Cyber Security Interview Questions in Gurgaon

Show answer

Pick a realistic scenario, such as ransomware on a weekend, and invite IT, security, legal, communications and business leaders. A facilitator releases injects step by step, like a ransom note appearing or a journalist calling, and participants explain decisions using the real plan. Record gaps in contacts, authority, backups and reporting timelines. Share findings and track fixes, and repeat at least twice a year.

What are the key points of India's DPDP Act?

Show answer

The Digital Personal Data Protection Act 2023 governs digital personal data. Data fiduciaries need valid consent or a legitimate use, must give clear notice, protect data with reasonable safeguards, notify breaches to the Data Protection Board and affected people, and delete data when no longer needed. Data principals have rights to access, correction and erasure. Penalties go up to 250 crore rupees. The DPDP Rules 2025 phase in obligations.

What is a business email compromise attack?

Show answer

In BEC, attackers take over or impersonate an executive, vendor or finance mailbox to trick staff into making payments or changing bank details. It often uses no malware, just a compromised account, mailbox forwarding rules and convincing requests. Controls include MFA, DMARC enforcement, alerts on new inbox rules, and a mandatory call-back process on a known number for any change to payment details.

What SOC metrics matter most?

SOC Operations and SIEMMedium

Show answer

Important metrics are mean time to detect, mean time to respond, alert volume per analyst, false positive rate per rule, percentage of alerts closed within SLA, detection coverage against priority ATT&CK techniques and log source health. Metrics should drive improvement, not punish analysts. For example, a rule with 95 percent false positives should be tuned, and long response times may point to missing automation.

A US customer asks your Indian SaaS company for a SOC 2 report. What is it and which type should you aim for?

Show answer

SOC 2 is an attestation report by an independent auditor on a service organisation's controls against the AICPA Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy. A Type I report checks control design at a point in time; a Type II checks operating effectiveness over a period, typically 6 to 12 months. Indian SaaS companies selling to US customers commonly need SOC 2 Type II.

What is Zero Trust security?

Show answer

Zero Trust removes implicit trust based on network location. Every request is verified using identity, device health and context, access is least privilege and granted per session, and the environment is assumed to be already breached. NIST SP 800-207 describes the model. In practice it means strong MFA, device posture checks, identity-aware proxies instead of flat VPN access, micro-segmentation and continuous monitoring. It is a journey, not a single product.

Leadership wants to block all USB drives tomorrow. How would you handle this request?

Show answer

I would support the goal but plan the rollout to avoid breaking business work. First, find who genuinely needs USB, such as field engineers, using endpoint logs. Then apply a device control policy through EDR or Intune that blocks mass storage by default, allows approved encrypted devices by serial number, and logs exceptions. Communicate the change, pilot it with one department, then enforce company wide.

A new vendor will process customer personal data. What checks do you perform before onboarding?

Show answer

Classify the vendor as high risk. Review their security questionnaire, ISO 27001 certificate or SOC 2 Type II report, data location, subprocessors, encryption, access controls and incident response capability. Under the DPDP Act, we remain responsible as data fiduciary, so the contract needs data processing terms, breach notification timelines, deletion on exit and audit rights. Track any gaps with deadlines.

What is defence in depth?

Security FundamentalsEasy

Show answer

Defence in depth means using several independent layers of controls so that one failure does not lead to a breach. A typical stack has perimeter firewalls, email filtering, endpoint EDR, MFA, network segmentation, least privilege, logging and backups. If a phishing email gets past the filter, MFA and EDR can still stop the attacker. The trade-off is cost and complexity, so layers should target the most likely attack paths.

Your IDS alerts on outbound traffic from a database server to an unknown IP on port 443 at 3 AM. How do you investigate?

Network SecurityMedium

Show answer

Database servers rarely need internet access, so this is suspicious. I would check the destination's reputation and WHOIS, look at flow data for volume and duration, and identify the process making the connection using EDR. Then I review recent logins, scheduled tasks and new binaries on the server. If data volume is large or the process is unknown, I contain the host and escalate as a possible exfiltration.

A user on the office LAN reports repeated certificate warnings and you suspect ARP spoofing. What is happening and how do you stop it?

Network SecurityMedium

Show answer

ARP has no authentication, so an attacker on the same LAN can send fake ARP replies linking their MAC address to the gateway's IP. Victims then send traffic through the attacker, enabling man-in-the-middle interception. Defences include Dynamic ARP Inspection with DHCP snooping on switches, port security, network access control, and encrypting traffic end to end with TLS so intercepted data is useless.

A user reports a pop-up saying their files are encrypted. What are your first steps?

Show answer

First, isolate the device from the network, ideally through EDR network containment, without powering it off so memory evidence is kept. Inform the incident lead and start a timeline. Check for the same indicators on other hosts, disable the user's sessions and reset credentials if needed, and identify the ransomware family from the note. Then confirm backups are intact and offline before any recovery begins.

What is RBAC and ABAC?

Show answer

Role-Based Access Control grants permissions to roles such as Finance Analyst, and users get roles; it is simple to manage and audit. Attribute-Based Access Control decides using attributes of the user, resource and context, such as department, data classification, location and time. ABAC is more flexible but harder to reason about. Many organisations use RBAC as the base and add attribute conditions for sensitive cases.

What is the Cyber Kill Chain?

Show answer

The Lockheed Martin Cyber Kill Chain describes seven stages of an intrusion: reconnaissance, weaponisation, delivery, exploitation, installation, command and control, and actions on objectives. Defenders use it to map controls to each stage, for example email filtering at delivery and egress filtering at command and control. Its weakness is a perimeter focus, so many teams pair it with MITRE ATT&CK for detailed techniques after initial access.

GuardDuty reports an EC2 instance communicating with a known crypto-mining pool. How do you respond?

Cloud SecurityMedium

Show answer

Isolate the instance by changing its security group to a quarantine group with no traffic, and snapshot its volumes for analysis. Check how it was compromised: exposed SSH, vulnerable app or leaked key. Review CloudTrail for actions by its instance role. Terminate and rebuild from a clean image, rotate secrets the instance could access, and fix the root cause, such as closing public ports.

How do you collect audit evidence efficiently?

Show answer

Map each control to the evidence an auditor will request, such as screenshots of configurations, system exports, tickets, logs and signed approvals. Keep a central evidence library organised by control ID with dates. Automate collection where possible through GRC tools that pull data from cloud, identity and ticketing systems. Sample in advance to confirm evidence covers the full audit period.

What is certificate revocation and how is it checked?

Cryptography and PKIMedium

Show answer

Revocation invalidates a certificate before expiry, for example when its private key leaks. Methods are CRLs, which are signed lists of revoked serial numbers, and OCSP, where the client asks a responder about one certificate. OCSP stapling lets the server attach a fresh response to the handshake. Because revocation checking is unreliable, the industry is moving to much shorter certificate lifetimes, which reduces exposure.

How do you handle a network team that refuses a security change you recommended?

Network SecurityMedium

Show answer

Situation: the network team rejected my request to block outbound SMB at the firewall, fearing outages. Task: reduce the risk without damaging the relationship. Action: I shared flow data showing only two servers needed it, proposed an allowlist for them and a one-week monitor-only phase. Result: the team agreed, the rule went live with zero incidents, and we now review rules together monthly.

How would you set up envelope encryption for application data in the cloud?

Cryptography and PKIHard

Show answer

Create a customer managed key in the cloud KMS with strict IAM so only the app role can use it. The app asks KMS for a data key, encrypts records locally with AES-GCM using the plaintext data key, stores the encrypted data key next to the data, and discards the plaintext key. To decrypt, it sends the encrypted data key to KMS. Enable key rotation and audit logging.

What are key container and Kubernetes security practices?

Cloud SecurityHard

Show answer

Use minimal, scanned base images and sign them. Run containers as non-root with read-only filesystems and dropped capabilities. In Kubernetes, enforce Pod Security Standards, use RBAC with least privilege, network policies to restrict pod traffic, secrets from an external store, and keep the API server private. Enable audit logs and runtime detection such as Falco, and patch clusters regularly.

What is the difference between static and dynamic malware analysis?

Show answer

Static analysis examines a sample without running it: hashes, strings, imports, PE headers, YARA rule matches and disassembly. Dynamic analysis runs it in an isolated sandbox to observe processes, file changes, registry edits and network calls. Static is safe and fast but defeated by packing; dynamic shows real behaviour but malware may detect sandboxes. Analysts usually combine both in a controlled lab.

What is chain of custody in digital forensics?

Incident Response and ForensicsEasy

Show answer

Chain of custody is the documented record of who collected evidence, when, how, where it was stored and every person who handled it. It proves evidence was not altered, which is essential if the case goes to court or regulators. Practices include hashing disk images at acquisition, using write blockers, storing evidence securely and logging every transfer with signatures and timestamps.

A finance employee transferred money after a fake email from the CEO. What do you do?

Show answer

Contact the bank immediately to try to stop or recall the transfer; speed matters most. Report to the cybercrime portal and police. Investigate the email: was the CEO mailbox compromised or spoofed? Check sign-in logs, forwarding rules and other targeted staff. Reset credentials, enforce MFA and DMARC, and add a call-back rule for payment changes. Include legal and management throughout.

What is the difference between OAuth 2.0 and OpenID Connect?

Show answer

OAuth 2.0 is an authorisation framework; it lets an app get an access token to call an API on a user's behalf, without the user's password. It does not define who the user is. OpenID Connect adds an identity layer with an ID token, a signed JWT containing user claims, and a userinfo endpoint. Use OIDC for login, and OAuth access tokens for API authorisation.

Attackers bypassed MFA by sending repeated push notifications until a user approved. How do you prevent this?

Show answer

This is MFA fatigue. Enable number matching and show app and location context in push requests, limit the number of prompts, and alert on repeated denials. Move high-risk users and admins to phishing-resistant methods such as FIDO2 keys or passkeys. Train users to report unexpected prompts. Also revoke the attacker's sessions and review what they accessed.

During triage you notice a user logged in from Mumbai and then from Frankfurt 20 minutes later. How do you handle it?

SOC Operations and SIEMMedium

Show answer

This is an impossible travel alert. First rule out benign causes like corporate VPN, cloud proxy egress or mobile networks. Check device IDs, user agents and MFA results for both logins. If the second login is from an unknown device without MFA, or followed by mailbox rule creation or data download, revoke sessions, reset credentials, review MFA methods and contact the user through a separate channel.

Your EDR shows the same suspicious hash on 30 machines. How do you scope the incident?

Incident Response and ForensicsHard

Show answer

Search the hash, file name and parent process across all endpoints, and look for related indicators like network destinations and persistence mechanisms. Build a timeline to find patient zero and the delivery method, for example an email attachment or a compromised software update. Group affected hosts by criticality, isolate them, and check whether any credentials were stolen to plan resets broadly.

Your CISO asks whether the company needs to act on quantum computing risk now. What do you advise?

Cryptography and PKIHard

Show answer

Large quantum computers could break RSA and elliptic curve cryptography using Shor's algorithm. NIST published post-quantum standards in 2024: ML-KEM for key exchange, and ML-DSA and SLH-DSA for signatures. Attackers can harvest encrypted traffic now and decrypt it later, so long-lived sensitive data is at risk. Organisations should inventory cryptography, prefer crypto agility, and test hybrid key exchange that browsers already support.

What is ISO/IEC 27001?

GRC and ComplianceEasy

Show answer

ISO/IEC 27001 is the international standard for an Information Security Management System. The 2022 version has clauses 4 to 10 for the management system, such as context, leadership, risk assessment, internal audit and improvement, and Annex A with 93 controls grouped into Organisational, People, Physical and Technological themes. Companies get certified through an accredited body, which Indian IT services firms often need for client contracts.

How would you run a basic threat model for a new web application?

Show answer

Draw a data flow diagram showing users, the web app, APIs, databases and third parties, and mark trust boundaries. Then apply STRIDE to each element: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service and Elevation of privilege. For each threat, record the existing control, a risk rating and an owner. Repeat the model whenever the architecture changes, ideally during design reviews.

What is a false positive and a false negative in SOC alerts?

SOC Operations and SIEMEasy

Show answer

A false positive is an alert on benign activity, such as an admin running a legitimate script flagged as malicious. A false negative is a real attack that produced no alert, which is more dangerous. Too many false positives cause alert fatigue and missed real incidents. Analysts tune rules with allowlists, thresholds and context, and test detections against simulated attacks to find false negatives.

What is EDR and how is it different from antivirus?

SOC Operations and SIEMEasy

Show answer

Endpoint Detection and Response records detailed endpoint activity, like process creation, command lines, network connections and registry changes, and detects suspicious behaviour, not just known files. Analysts can investigate a process tree, isolate a host and remove malware remotely. Traditional antivirus mainly blocks known signatures. XDR extends EDR by correlating endpoint, email, identity and cloud signals in one platform.

What is the role of a Hardware Security Module?

Cryptography and PKIHard

Show answer

An HSM is tamper-resistant hardware that generates, stores and uses cryptographic keys without exposing them. Keys never leave the device in plain form. Banks and payment processors use HSMs for PIN processing, card keys and signing, and CAs protect root keys with them. Cloud offerings include managed HSM and KMS services. HSMs are often required for compliance standards such as PCI DSS and certified to FIPS 140-3.

How would you roll out MFA to 5000 employees?

Show answer

Start with admins and remote access, then high-risk groups like finance. Pick methods, preferring authenticator app number matching and passkeys or FIDO2 keys for admins. Pilot with one department, prepare helpdesk scripts and self-service registration, and communicate clearly with deadlines. Use conditional access in report-only mode to find gaps, then enforce. Block legacy authentication and track registration rates weekly.

What is the role of IAM in AWS security?

Cloud SecurityMedium

Show answer

AWS IAM controls who can do what on which resources through users, groups, roles and JSON policies. Best practices are avoiding root account use and protecting it with MFA, using roles with temporary credentials instead of access keys, least privilege policies, permission boundaries, and Service Control Policies in AWS Organizations to set guardrails across accounts. IAM Access Analyzer helps find unused and external access.

How do you decode and check a JWT during troubleshooting?