Skip to content
Cyber Security
All coursesPlacement Report
‹ Back to previous sectionCourse homeAll page URLs

Cyber Security Interview Questions in Mumbai

36 practice questions with answers for Cyber Security interviews in Mumbai.

Cyber Security jobs in Mumbai

Mumbai is India's financial capital, so banks, fintechs, insurers, media and consulting firms drive much of the hiring. Data and QA interviews often include domain questions on payments, risk, trading or customer analytics.

Below are 36 questions that match the mix of service, product and domain employers hiring soc analyst (l1/l2)s in Mumbai.

Solved for MumbaiStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
3 questions free Unlock the rest in seconds
01

What is a SIEM and what does it do?

SOC Operations and SIEMEasy
Save to ▾
Show answer
A Security Information and Event Management platform collects logs from firewalls, endpoints, servers, cloud and applications, normalises them, stores them for search and correlates events to raise alerts. Examples are Splunk, Microsoft Sentinel, IBM QRadar, Elastic Security and Google Security Operations. A SIEM supports detection, investigation, dashboards and compliance reporting. Its value depends on good log sources, parsing and tuned rules.
02

How would you capture and analyse suspicious traffic using tcpdump and Wireshark?

Network SecurityMedium
Save to ▾
Show answer
Capture on the right interface with a filter to limit size, save to a pcap file, then open it in Wireshark. sudo tcpdump -i eth0 host 10.10.0.15 and port 53 -w dns.pcap In Wireshark, use display filters such as dns, http.request or tls.handshake.type == 1, and Statistics > Conversations to spot top talkers. Protect pcaps because they may contain sensitive data.
03

What should a post-incident review include?

Incident Response and ForensicsEasy
Save to ▾
Show answer
A blameless review covers the timeline, root cause, how the attacker got in, what detected it, what slowed response, business impact and decisions made. It ends with specific actions that have owners and dates, such as enabling MFA on all VPN users or adding a detection rule. Tracking these actions to completion matters more than the report itself, otherwise the same incident repeats.
04

A user on the office LAN reports repeated certificate warnings and you suspect ARP spoofing. What is happening and how do you stop it?

Network SecurityMedium
Save to ▾
Show answer
ARP has no authentication, so an attacker on the same LAN can send fake ARP replies linking their MAC address to the gateway's IP. Victims then send traffic through the attacker, enabling man-in-the-middle interception. Defences include Dynamic ARP Inspection with DHCP snooping on switches, port security, network access control, and encrypting traffic end to end with TLS so intercepted data is useless.
05

What is single sign-on and what protocols does it use?

Identity and Access ManagementEasy
Save to ▾
Show answer
SSO lets a user authenticate once with an identity provider and access many applications without separate passwords. SAML 2.0 uses signed XML assertions and is common for enterprise web apps. OpenID Connect, built on OAuth 2.0, uses JSON tokens and suits modern web and mobile apps. SSO reduces password reuse and helps central control, but makes the identity provider a high-value target that needs strong MFA.
06

What is a digital signature and how does it work?

Cryptography and PKIEasy
Save to ▾
Show answer
A digital signature proves who created data and that it has not changed. The signer hashes the data and signs the hash with their private key using algorithms like RSA-PSS, ECDSA or Ed25519. Anyone with the public key can verify it. Signatures give integrity, authentication and non-repudiation, and are used in software updates, TLS certificates, e-sign documents and signed emails.
07

An alert shows Microsoft Word spawning PowerShell with an encoded command. What does it mean and what do you do?

SOC Operations and SIEMMedium
Save to ▾
Show answer
Office apps rarely start PowerShell, so this usually means a malicious macro or document exploit. Decode the Base64 command to see what it does, check the process tree and any network connections for downloads, and find the source email. Isolate the host through EDR, block the sender and URLs, search for the same email in other mailboxes and hunt for the same command line elsewhere.
08

How would you check a cloud account against CIS benchmarks?

Cloud SecurityEasy
Save to ▾
Show answer
Enable the native posture service, such as AWS Security Hub with the CIS AWS Foundations standard, Microsoft Defender for Cloud with the CIS Azure benchmark, or Security Command Center on Google Cloud. Open source tools like Prowler or ScoutSuite also work. Export findings, prioritise critical ones like root MFA, public storage and open admin ports, assign owners and track remediation over time.
09

A user reports a pop-up saying their files are encrypted. What are your first steps?

Security FundamentalsMedium
Save to ▾
Show answer
First, isolate the device from the network, ideally through EDR network containment, without powering it off so memory evidence is kept. Inform the incident lead and start a timeline. Check for the same indicators on other hosts, disable the user's sessions and reset credentials if needed, and identify the ransomware family from the note. Then confirm backups are intact and offline before any recovery begins.
10

How do you scan your own network for open ports with Nmap, with permission?

Network SecurityEasy
Save to ▾
Show answer
Only scan networks you own or have written approval for. Start with host discovery, then service and version detection on key ports. nmap -sn 10.10.0.0/24 nmap -sV -T3 -p 1-1000 10.10.0.15 nmap -sV --top-ports 100 -oA scan_results 10.10.0.0/24 Compare results with the approved service list and raise tickets for unexpected open ports.
11

How do you decode and check a JWT during troubleshooting?

Identity and Access ManagementMedium
Save to ▾
Show answer
A JWT has header, payload and signature separated by dots. Decode the first two parts to read claims, but never trust them without verifying the signature. echo $TOKEN | cut -d. -f2 | base64 -d 2>/dev/null Check iss, aud, exp and nbf claims. In code, verify with a library using the expected algorithm and issuer keys, and reject alg none.
12

How do you design an access review for a critical application?

Identity and Access ManagementMedium
Save to ▾
Show answer
Define scope, such as all users with write or admin rights. Pull entitlements and last-login data from the app, and route each item to the user's manager and the app owner. Give clear choices of keep or revoke with a deadline, and revoke automatically if not reviewed. Capture evidence for auditors, and review exceptions with security. Run it quarterly for privileged access.
13

What SOC metrics matter most?

SOC Operations and SIEMMedium
Save to ▾
Show answer
Important metrics are mean time to detect, mean time to respond, alert volume per analyst, false positive rate per rule, percentage of alerts closed within SLA, detection coverage against priority ATT&CK techniques and log source health. Metrics should drive improvement, not punish analysts. For example, a rule with 95 percent false positives should be tuned, and long response times may point to missing automation.
14

What is the difference between OAuth 2.0 and OpenID Connect?

Identity and Access ManagementMedium
Save to ▾
Show answer
OAuth 2.0 is an authorisation framework; it lets an app get an access token to call an API on a user's behalf, without the user's password. It does not define who the user is. OpenID Connect adds an identity layer with an ID token, a signed JWT containing user claims, and a userinfo endpoint. Use OIDC for login, and OAuth access tokens for API authorisation.
15

Tell me about a time you explained a security risk to a non-technical person.

Security FundamentalsMedium
Save to ▾
Show answer
Situation: my team lead in a support role wanted to share admin passwords on a spreadsheet. Task: change this without slowing the team. Action: I explained the risk as a house key copied for everyone, showed how one leaked laptop exposes all systems, and proposed a password manager with shared vaults. Result: we adopted it within a week and audit findings dropped.
16

What is threat hunting?

SOC Operations and SIEMMedium
Save to ▾
Show answer
Threat hunting is proactive searching for attackers who evaded existing detections. Hunters start from a hypothesis, for example that attackers use scheduled tasks for persistence, then query EDR and SIEM data to confirm or reject it. Findings become new detection rules. Hunting requires good data retention, knowledge of normal behaviour and frameworks like MITRE ATT&CK to guide hypotheses.
17

What is multi-factor authentication and which factors are strongest?

Identity and Access ManagementEasy
Save to ▾
Show answer
MFA requires two or more factor types: something you know like a password, something you have like a phone or security key, and something you are like a fingerprint. SMS OTPs are vulnerable to SIM swap and phishing, and push approvals to MFA fatigue. Phishing-resistant methods such as FIDO2 security keys, passkeys and certificate-based authentication are strongest because they are bound to the real site.
18

What is the difference between qualitative and quantitative risk assessment?

GRC and ComplianceMedium
Save to ▾
Show answer
Qualitative assessment rates likelihood and impact on scales like low, medium and high, and is quick and easy to communicate. Quantitative assessment uses numbers, such as single loss expectancy times annual rate of occurrence to get annual loss expectancy, or FAIR models. Quantitative helps justify budgets but needs data that is often uncertain. Many teams start qualitative and quantify the top risks.
19

What is memory forensics and which tool is commonly used?

Incident Response and ForensicsMedium
Save to ▾
Show answer
Memory forensics analyses a RAM capture to find running processes, injected code, network connections, loaded DLLs, command history and encryption keys. It reveals fileless malware that leaves little on disk. Volatility 3 is the common open source framework, with plugins such as windows.pslist, windows.netscan and windows.malfind. Captures are taken with tools like WinPmem or through EDR live response.
20

What is business continuity and disaster recovery, and what are RTO and RPO?

GRC and ComplianceEasy
Save to ▾
Show answer
Business continuity keeps critical business functions running during disruption, while disaster recovery restores IT systems. Recovery Time Objective is the maximum acceptable downtime, and Recovery Point Objective is the maximum acceptable data loss measured in time. A payments system may need an RTO of one hour and an RPO near zero, which needs replication, while an internal wiki may accept a day.
21

Tell me about a time you had to say no to a senior person's access request.

Identity and Access ManagementMedium
Save to ▾
Show answer
Situation: a senior manager asked for permanent admin rights on production to speed up reports. Task: protect production without blocking the work. Action: I explained the audit and breach risk, then offered a read-only reporting role and a scheduled export within a day. Result: the manager got the data faster than before, and the audit later had no finding on that system.
22

How do you collect basic triage data from a suspected compromised Windows host?

Incident Response and ForensicsMedium
Save to ▾
Show answer
Collect volatile data first, ideally with EDR live response or a trusted triage tool. Useful built-in commands: tasklist /v netstat -ano schtasks /query /fo LIST /v wmic service get name,pathname,startmode reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run wevtutil epl Security C:\IR\security.evtx Save output to external media and hash every file.
23

Why do you want to build a career in cyber security?

Security FundamentalsEasy
Save to ▾
Show answer
A good answer links genuine interest to evidence. For example: I got interested after investigating a phishing email that reached my college group, which led me to study networking and complete Security+. I built a home lab with a SIEM and wrote detections for brute-force logins. I enjoy problem solving under pressure, and I want to grow in a SOC, then specialise in incident response.
24

What is forward secrecy?

Cryptography and PKIMedium
Save to ▾
Show answer
Forward secrecy means that if a server's long-term private key is stolen later, previously recorded sessions still cannot be decrypted. It is achieved with ephemeral key exchange, such as ECDHE, where a new key pair is created for each session and discarded. TLS 1.3 makes forward secrecy mandatory by removing static RSA key exchange, which is one reason older TLS configurations are considered weak.
25

What is Identity and Access Management?

Identity and Access ManagementEasy
Save to ▾
Show answer
IAM is the set of processes and tools that manage digital identities and control their access to systems. It covers user provisioning and deprovisioning, authentication, authorisation, single sign-on, MFA, privileged access, access reviews and audit. Since most breaches involve stolen or misused credentials, IAM is a core security control. Common platforms include Microsoft Entra ID, Okta, Ping Identity and SailPoint for governance.
26

How do you run a tabletop exercise?

Incident Response and ForensicsMedium
Save to ▾
Show answer
Pick a realistic scenario, such as ransomware on a weekend, and invite IT, security, legal, communications and business leaders. A facilitator releases injects step by step, like a ransom note appearing or a journalist calling, and participants explain decisions using the real plan. Record gaps in contacts, authority, backups and reporting timelines. Share findings and track fixes, and repeat at least twice a year.
27

Leadership wants to block all USB drives tomorrow. How would you handle this request?

Security FundamentalsMedium
Save to ▾
Show answer
I would support the goal but plan the rollout to avoid breaking business work. First, find who genuinely needs USB, such as field engineers, using endpoint logs. Then apply a device control policy through EDR or Intune that blocks mass storage by default, allows approved encrypted devices by serial number, and logs exceptions. Communicate the change, pilot it with one department, then enforce company wide.
28

How does a VPN protect traffic and what are its limits?

Network SecurityMedium
Save to ▾
Show answer
A VPN creates an encrypted tunnel, using IPsec, WireGuard or TLS, between a client and a network, protecting data on untrusted networks. Its limits are important: once connected, users often get broad network access, and VPN appliances are a frequent target for exploited vulnerabilities. That is why many companies move to Zero Trust Network Access, which grants per-application access after identity and device checks.
29

What are the phases of incident response?

Incident Response and ForensicsEasy
Save to ▾
Show answer
NIST SP 800-61 describes preparation; detection and analysis; containment, eradication and recovery; and post-incident activity. The 2025 revision aligns these with the NIST CSF 2.0 functions of Govern, Identify, Protect, Detect, Respond and Recover. Preparation includes playbooks, contacts and tools. Containment limits spread, eradication removes the attacker, recovery restores operations, and lessons learned improve controls and detections.
30

What is the difference between static and dynamic malware analysis?

Incident Response and ForensicsMedium
Save to ▾
Show answer
Static analysis examines a sample without running it: hashes, strings, imports, PE headers, YARA rule matches and disassembly. Dynamic analysis runs it in an isolated sandbox to observe processes, file changes, registry edits and network calls. Static is safe and fast but defeated by packing; dynamic shows real behaviour but malware may detect sandboxes. Analysts usually combine both in a controlled lab.
31

You receive an alert for 300 failed logins on one account followed by a success. How do you triage it?

SOC Operations and SIEMMedium
Save to ▾
Show answer
This pattern suggests brute force or password spraying that succeeded. Check source IPs, location and logon type, and whether MFA was used for the success. Review what the account did after login, such as mailbox rules, file access or new tokens. If suspicious, disable the account or revoke sessions, reset the password, block source IPs and check whether the same IPs targeted other accounts.
32

Describe a time you dealt with a user who was upset about losing access.

Identity and Access ManagementMedium
Save to ▾
Show answer
Situation: after an access review removed a sales manager's export rights, he escalated angrily before a client deadline. Task: solve his need while keeping the control. Action: I listened, explained why bulk exports were restricted, and arranged a time-bound approved export through his manager within an hour. Result: he met the deadline, and we added a documented request path for such cases.
33

You are asked to prepare the company for its first ISO 27001 certification in nine months. How do you plan it?

GRC and ComplianceHard
Save to ▾
Show answer
Get leadership sponsorship and define the ISMS scope. Run a gap assessment against clauses and Annex A, then do the risk assessment and build the risk treatment plan and Statement of Applicability. Write core policies, implement missing controls, and train staff. Collect evidence for a few months, run an internal audit and management review, fix findings, then book stage 1 and stage 2 audits.
34

An audit finds 200 active accounts belonging to employees who left. How do you fix it?

Identity and Access ManagementMedium
Save to ▾
Show answer
Disable the accounts immediately after confirming with HR, then check each for recent logins, since any use after the exit date is a potential incident. Find the root cause, usually manual offboarding or apps not connected to SSO. Integrate the HR system with the identity platform for automatic disabling, connect apps to SSO and SCIM provisioning, and run monthly orphan account reports.
35

What is Zero Trust security?

Security FundamentalsMedium
Save to ▾
Show answer
Zero Trust removes implicit trust based on network location. Every request is verified using identity, device health and context, access is least privilege and granted per session, and the environment is assumed to be already breached. NIST SP 800-207 describes the model. In practice it means strong MFA, device posture checks, identity-aware proxies instead of flat VPN access, micro-segmentation and continuous monitoring. It is a journey, not a single product.
36

How do you prioritise 500 vulnerabilities found in a scan?

Security FundamentalsHard
Save to ▾
Show answer
CVSS alone is not enough. I combine severity with exploitability and exposure: check the CISA Known Exploited Vulnerabilities list and EPSS score, whether the asset is internet facing, and how critical the business data on it is. Internet-facing systems with known exploited flaws are fixed first, often within days. Internal low-severity findings go into normal patch cycles. Group fixes by patch to reduce effort.

Companies with offices in Mumbai (11)

IT services

TCS

Cyber Security interview questions

  • 30 questions
  • 4 rounds

Mumbai, Chennai, Pune +2

View questions
Consulting

Accenture

Cyber Security interview questions

  • 30 questions
  • 4 rounds

Bengaluru, Hyderabad, Pune +2

View questions
IT services

Capgemini

Cyber Security interview questions

  • 30 questions
  • 4 rounds

Mumbai, Bengaluru, Pune +2

View questions
Consulting

Deloitte

Cyber Security interview questions

  • 30 questions
  • 4 rounds

Hyderabad, Bengaluru, Mumbai +2

View questions
Consulting

KPMG

Cyber Security interview questions

  • 30 questions
  • 4 rounds

Gurugram, Bengaluru, Mumbai +2

View questions
Consulting

PwC

Cyber Security interview questions

  • 30 questions
  • 4 rounds

Kolkata, Bengaluru, Mumbai +2

View questions
Banking & finance

JP Morgan Chase

Cyber Security interview questions

  • 30 questions
  • 5 rounds

Mumbai, Bengaluru, Hyderabad

View questions
Banking & finance

HDFC Bank

Cyber Security interview questions

  • 30 questions
  • 4 rounds

Mumbai, Chennai, Bengaluru

View questions
Telecom

Airtel

Cyber Security interview questions

  • 30 questions
  • 4 rounds

Gurugram, Bengaluru, Mumbai +1

View questions
Fintech

Razorpay

Cyber Security interview questions

  • 30 questions
  • 5 rounds

Bengaluru, Mumbai

View questions
Consulting

Protiviti

Cyber Security interview questions

  • 30 questions
  • 4 rounds

Gurugram, Mumbai, Bengaluru +1

View questions

Frequently asked questions

Which companies hire Cyber Security professionals in Mumbai?

Companies with large offices in Mumbai include TCS, Accenture, Capgemini, Deloitte, KPMG, PwC, JP Morgan Chase, HDFC Bank, Airtel, Razorpay. Use their company pages below to practise employer-specific sets.

Are Cyber Security interviews in Mumbai different from other cities?

The questions depend more on the company than the city. Mumbai's mix of employers decides the style: Data and QA interviews often include domain questions on payments, risk, trading or customer analytics

How do I find Cyber Security jobs in Mumbai?

Shortlist companies with Mumbai offices, keep your CV focused on Cyber Security projects, apply on company career pages and job portals with the Mumbai filter, and practise the questions on this page before each interview.

Other cities

DelhiNoidaGurgaonBangaloreHyderabadPuneChennaiKolkataAhmedabadJaipurLucknowChandigarhIndoreKochiCoimbatoreBhubaneswarNagpurVisakhapatnamThiruvananthapuram

More ways to practise

Company-wise Cyber Security questionsExperience-wise Cyber Security questionsRole-wise Cyber Security questionsCity-wise Cyber Security questionsMost asked Cyber Security questionsScenario-based questionsPractical / hands-on questionsHR & behavioural questionsCyber Security mock interviewOnline assessment questionsTechnical round questionsManagerial round questionsCyber Security topic sheets