HDFC Bank Cyber Security Interview Questions & Answers
Curated interview practice questions with answers. These are practice scenarios, not a verified list of past interview questions.
About HDFC Bank hiring for Cyber Security roles
HDFC Bank is one of India's largest private sector banks, offering retail banking, loans, cards, wholesale banking and digital banking. Its analytics, risk and technology teams work on credit decisions, customer analytics, fraud detection and digital channels. It hires for data analysts, credit and risk analysts, testers and technology roles.
For Cyber Security roles, this HDFC Bank practice set focuses most on SOC Operations and SIEM (7), Incident Response and Forensics (5), Identity and Access Management (4), Network Security (4). It has 8 easy, 18 medium, 4 hard questions, so you can start easy and work up to the harder ones.
Company type
Banking & finance
Headquarters
Mumbai, India
Main India offices
Mumbai, Chennai, Bengaluru
HDFC Bank Cyber Security interview process
Online assessment (aptitude + domain)
Technical or functional interview
Managerial round
HR round
Typical pattern based on public candidate experiences. Rounds vary by role, team and year.
Solved for HDFC BankStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
A SOC is the team, processes and technology that monitor an organisation's environment around the clock, detect threats, triage alerts and coordinate response. Tier 1 analysts triage alerts, Tier 2 investigate and contain, and Tier 3 or threat hunters handle complex cases and build detections. A SOC can be in-house, outsourced to an MSSP or hybrid. Many Indian IT firms run global SOCs for international clients.
02
What is the difference between authentication, authorisation and accounting?
Authentication proves who you are, for example password plus an OTP or passkey. Authorisation decides what you are allowed to do after login, such as read-only access to a finance folder. Accounting, or auditing, records what you actually did, like logins, file access and admin changes. Together they are called AAA. Weak accounting is a common gap, because without logs an incident cannot be investigated.
Short-term containment stops the spread quickly, for example isolating hosts through EDR, disabling accounts, blocking IPs or domains and segmenting networks. Long-term containment keeps business running while preparing clean systems, such as rebuilding servers in a separate network. Responders must balance speed with evidence preservation and avoid alerting a sophisticated attacker too early if they need to understand the full scope.
Start with admins and remote access, then high-risk groups like finance. Pick methods, preferring authenticator app number matching and passkeys or FIDO2 keys for admins. Pilot with one department, prepare helpdesk scripts and self-service registration, and communicate clearly with deadlines. Use conditional access in report-only mode to find gaps, then enforce. Block legacy authentication and track registration rates weekly.
Map each control to the evidence an auditor will request, such as screenshots of configurations, system exports, tickets, logs and signed approvals. Keep a central evidence library organised by control ID with dates. Automate collection where possible through GRC tools that pull data from cloud, identity and ticketing systems. Sample in advance to confirm evidence covers the full audit period.
A blameless review covers the timeline, root cause, how the attacker got in, what detected it, what slowed response, business impact and decisions made. It ends with specific actions that have owners and dates, such as enabling MFA on all VPN users or adding a detection rule. Tracking these actions to completion matters more than the report itself, otherwise the same incident repeats.
07
How do you handle a network team that refuses a security change you recommended?
Situation: the network team rejected my request to block outbound SMB at the firewall, fearing outages. Task: reduce the risk without damaging the relationship. Action: I shared flow data showing only two servers needed it, proposed an allowlist for them and a one-week monitor-only phase. Result: the team agreed, the rule went live with zero incidents, and we now review rules together monthly.
08
You find an application storing user passwords as unsalted MD5. What do you recommend?
MD5 is fast and broken, so these hashes can be cracked quickly if leaked. Recommend Argon2id or bcrypt with proper cost settings. To migrate without forcing resets, wrap existing hashes: compute Argon2id over the MD5 value now, and on next login replace it with a direct Argon2id hash of the password. Also check whether the database was ever exposed, and enforce MFA.
09
How does encryption work for data at rest in the cloud?
Most cloud storage, databases and disks encrypt data at rest by default with provider-managed keys. For more control, use customer managed keys in KMS, with key policies, rotation and logs of every use, or bring and hold your own keys for strict regulatory needs. Encryption at rest protects against physical media theft, but not against someone with valid IAM permissions, so access control remains critical.
10
How do you analyse a suspicious email reported by a user?
Get the original email with full headers. Check SPF, DKIM and DMARC results, the real sender and Reply-To, and the received path. Extract URLs and attachments without clicking, check them in a sandbox and reputation services, and compare the sender domain for lookalikes. If malicious, search for the same message across mailboxes, purge it, block indicators and check whether anyone clicked or entered credentials.
11
An auditor finds that access reviews were not done for two quarters. What do you do?
Acknowledge the finding and agree a remediation plan. Immediately run the overdue reviews for in-scope systems, prioritising privileged access, and revoke unneeded access. Find the cause, such as no owner or a manual process, and fix it by assigning owners, automating campaigns in the IGA tool and adding reminders and escalations. Provide evidence of completed reviews to close the finding.
12
Users complain that a new firewall rule broke an application. How do you troubleshoot?
First check the firewall logs for denied traffic from the affected users or servers around the change time. Compare the change ticket with actual app requirements, since apps often use extra ports or dependencies. Use packet capture or a test connection to confirm. Then add a narrow rule for the real need, not an any-any rule, and update documentation so the next change does not repeat the problem.
13
You find a web shell on a public web server. What steps do you take?
Do not just delete it. Capture the file, web logs and a memory image if possible, then identify when it was created and which request uploaded it. Search logs for commands executed through it and lateral movement from the server. Contain by isolating the server or blocking the path at the WAF, then patch the vulnerable application, rebuild from a clean image and rotate any credentials stored on it.
14
An alert shows Microsoft Word spawning PowerShell with an encoded command. What does it mean and what do you do?
Office apps rarely start PowerShell, so this usually means a malicious macro or document exploit. Decode the Base64 command to see what it does, check the process tree and any network connections for downloads, and find the source email. Isolate the host through EDR, block the sender and URLs, search for the same email in other mailboxes and hunt for the same command line elsewhere.
PAM protects powerful accounts like domain admins, root, database admins and cloud owners. It includes a vault for credentials with automatic rotation, just-in-time elevation, session brokering with recording, approval workflows and alerts on unusual use. Tools include CyberArk, BeyondTrust and Delinea. PAM is important because attackers aim for privileged credentials to move laterally and deploy ransomware across the network.
16
Your IDS alerts on outbound traffic from a database server to an unknown IP on port 443 at 3 AM. How do you investigate?
Database servers rarely need internet access, so this is suspicious. I would check the destination's reputation and WHOIS, look at flow data for volume and duration, and identify the process making the connection using EDR. Then I review recent logins, scheduled tasks and new binaries on the server. If data volume is large or the process is unknown, I contain the host and escalate as a possible exfiltration.
17
What is memory forensics and which tool is commonly used?
Memory forensics analyses a RAM capture to find running processes, injected code, network connections, loaded DLLs, command history and encryption keys. It reveals fileless malware that leaves little on disk. Volatility 3 is the common open source framework, with plugins such as windows.pslist, windows.netscan and windows.malfind. Captures are taken with tools like WinPmem or through EDR live response.
18
How do you enable organisation-wide audit logging in AWS?
Create a multi-region organisation trail that sends logs to a bucket in a dedicated log archive account.
aws cloudtrail create-trail --name org-trail \
--s3-bucket-name central-ct-logs --is-multi-region-trail \
--is-organization-trail --enable-log-file-validation
aws cloudtrail start-logging --name org-trail
Protect the bucket with Object Lock and an SCP that denies stopping CloudTrail.
19
Tell me about a time you worked with developers to fix a security finding.
Situation: a scan found a critical vulnerability in a library used by five microservices just before a release. Task: fix it without delaying the launch. Action: I paired with the lead developer, confirmed which services were truly exploitable, prepared tested upgrade pull requests and added a WAF rule as a temporary safeguard. Result: all services were patched in two days and release stayed on schedule.
20
Which cloud logs are essential for security monitoring?
Essential sources are control plane audit logs such as AWS CloudTrail, Azure Activity Log and Entra sign-in logs, and Google Cloud Audit Logs. Add network flow logs, DNS logs, load balancer and WAF logs, storage access logs for sensitive buckets, and Kubernetes audit logs. Send them to a central account or SIEM that workload owners cannot delete, and enable threat detection services like GuardDuty.
Sigma is a generic YAML detection format that converts to SIEM queries.
title: Office Spawning PowerShell
logsource:
product: windows
category: process_creation
detection:
selection:
ParentImage|endswith: ['\winword.exe', '\excel.exe']
Image|endswith: '\powershell.exe'
condition: selection
level: high
tags: [attack.execution, attack.t1059.001]
22
What is a false positive and a false negative in SOC alerts?
A false positive is an alert on benign activity, such as an admin running a legitimate script flagged as malicious. A false negative is a real attack that produced no alert, which is more dangerous. Too many false positives cause alert fatigue and missed real incidents. Analysts tune rules with allowlists, thresholds and context, and test detections against simulated attacks to find false negatives.
23
What is the difference between an event, an alert and an incident?
An event is any observable occurrence, like a login or a file change. An alert is an event or pattern that a tool flags as possibly malicious. An incident is a confirmed or highly likely violation of security policy that needs response, such as a compromised account. Clear definitions matter because incidents trigger escalation, legal review and regulatory reporting timelines.
ISO/IEC 27001 is the international standard for an Information Security Management System. The 2022 version has clauses 4 to 10 for the management system, such as context, leadership, risk assessment, internal audit and improvement, and Annex A with 93 controls grouped into Organisational, People, Physical and Technological themes. Companies get certified through an accredited body, which Indian IT services firms often need for client contracts.
25
How do you decode and check a JWT during troubleshooting?
A JWT has header, payload and signature separated by dots. Decode the first two parts to read claims, but never trust them without verifying the signature.
echo $TOKEN | cut -d. -f2 | base64 -d 2>/dev/null
Check iss, aud, exp and nbf claims. In code, verify with a library using the expected algorithm and issuer keys, and reject alg none.
26
Developers share one admin account for a production database. What do you propose?
Shared accounts break accountability and are hard to rotate. Give each person an individual named account with least privilege, and provide admin access through PAM with just-in-time approval and session recording. Store the remaining break-glass credential in the vault with alerts on use. Use read-only roles for daily troubleshooting. Roll out with the team so it does not slow urgent fixes.
27
A key log source stopped sending data to the SIEM two days ago. Why does it matter and what do you do?
Silent log gaps create blind spots where attacks go undetected, and they can also break compliance. Raise it as a priority issue, check the forwarder or agent health, network path, licence limits and parsing errors, and restore ingestion. Check whether the gap overlapped any suspicious activity. Then add log source health monitoring that alerts when expected volume drops, so gaps are found in hours, not days.
28
Your SOC sees heavy DNS traffic with long random subdomains from one workstation. Which DNS attacks should you consider and what defences apply?
Key DNS attacks are cache poisoning, which inserts false records; DNS tunnelling, which hides data or command traffic inside queries; domain hijacking through registrar account takeover; and DNS amplification DDoS. Defences include DNSSEC to sign records, protective DNS resolvers that block malicious domains, monitoring for long or high-entropy subdomains, registrar lock with MFA, and rate limiting open resolvers.
29
Why do you want to build a career in cyber security?
A good answer links genuine interest to evidence. For example: I got interested after investigating a phishing email that reached my college group, which led me to study networking and complete Security+. I built a home lab with a SIEM and wrote detections for brute-force logins. I enjoy problem solving under pressure, and I want to grow in a SOC, then specialise in incident response.
30
During triage you notice a user logged in from Mumbai and then from Frankfurt 20 minutes later. How do you handle it?
This is an impossible travel alert. First rule out benign causes like corporate VPN, cloud proxy egress or mobile networks. Check device IDs, user agents and MFA results for both logins. If the second login is from an unknown device without MFA, or followed by mailbox rule creation or data download, revoke sessions, reset credentials, review MFA methods and contact the user through a separate channel.
Tips to crack the HDFC Bank Cyber Security interview
Learn Indian banking basics like CASA, NPAs, credit scores, KYC and RBI regulations for domain questions.
Revise SQL, Excel and basic statistics for analytics and risk roles with banking examples.
Understand UPI, net banking and mobile banking flows if applying for digital channel testing roles.
Keep a one-minute story ready for every project on your CV: problem, your part, tools, result.
Practise the hard questions on this page aloud; HDFC Bank interviewers usually ask follow-ups on your first answer.
Frequently asked questions
How many rounds are there in the HDFC Bank Cyber Security interview?
Candidates usually go through 4 stages: Online assessment (aptitude + domain); Technical or functional interview; Managerial round; HR round. The exact rounds change with the role, team, location and your experience, so confirm the process with the recruiter.
Which topics should I prepare for the HDFC Bank Cyber Security interview?
This practice set leans on SOC Operations and SIEM (7), Incident Response and Forensics (5), Identity and Access Management (4), Network Security (4). Revise those first, then practise explaining one or two of your own projects end to end, because most HDFC Bank interviewers ask you to walk through real work.
Are these the exact questions asked at HDFC Bank?
No. These are curated practice questions that match the skills and difficulty usually tested in banking & finance interviews like HDFC Bank's. They are not a leaked or verified list of past questions.
Where does HDFC Bank hire Cyber Security professionals in India?
HDFC Bank has large teams in Mumbai, Chennai, Bengaluru. Openings and locations change often, so check the HDFC Bank careers page and filter by city and experience.