Cyber Security Interview Questions in Thiruvananthapuram
36 practice questions with answers for Cyber Security interviews in Thiruvananthapuram.
Cyber Security jobs in Thiruvananthapuram
Thiruvananthapuram's Technopark is one of India's oldest IT parks, hosting IT-services, product and engineering-services companies. Data and testing teams here often work with global clients in finance, travel and healthcare.
Below are 36 questions that match the mix of service, product and domain employers hiring soc analyst (l1/l2)s in Thiruvananthapuram.
Solved for ThiruvananthapuramStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
TPRM assesses and monitors the security of vendors that access your data or systems, since many breaches start with a supplier. It includes tiering vendors by risk, security questionnaires, reviewing SOC 2 or ISO 27001 reports, contract clauses for breach notification and audit rights, and continuous monitoring. High-risk vendors such as payroll or cloud providers get deeper reviews and annual reassessment.
02
Your SOC sees heavy DNS traffic with long random subdomains from one workstation. Which DNS attacks should you consider and what defences apply?
Key DNS attacks are cache poisoning, which inserts false records; DNS tunnelling, which hides data or command traffic inside queries; domain hijacking through registrar account takeover; and DNS amplification DDoS. Defences include DNSSEC to sign records, protective DNS resolvers that block malicious domains, monitoring for long or high-entropy subdomains, registrar lock with MFA, and rate limiting open resolvers.
Role-Based Access Control grants permissions to roles such as Finance Analyst, and users get roles; it is simple to manage and audit. Attribute-Based Access Control decides using attributes of the user, resource and context, such as department, data classification, location and time. ABAC is more flexible but harder to reason about. Many organisations use RBAC as the base and add attribute conditions for sensitive cases.
Start from business needs and regulations, keep it short and clear, and state scope, purpose, roles, requirements and exceptions. Avoid technical detail that changes often; put that in standards. Get input from IT, HR and legal, then management approval. Publish it where staff can find it, train people, require acknowledgement and review it at least yearly or after major changes.
05
What is the difference between OAuth 2.0 and OpenID Connect?
OAuth 2.0 is an authorisation framework; it lets an app get an access token to call an API on a user's behalf, without the user's password. It does not define who the user is. OpenID Connect adds an identity layer with an ID token, a signed JWT containing user claims, and a userinfo endpoint. Use OIDC for login, and OAuth access tokens for API authorisation.
TLS secures data in transit. In the TLS 1.3 handshake the client and server agree on cipher suites, perform an ephemeral key exchange such as X25519 for forward secrecy, and the server proves its identity with a certificate signed by a trusted CA. Both derive session keys, then traffic is encrypted with an AEAD cipher like AES-GCM. TLS 1.0 and 1.1 are deprecated and should be disabled.
07
Your CISO asks whether the company needs to act on quantum computing risk now. What do you advise?
Large quantum computers could break RSA and elliptic curve cryptography using Shor's algorithm. NIST published post-quantum standards in 2024: ML-KEM for key exchange, and ML-DSA and SLH-DSA for signatures. Attackers can harvest encrypted traffic now and decrypt it later, so long-lived sensitive data is at risk. Organisations should inventory cryptography, prefer crypto agility, and test hybrid key exchange that browsers already support.
08
Which Indian regulators issue cyber security requirements for financial firms?
RBI issues directions for banks, NBFCs and payment operators, including the IT governance and risk management directions and the cyber security framework for banks. SEBI issued the Cybersecurity and Cyber Resilience Framework for regulated entities in 2024. IRDAI has information and cyber security guidelines for insurers. All require board-approved policies, SOC monitoring, incident reporting and periodic audits.
09
How would you verify the integrity of a downloaded installer on Windows and Linux?
Compare the file's hash with the value published by the vendor over a trusted channel, or verify its digital signature. On Windows, use PowerShell and check the Authenticode signature. On Linux, use sha256sum and gpg for signed checksum files.
Get-FileHash .\setup.exe -Algorithm SHA256
Get-AuthenticodeSignature .\setup.exe
sha256sum tool.tar.gz
gpg --verify SHA256SUMS.asc SHA256SUMS
NIST CSF 2.0, released in 2024, organises cyber security outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover. Govern was added to cover strategy, roles, policy and supply chain risk. Each function has categories and subcategories. Organisations create current and target profiles to find gaps and plan improvements. It is voluntary and widely used to report maturity to boards.
11
How does a VPN protect traffic and what are its limits?
A VPN creates an encrypted tunnel, using IPsec, WireGuard or TLS, between a client and a network, protecting data on untrusted networks. Its limits are important: once connected, users often get broad network access, and VPN appliances are a frequent target for exploited vulnerabilities. That is why many companies move to Zero Trust Network Access, which grants per-application access after identity and device checks.
CSPM, Cloud Security Posture Management, checks cloud configurations against benchmarks like CIS and flags risks. CWPP, Cloud Workload Protection Platform, protects running workloads such as VMs, containers and serverless with vulnerability scanning and runtime detection. CNAPP combines these with identity analysis, IaC scanning and attack path analysis in one platform. The goal is to prioritise risks that combine, like a public VM with a critical flaw and admin role.
13
How would you set up envelope encryption for application data in the cloud?
Create a customer managed key in the cloud KMS with strict IAM so only the app role can use it. The app asks KMS for a data key, encrypts records locally with AES-GCM using the plaintext data key, stores the encrypted data key next to the data, and discards the plaintext key. To decrypt, it sends the encrypted data key to KMS. Enable key rotation and audit logging.
14
Explain the difference between symmetric and asymmetric encryption at a basic level.
Symmetric encryption uses one shared key for encryption and decryption, such as AES; it is fast and used for bulk data. Asymmetric encryption uses a public and private key pair, such as RSA or elliptic curve keys; it is slower but solves key distribution and enables digital signatures. Real protocols like TLS combine them: asymmetric methods agree on a session key, then AES encrypts the traffic.
15
How would you use Sysmon to improve endpoint visibility on Windows?
Sysmon is a free Microsoft Sysinternals tool that logs detailed endpoint events to the Windows event log. Useful events are ID 1 process creation with hashes and command line, ID 3 network connection, ID 11 file creation, ID 13 registry changes and ID 22 DNS queries. With a tuned configuration, it gives rich telemetry for SIEM detections when a full EDR is not available or as an extra source.
16
Leadership wants to block all USB drives tomorrow. How would you handle this request?
I would support the goal but plan the rollout to avoid breaking business work. First, find who genuinely needs USB, such as field engineers, using endpoint logs. Then apply a device control policy through EDR or Intune that blocks mass storage by default, allows approved encrypted devices by serial number, and logs exceptions. Communicate the change, pilot it with one department, then enforce company wide.
17
Tell me about a time you learned a difficult technical topic quickly.
Situation: in my final year project I needed TLS mutual authentication for an IoT prototype within two weeks. Task: understand PKI enough to build it. Action: I read the TLS 1.3 overview, set up a small CA with OpenSSL, issued device certificates and tested failures deliberately. Result: the demo worked, and I documented the steps so classmates could reuse them, which helped our team score well.
18
A key log source stopped sending data to the SIEM two days ago. Why does it matter and what do you do?
Silent log gaps create blind spots where attacks go undetected, and they can also break compliance. Raise it as a priority issue, check the forwarder or agent health, network path, licence limits and parsing errors, and restore ingestion. Check whether the gap overlapped any suspicious activity. Then add log source health monitoring that alerts when expected volume drops, so gaps are found in hours, not days.
19
Your manager asks why the company needs security when it already has antivirus on every laptop. How do you explain?
I would explain that antivirus mainly blocks known malicious files, while most modern attacks use stolen credentials, phishing links, living-off-the-land tools like PowerShell, or cloud misconfigurations that antivirus never sees. I would map our top risks to missing controls, such as MFA, EDR, logging and backups, and use a recent real incident pattern to show business impact in downtime and regulatory reporting cost.
20
Tell me about a time you explained a security risk to a non-technical person.
Situation: my team lead in a support role wanted to share admin passwords on a spreadsheet. Task: change this without slowing the team. Action: I explained the risk as a house key copied for everyone, showed how one leaked laptop exposes all systems, and proposed a password manager with shared vaults. Result: we adopted it within a week and audit findings dropped.
GRC is Governance, Risk and Compliance. Governance sets direction, policies, roles and accountability for security. Risk management identifies, assesses and treats risks to an acceptable level. Compliance ensures the organisation meets laws, regulations, contracts and standards such as the DPDP Act, RBI directions, ISO 27001 and PCI DSS. GRC analysts write policies, run risk assessments, manage audits and track remediation.
22
A user on the office LAN reports repeated certificate warnings and you suspect ARP spoofing. What is happening and how do you stop it?
ARP has no authentication, so an attacker on the same LAN can send fake ARP replies linking their MAC address to the gateway's IP. Victims then send traffic through the attacker, enabling man-in-the-middle interception. Defences include Dynamic ARP Inspection with DHCP snooping on switches, port security, network access control, and encrypting traffic end to end with TLS so intercepted data is useless.
For sharing, use the recipient's public key; for personal storage, use symmetric mode with a strong passphrase.
gpg --encrypt --recipient analyst@example.in report.pdf
gpg --output report.pdf --decrypt report.pdf.gpg
gpg --symmetric --cipher-algo AES256 backup.tar
Verify the recipient key fingerprint out of band before trusting it.
24
How would you check a cloud account against CIS benchmarks?
Enable the native posture service, such as AWS Security Hub with the CIS AWS Foundations standard, Microsoft Defender for Cloud with the CIS Azure benchmark, or Security Command Center on Google Cloud. Open source tools like Prowler or ScoutSuite also work. Export findings, prioritise critical ones like root MFA, public storage and open admin ports, assign owners and track remediation over time.
25
Your IDS alerts on outbound traffic from a database server to an unknown IP on port 443 at 3 AM. How do you investigate?
Database servers rarely need internet access, so this is suspicious. I would check the destination's reputation and WHOIS, look at flow data for volume and duration, and identify the process making the connection using EDR. Then I review recent logins, scheduled tasks and new binaries on the server. If data volume is large or the process is unknown, I contain the host and escalate as a possible exfiltration.
26
A guest Wi-Fi user can reach internal printers. What is wrong and how do you fix it?
Guest traffic is not properly isolated, likely because the guest SSID shares a VLAN with internal devices or the firewall allows inter-VLAN routing. Fix by placing guests on a separate VLAN with internet-only access, applying ACLs that deny all RFC 1918 internal ranges, and enabling client isolation on the wireless controller. Then test from a guest device and document the design.
27
How do you write a Splunk search to find brute-force attempts on Windows?
Search failed logon events, count per account and source, and filter high counts.
index=wineventlog EventCode=4625
| stats count AS failures dc(TargetUserName) AS users BY IpAddress
| where failures > 50
| sort - failures
A high distinct user count from one IP points to password spraying rather than a single account brute force.
28
An employee who is leaving copied large volumes of data to a personal cloud drive. How do you handle it?
Treat it as a potential insider incident and involve HR and legal before contacting the employee. Preserve evidence such as DLP alerts, proxy logs, endpoint file activity and cloud app logs, and document what data was involved and its sensitivity. Restrict the user's access as advised. Legal decides on next steps, such as requesting deletion with an undertaking. Then improve DLP and offboarding controls.
29
How do you onboard a new log source into a SIEM properly?
Define why the source is needed and which detections it supports. Configure collection through an agent, syslog or API, verify time sync and time zone, and ensure parsing maps fields to the SIEM's data model. Check volume and licence impact, set retention, and test with sample events. Finally build or enable detections and add health monitoring so the team knows if it stops.
A SIEM collects and correlates logs to detect threats. SOAR, Security Orchestration, Automation and Response, takes alerts and runs playbooks that enrich, decide and act, for example looking up an IP's reputation, querying EDR, disabling a user and opening a ticket. SIEM answers what is happening; SOAR speeds up the response. Many platforms now combine both, but automation still needs human approval for disruptive actions.
31
How do you collect basic triage data from a suspected compromised Windows host?
Collect volatile data first, ideally with EDR live response or a trusted triage tool. Useful built-in commands:
tasklist /v
netstat -ano
schtasks /query /fo LIST /v
wmic service get name,pathname,startmode
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run
wevtutil epl Security C:\IR\security.evtx
Save output to external media and hash every file.
The Payment Card Industry Data Security Standard applies to any organisation that stores, processes or transmits cardholder data. Version 4.0.1 is current, and its future-dated requirements became mandatory from March 2025. It has 12 requirement areas, including network security controls, protecting stored data, encryption in transit, vulnerability management, access control, logging and testing. Reducing scope through tokenisation and segmentation lowers compliance effort.
33
How do you handle a network team that refuses a security change you recommended?
Situation: the network team rejected my request to block outbound SMB at the firewall, fearing outages. Task: reduce the risk without damaging the relationship. Action: I shared flow data showing only two servers needed it, proposed an allowlist for them and a one-week monitor-only phase. Result: the team agreed, the rule went live with zero incidents, and we now review rules together monthly.
An HSM is tamper-resistant hardware that generates, stores and uses cryptographic keys without exposing them. Keys never leave the device in plain form. Banks and payment processors use HSMs for PIN processing, card keys and signing, and CAs protect root keys with them. Cloud offerings include managed HSM and KMS services. HSMs are often required for compliance standards such as PCI DSS and certified to FIPS 140-3.
35
What is the difference between a vulnerability assessment and a penetration test?
A vulnerability assessment uses scanners to find and rank as many known weaknesses as possible across many assets, and it is broad and frequent. A penetration test is a time-boxed, authorised attempt to exploit weaknesses and show real impact, such as reaching sensitive data. Assessments answer what is wrong; pen tests answer what an attacker could actually achieve. Most programmes run monthly scans and annual or release-based pen tests.
36
How do you manage many audit and compliance deadlines at the same time?
Situation: in one quarter I had an ISO surveillance audit, a client security questionnaire backlog and a regulator report due. Task: deliver all without missing dates. Action: I listed every deliverable with owners and deadlines in a tracker, reused a central evidence library for overlapping requests, and gave weekly status to my manager. Result: everything was delivered on time with no major findings.
Few big employers listed in Thiruvananthapuram?
Many Thiruvananthapuram candidates also apply to teams in Bangalore and to remote or hybrid roles. Practise the Bangalore set as well.
Which companies hire Cyber Security professionals in Thiruvananthapuram?
Companies with large offices in Thiruvananthapuram include many IT services and product firms. Use their company pages below to practise employer-specific sets.
Are Cyber Security interviews in Thiruvananthapuram different from other cities?
The questions depend more on the company than the city. Thiruvananthapuram's mix of employers decides the style: Data and testing teams here often work with global clients in finance, travel and healthcare
How do I find Cyber Security jobs in Thiruvananthapuram?
Shortlist companies with Thiruvananthapuram offices, keep your CV focused on Cyber Security projects, apply on company career pages and job portals with the Thiruvananthapuram filter, and practise the questions on this page before each interview.