36 practice questions with answers for Cyber Security interviews in Chandigarh.
Cyber Security jobs in Chandigarh
Chandigarh, Mohali and Panchkula form the Tricity IT cluster, with IT-services firms, SaaS companies and start-ups in Mohali's IT City and Chandigarh's IT Park. Interviews usually check strong fundamentals and practical tool skills.
Below are 36 questions that match the mix of service, product and domain employers hiring soc analyst (l1/l2)s in Chandigarh.
Solved for ChandigarhStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
How would you design a joiner, mover, leaver process for a growing company?
JML is the identity lifecycle. Joiners get accounts and baseline access from HR data on day one. Movers change roles, and their old access must be removed, not just new access added, to avoid privilege creep. Leavers must be disabled promptly, ideally automatically when HR records their exit. Automating JML from the HR system to the identity platform reduces orphan accounts, which auditors frequently flag.
02
How do you decode and check a JWT during troubleshooting?
A JWT has header, payload and signature separated by dots. Decode the first two parts to read claims, but never trust them without verifying the signature.
echo $TOKEN | cut -d. -f2 | base64 -d 2>/dev/null
Check iss, aud, exp and nbf claims. In code, verify with a library using the expected algorithm and issuer keys, and reject alg none.
A Distributed Denial of Service attack floods a target from many sources to exhaust bandwidth, connection tables or application resources. Types are volumetric floods, protocol attacks like SYN floods, and application layer floods hitting costly pages. Mitigation uses upstream scrubbing services or CDN providers, anycast networks, rate limiting, SYN cookies, autoscaling, and a tested runbook agreed with the ISP before an attack.
04
How do you find stale and privileged accounts in Active Directory with PowerShell?
Situation: a scan found a critical vulnerability in a library used by five microservices just before a release. Task: fix it without delaying the launch. Action: I paired with the lead developer, confirmed which services were truly exploitable, prepared tested upgrade pull requests and added a WAF rule as a temporary safeguard. Result: all services were patched in two days and release stayed on schedule.
06
A firewall audit finds 40 percent of rules have not been hit in a year. What do you do?
Unused rules expand attack surface and slow audits. I would export rule hit counts, confirm no seasonal apps like year-end batch jobs depend on them, and contact rule owners listed in tickets. Rules with no owner are disabled first, not deleted, and monitored for a month. After that they are removed. I would also add rule expiry dates and quarterly reviews to the change process.
Check supported protocol versions, ciphers and certificate details. OpenSSL gives a quick view, and tools like testssl.sh give a full report.
openssl s_client -connect example.com:443 -tls1_2
openssl s_client -connect example.com:443 -servername example.com | openssl x509 -noout -dates -issuer
./testssl.sh example.com
Disable TLS 1.0 and 1.1, weak ciphers like RC4 and 3DES, and fix expiring certificates.
A DMZ, or perimeter network, is a separate zone between the internet and the internal network for public-facing services like web servers, mail relays and reverse proxies. Firewall rules allow internet traffic only to DMZ hosts and allow DMZ hosts only limited, specific connections inward. If a DMZ server is compromised, the attacker still faces another firewall layer before reaching internal systems.
MITRE ATT&CK is a public knowledge base of adversary tactics and techniques observed in real attacks, organised in matrices for Enterprise, Mobile and ICS. Tactics are the goal, such as Persistence, and techniques are the method, such as T1053 Scheduled Task. Teams use it to map detection coverage, write threat-informed detections, plan red and purple team exercises, and describe incidents in a common language.
10
What is the difference between qualitative and quantitative risk assessment?
Qualitative assessment rates likelihood and impact on scales like low, medium and high, and is quick and easy to communicate. Quantitative assessment uses numbers, such as single loss expectancy times annual rate of occurrence to get annual loss expectancy, or FAIR models. Quantitative helps justify budgets but needs data that is often uncertain. Many teams start qualitative and quantify the top risks.
11
What is the difference between static and dynamic malware analysis?
Static analysis examines a sample without running it: hashes, strings, imports, PE headers, YARA rule matches and disassembly. Dynamic analysis runs it in an isolated sandbox to observe processes, file changes, registry edits and network calls. Static is safe and fast but defeated by packing; dynamic shows real behaviour but malware may detect sandboxes. Analysts usually combine both in a controlled lab.
12
How do you handle night shifts and rotating schedules in a SOC?
A good answer shows realism and discipline. For example: I understand SOCs run 24x7 and night shifts are common early in a career. I keep a fixed sleep routine, prepare handover notes carefully and read previous shift notes before starting. During quiet hours I study detections or practise queries. I communicate early if a schedule conflict arises so the team can plan cover.
13
Write a KQL query in Microsoft Sentinel to find sign-ins from many countries for one user.
Use SigninLogs, summarise distinct countries per user over a day and flag outliers.
SigninLogs
| where TimeGenerated > ago(1d)
| where ResultType == 0
| summarize Countries = dcount(Location), List = make_set(Location) by UserPrincipalName
| where Countries > 2
| order by Countries desc
Review results with known travel and VPN egress points before escalating.
14
Developers share one admin account for a production database. What do you propose?
Shared accounts break accountability and are hard to rotate. Give each person an individual named account with least privilege, and provide admin access through PAM with just-in-time approval and session recording. Store the remaining break-glass credential in the vault with alerts on use. Use read-only roles for daily troubleshooting. Roll out with the team so it does not slow urgent fixes.
Map each control to the evidence an auditor will request, such as screenshots of configurations, system exports, tickets, logs and signed approvals. Keep a central evidence library organised by control ID with dates. Automate collection where possible through GRC tools that pull data from cloud, identity and ticketing systems. Sample in advance to confirm evidence covers the full audit period.
16
Users complain that a new firewall rule broke an application. How do you troubleshoot?
First check the firewall logs for denied traffic from the affected users or servers around the change time. Compare the change ticket with actual app requirements, since apps often use extra ports or dependencies. Use packet capture or a test connection to confirm. Then add a narrow rule for the real need, not an any-any rule, and update documentation so the next change does not repeat the problem.
17
A scan shows an S3 bucket with customer documents is publicly readable. What do you do?
Block public access on the bucket immediately and confirm with the owner whether any public access was intended. Check access logs and CloudTrail data events, if enabled, to see who downloaded files and when. If personal data was accessed, start the incident and breach notification process with legal. Then enable account-level block public access, add a preventive guardrail and alert on policy changes.
18
What is a salt and why is it used in password hashing?
A salt is a unique random value stored with each password hash. It makes identical passwords produce different hashes, so precomputed rainbow tables are useless and attackers must crack each hash separately. Salts are not secret. A pepper is an additional secret kept outside the database. Combined with slow algorithms like Argon2id, bcrypt or scrypt, salting makes offline cracking much more expensive.
19
How do you find overly permissive security groups with the AWS CLI?
Query security groups that allow ingress from anywhere, then review each.
aws ec2 describe-security-groups \
--filters Name=ip-permission.cidr,Values=0.0.0.0/0 \
--query 'SecurityGroups[*].[GroupId,GroupName]' --output table
Pay attention to ports 22, 3389, 3306 and 5432. Replace them with VPN, bastion or session manager access.
20
Tell me about a time you had to say no to a senior person's access request.
Situation: a senior manager asked for permanent admin rights on production to speed up reports. Task: protect production without blocking the work. Action: I explained the audit and breach risk, then offered a read-only reporting role and a scheduled export within a day. Result: the manager got the data faster than before, and the audit later had no finding on that system.
Threat hunting is proactive searching for attackers who evaded existing detections. Hunters start from a hypothesis, for example that attackers use scheduled tasks for persistence, then query EDR and SIEM data to confirm or reject it. Findings become new detection rules. Hunting requires good data retention, knowledge of normal behaviour and frameworks like MITRE ATT&CK to guide hypotheses.
22
Your company website is under an application layer DDoS attack. What actions do you take?
Confirm it is an attack and not a traffic spike by checking request patterns, user agents and source spread. Enable or tighten the CDN or WAF bot protection and rate limits on targeted URLs, add challenge pages for suspicious clients, and cache heavy pages. Inform the ISP or DDoS provider and management. After the attack, review logs, tune rules and update the runbook.
An HSM is tamper-resistant hardware that generates, stores and uses cryptographic keys without exposing them. Keys never leave the device in plain form. Banks and payment processors use HSMs for PIN processing, card keys and signing, and CAs protect root keys with them. Cloud offerings include managed HSM and KMS services. HSMs are often required for compliance standards such as PCI DSS and certified to FIPS 140-3.
IaC scanning checks Terraform, CloudFormation, Bicep or Kubernetes manifests for misconfigurations before deployment, such as public buckets or unencrypted databases. Tools include Checkov, tfsec in Trivy, and KICS. It shifts security left, so issues are fixed in a pull request rather than in production. Combine it with policy as code, like OPA, and drift detection to catch manual changes made in the console.
Create two cloud-only emergency accounts excluded from normal conditional access but protected by FIDO2 keys stored in a safe. Use long random passwords, store them split between two senior people or in a sealed vault, and give them the minimum emergency role. Alert the SOC on any sign-in, and test them every quarter. They exist for identity provider outages or misconfigured policies.
26
What is the difference between encoding, encryption and obfuscation?
Encoding, like Base64 or URL encoding, changes data format for transport and is reversible by anyone, so it gives no security. Encryption makes data unreadable without a key. Obfuscation makes code or data harder to understand but does not use a secret key, so a determined analyst can reverse it. A common mistake is treating Base64 credentials in config files as protected.
27
How would you use Sysmon to improve endpoint visibility on Windows?
Sysmon is a free Microsoft Sysinternals tool that logs detailed endpoint events to the Windows event log. Useful events are ID 1 process creation with hashes and command line, ID 3 network connection, ID 11 file creation, ID 13 registry changes and ID 22 DNS queries. With a tuned configuration, it gives rich telemetry for SIEM detections when a full EDR is not available or as an extra source.
28
What is the difference between TCP and UDP from a security point of view?
TCP is connection oriented with a three-way handshake, which makes it reliable but open to SYN flood attacks. UDP is connectionless, so it is easy to spoof source addresses and is abused in amplification attacks using DNS, NTP or memcached. Firewalls track TCP state easily, while UDP state is inferred from timeouts. Security monitoring must cover both, since DNS tunnelling uses UDP 53.
29
A US customer asks your Indian SaaS company for a SOC 2 report. What is it and which type should you aim for?
SOC 2 is an attestation report by an independent auditor on a service organisation's controls against the AICPA Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy. A Type I report checks control design at a point in time; a Type II checks operating effectiveness over a period, typically 6 to 12 months. Indian SaaS companies selling to US customers commonly need SOC 2 Type II.
30
How would you capture and analyse suspicious traffic using tcpdump and Wireshark?
Capture on the right interface with a filter to limit size, save to a pcap file, then open it in Wireshark.
sudo tcpdump -i eth0 host 10.10.0.15 and port 53 -w dns.pcap
In Wireshark, use display filters such as dns, http.request or tls.handshake.type == 1, and Statistics > Conversations to spot top talkers. Protect pcaps because they may contain sensitive data.
31
What is threat intelligence and what are IOCs and TTPs?
Threat intelligence is analysed information about adversaries, their tools and behaviour. Indicators of Compromise are artefacts like malicious IPs, domains and file hashes; they are easy to use but change quickly. TTPs, tactics, techniques and procedures, describe how attackers operate, and are harder for attackers to change. The Pyramid of Pain shows that detecting TTPs causes attackers more cost than blocking hashes.
32
How would you check a cloud account against CIS benchmarks?
Enable the native posture service, such as AWS Security Hub with the CIS AWS Foundations standard, Microsoft Defender for Cloud with the CIS Azure benchmark, or Security Command Center on Google Cloud. Open source tools like Prowler or ScoutSuite also work. Export findings, prioritise critical ones like root MFA, public storage and open admin ports, assign owners and track remediation over time.
33
How do you manage many audit and compliance deadlines at the same time?
Situation: in one quarter I had an ISO surveillance audit, a client security questionnaire backlog and a regulator report due. Task: deliver all without missing dates. Action: I listed every deliverable with owners and deadlines in a tracker, reused a central evidence library for overlapping requests, and gave weekly status to my manager. Result: everything was delivered on time with no major findings.
34
A business unit wants to accept a high risk instead of fixing it. How do you handle it?
Risk acceptance is a business decision, but it must be informed. I would document the risk, likely impact, cost of fixing and compensating controls, and confirm it exceeds or meets risk appetite. If it is high, escalate to the right authority, such as the CISO or risk committee, for formal sign-off with an expiry date. I record it in the risk register and review it on schedule.
35
An employee who is leaving copied large volumes of data to a personal cloud drive. How do you handle it?
Treat it as a potential insider incident and involve HR and legal before contacting the employee. Preserve evidence such as DLP alerts, proxy logs, endpoint file activity and cloud app logs, and document what data was involved and its sensitivity. Restrict the user's access as advised. Legal decides on next steps, such as requesting deletion with an undertaking. Then improve DLP and offboarding controls.
36
An audit finds hundreds of service accounts with no owner and keys older than three years. What are the risks and which controls do you put in place?
Service accounts and API keys often have broad privileges, never expire, are shared among teams and are excluded from MFA. Machine identities now outnumber human ones in cloud environments. Risks include hardcoded secrets and silent abuse. Controls are an inventory with owners, least privilege, managed identities or workload identity federation instead of static keys, secret rotation, and monitoring for interactive logins.
Few big employers listed in Chandigarh?
Many Chandigarh candidates also apply to teams in Gurgaon and to remote or hybrid roles. Practise the Gurgaon set as well.
Which companies hire Cyber Security professionals in Chandigarh?
Companies with large offices in Chandigarh include many IT services and product firms. Use their company pages below to practise employer-specific sets.
Are Cyber Security interviews in Chandigarh different from other cities?
The questions depend more on the company than the city. Chandigarh's mix of employers decides the style: Interviews usually check strong fundamentals and practical tool skills
How do I find Cyber Security jobs in Chandigarh?
Shortlist companies with Chandigarh offices, keep your CV focused on Cyber Security projects, apply on company career pages and job portals with the Chandigarh filter, and practise the questions on this page before each interview.