent. A penetration test is a time-boxed, authorised attempt to exploit weaknesses and show real impact, such as reaching sensitive data. Assessments answer what is wrong; pen tests answer what an attacker could actually achieve. Most programmes run monthly scans and annual or release-based pen tests.
06
A developer has hardcoded database passwords in a public code repository. What do you do?
Treat the secret as compromised immediately, even if the commit is removed, because public repos are scraped within minutes. Rotate the password and any related keys, check database logs for unknown logins since the commit time, and remove the secret from git history. Then fix the root cause by moving secrets to a vault or cloud secret manager and adding secret scanning to pre-commit hooks and the CI pipeline.
07
How would you build a forensic timeline of an incident?
Collect timestamps from many sources: Windows event logs, file system MFT records, prefetch, browser history, EDR telemetry, proxy, firewall and cloud logs. Normalise all of them to UTC, then merge them using tools like Plaso and Timeline Explorer. Mark key points such as initial access, privilege escalation, lateral movement and exfiltration. The timeline drives scoping, root cause and the incident report.
08
Tell me about a time you worked with developers to fix a security finding.
Situation: a scan found a critical vulnerability in a library used by five microservices just before a release. Task: fix it without delaying the launch. Action: I paired with the lead developer, confirmed which services were truly exploitable, prepared tested upgrade pull requests and added a WAF rule as a temporary safeguard. Result: all services were patched in two days and release stayed on schedule.
09
A key log source stopped sending data to the SIEM two days ago. Why does it matter and what do you do?
Silent log gaps create blind spots where attacks go undetected, and they can also break compliance. Raise it as a priority issue, check the forwarder or agent health, network path, licence limits and parsing errors, and restore ingestion. Check whether the gap overlapped any suspicious activity. Then add log source health monitoring that alerts when expected volume drops, so gaps are found in hours, not days.
IAM is the set of processes and tools that manage digital identities and control their access to systems. It covers user provisioning and deprovisioning, authentication, authorisation, single sign-on, MFA, privileged access, access reviews and audit. Since most breaches involve stolen or misused credentials, IAM is a core security control. Common platforms include Microsoft Entra ID, Okta, Ping Identity and SailPoint for governance.
11
What is EDR and how is it different from antivirus?
Endpoint Detection and Response records detailed endpoint activity, like process creation, command lines, network connections and registry changes, and detects suspicious behaviour, not just known files. Analysts can investigate a process tree, isolate a host and remove malware remotely. Traditional antivirus mainly blocks known signatures. XDR extends EDR by correlating endpoint, email, identity and cloud signals in one platform.
12
Describe a time you worked under pressure during an incident.
Situation: during a phishing campaign, 40 users received a credential-harvesting email on a Friday evening. Task: contain it before attackers used stolen accounts. Action: I purged the email across mailboxes, identified six users who clicked, reset their passwords, revoked sessions and blocked the domain, while updating my lead every 30 minutes. Result: no account misuse was found and the playbook was updated.
13
What is social engineering and what are its common forms?
Social engineering manipulates people rather than technology to gain access or information. Common forms are phishing emails, spear phishing aimed at specific staff, vishing over phone calls, smishing over SMS or WhatsApp, pretexting with a fake story, baiting with infected USB drives and tailgating into offices. Defences include awareness training, phishing simulations, call-back verification for payment changes, and technical controls such as MFA and email authentication.
ISO/IEC 27001 is the international standard for an Information Security Management System. The 2022 version has clauses 4 to 10 for the management system, such as context, leadership, risk assessment, internal audit and improvement, and Annex A with 93 controls grouped into Organisational, People, Physical and Technological themes. Companies get certified through an accredited body, which Indian IT services firms often need for client contracts.
15
How would you check a cloud account against CIS benchmarks?
Enable the native posture service, such as AWS Security Hub with the CIS AWS Foundations standard, Microsoft Defender for Cloud with the CIS Azure benchmark, or Security Command Center on Google Cloud. Open source tools like Prowler or ScoutSuite also work. Export findings, prioritise critical ones like root MFA, public storage and open admin ports, assign owners and track remediation over time.
16
What is a false positive and a false negative in SOC alerts?
A false positive is an alert on benign activity, such as an admin running a legitimate script flagged as malicious. A false negative is a real attack that produced no alert, which is more dangerous. Too many false positives cause alert fatigue and missed real incidents. Analysts tune rules with allowlists, thresholds and context, and test detections against simulated attacks to find false negatives.
17
What is the difference between static and dynamic malware analysis?
Static analysis examines a sample without running it: hashes, strings, imports, PE headers, YARA rule matches and disassembly. Dynamic analysis runs it in an isolated sandbox to observe processes, file changes, registry edits and network calls. Static is safe and fast but defeated by packing; dynamic shows real behaviour but malware may detect sandboxes. Analysts usually combine both in a controlled lab.
18
How would you capture and analyse suspicious traffic using tcpdump and Wireshark?
Capture on the right interface with a filter to limit size, save to a pcap file, then open it in Wireshark.
sudo tcpdump -i eth0 host 10.10.0.15 and port 53 -w dns.pcap
In Wireshark, use display filters such as dns, http.request or tls.handshake.type == 1, and Statistics > Conversations to spot top talkers. Protect pcaps because they may contain sensitive data.
19
A US customer asks your Indian SaaS company for a SOC 2 report. What is it and which type should you aim for?
SOC 2 is an attestation report by an independent auditor on a service organisation's controls against the AICPA Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy. A Type I report checks control design at a point in time; a Type II checks operating effectiveness over a period, typically 6 to 12 months. Indian SaaS companies selling to US customers commonly need SOC 2 Type II.
20
Where do you see yourself in five years in cyber security?
A strong answer is specific yet flexible. For example: in five years I want to lead incident response or security engineering work for a large environment. I plan to master SOC operations first, then specialise through hands-on cloud and IR projects and certifications such as CySA+ and later CISSP. I also want to mentor junior analysts, since teaching strengthens my own skills.
21
What is the difference between authentication, authorisation and accounting?
Authentication proves who you are, for example password plus an OTP or passkey. Authorisation decides what you are allowed to do after login, such as read-only access to a finance folder. Accounting, or auditing, records what you actually did, like logins, file access and admin changes. Together they are called AAA. Weak accounting is a common gap, because without logs an incident cannot be investigated.
22
What is malware and how do virus, worm, trojan and ransomware differ?
Malware is any software built to harm or misuse a system. A virus attaches to files and spreads when they run. A worm spreads by itself across networks, often using a vulnerability. A trojan pretends to be legitimate software to trick users into installing it. Ransomware encrypts or steals data and demands payment, and modern groups use double extortion by threatening to leak stolen data.
23
What is the difference between a policy, a standard, a procedure and a guideline?
A policy is a high-level management statement of intent, such as all data must be classified. A standard sets mandatory specific requirements, like AES-256 for confidential data. A procedure gives step-by-step instructions to meet the standard. A guideline is recommended but optional advice. This hierarchy lets policies stay stable while standards and procedures change with technology.
24
What is single sign-on and what protocols does it use?
SSO lets a user authenticate once with an identity provider and access many applications without separate passwords. SAML 2.0 uses signed XML assertions and is common for enterprise web apps. OpenID Connect, built on OAuth 2.0, uses JSON tokens and suits modern web and mobile apps. SSO reduces password reuse and helps central control, but makes the identity provider a high-value target that needs strong MFA.
A SOC is the team, processes and technology that monitor an organisation's environment around the clock, detect threats, triage alerts and coordinate response. Tier 1 analysts triage alerts, Tier 2 investigate and contain, and Tier 3 or threat hunters handle complex cases and build detections. A SOC can be in-house, outsourced to an MSSP or hybrid. Many Indian IT firms run global SOCs for international clients.
26
How would you run a basic threat model for a new web application?
Draw a data flow diagram showing users, the web app, APIs, databases and third parties, and mark trust boundaries. Then apply STRIDE to each element: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service and Elevation of privilege. For each threat, record the existing control, a risk rating and an owner. Repeat the model whenever the architecture changes, ideally during design reviews.
TPRM assesses and monitors the security of vendors that access your data or systems, since many breaches start with a supplier. It includes tiering vendors by risk, security questionnaires, reviewing SOC 2 or ISO 27001 reports, contract clauses for breach notification and audit rights, and continuous monitoring. High-risk vendors such as payroll or cloud providers get deeper reviews and annual reassessment.
NAC checks devices and users before allowing them on the network, typically using 802.1X with a RADIUS server. It can verify certificates, patch level, EDR presence and user identity, then assign a VLAN or policy. Unknown or non-compliant devices go to a quarantine or guest network. NAC is important in offices with many personal devices and IoT equipment such as printers and cameras.
GRC is Governance, Risk and Compliance. Governance sets direction, policies, roles and accountability for security. Risk management identifies, assesses and treats risks to an acceptable level. Compliance ensures the organisation meets laws, regulations, contracts and standards such as the DPDP Act, RBI directions, ISO 27001 and PCI DSS. GRC analysts write policies, run risk assessments, manage audits and track remediation.
Least privilege means every user, service and application gets only the minimum access needed for its job, and only for as long as needed. It limits the damage from compromised accounts and insider mistakes. Examples are giving developers read-only production access, using separate admin accounts, and just-in-time elevation that expires after a few hours. Regular access reviews are needed because permissions tend to grow over time.
Tips to crack the HCLTech Cyber Security interview
Revise programming basics, SQL and networking fundamentals, as HCLTech roles span applications and infrastructure services.
Learn about HCLTech's software products business, HCLSoftware, and its engineering and R&D services.
Be clear and honest about your preferred domain and shift flexibility, as some roles involve support or global time zones.
Keep a one-minute story ready for every project on your CV: problem, your part, tools, result.
Practise the hard questions on this page aloud; HCLTech interviewers usually ask follow-ups on your first answer.
Frequently asked questions
How many rounds are there in the HCLTech Cyber Security interview?
Candidates usually go through 4 stages: Online assessment (aptitude + technical); Technical interview; Managerial round; HR round. The exact rounds change with the role, team, location and your experience, so confirm the process with the recruiter.
Which topics should I prepare for the HCLTech Cyber Security interview?
This practice set leans on GRC and Compliance (7), Security Fundamentals (7), SOC Operations and SIEM (4), Identity and Access Management (3). Revise those first, then practise explaining one or two of your own projects end to end, because most HCLTech interviewers ask you to walk through real work.
Are these the exact questions asked at HCLTech?
No. These are curated practice questions that match the skills and difficulty usually tested in it services interviews like HCLTech's. They are not a leaked or verified list of past questions.
Where does HCLTech hire Cyber Security professionals in India?
HCLTech has large teams in Noida, Chennai, Bengaluru, Hyderabad, Lucknow. Openings and locations change often, so check the HCLTech careers page and filter by city and experience.