Cyber Security Interview Questions in Kolkata

Show answer

Situation: our team checked cloud accounts manually every week for public buckets, which took hours. Task: make it faster and continuous. Action: I wrote a small script using the cloud CLI, scheduled it, and sent findings to a team channel with owner tags, then moved it into the CSPM tool. Result: checks ran hourly and average exposure time dropped from days to under an hour.

What is social engineering and what are its common forms?

Security FundamentalsEasy

Show answer

Social engineering manipulates people rather than technology to gain access or information. Common forms are phishing emails, spear phishing aimed at specific staff, vishing over phone calls, smishing over SMS or WhatsApp, pretexting with a fake story, baiting with infected USB drives and tailgating into offices. Defences include awareness training, phishing simulations, call-back verification for payment changes, and technical controls such as MFA and email authentication.

Write a least-privilege AWS IAM policy that allows reading one S3 bucket.

Show answer

Allow only listing that bucket and reading its objects. { "Version": "2012-10-17", "Statement": [ {"Effect": "Allow", "Action": "s3:ListBucket", "Resource": "arn:aws:s3:::reports-prod"}, {"Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::reports-prod/*"} ] } Attach it to a role, not a user with long-lived keys.

A user reports a pop-up saying their files are encrypted. What are your first steps?

Show answer

First, isolate the device from the network, ideally through EDR network containment, without powering it off so memory evidence is kept. Inform the incident lead and start a timeline. Check for the same indicators on other hosts, disable the user's sessions and reset credentials if needed, and identify the ransomware family from the note. Then confirm backups are intact and offline before any recovery begins.

Your manager asks why the company needs security when it already has antivirus on every laptop. How do you explain?

Show answer

I would explain that antivirus mainly blocks known malicious files, while most modern attacks use stolen credentials, phishing links, living-off-the-land tools like PowerShell, or cloud misconfigurations that antivirus never sees. I would map our top risks to missing controls, such as MFA, EDR, logging and backups, and use a recent real incident pattern to show business impact in downtime and regulatory reporting cost.

Describe a time you dealt with a user who was upset about losing access.

Identity and Access ManagementMedium

Show answer

Situation: after an access review removed a sales manager's export rights, he escalated angrily before a client deadline. Task: solve his need while keeping the control. Action: I listened, explained why bulk exports were restricted, and arranged a time-bound approved export through his manager within an hour. Result: he met the deadline, and we added a documented request path for such cases.

Describe a time you had to admit you did not know something in a technical discussion.

Cryptography and PKIEasy

Show answer

Situation: in a design review, an architect asked me whether our VPN supported post-quantum key exchange. Task: give an accurate answer. Action: I said I did not know rather than guessing, checked the vendor documentation and release notes that afternoon and shared a short summary with options. Result: the team trusted my answers more, and the finding was added to our cryptography roadmap.

What are India's CERT-In incident reporting requirements?

Incident Response and ForensicsMedium

Show answer

Under the CERT-In directions issued in April 2022, service providers, intermediaries, data centres and body corporates must report specified cyber incidents to CERT-In within six hours of noticing them. They must also keep ICT system logs for 180 days within India and synchronise clocks with NTP servers of NIC or NPL. Reportable incidents include ransomware, data breaches, and attacks on servers and cloud systems.

What is the NIST Cybersecurity Framework 2.0?

GRC and ComplianceMedium

Show answer

NIST CSF 2.0, released in 2024, organises cyber security outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover. Govern was added to cover strategy, roles, policy and supply chain risk. Each function has categories and subcategories. Organisations create current and target profiles to find gaps and plan improvements. It is voluntary and widely used to report maturity to boards.

What is network segmentation and why is it important?

Show answer

Segmentation splits a network into zones such as user, server, OT, guest and management, with controlled traffic between them using VLANs, firewalls and ACLs. It limits lateral movement, so ransomware on one laptop cannot reach every server. It also reduces compliance scope, for example isolating the cardholder data environment for PCI DSS. Micro-segmentation goes further with per-workload policies in data centres and cloud.

How do you create a private key and CSR with OpenSSL?

Cryptography and PKIMedium

Show answer

Generate a key, then a certificate signing request to send to a CA. openssl ecparam -genkey -name prime256v1 -out server.key openssl req -new -key server.key -out server.csr \ -subj "/CN=portal.example.in" \ -addext "subjectAltName=DNS:portal.example.in" openssl req -in server.csr -noout -text Keep server.key private with restricted file permissions.

Which cloud logs are essential for security monitoring?

Show answer

Essential sources are control plane audit logs such as AWS CloudTrail, Azure Activity Log and Entra sign-in logs, and Google Cloud Audit Logs. Add network flow logs, DNS logs, load balancer and WAF logs, storage access logs for sensitive buckets, and Kubernetes audit logs. Send them to a central account or SIEM that workload owners cannot delete, and enable threat detection services like GuardDuty.

What does GRC stand for in cyber security?

GRC and ComplianceEasy

Show answer

GRC is Governance, Risk and Compliance. Governance sets direction, policies, roles and accountability for security. Risk management identifies, assesses and treats risks to an acceptable level. Compliance ensures the organisation meets laws, regulations, contracts and standards such as the DPDP Act, RBI directions, ISO 27001 and PCI DSS. GRC analysts write policies, run risk assessments, manage audits and track remediation.

How do you check a server's TLS configuration?

Show answer

Check supported protocol versions, ciphers and certificate details. OpenSSL gives a quick view, and tools like testssl.sh give a full report. openssl s_client -connect example.com:443 -tls1_2 openssl s_client -connect example.com:443 -servername example.com | openssl x509 -noout -dates -issuer ./testssl.sh example.com Disable TLS 1.0 and 1.1, weak ciphers like RC4 and 3DES, and fix expiring certificates.

An audit finds 200 active accounts belonging to employees who left. How do you fix it?

Identity and Access ManagementMedium

Show answer

Disable the accounts immediately after confirming with HR, then check each for recent logins, since any use after the exit date is a potential incident. Find the root cause, usually manual offboarding or apps not connected to SSO. Integrate the HR system with the identity platform for automatic disabling, connect apps to SSO and SCIM provisioning, and run monthly orphan account reports.

Why do you want to build a career in cyber security?

Security FundamentalsEasy

Show answer

A good answer links genuine interest to evidence. For example: I got interested after investigating a phishing email that reached my college group, which led me to study networking and complete Security+. I built a home lab with a SIEM and wrote detections for brute-force logins. I enjoy problem solving under pressure, and I want to grow in a SOC, then specialise in incident response.

How do you build a risk register?

GRC and ComplianceEasy

Show answer

Create a table where each risk has an ID, description written as cause, event and impact, asset, owner, inherent likelihood and impact, existing controls, residual rating, treatment decision, action plan, due date and review date. Gather risks through workshops, audits, incidents and threat intelligence. Review the register monthly with owners and report top risks to leadership quarterly.

What is threat intelligence and what are IOCs and TTPs?

SOC Operations and SIEMMedium

Show answer

Threat intelligence is analysed information about adversaries, their tools and behaviour. Indicators of Compromise are artefacts like malicious IPs, domains and file hashes; they are easy to use but change quickly. TTPs, tactics, techniques and procedures, describe how attackers operate, and are harder for attackers to change. The Pyramid of Pain shows that detecting TTPs causes attackers more cost than blocking hashes.

What is threat hunting?

SOC Operations and SIEMMedium

Show answer

Threat hunting is proactive searching for attackers who evaded existing detections. Hunters start from a hypothesis, for example that attackers use scheduled tasks for persistence, then query EDR and SIEM data to confirm or reject it. Findings become new detection rules. Hunting requires good data retention, knowledge of normal behaviour and frameworks like MITRE ATT&CK to guide hypotheses.

Your SOC sees heavy DNS traffic with long random subdomains from one workstation. Which DNS attacks should you consider and what defences apply?

Show answer

Key DNS attacks are cache poisoning, which inserts false records; DNS tunnelling, which hides data or command traffic inside queries; domain hijacking through registrar account takeover; and DNS amplification DDoS. Defences include DNSSEC to sign records, protective DNS resolvers that block malicious domains, monitoring for long or high-entropy subdomains, registrar lock with MFA, and rate limiting open resolvers.

What are the key points of India's DPDP Act?

GRC and ComplianceMedium

Show answer

The Digital Personal Data Protection Act 2023 governs digital personal data. Data fiduciaries need valid consent or a legitimate use, must give clear notice, protect data with reasonable safeguards, notify breaches to the Data Protection Board and affected people, and delete data when no longer needed. Data principals have rights to access, correction and erasure. Penalties go up to 250 crore rupees. The DPDP Rules 2025 phase in obligations.

What is MITRE ATT&CK and how is it used?

Show answer

MITRE ATT&CK is a public knowledge base of adversary tactics and techniques observed in real attacks, organised in matrices for Enterprise, Mobile and ICS. Tactics are the goal, such as Persistence, and techniques are the method, such as T1053 Scheduled Task. Teams use it to map detection coverage, write threat-informed detections, plan red and purple team exercises, and describe incidents in a common language.

What is a DDoS attack and how is it mitigated?

Show answer

A Distributed Denial of Service attack floods a target from many sources to exhaust bandwidth, connection tables or application resources. Types are volumetric floods, protocol attacks like SYN floods, and application layer floods hitting costly pages. Mitigation uses upstream scrubbing services or CDN providers, anycast networks, rate limiting, SYN cookies, autoscaling, and a tested runbook agreed with the ISP before an attack.

How do you check which ports are listening on a server you manage?

Security FundamentalsEasy

Show answer

List listening sockets with the owning process, then compare against what the server should expose. Anything unexpected needs an owner or should be closed. # Linux sudo ss -tulpn # Windows netstat -ano | findstr LISTENING Get-NetTCPConnection -State Listen Map the PID to a process name in Task Manager or with ps to identify the service.

What is Zero Trust security?

Show answer

Zero Trust removes implicit trust based on network location. Every request is verified using identity, device health and context, access is least privilege and granted per session, and the environment is assumed to be already breached. NIST SP 800-207 describes the model. In practice it means strong MFA, device posture checks, identity-aware proxies instead of flat VPN access, micro-segmentation and continuous monitoring. It is a journey, not a single product.

What are the four risk treatment options?

GRC and ComplianceEasy

Show answer

Mitigate by adding controls to reduce likelihood or impact, such as MFA. Transfer by shifting financial impact to others, like cyber insurance or contracts. Avoid by stopping the risky activity, for example retiring an old system. Accept when the risk is within appetite and formally documented with an owner and review date. Risk acceptance should be signed by a business owner, not just the security team.

What is TLS and what does the handshake achieve?

Show answer

TLS secures data in transit. In the TLS 1.3 handshake the client and server agree on cipher suites, perform an ephemeral key exchange such as X25519 for forward secrecy, and the server proves its identity with a certificate signed by a trusted CA. Both derive session keys, then traffic is encrypted with an AEAD cipher like AES-GCM. TLS 1.0 and 1.1 are deprecated and should be disabled.

What are common Active Directory attacks?

Identity and Access ManagementHard

Show answer

Common attacks are password spraying, Kerberoasting, which requests service tickets for accounts with SPNs and cracks them offline, AS-REP roasting on accounts without pre-authentication, pass-the-hash, DCSync to pull password hashes, and abusing misconfigured ACLs and delegation. Defences include long random service account passwords or gMSAs, tiered admin models, LAPS for local admin passwords, Protected Users group and monitoring ticket requests.

A developer has hardcoded database passwords in a public code repository. What do you do?

Show answer

Treat the secret as compromised immediately, even if the commit is removed, because public repos are scraped within minutes. Rotate the password and any related keys, check database logs for unknown logins since the commit time, and remove the secret from git history. Then fix the root cause by moving secrets to a vault or cloud secret manager and adding secret scanning to pre-commit hooks and the CI pipeline.

Developers want admin access in the cloud to move fast. How do you balance speed and security?

Show answer

Give them freedom inside guardrails. Provide sandbox accounts where they have broad rights, but production changes go through IaC pipelines with scanning and review. Use permission boundaries and SCPs to block dangerous actions like disabling logging or making resources public. Offer pre-approved modules for common patterns. This keeps speed high while preventing the riskiest mistakes.

GuardDuty reports an EC2 instance communicating with a known crypto-mining pool. How do you respond?