Cyber Security Interview Questions in Chennai

Show answer

Use a write blocker or a forensic tool, image the whole disk, and hash both source and image. sudo dc3dd if=/dev/sdb of=/evidence/case12.img hash=sha256 log=/evidence/case12.log sha256sum /evidence/case12.img Record the hashes, time, examiner and device details in the chain of custody form. Analyse a working copy, never the original.

What is social engineering and what are its common forms?

Security FundamentalsEasy

Show answer

Social engineering manipulates people rather than technology to gain access or information. Common forms are phishing emails, spear phishing aimed at specific staff, vishing over phone calls, smishing over SMS or WhatsApp, pretexting with a fake story, baiting with infected USB drives and tailgating into offices. Defences include awareness training, phishing simulations, call-back verification for payment changes, and technical controls such as MFA and email authentication.

Which cloud logs are essential for security monitoring?

Show answer

Essential sources are control plane audit logs such as AWS CloudTrail, Azure Activity Log and Entra sign-in logs, and Google Cloud Audit Logs. Add network flow logs, DNS logs, load balancer and WAF logs, storage access logs for sensitive buckets, and Kubernetes audit logs. Send them to a central account or SIEM that workload owners cannot delete, and enable threat detection services like GuardDuty.

Which Windows event IDs should a SOC analyst know?

Show answer

Key Security log events are 4624 successful logon, 4625 failed logon, 4672 special privileges assigned, 4688 process creation, 4720 user created, 4728 and 4732 user added to privileged groups, 4740 account lockout, 1102 audit log cleared, 4698 scheduled task created and 7045 service installed in the System log. Logon type in 4624, such as 3 for network and 10 for RDP, adds important context.

You find a web shell on a public web server. What steps do you take?

Incident Response and ForensicsHard

Show answer

Do not just delete it. Capture the file, web logs and a memory image if possible, then identify when it was created and which request uploaded it. Search logs for commands executed through it and lateral movement from the server. Contain by isolating the server or blocking the path at the WAF, then patch the vulnerable application, rebuild from a clean image and rotate any credentials stored on it.

How do you write a Splunk search to find brute-force attempts on Windows?

Show answer

Search failed logon events, count per account and source, and filter high counts. index=wineventlog EventCode=4625 | stats count AS failures dc(TargetUserName) AS users BY IpAddress | where failures > 50 | sort - failures A high distinct user count from one IP points to password spraying rather than a single account brute force.

Your company is acquiring another firm with its own Active Directory. How do you approach identity integration securely?

Identity and Access ManagementHard

Show answer

Start with assessment: their AD health, privileged accounts, trust relationships, MFA coverage and any signs of compromise. Avoid creating a full two-way forest trust early, as it can import their risks. Prefer bringing users into your cloud identity provider with B2B access or migration, with conditional access. Reset privileged credentials, apply your tiering model, and migrate application by application.

How would you use Sysmon to improve endpoint visibility on Windows?

Show answer

Sysmon is a free Microsoft Sysinternals tool that logs detailed endpoint events to the Windows event log. Useful events are ID 1 process creation with hashes and command line, ID 3 network connection, ID 11 file creation, ID 13 registry changes and ID 22 DNS queries. With a tuned configuration, it gives rich telemetry for SIEM detections when a full EDR is not available or as an extra source.

What is the difference between a threat, a vulnerability and a risk?

Security FundamentalsEasy

Show answer

A vulnerability is a weakness, such as an unpatched server. A threat is anything that can exploit it, such as a ransomware group. Risk is the likelihood that the threat exploits the vulnerability multiplied by the business impact. For example, an unpatched internet-facing VPN is high risk, while the same flaw on an isolated lab machine is low risk because likelihood and impact are smaller.

What is the difference between qualitative and quantitative risk assessment?

GRC and ComplianceMedium

Show answer

Qualitative assessment rates likelihood and impact on scales like low, medium and high, and is quick and easy to communicate. Quantitative assessment uses numbers, such as single loss expectancy times annual rate of occurrence to get annual loss expectancy, or FAIR models. Quantitative helps justify budgets but needs data that is often uncertain. Many teams start qualitative and quantify the top risks.

During triage you notice a user logged in from Mumbai and then from Frankfurt 20 minutes later. How do you handle it?

Show answer

This is an impossible travel alert. First rule out benign causes like corporate VPN, cloud proxy egress or mobile networks. Check device IDs, user agents and MFA results for both logins. If the second login is from an unknown device without MFA, or followed by mailbox rule creation or data download, revoke sessions, reset credentials, review MFA methods and contact the user through a separate channel.

How do you handle night shifts and rotating schedules in a SOC?

SOC Operations and SIEMEasy

Show answer

A good answer shows realism and discipline. For example: I understand SOCs run 24x7 and night shifts are common early in a career. I keep a fixed sleep routine, prepare handover notes carefully and read previous shift notes before starting. During quiet hours I study detections or practise queries. I communicate early if a schedule conflict arises so the team can plan cover.

Your EDR shows the same suspicious hash on 30 machines. How do you scope the incident?

Incident Response and ForensicsHard

Show answer

Search the hash, file name and parent process across all endpoints, and look for related indicators like network destinations and persistence mechanisms. Build a timeline to find patient zero and the delivery method, for example an email attachment or a compromised software update. Group affected hosts by criticality, isolate them, and check whether any credentials were stolen to plan resets broadly.

What is the Cyber Kill Chain?

Security FundamentalsMedium

Show answer

The Lockheed Martin Cyber Kill Chain describes seven stages of an intrusion: reconnaissance, weaponisation, delivery, exploitation, installation, command and control, and actions on objectives. Defenders use it to map controls to each stage, for example email filtering at delivery and egress filtering at command and control. Its weakness is a perimeter focus, so many teams pair it with MITRE ATT&CK for detailed techniques after initial access.

You are asked to prepare the company for its first ISO 27001 certification in nine months. How do you plan it?

GRC and ComplianceHard

Show answer

Get leadership sponsorship and define the ISMS scope. Run a gap assessment against clauses and Annex A, then do the risk assessment and build the risk treatment plan and Statement of Applicability. Write core policies, implement missing controls, and train staff. Collect evidence for a few months, run an internal audit and management review, fix findings, then book stage 1 and stage 2 audits.

What are the phases of incident response?

Incident Response and ForensicsEasy

Show answer

NIST SP 800-61 describes preparation; detection and analysis; containment, eradication and recovery; and post-incident activity. The 2025 revision aligns these with the NIST CSF 2.0 functions of Govern, Identify, Protect, Detect, Respond and Recover. Preparation includes playbooks, contacts and tools. Containment limits spread, eradication removes the attacker, recovery restores operations, and lessons learned improve controls and detections.

What is memory forensics and which tool is commonly used?

Show answer

Memory forensics analyses a RAM capture to find running processes, injected code, network connections, loaded DLLs, command history and encryption keys. It reveals fileless malware that leaves little on disk. Volatility 3 is the common open source framework, with plugins such as windows.pslist, windows.netscan and windows.malfind. Captures are taken with tools like WinPmem or through EDR live response.

GuardDuty reports an EC2 instance communicating with a known crypto-mining pool. How do you respond?

Show answer

Isolate the instance by changing its security group to a quarantine group with no traffic, and snapshot its volumes for analysis. Check how it was compromised: exposed SSH, vulnerable app or leaked key. Review CloudTrail for actions by its instance role. Terminate and rebuild from a clean image, rotate secrets the instance could access, and fix the root cause, such as closing public ports.

An alert shows Microsoft Word spawning PowerShell with an encoded command. What does it mean and what do you do?

Show answer

Office apps rarely start PowerShell, so this usually means a malicious macro or document exploit. Decode the Base64 command to see what it does, check the process tree and any network connections for downloads, and find the source email. Isolate the host through EDR, block the sender and URLs, search for the same email in other mailboxes and hunt for the same command line elsewhere.

How do you run a tabletop exercise?

Show answer

Pick a realistic scenario, such as ransomware on a weekend, and invite IT, security, legal, communications and business leaders. A facilitator releases injects step by step, like a ransom note appearing or a journalist calling, and participants explain decisions using the real plan. Record gaps in contacts, authority, backups and reporting timelines. Share findings and track fixes, and repeat at least twice a year.

What is MITRE ATT&CK and how is it used?

Security FundamentalsMedium

Show answer

MITRE ATT&CK is a public knowledge base of adversary tactics and techniques observed in real attacks, organised in matrices for Enterprise, Mobile and ICS. Tactics are the goal, such as Persistence, and techniques are the method, such as T1053 Scheduled Task. Teams use it to map detection coverage, write threat-informed detections, plan red and purple team exercises, and describe incidents in a common language.

Tell me about a time you made a mistake at work and how you handled it.

Show answer

Situation: as a Tier 1 analyst I closed an alert as false positive without checking the user's later activity. Task: my lead found it was a real phishing compromise. Action: I owned the mistake, helped contain it, and proposed a checklist for credential alerts that includes reviewing activity after login. Result: the checklist was adopted by the shift and similar misses stopped.

What is a business email compromise attack?

Show answer

In BEC, attackers take over or impersonate an executive, vendor or finance mailbox to trick staff into making payments or changing bank details. It often uses no malware, just a compromised account, mailbox forwarding rules and convincing requests. Controls include MFA, DMARC enforcement, alerts on new inbox rules, and a mandatory call-back process on a known number for any change to payment details.

What is a false positive and a false negative in SOC alerts?

SOC Operations and SIEMEasy

Show answer

A false positive is an alert on benign activity, such as an admin running a legitimate script flagged as malicious. A false negative is a real attack that produced no alert, which is more dangerous. Too many false positives cause alert fatigue and missed real incidents. Analysts tune rules with allowlists, thresholds and context, and test detections against simulated attacks to find false negatives.

What is Zero Trust security?

Security FundamentalsMedium

Show answer

Zero Trust removes implicit trust based on network location. Every request is verified using identity, device health and context, access is least privilege and granted per session, and the environment is assumed to be already breached. NIST SP 800-207 describes the model. In practice it means strong MFA, device posture checks, identity-aware proxies instead of flat VPN access, micro-segmentation and continuous monitoring. It is a journey, not a single product.

What is single sign-on and what protocols does it use?

Identity and Access ManagementEasy

Show answer

SSO lets a user authenticate once with an identity provider and access many applications without separate passwords. SAML 2.0 uses signed XML assertions and is common for enterprise web apps. OpenID Connect, built on OAuth 2.0, uses JSON tokens and suits modern web and mobile apps. SSO reduces password reuse and helps central control, but makes the identity provider a high-value target that needs strong MFA.

Tell me about a time you worked with developers to fix a security finding.

Show answer

Situation: a scan found a critical vulnerability in a library used by five microservices just before a release. Task: fix it without delaying the launch. Action: I paired with the lead developer, confirmed which services were truly exploitable, prepared tested upgrade pull requests and added a WAF rule as a temporary safeguard. Result: all services were patched in two days and release stayed on schedule.

How do you build a risk register?

GRC and ComplianceEasy

Show answer

Create a table where each risk has an ID, description written as cause, event and impact, asset, owner, inherent likelihood and impact, existing controls, residual rating, treatment decision, action plan, due date and review date. Gather risks through workshops, audits, incidents and threat intelligence. Review the register monthly with owners and report top risks to leadership quarterly.

What is business continuity and disaster recovery, and what are RTO and RPO?

GRC and ComplianceEasy

Show answer

Business continuity keeps critical business functions running during disruption, while disaster recovery restores IT systems. Recovery Time Objective is the maximum acceptable downtime, and Recovery Point Objective is the maximum acceptable data loss measured in time. A payments system may need an RTO of one hour and an RPO near zero, which needs replication, while an internal wiki may accept a day.

How does encryption work for data at rest in the cloud?

Show answer

Most cloud storage, databases and disks encrypt data at rest by default with provider-managed keys. For more control, use customer managed keys in KMS, with key policies, rotation and logs of every use, or bring and hold your own keys for strict regulatory needs. Encryption at rest protects against physical media theft, but not against someone with valid IAM permissions, so access control remains critical.

What is threat intelligence and what are IOCs and TTPs?