Skip to content
Cyber Security
All coursesPlacement Report
‹ Back to previous sectionCourse homeAll page URLs

Cyber Security Interview Questions in Noida

36 practice questions with answers for Cyber Security interviews in Noida.

Cyber Security jobs in Noida

Noida is a major IT and IT-services hub in Delhi NCR with large campuses of service companies, product firms and fast-growing start-ups along the Noida–Greater Noida Expressway. Freshers often find their first role here, and many teams run hybrid work.

Below are 36 questions that match the mix of service, product and domain employers hiring soc analyst (l1/l2)s in Noida.

Solved for NoidaStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
3 questions free Unlock the rest in seconds
01

What is UEBA?

SOC Operations and SIEMMedium
Save to ▾
Show answer
User and Entity Behaviour Analytics builds baselines of normal behaviour for users, hosts and service accounts, then flags anomalies such as logging in from a new country, accessing far more files than usual or a service account doing interactive logins. It helps detect insider threats and stolen credentials that look like normal logins. It needs good identity data and careful tuning to avoid noisy alerts.
02

Your IDS alerts on outbound traffic from a database server to an unknown IP on port 443 at 3 AM. How do you investigate?

Network SecurityMedium
Save to ▾
Show answer
Database servers rarely need internet access, so this is suspicious. I would check the destination's reputation and WHOIS, look at flow data for volume and duration, and identify the process making the connection using EDR. Then I review recent logins, scheduled tasks and new binaries on the server. If data volume is large or the process is unknown, I contain the host and escalate as a possible exfiltration.
03

How would you run a basic threat model for a new web application?

Security FundamentalsMedium
Save to ▾
Show answer
Draw a data flow diagram showing users, the web app, APIs, databases and third parties, and mark trust boundaries. Then apply STRIDE to each element: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service and Elevation of privilege. For each threat, record the existing control, a risk rating and an owner. Repeat the model whenever the architecture changes, ideally during design reviews.
04

What is the difference between qualitative and quantitative risk assessment?

GRC and ComplianceMedium
Save to ▾
Show answer
Qualitative assessment rates likelihood and impact on scales like low, medium and high, and is quick and easy to communicate. Quantitative assessment uses numbers, such as single loss expectancy times annual rate of occurrence to get annual loss expectancy, or FAIR models. Quantitative helps justify budgets but needs data that is often uncertain. Many teams start qualitative and quantify the top risks.
05

How do you create a private key and CSR with OpenSSL?

Cryptography and PKIMedium
Save to ▾
Show answer
Generate a key, then a certificate signing request to send to a CA. openssl ecparam -genkey -name prime256v1 -out server.key openssl req -new -key server.key -out server.csr \ -subj "/CN=portal.example.in" \ -addext "subjectAltName=DNS:portal.example.in" openssl req -in server.csr -noout -text Keep server.key private with restricted file permissions.
06

During triage you notice a user logged in from Mumbai and then from Frankfurt 20 minutes later. How do you handle it?

SOC Operations and SIEMMedium
Save to ▾
Show answer
This is an impossible travel alert. First rule out benign causes like corporate VPN, cloud proxy egress or mobile networks. Check device IDs, user agents and MFA results for both logins. If the second login is from an unknown device without MFA, or followed by mailbox rule creation or data download, revoke sessions, reset credentials, review MFA methods and contact the user through a separate channel.
07

Describe a time you handled a stressful outage or security issue.

Network SecurityMedium
Save to ▾
Show answer
Situation: during my internship the office internet went down during a client demo because of a broadcast storm. Task: restore service quickly. Action: I checked switch logs, found a looped cable creating a loop, removed it, and then enabled spanning tree and storm control with my senior. Result: service returned in 20 minutes, and I wrote a short runbook so the team could resolve similar issues faster.
08

Leadership wants to block all USB drives tomorrow. How would you handle this request?

Security FundamentalsMedium
Save to ▾
Show answer
I would support the goal but plan the rollout to avoid breaking business work. First, find who genuinely needs USB, such as field engineers, using endpoint logs. Then apply a device control policy through EDR or Intune that blocks mass storage by default, allows approved encrypted devices by serial number, and logs exceptions. Communicate the change, pilot it with one department, then enforce company wide.
09

How do you manage many audit and compliance deadlines at the same time?

GRC and ComplianceHard
Save to ▾
Show answer
Situation: in one quarter I had an ISO surveillance audit, a client security questionnaire backlog and a regulator report due. Task: deliver all without missing dates. Action: I listed every deliverable with owners and deadlines in a tracker, reused a central evidence library for overlapping requests, and gave weekly status to my manager. Result: everything was delivered on time with no major findings.
10

How do you collect audit evidence efficiently?

GRC and ComplianceMedium
Save to ▾
Show answer
Map each control to the evidence an auditor will request, such as screenshots of configurations, system exports, tickets, logs and signed approvals. Keep a central evidence library organised by control ID with dates. Automate collection where possible through GRC tools that pull data from cloud, identity and ticketing systems. Sample in advance to confirm evidence covers the full audit period.
11

What is the shared responsibility model in cloud security?

Cloud SecurityEasy
Save to ▾
Show answer
The cloud provider secures the infrastructure: data centres, hardware, hypervisors and managed service internals. The customer secures what they put in the cloud: identities, data, configurations, network rules and their applications. The split changes by service type; with IaaS you patch the OS, with SaaS you mainly manage users and data settings. Most cloud breaches come from customer-side misconfiguration, not provider failures.
12

What is a DMZ?

Network SecurityEasy
Save to ▾
Show answer
A DMZ, or perimeter network, is a separate zone between the internet and the internal network for public-facing services like web servers, mail relays and reverse proxies. Firewall rules allow internet traffic only to DMZ hosts and allow DMZ hosts only limited, specific connections inward. If a DMZ server is compromised, the attacker still faces another firewall layer before reaching internal systems.
13

What is Privileged Access Management?

Identity and Access ManagementMedium
Save to ▾
Show answer
PAM protects powerful accounts like domain admins, root, database admins and cloud owners. It includes a vault for credentials with automatic rotation, just-in-time elevation, session brokering with recording, approval workflows and alerts on unusual use. Tools include CyberArk, BeyondTrust and Delinea. PAM is important because attackers aim for privileged credentials to move laterally and deploy ransomware across the network.
14

How do you analyse a memory dump with Volatility 3?

Incident Response and ForensicsHard
Save to ▾
Show answer
Run plugins to list processes, network connections and injected code, then dig into suspicious items. vol -f mem.raw windows.info vol -f mem.raw windows.pstree vol -f mem.raw windows.netscan vol -f mem.raw windows.cmdline vol -f mem.raw windows.malfind Look for unusual parent-child processes, processes in odd paths and connections to unknown IPs.
15

What is single sign-on and what protocols does it use?

Identity and Access ManagementEasy
Save to ▾
Show answer
SSO lets a user authenticate once with an identity provider and access many applications without separate passwords. SAML 2.0 uses signed XML assertions and is common for enterprise web apps. OpenID Connect, built on OAuth 2.0, uses JSON tokens and suits modern web and mobile apps. SSO reduces password reuse and helps central control, but makes the identity provider a high-value target that needs strong MFA.
16

How do you generate a strong random secret or password from the command line?

Security FundamentalsEasy
Save to ▾
Show answer
Use a cryptographically secure source, never a simple random function. OpenSSL and Python's secrets module both use the operating system CSPRNG. openssl rand -base64 32 python3 -c "import secrets; print(secrets.token_urlsafe(32))" Store the output in a password manager or secret vault, not in a text file or chat message.
17

How do you build a risk register?

GRC and ComplianceEasy
Save to ▾
Show answer
Create a table where each risk has an ID, description written as cause, event and impact, asset, owner, inherent likelihood and impact, existing controls, residual rating, treatment decision, action plan, due date and review date. Gather risks through workshops, audits, incidents and threat intelligence. Review the register monthly with owners and report top risks to leadership quarterly.
18

What is RBAC and ABAC?

Identity and Access ManagementMedium
Save to ▾
Show answer
Role-Based Access Control grants permissions to roles such as Finance Analyst, and users get roles; it is simple to manage and audit. Attribute-Based Access Control decides using attributes of the user, resource and context, such as department, data classification, location and time. ABAC is more flexible but harder to reason about. Many organisations use RBAC as the base and add attribute conditions for sensitive cases.
19

What is Zero Trust security?

Security FundamentalsMedium
Save to ▾
Show answer
Zero Trust removes implicit trust based on network location. Every request is verified using identity, device health and context, access is least privilege and granted per session, and the environment is assumed to be already breached. NIST SP 800-207 describes the model. In practice it means strong MFA, device posture checks, identity-aware proxies instead of flat VPN access, micro-segmentation and continuous monitoring. It is a journey, not a single product.
20

Tell me about a time you had to say no to a senior person's access request.

Identity and Access ManagementMedium
Save to ▾
Show answer
Situation: a senior manager asked for permanent admin rights on production to speed up reports. Task: protect production without blocking the work. Action: I explained the audit and breach risk, then offered a read-only reporting role and a scheduled export within a day. Result: the manager got the data faster than before, and the audit later had no finding on that system.
21

Your SOC receives 4000 alerts a day and analysts are overwhelmed. How do you fix this?

SOC Operations and SIEMHard
Save to ▾
Show answer
Analyse alert data to find the top noisy rules, which usually create most of the volume. Tune them with context and allowlists, or turn low-value ones into dashboards. Add enrichment and automated closure for known benign patterns using SOAR, group related alerts into incidents and add risk-based alerting that scores entities. Track false positive rate per rule weekly and require testing for new rules.
22

What are India's CERT-In incident reporting requirements?

Incident Response and ForensicsMedium
Save to ▾
Show answer
Under the CERT-In directions issued in April 2022, service providers, intermediaries, data centres and body corporates must report specified cyber incidents to CERT-In within six hours of noticing them. They must also keep ICT system logs for 180 days within India and synchronise clocks with NTP servers of NIC or NPL. Reportable incidents include ransomware, data breaches, and attacks on servers and cloud systems.
23

What is the difference between TCP and UDP from a security point of view?

Network SecurityEasy
Save to ▾
Show answer
TCP is connection oriented with a three-way handshake, which makes it reliable but open to SYN flood attacks. UDP is connectionless, so it is easy to spoof source addresses and is abused in amplification attacks using DNS, NTP or memcached. Firewalls track TCP state easily, while UDP state is inferred from timeouts. Security monitoring must cover both, since DNS tunnelling uses UDP 53.
24

What is PCI DSS?

GRC and ComplianceMedium
Save to ▾
Show answer
The Payment Card Industry Data Security Standard applies to any organisation that stores, processes or transmits cardholder data. Version 4.0.1 is current, and its future-dated requirements became mandatory from March 2025. It has 12 requirement areas, including network security controls, protecting stored data, encryption in transit, vulnerability management, access control, logging and testing. Reducing scope through tokenisation and segmentation lowers compliance effort.
25

A guest Wi-Fi user can reach internal printers. What is wrong and how do you fix it?

Network SecurityMedium
Save to ▾
Show answer
Guest traffic is not properly isolated, likely because the guest SSID shares a VLAN with internal devices or the firewall allows inter-VLAN routing. Fix by placing guests on a separate VLAN with internet-only access, applying ACLs that deny all RFC 1918 internal ranges, and enabling client isolation on the wireless controller. Then test from a guest device and document the design.
26

An auditor finds that access reviews were not done for two quarters. What do you do?

GRC and ComplianceMedium
Save to ▾
Show answer
Acknowledge the finding and agree a remediation plan. Immediately run the overdue reviews for in-scope systems, prioritising privileged access, and revoke unneeded access. Find the cause, such as no owner or a manual process, and fix it by assigning owners, automating campaigns in the IGA tool and adding reminders and escalations. Provide evidence of completed reviews to close the finding.
27

How do you run a tabletop exercise?

Incident Response and ForensicsMedium
Save to ▾
Show answer
Pick a realistic scenario, such as ransomware on a weekend, and invite IT, security, legal, communications and business leaders. A facilitator releases injects step by step, like a ransom note appearing or a journalist calling, and participants explain decisions using the real plan. Record gaps in contacts, authority, backups and reporting timelines. Share findings and track fixes, and repeat at least twice a year.
28

What is third-party or vendor risk management?

GRC and ComplianceMedium
Save to ▾
Show answer
TPRM assesses and monitors the security of vendors that access your data or systems, since many breaches start with a supplier. It includes tiering vendors by risk, security questionnaires, reviewing SOC 2 or ISO 27001 reports, contract clauses for breach notification and audit rights, and continuous monitoring. High-risk vendors such as payroll or cloud providers get deeper reviews and annual reassessment.
29

What are the data residency rules relevant to cloud in India?

Cloud SecurityHard
Save to ▾
Show answer
The DPDP Act 2023 allows cross-border transfer of personal data except to countries the government restricts, though sector rules can be stricter. RBI requires payment system data to be stored only in India. CERT-In requires ICT logs to be kept in India for 180 days. SEBI and IRDAI have their own requirements for regulated entities. Cloud architects choose Indian regions such as Mumbai or Hyderabad for compliance.
30

What are key container and Kubernetes security practices?

Cloud SecurityHard
Save to ▾
Show answer
Use minimal, scanned base images and sign them. Run containers as non-root with read-only filesystems and dropped capabilities. In Kubernetes, enforce Pod Security Standards, use RBAC with least privilege, network policies to restrict pod traffic, secrets from an external store, and keep the API server private. Enable audit logs and runtime detection such as Falco, and patch clusters regularly.
31

A developer has hardcoded database passwords in a public code repository. What do you do?

Security FundamentalsMedium
Save to ▾
Show answer
Treat the secret as compromised immediately, even if the commit is removed, because public repos are scraped within minutes. Rotate the password and any related keys, check database logs for unknown logins since the commit time, and remove the secret from git history. Then fix the root cause by moving secrets to a vault or cloud secret manager and adding secret scanning to pre-commit hooks and the CI pipeline.
32

Tell me about a time you improved a process with automation.

Cloud SecurityMedium
Save to ▾
Show answer
Situation: our team checked cloud accounts manually every week for public buckets, which took hours. Task: make it faster and continuous. Action: I wrote a small script using the cloud CLI, scheduled it, and sent findings to a team channel with owner tags, then moved it into the CSPM tool. Result: checks ran hourly and average exposure time dropped from days to under an hour.
33

What is a firewall and what types exist?

Network SecurityEasy
Save to ▾
Show answer
A firewall enforces rules on traffic between networks. Packet-filtering firewalls check IP, port and protocol. Stateful firewalls track connections and allow return traffic automatically. Next-generation firewalls add application awareness, user identity, TLS inspection, IPS and URL filtering. Web application firewalls protect HTTP applications from attacks such as SQL injection. Host firewalls like Windows Defender Firewall or nftables protect individual machines.
34

How do you write basic Linux host firewall rules with nftables?

Network SecurityMedium
Save to ▾
Show answer
Default deny inbound, allow established traffic, loopback and only required services. nft add table inet filter nft add chain inet filter input '{ type filter hook input priority 0; policy drop; }' nft add rule inet filter input ct state established,related accept nft add rule inet filter input iif lo accept nft add rule inet filter input tcp dport 22 ip saddr 10.10.1.0/24 accept nft add rule inet filter input tcp dport 443 accept Save the ruleset so it persists after reboot.
35

How do you inspect a certificate and check its chain?

Cryptography and PKIEasy
Save to ▾
Show answer
Use OpenSSL to view the fields and verify the chain against the CA bundle. openssl x509 -in cert.pem -noout -subject -issuer -dates -ext subjectAltName openssl verify -CAfile chain.pem cert.pem openssl s_client -connect portal.example.in:443 -showcerts Check the SAN matches the hostname, the dates are valid, and the server sends intermediate certificates.
36

Your manager asks why the company needs security when it already has antivirus on every laptop. How do you explain?

Security FundamentalsMedium
Save to ▾
Show answer
I would explain that antivirus mainly blocks known malicious files, while most modern attacks use stolen credentials, phishing links, living-off-the-land tools like PowerShell, or cloud misconfigurations that antivirus never sees. I would map our top risks to missing controls, such as MFA, EDR, logging and backups, and use a recent real incident pattern to show business impact in downtime and regulatory reporting cost.

Companies with offices in Noida (3)

IT services

HCLTech

Cyber Security interview questions

  • 30 questions
  • 4 rounds

Noida, Chennai, Bengaluru +2

View questions
IT services

Tech Mahindra

Cyber Security interview questions

  • 30 questions
  • 4 rounds

Pune, Hyderabad, Bengaluru +2

View questions
Product

Microsoft

Cyber Security interview questions

  • 30 questions
  • 5 rounds

Hyderabad, Bengaluru, Noida +2

View questions

Frequently asked questions

Which companies hire Cyber Security professionals in Noida?

Companies with large offices in Noida include HCLTech, Tech Mahindra, Microsoft. Use their company pages below to practise employer-specific sets.

Are Cyber Security interviews in Noida different from other cities?

The questions depend more on the company than the city. Noida's mix of employers decides the style: Freshers often find their first role here, and many teams run hybrid work

How do I find Cyber Security jobs in Noida?

Shortlist companies with Noida offices, keep your CV focused on Cyber Security projects, apply on company career pages and job portals with the Noida filter, and practise the questions on this page before each interview.

Other cities

DelhiGurgaonBangaloreHyderabadPuneChennaiMumbaiKolkataAhmedabadJaipurLucknowChandigarhIndoreKochiCoimbatoreBhubaneswarNagpurVisakhapatnamThiruvananthapuram

More ways to practise

Company-wise Cyber Security questionsExperience-wise Cyber Security questionsRole-wise Cyber Security questionsCity-wise Cyber Security questionsMost asked Cyber Security questionsScenario-based questionsPractical / hands-on questionsHR & behavioural questionsCyber Security mock interviewOnline assessment questionsTechnical round questionsManagerial round questionsCyber Security topic sheets