36 practice questions with answers for Cyber Security interviews in Kochi.
Cyber Security jobs in Kochi
Kochi's Infopark and SmartCity host IT-services firms, product companies and start-ups, making it Kerala's largest tech job market along with Thiruvananthapuram. Testing and data roles are common in its service and product teams.
Below are 36 questions that match the mix of service, product and domain employers hiring soc analyst (l1/l2)s in Kochi.
Solved for KochiStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
The Lockheed Martin Cyber Kill Chain describes seven stages of an intrusion: reconnaissance, weaponisation, delivery, exploitation, installation, command and control, and actions on objectives. Defenders use it to map controls to each stage, for example email filtering at delivery and egress filtering at command and control. Its weakness is a perimeter focus, so many teams pair it with MITRE ATT&CK for detailed techniques after initial access.
02
What is the difference between a policy, a standard, a procedure and a guideline?
A policy is a high-level management statement of intent, such as all data must be classified. A standard sets mandatory specific requirements, like AES-256 for confidential data. A procedure gives step-by-step instructions to meet the standard. A guideline is recommended but optional advice. This hierarchy lets policies stay stable while standards and procedures change with technology.
In BEC, attackers take over or impersonate an executive, vendor or finance mailbox to trick staff into making payments or changing bank details. It often uses no malware, just a compromised account, mailbox forwarding rules and convincing requests. Controls include MFA, DMARC enforcement, alerts on new inbox rules, and a mandatory call-back process on a known number for any change to payment details.
04
What are the data residency rules relevant to cloud in India?
The DPDP Act 2023 allows cross-border transfer of personal data except to countries the government restricts, though sector rules can be stricter. RBI requires payment system data to be stored only in India. CERT-In requires ICT logs to be kept in India for 180 days. SEBI and IRDAI have their own requirements for regulated entities. Cloud architects choose Indian regions such as Mumbai or Hyderabad for compliance.
Use a dedicated password hashing library with Argon2id, which handles salts and parameters automatically.
from argon2 import PasswordHasher
ph = PasswordHasher()
stored = ph.hash(password)
try:
ph.verify(stored, attempt)
if ph.check_needs_rehash(stored):
stored = ph.hash(attempt)
except Exception:
deny_login()
Never use plain SHA-256 or MD5 for passwords.
ISO/IEC 27001 is the international standard for an Information Security Management System. The 2022 version has clauses 4 to 10 for the management system, such as context, leadership, risk assessment, internal audit and improvement, and Annex A with 93 controls grouped into Organisational, People, Physical and Technological themes. Companies get certified through an accredited body, which Indian IT services firms often need for client contracts.
07
Tell me about a time you had to say no to a senior person's access request.
Situation: a senior manager asked for permanent admin rights on production to speed up reports. Task: protect production without blocking the work. Action: I explained the audit and breach risk, then offered a read-only reporting role and a scheduled export within a day. Result: the manager got the data faster than before, and the audit later had no finding on that system.
08
Which cloud logs are essential for security monitoring?
Essential sources are control plane audit logs such as AWS CloudTrail, Azure Activity Log and Entra sign-in logs, and Google Cloud Audit Logs. Add network flow logs, DNS logs, load balancer and WAF logs, storage access logs for sensitive buckets, and Kubernetes audit logs. Send them to a central account or SIEM that workload owners cannot delete, and enable threat detection services like GuardDuty.
09
A finance employee transferred money after a fake email from the CEO. What do you do?
Contact the bank immediately to try to stop or recall the transfer; speed matters most. Report to the cybercrime portal and police. Investigate the email: was the CEO mailbox compromised or spoofed? Check sign-in logs, forwarding rules and other targeted staff. Reset credentials, enforce MFA and DMARC, and add a call-back rule for payment changes. Include legal and management throughout.
Passkeys are FIDO2 credentials that replace passwords. The device creates a key pair per website; the private key stays in the device or synced password manager, protected by biometrics or PIN, and the server stores only the public key. Login is a signature over a challenge tied to the real domain, so passkeys resist phishing and cannot be reused across sites. They also remove password reset load.
11
What is certificate revocation and how is it checked?
Revocation invalidates a certificate before expiry, for example when its private key leaks. Methods are CRLs, which are signed lists of revoked serial numbers, and OCSP, where the client asks a responder about one certificate. OCSP stapling lets the server attach a fresh response to the handshake. Because revocation checking is unreliable, the industry is moving to much shorter certificate lifetimes, which reduces exposure.
12
Your SOC sees heavy DNS traffic with long random subdomains from one workstation. Which DNS attacks should you consider and what defences apply?
Key DNS attacks are cache poisoning, which inserts false records; DNS tunnelling, which hides data or command traffic inside queries; domain hijacking through registrar account takeover; and DNS amplification DDoS. Defences include DNSSEC to sign records, protective DNS resolvers that block malicious domains, monitoring for long or high-entropy subdomains, registrar lock with MFA, and rate limiting open resolvers.
13
A business unit wants to accept a high risk instead of fixing it. How do you handle it?
Risk acceptance is a business decision, but it must be informed. I would document the risk, likely impact, cost of fixing and compensating controls, and confirm it exceeds or meets risk appetite. If it is high, escalate to the right authority, such as the CISO or risk committee, for formal sign-off with an expiry date. I record it in the risk register and review it on schedule.
14
Tell me about a time you had to convince a team to follow a compliance requirement they disliked.
Situation: developers resisted mandatory code review evidence for SOC 2, seeing it as paperwork. Task: get compliance without slowing releases. Action: I explained the audit risk to customer deals and showed that branch protection rules could create evidence automatically. Result: we enabled required reviews in the repository settings, evidence became automatic and the audit passed with no finding.
15
A user on the office LAN reports repeated certificate warnings and you suspect ARP spoofing. What is happening and how do you stop it?
ARP has no authentication, so an attacker on the same LAN can send fake ARP replies linking their MAC address to the gateway's IP. Victims then send traffic through the attacker, enabling man-in-the-middle interception. Defences include Dynamic ARP Inspection with DHCP snooping on switches, port security, network access control, and encrypting traffic end to end with TLS so intercepted data is useless.
16
How would you design a joiner, mover, leaver process for a growing company?
JML is the identity lifecycle. Joiners get accounts and baseline access from HR data on day one. Movers change roles, and their old access must be removed, not just new access added, to avoid privilege creep. Leavers must be disabled promptly, ideally automatically when HR records their exit. Automating JML from the HR system to the identity platform reduces orphan accounts, which auditors frequently flag.
Short-term containment stops the spread quickly, for example isolating hosts through EDR, disabling accounts, blocking IPs or domains and segmenting networks. Long-term containment keeps business running while preparing clean systems, such as rebuilding servers in a separate network. Responders must balance speed with evidence preservation and avoid alerting a sophisticated attacker too early if they need to understand the full scope.
18
A guest Wi-Fi user can reach internal printers. What is wrong and how do you fix it?
Guest traffic is not properly isolated, likely because the guest SSID shares a VLAN with internal devices or the firewall allows inter-VLAN routing. Fix by placing guests on a separate VLAN with internet-only access, applying ACLs that deny all RFC 1918 internal ranges, and enabling client isolation on the wireless controller. Then test from a guest device and document the design.
19
What is the order of volatility in evidence collection?
Collect the most volatile evidence first because it disappears quickly. The order is CPU registers and cache, memory including running processes and network connections, temporary files, disk, remote logs, and finally archived media. That is why responders capture RAM before shutting down a machine, since malware running only in memory, decrypted keys and active connections are lost at power off.
20
How do you handle a network team that refuses a security change you recommended?
Situation: the network team rejected my request to block outbound SMB at the firewall, fearing outages. Task: reduce the risk without damaging the relationship. Action: I shared flow data showing only two servers needed it, proposed an allowlist for them and a one-week monitor-only phase. Result: the team agreed, the rule went live with zero incidents, and we now review rules together monthly.
21
Tell me about a time you made a mistake at work and how you handled it.
Situation: as a Tier 1 analyst I closed an alert as false positive without checking the user's later activity. Task: my lead found it was a real phishing compromise. Action: I owned the mistake, helped contain it, and proposed a checklist for credential alerts that includes reviewing activity after login. Result: the checklist was adopted by the shift and similar misses stopped.
22
A new vendor will process customer personal data. What checks do you perform before onboarding?
Classify the vendor as high risk. Review their security questionnaire, ISO 27001 certificate or SOC 2 Type II report, data location, subprocessors, encryption, access controls and incident response capability. Under the DPDP Act, we remain responsible as data fiduciary, so the contract needs data processing terms, breach notification timelines, deletion on exit and audit rights. Track any gaps with deadlines.
23
How do you design an access review for a critical application?
Define scope, such as all users with write or admin rights. Pull entitlements and last-login data from the app, and route each item to the user's manager and the app owner. Give clear choices of keep or revoke with a deadline, and revoke automatically if not reviewed. Capture evidence for auditors, and review exceptions with security. Run it quarterly for privileged access.
24
Leadership wants to block all USB drives tomorrow. How would you handle this request?
I would support the goal but plan the rollout to avoid breaking business work. First, find who genuinely needs USB, such as field engineers, using endpoint logs. Then apply a device control policy through EDR or Intune that blocks mass storage by default, allows approved encrypted devices by serial number, and logs exceptions. Communicate the change, pilot it with one department, then enforce company wide.
25
What is the difference between static and dynamic malware analysis?
Static analysis examines a sample without running it: hashes, strings, imports, PE headers, YARA rule matches and disassembly. Dynamic analysis runs it in an isolated sandbox to observe processes, file changes, registry edits and network calls. Static is safe and fast but defeated by packing; dynamic shows real behaviour but malware may detect sandboxes. Analysts usually combine both in a controlled lab.
A Distributed Denial of Service attack floods a target from many sources to exhaust bandwidth, connection tables or application resources. Types are volumetric floods, protocol attacks like SYN floods, and application layer floods hitting costly pages. Mitigation uses upstream scrubbing services or CDN providers, anycast networks, rate limiting, SYN cookies, autoscaling, and a tested runbook agreed with the ISP before an attack.
27
How would you use Sysmon to improve endpoint visibility on Windows?
Sysmon is a free Microsoft Sysinternals tool that logs detailed endpoint events to the Windows event log. Useful events are ID 1 process creation with hashes and command line, ID 3 network connection, ID 11 file creation, ID 13 registry changes and ID 22 DNS queries. With a tuned configuration, it gives rich telemetry for SIEM detections when a full EDR is not available or as an extra source.
TPRM assesses and monitors the security of vendors that access your data or systems, since many breaches start with a supplier. It includes tiering vendors by risk, security questionnaires, reviewing SOC 2 or ISO 27001 reports, contract clauses for breach notification and audit rights, and continuous monitoring. High-risk vendors such as payroll or cloud providers get deeper reviews and annual reassessment.
29
What is the difference between a threat, a vulnerability and a risk?
A vulnerability is a weakness, such as an unpatched server. A threat is anything that can exploit it, such as a ransomware group. Risk is the likelihood that the threat exploits the vulnerability multiplied by the business impact. For example, an unpatched internet-facing VPN is high risk, while the same flaw on an isolated lab machine is low risk because likelihood and impact are smaller.
Use a laptop with virtualisation, run a Windows VM with Sysmon, a Linux server and a free SIEM such as Elastic or Splunk Free, or Wazuh as an open source option. Forward logs, then simulate attacks safely with Atomic Red Team tests on your own VMs. Write detections for each test, document them on GitHub and explain them in interviews.
31
What is the difference between OAuth 2.0 and OpenID Connect?
OAuth 2.0 is an authorisation framework; it lets an app get an access token to call an API on a user's behalf, without the user's password. It does not define who the user is. OpenID Connect adds an identity layer with an ID token, a signed JWT containing user claims, and a userinfo endpoint. Use OIDC for login, and OAuth access tokens for API authorisation.
Zero Trust removes implicit trust based on network location. Every request is verified using identity, device health and context, access is least privilege and granted per session, and the environment is assumed to be already breached. NIST SP 800-207 describes the model. In practice it means strong MFA, device posture checks, identity-aware proxies instead of flat VPN access, micro-segmentation and continuous monitoring. It is a journey, not a single product.
33
How do you find overly permissive security groups with the AWS CLI?
Query security groups that allow ingress from anywhere, then review each.
aws ec2 describe-security-groups \
--filters Name=ip-permission.cidr,Values=0.0.0.0/0 \
--query 'SecurityGroups[*].[GroupId,GroupName]' --output table
Pay attention to ports 22, 3389, 3306 and 5432. Replace them with VPN, bastion or session manager access.
Important metrics are mean time to detect, mean time to respond, alert volume per analyst, false positive rate per rule, percentage of alerts closed within SLA, detection coverage against priority ATT&CK techniques and log source health. Metrics should drive improvement, not punish analysts. For example, a rule with 95 percent false positives should be tuned, and long response times may point to missing automation.
Pick a realistic scenario, such as ransomware on a weekend, and invite IT, security, legal, communications and business leaders. A facilitator releases injects step by step, like a ransom note appearing or a journalist calling, and participants explain decisions using the real plan. Record gaps in contacts, authority, backups and reporting timelines. Share findings and track fixes, and repeat at least twice a year.
AWS IAM controls who can do what on which resources through users, groups, roles and JSON policies. Best practices are avoiding root account use and protecting it with MFA, using roles with temporary credentials instead of access keys, least privilege policies, permission boundaries, and Service Control Policies in AWS Organizations to set guardrails across accounts. IAM Access Analyzer helps find unused and external access.
Which companies hire Cyber Security professionals in Kochi?
Companies with large offices in Kochi include EY. Use their company pages below to practise employer-specific sets.
Are Cyber Security interviews in Kochi different from other cities?
The questions depend more on the company than the city. Kochi's mix of employers decides the style: Testing and data roles are common in its service and product teams
How do I find Cyber Security jobs in Kochi?
Shortlist companies with Kochi offices, keep your CV focused on Cyber Security projects, apply on company career pages and job portals with the Kochi filter, and practise the questions on this page before each interview.