Cyber Security Interview Questions in Hyderabad

Show answer

Define scope, such as all users with write or admin rights. Pull entitlements and last-login data from the app, and route each item to the user's manager and the app owner. Give clear choices of keep or revoke with a deadline, and revoke automatically if not reviewed. Capture evidence for auditors, and review exceptions with security. Run it quarterly for privileged access.

How do you handle a network team that refuses a security change you recommended?

Network SecurityMedium

Show answer

Situation: the network team rejected my request to block outbound SMB at the firewall, fearing outages. Task: reduce the risk without damaging the relationship. Action: I shared flow data showing only two servers needed it, proposed an allowlist for them and a one-week monitor-only phase. Result: the team agreed, the rule went live with zero incidents, and we now review rules together monthly.

What is PCI DSS?

GRC and ComplianceMedium

Show answer

The Payment Card Industry Data Security Standard applies to any organisation that stores, processes or transmits cardholder data. Version 4.0.1 is current, and its future-dated requirements became mandatory from March 2025. It has 12 requirement areas, including network security controls, protecting stored data, encryption in transit, vulnerability management, access control, logging and testing. Reducing scope through tokenisation and segmentation lowers compliance effort.

Why is AES-GCM preferred over AES-CBC?

Show answer

AES-GCM is an authenticated encryption mode, so it gives confidentiality and integrity together, detecting any tampering through its authentication tag. AES-CBC gives only confidentiality and needs a separate MAC; mistakes in combining them caused padding oracle attacks. GCM is also fast with hardware support. Its main rule is never reusing a nonce with the same key, because reuse breaks both confidentiality and integrity.

What is threat hunting?

Show answer

Threat hunting is proactive searching for attackers who evaded existing detections. Hunters start from a hypothesis, for example that attackers use scheduled tasks for persistence, then query EDR and SIEM data to confirm or reject it. Findings become new detection rules. Hunting requires good data retention, knowledge of normal behaviour and frameworks like MITRE ATT&CK to guide hypotheses.

Write a least-privilege AWS IAM policy that allows reading one S3 bucket.

Cloud SecurityMedium

Show answer

Allow only listing that bucket and reading its objects. { "Version": "2012-10-17", "Statement": [ {"Effect": "Allow", "Action": "s3:ListBucket", "Resource": "arn:aws:s3:::reports-prod"}, {"Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::reports-prod/*"} ] } Attach it to a role, not a user with long-lived keys.

How would you roll out MFA to 5000 employees?

Show answer

Start with admins and remote access, then high-risk groups like finance. Pick methods, preferring authenticator app number matching and passkeys or FIDO2 keys for admins. Pilot with one department, prepare helpdesk scripts and self-service registration, and communicate clearly with deadlines. Use conditional access in report-only mode to find gaps, then enforce. Block legacy authentication and track registration rates weekly.

Which Windows event IDs should a SOC analyst know?

Show answer

Key Security log events are 4624 successful logon, 4625 failed logon, 4672 special privileges assigned, 4688 process creation, 4720 user created, 4728 and 4732 user added to privileged groups, 4740 account lockout, 1102 audit log cleared, 4698 scheduled task created and 7045 service installed in the System log. Logon type in 4624, such as 3 for network and 10 for RDP, adds important context.

What is threat intelligence and what are IOCs and TTPs?

Show answer

Threat intelligence is analysed information about adversaries, their tools and behaviour. Indicators of Compromise are artefacts like malicious IPs, domains and file hashes; they are easy to use but change quickly. TTPs, tactics, techniques and procedures, describe how attackers operate, and are harder for attackers to change. The Pyramid of Pain shows that detecting TTPs causes attackers more cost than blocking hashes.

How do you create a forensic disk image and verify it?

Incident Response and ForensicsMedium

Show answer

Use a write blocker or a forensic tool, image the whole disk, and hash both source and image. sudo dc3dd if=/dev/sdb of=/evidence/case12.img hash=sha256 log=/evidence/case12.log sha256sum /evidence/case12.img Record the hashes, time, examiner and device details in the chain of custody form. Analyse a working copy, never the original.

What is Privileged Access Management?

Show answer

PAM protects powerful accounts like domain admins, root, database admins and cloud owners. It includes a vault for credentials with automatic rotation, just-in-time elevation, session brokering with recording, approval workflows and alerts on unusual use. Tools include CyberArk, BeyondTrust and Delinea. PAM is important because attackers aim for privileged credentials to move laterally and deploy ransomware across the network.

What is Infrastructure as Code security scanning?

Cloud SecurityMedium

Show answer

IaC scanning checks Terraform, CloudFormation, Bicep or Kubernetes manifests for misconfigurations before deployment, such as public buckets or unencrypted databases. Tools include Checkov, tfsec in Trivy, and KICS. It shifts security left, so issues are fixed in a pull request rather than in production. Combine it with policy as code, like OPA, and drift detection to catch manual changes made in the console.

Attackers bypassed MFA by sending repeated push notifications until a user approved. How do you prevent this?

Show answer

This is MFA fatigue. Enable number matching and show app and location context in push requests, limit the number of prompts, and alert on repeated denials. Move high-risk users and admins to phishing-resistant methods such as FIDO2 keys or passkeys. Train users to report unexpected prompts. Also revoke the attacker's sessions and review what they accessed.

What is the difference between an event, an alert and an incident?

Incident Response and ForensicsEasy

Show answer

An event is any observable occurrence, like a login or a file change. An alert is an event or pattern that a tool flags as possibly malicious. An incident is a confirmed or highly likely violation of security policy that needs response, such as a compromised account. Clear definitions matter because incidents trigger escalation, legal review and regulatory reporting timelines.

How do you decode and check a JWT during troubleshooting?

Show answer

A JWT has header, payload and signature separated by dots. Decode the first two parts to read claims, but never trust them without verifying the signature. echo $TOKEN | cut -d. -f2 | base64 -d 2>/dev/null Check iss, aud, exp and nbf claims. In code, verify with a library using the expected algorithm and issuer keys, and reject alg none.

What are passkeys?

Show answer

Passkeys are FIDO2 credentials that replace passwords. The device creates a key pair per website; the private key stays in the device or synced password manager, protected by biometrics or PIN, and the server stores only the public key. Login is a signature over a challenge tied to the real domain, so passkeys resist phishing and cannot be reused across sites. They also remove password reset load.

Tell me about a time you learned a difficult technical topic quickly.

Cryptography and PKIEasy

Show answer

Situation: in my final year project I needed TLS mutual authentication for an IoT prototype within two weeks. Task: understand PKI enough to build it. Action: I read the TLS 1.3 overview, set up a small CA with OpenSSL, issued device certificates and tested failures deliberately. Result: the demo worked, and I documented the steps so classmates could reuse them, which helped our team score well.

What is key management and why is it hard?

Show answer

Key management covers generating, distributing, storing, rotating, backing up and destroying keys. It is hard because strong encryption is useless if keys sit in code, config files or shared drives. Good practice is a central KMS or vault, envelope encryption with data keys wrapped by master keys, automatic rotation, strict IAM on key usage and logging every decrypt call. Losing keys can also mean losing data permanently.

What is Network Access Control?

Network SecurityMedium

Show answer

NAC checks devices and users before allowing them on the network, typically using 802.1X with a RADIUS server. It can verify certificates, patch level, EDR presence and user identity, then assign a VLAN or policy. Unknown or non-compliant devices go to a quarantine or guest network. NAC is important in offices with many personal devices and IoT equipment such as printers and cameras.

How do you write a Splunk search to find brute-force attempts on Windows?

Show answer

Search failed logon events, count per account and source, and filter high counts. index=wineventlog EventCode=4625 | stats count AS failures dc(TargetUserName) AS users BY IpAddress | where failures > 50 | sort - failures A high distinct user count from one IP points to password spraying rather than a single account brute force.

What is the shared responsibility model in cloud security?

Cloud SecurityEasy

Show answer

The cloud provider secures the infrastructure: data centres, hardware, hypervisors and managed service internals. The customer secures what they put in the cloud: identities, data, configurations, network rules and their applications. The split changes by service type; with IaaS you patch the OS, with SaaS you mainly manage users and data settings. Most cloud breaches come from customer-side misconfiguration, not provider failures.

What is certificate revocation and how is it checked?

Cryptography and PKIMedium

Show answer

Revocation invalidates a certificate before expiry, for example when its private key leaks. Methods are CRLs, which are signed lists of revoked serial numbers, and OCSP, where the client asks a responder about one certificate. OCSP stapling lets the server attach a fresh response to the handshake. Because revocation checking is unreliable, the industry is moving to much shorter certificate lifetimes, which reduces exposure.

How would you set up envelope encryption for application data in the cloud?

Show answer

Create a customer managed key in the cloud KMS with strict IAM so only the app role can use it. The app asks KMS for a data key, encrypts records locally with AES-GCM using the plaintext data key, stores the encrypted data key next to the data, and discards the plaintext key. To decrypt, it sends the encrypted data key to KMS. Enable key rotation and audit logging.

What is Certificate Transparency?

Show answer

Certificate Transparency requires publicly trusted CAs to log every issued certificate in public append-only logs. Browsers require proof of logging before trusting a certificate. Domain owners can monitor these logs to detect certificates issued for their domains without permission, for example by a compromised CA or a phishing actor. Security teams also use CT logs for subdomain discovery and asset inventory.

A developer wants to write their own encryption algorithm for customer data. How do you respond?

Cryptography and PKIEasy

Show answer

I would advise against it. Custom cryptography almost always has flaws that experts would find, and it fails audits. Instead, use well-reviewed libraries such as libsodium, platform crypto APIs, or the cloud KMS with AES-GCM and envelope encryption. I would offer to help choose the right library and key management design, and include a security review in the feature's pull request.

What is the difference between TCP and UDP from a security point of view?

Network SecurityEasy

Show answer

TCP is connection oriented with a three-way handshake, which makes it reliable but open to SYN flood attacks. UDP is connectionless, so it is easy to spoof source addresses and is abused in amplification attacks using DNS, NTP or memcached. Firewalls track TCP state easily, while UDP state is inferred from timeouts. Security monitoring must cover both, since DNS tunnelling uses UDP 53.

How do you find stale and privileged accounts in Active Directory with PowerShell?

Show answer

Use the ActiveDirectory module. Search-ADAccount -AccountInactive -TimeSpan 90.00:00:00 -UsersOnly | Select Name, LastLogonDate Get-ADGroupMember 'Domain Admins' -Recursive | Select Name, SamAccountName Get-ADUser -Filter {PasswordNeverExpires -eq $true} | Select Name Review results with owners before disabling anything.

How do you scan your own network for open ports with Nmap, with permission?

Network SecurityEasy

Show answer

Only scan networks you own or have written approval for. Start with host discovery, then service and version detection on key ports. nmap -sn 10.10.0.0/24 nmap -sV -T3 -p 1-1000 10.10.0.15 nmap -sV --top-ports 100 -oA scan_results 10.10.0.0/24 Compare results with the approved service list and raise tickets for unexpected open ports.

Developers want admin access in the cloud to move fast. How do you balance speed and security?

Cloud SecurityMedium

Show answer

Give them freedom inside guardrails. Provide sandbox accounts where they have broad rights, but production changes go through IaC pipelines with scanning and review. Use permission boundaries and SCPs to block dangerous actions like disabling logging or making resources public. Offer pre-approved modules for common patterns. This keeps speed high while preventing the riskiest mistakes.

Tell me about a time you followed process even though a shortcut was tempting.

Incident Response and ForensicsHard

Show answer

Situation: during a suspected malware case, a senior engineer wanted to wipe the laptop immediately to save time. Task: contain the threat while preserving evidence. Action: I explained that we needed a memory capture and EDR timeline first, which would take 20 minutes, and isolated the laptop meanwhile. Result: the capture revealed stolen browser credentials, so we reset them before they were misused.

What is a false positive and a false negative in SOC alerts?

SOC Operations and SIEMEasy

Show answer

A false positive is an alert on benign activity, such as an admin running a legitimate script flagged as malicious. A false negative is a real attack that produced no alert, which is more dangerous. Too many false positives cause alert fatigue and missed real incidents. Analysts tune rules with allowlists, thresholds and context, and test detections against simulated attacks to find false negatives.

What is RBAC and ABAC?