Curated interview practice questions with answers. These are practice scenarios, not a verified list of past interview questions.
About IBM hiring for Cyber Security roles
IBM is a global technology company offering hybrid cloud, AI through watsonx, software such as Red Hat, infrastructure and IBM Consulting services. Its India Software Labs and IBM Consulting teams form one of its largest workforces outside the US. It hires in India for software developers, test engineers, data engineers, data scientists and consultants.
For Cyber Security roles, this IBM practice set focuses most on Network Security (6), Cryptography and PKI (5), Identity and Access Management (5), Security Fundamentals (4). It has 14 easy, 15 medium, 1 hard questions, so you can start easy and work up to the harder ones.
Company type
IT services
Headquarters
Armonk, New York, USA
Main India offices
Bengaluru, Pune, Hyderabad, Kolkata, Gurugram
IBM Cyber Security interview process
Online assessment (cognitive games + coding)
English language test
Technical interview
Managerial or HR round
Typical pattern based on public candidate experiences. Rounds vary by role, team and year.
Solved for IBMStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
What is network segmentation and why is it important?
Segmentation splits a network into zones such as user, server, OT, guest and management, with controlled traffic between them using VLANs, firewalls and ACLs. It limits lateral movement, so ransomware on one laptop cannot reach every server. It also reduces compliance scope, for example isolating the cardholder data environment for PCI DSS. Micro-segmentation goes further with per-workload policies in data centres and cloud.
Map each control to the evidence an auditor will request, such as screenshots of configurations, system exports, tickets, logs and signed approvals. Keep a central evidence library organised by control ID with dates. Automate collection where possible through GRC tools that pull data from cloud, identity and ticketing systems. Sample in advance to confirm evidence covers the full audit period.
03
How do you check which ports are listening on a server you manage?
List listening sockets with the owning process, then compare against what the server should expose. Anything unexpected needs an owner or should be closed.
# Linux
sudo ss -tulpn
# Windows
netstat -ano | findstr LISTENING
Get-NetTCPConnection -State Listen
Map the PID to a process name in Task Manager or with ps to identify the service.
04
What is memory forensics and which tool is commonly used?
Memory forensics analyses a RAM capture to find running processes, injected code, network connections, loaded DLLs, command history and encryption keys. It reveals fileless malware that leaves little on disk. Volatility 3 is the common open source framework, with plugins such as windows.pslist, windows.netscan and windows.malfind. Captures are taken with tools like WinPmem or through EDR live response.
05
Describe a time you had to admit you did not know something in a technical discussion.
Situation: in a design review, an architect asked me whether our VPN supported post-quantum key exchange. Task: give an accurate answer. Action: I said I did not know rather than guessing, checked the vendor documentation and release notes that afternoon and shared a short summary with options. Result: the team trusted my answers more, and the finding was added to our cryptography roadmap.
06
What are the most common cloud security misconfigurations?
Frequent issues are publicly accessible storage buckets, overly permissive IAM policies with wildcards, long-lived access keys, security groups open to 0.0.0.0/0 on SSH, RDP or databases, disabled audit logging, unencrypted snapshots shared publicly, and exposed instance metadata. Cloud Security Posture Management tools and native services such as AWS Security Hub, Microsoft Defender for Cloud and Google Security Command Center detect them continuously.
07
What is a man-in-the-middle attack on TLS and how do certificates prevent it?
In a MITM attack, an attacker intercepts traffic and pretends to be the server. Certificates prevent this because the client checks that the server certificate chains to a trusted root, matches the hostname and is valid. An attacker cannot produce a valid certificate without the private key or a compromised CA. Certificate warnings that users click through, and apps that skip validation, break this protection.
08
What is a salt and why is it used in password hashing?
A salt is a unique random value stored with each password hash. It makes identical passwords produce different hashes, so precomputed rainbow tables are useless and attackers must crack each hash separately. Salts are not secret. A pepper is an additional secret kept outside the database. Combined with slow algorithms like Argon2id, bcrypt or scrypt, salting makes offline cracking much more expensive.
Conditional access applies policies based on signals at sign-in, such as user, group, device compliance, location, application and risk score. For example, allow finance apps only from managed devices with MFA, block legacy authentication, and require a password change when sign-in risk is high. It is a key Zero Trust building block in platforms like Microsoft Entra ID. Policies need testing in report-only mode first.
Forward secrecy means that if a server's long-term private key is stolen later, previously recorded sessions still cannot be decrypted. It is achieved with ephemeral key exchange, such as ECDHE, where a new key pair is created for each session and discarded. TLS 1.3 makes forward secrecy mandatory by removing static RSA key exchange, which is one reason older TLS configurations are considered weak.
IAM is the set of processes and tools that manage digital identities and control their access to systems. It covers user provisioning and deprovisioning, authentication, authorisation, single sign-on, MFA, privileged access, access reviews and audit. Since most breaches involve stolen or misused credentials, IAM is a core security control. Common platforms include Microsoft Entra ID, Okta, Ping Identity and SailPoint for governance.
12
What is the shared responsibility model in cloud security?
The cloud provider secures the infrastructure: data centres, hardware, hypervisors and managed service internals. The customer secures what they put in the cloud: identities, data, configurations, network rules and their applications. The split changes by service type; with IaaS you patch the OS, with SaaS you mainly manage users and data settings. Most cloud breaches come from customer-side misconfiguration, not provider failures.
13
A developer wants to write their own encryption algorithm for customer data. How do you respond?
I would advise against it. Custom cryptography almost always has flaws that experts would find, and it fails audits. Instead, use well-reviewed libraries such as libsodium, platform crypto APIs, or the cloud KMS with AES-GCM and envelope encryption. I would offer to help choose the right library and key management design, and include a security review in the feature's pull request.
14
What is the difference between an event, an alert and an incident?
An event is any observable occurrence, like a login or a file change. An alert is an event or pattern that a tool flags as possibly malicious. An incident is a confirmed or highly likely violation of security policy that needs response, such as a compromised account. Clear definitions matter because incidents trigger escalation, legal review and regulatory reporting timelines.
15
How do you analyse a suspicious email reported by a user?
Get the original email with full headers. Check SPF, DKIM and DMARC results, the real sender and Reply-To, and the received path. Extract URLs and attachments without clicking, check them in a sandbox and reputation services, and compare the sender domain for lookalikes. If malicious, search for the same message across mailboxes, purge it, block indicators and check whether anyone clicked or entered credentials.
16
How do you create a forensic disk image and verify it?
Use a write blocker or a forensic tool, image the whole disk, and hash both source and image.
sudo dc3dd if=/dev/sdb of=/evidence/case12.img hash=sha256 log=/evidence/case12.log
sha256sum /evidence/case12.img
Record the hashes, time, examiner and device details in the chain of custody form. Analyse a working copy, never the original.
TLS secures data in transit. In the TLS 1.3 handshake the client and server agree on cipher suites, perform an ephemeral key exchange such as X25519 for forward secrecy, and the server proves its identity with a certificate signed by a trusted CA. Both derive session keys, then traffic is encrypted with an AEAD cipher like AES-GCM. TLS 1.0 and 1.1 are deprecated and should be disabled.
18
Explain the difference between symmetric and asymmetric encryption at a basic level.
Symmetric encryption uses one shared key for encryption and decryption, such as AES; it is fast and used for bulk data. Asymmetric encryption uses a public and private key pair, such as RSA or elliptic curve keys; it is slower but solves key distribution and enables digital signatures. Real protocols like TLS combine them: asymmetric methods agree on a session key, then AES encrypts the traffic.
19
Your IDS alerts on outbound traffic from a database server to an unknown IP on port 443 at 3 AM. How do you investigate?
Database servers rarely need internet access, so this is suspicious. I would check the destination's reputation and WHOIS, look at flow data for volume and duration, and identify the process making the connection using EDR. Then I review recent logins, scheduled tasks and new binaries on the server. If data volume is large or the process is unknown, I contain the host and escalate as a possible exfiltration.
PAM protects powerful accounts like domain admins, root, database admins and cloud owners. It includes a vault for credentials with automatic rotation, just-in-time elevation, session brokering with recording, approval workflows and alerts on unusual use. Tools include CyberArk, BeyondTrust and Delinea. PAM is important because attackers aim for privileged credentials to move laterally and deploy ransomware across the network.
MITRE ATT&CK is a public knowledge base of adversary tactics and techniques observed in real attacks, organised in matrices for Enterprise, Mobile and ICS. Tactics are the goal, such as Persistence, and techniques are the method, such as T1053 Scheduled Task. Teams use it to map detection coverage, write threat-informed detections, plan red and purple team exercises, and describe incidents in a common language.
NAC checks devices and users before allowing them on the network, typically using 802.1X with a RADIUS server. It can verify certificates, patch level, EDR presence and user identity, then assign a VLAN or policy. Unknown or non-compliant devices go to a quarantine or guest network. NAC is important in offices with many personal devices and IoT equipment such as printers and cameras.
NIST SP 800-61 describes preparation; detection and analysis; containment, eradication and recovery; and post-incident activity. The 2025 revision aligns these with the NIST CSF 2.0 functions of Govern, Identify, Protect, Detect, Respond and Recover. Preparation includes playbooks, contacts and tools. Containment limits spread, eradication removes the attacker, recovery restores operations, and lessons learned improve controls and detections.
24
How would you verify the integrity of a downloaded installer on Windows and Linux?
Compare the file's hash with the value published by the vendor over a trusted channel, or verify its digital signature. On Windows, use PowerShell and check the Authenticode signature. On Linux, use sha256sum and gpg for signed checksum files.
Get-FileHash .\setup.exe -Algorithm SHA256
Get-AuthenticodeSignature .\setup.exe
sha256sum tool.tar.gz
gpg --verify SHA256SUMS.asc SHA256SUMS
25
How do you decode and check a JWT during troubleshooting?
A JWT has header, payload and signature separated by dots. Decode the first two parts to read claims, but never trust them without verifying the signature.
echo $TOKEN | cut -d. -f2 | base64 -d 2>/dev/null
Check iss, aud, exp and nbf claims. In code, verify with a library using the expected algorithm and issuer keys, and reject alg none.
26
What is multi-factor authentication and which factors are strongest?
MFA requires two or more factor types: something you know like a password, something you have like a phone or security key, and something you are like a fingerprint. SMS OTPs are vulnerable to SIM swap and phishing, and push approvals to MFA fatigue. Phishing-resistant methods such as FIDO2 security keys, passkeys and certificate-based authentication are strongest because they are bound to the real site.
27
How does a VPN protect traffic and what are its limits?
A VPN creates an encrypted tunnel, using IPsec, WireGuard or TLS, between a client and a network, protecting data on untrusted networks. Its limits are important: once connected, users often get broad network access, and VPN appliances are a frequent target for exploited vulnerabilities. That is why many companies move to Zero Trust Network Access, which grants per-application access after identity and device checks.
28
How do you enable organisation-wide audit logging in AWS?
Create a multi-region organisation trail that sends logs to a bucket in a dedicated log archive account.
aws cloudtrail create-trail --name org-trail \
--s3-bucket-name central-ct-logs --is-multi-region-trail \
--is-organization-trail --enable-log-file-validation
aws cloudtrail start-logging --name org-trail
Protect the bucket with Object Lock and an SCP that denies stopping CloudTrail.
29
How would you capture and analyse suspicious traffic using tcpdump and Wireshark?
Capture on the right interface with a filter to limit size, save to a pcap file, then open it in Wireshark.
sudo tcpdump -i eth0 host 10.10.0.15 and port 53 -w dns.pcap
In Wireshark, use display filters such as dns, http.request or tls.handshake.type == 1, and Statistics > Conversations to spot top talkers. Protect pcaps because they may contain sensitive data.
30
How would you check a cloud account against CIS benchmarks?
Enable the native posture service, such as AWS Security Hub with the CIS AWS Foundations standard, Microsoft Defender for Cloud with the CIS Azure benchmark, or Security Command Center on Google Cloud. Open source tools like Prowler or ScoutSuite also work. Export findings, prioritise critical ones like root MFA, public storage and open admin ports, assign owners and track remediation over time.
Tips to crack the IBM Cyber Security interview
Practise IBM's game-based cognitive assessments, which test pattern recognition, memory and numerical reasoning quickly.
Learn basics of hybrid cloud, Red Hat OpenShift and watsonx, which IBM promotes as core strategic areas.
Revise SQL, Python or Java fundamentals and be ready to explain one project in depth.
Keep a one-minute story ready for every project on your CV: problem, your part, tools, result.
Practise the hard questions on this page aloud; IBM interviewers usually ask follow-ups on your first answer.
Frequently asked questions
How many rounds are there in the IBM Cyber Security interview?
Candidates usually go through 4 stages: Online assessment (cognitive games + coding); English language test; Technical interview; Managerial or HR round. The exact rounds change with the role, team, location and your experience, so confirm the process with the recruiter.
Which topics should I prepare for the IBM Cyber Security interview?
This practice set leans on Network Security (6), Cryptography and PKI (5), Identity and Access Management (5), Security Fundamentals (4). Revise those first, then practise explaining one or two of your own projects end to end, because most IBM interviewers ask you to walk through real work.
Are these the exact questions asked at IBM?
No. These are curated practice questions that match the skills and difficulty usually tested in it services interviews like IBM's. They are not a leaked or verified list of past questions.
Where does IBM hire Cyber Security professionals in India?
IBM has large teams in Bengaluru, Pune, Hyderabad, Kolkata, Gurugram. Openings and locations change often, so check the IBM careers page and filter by city and experience.