Curated interview practice questions with answers. These are practice scenarios, not a verified list of past interview questions.
About KPMG hiring for Cyber Security roles
KPMG is one of the Big Four professional services networks, providing audit, tax and advisory services. KPMG in India and its global delivery centres support clients with technology consulting, data and analytics, risk advisory and cybersecurity. It hires in India for analysts and consultants in data analytics, governance and risk, IT audit, testing and ERP implementation.
For Cyber Security roles, this KPMG practice set focuses most on Security Fundamentals (5), SOC Operations and SIEM (5), Network Security (5), Identity and Access Management (5). It has 3 easy, 20 medium, 7 hard questions, so you can start easy and work up to the harder ones.
Company type
Consulting
Headquarters
Amstelveen, Netherlands
Main India offices
Gurugram, Bengaluru, Mumbai, Hyderabad, Pune
KPMG Cyber Security interview process
Online assessment or screening test
Technical interview
Managerial or case round
Partner or HR round
Typical pattern based on public candidate experiences. Rounds vary by role, team and year.
Solved for KPMGStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
A user reports a pop-up saying their files are encrypted. What are your first steps?
First, isolate the device from the network, ideally through EDR network containment, without powering it off so memory evidence is kept. Inform the incident lead and start a timeline. Check for the same indicators on other hosts, disable the user's sessions and reset credentials if needed, and identify the ransomware family from the note. Then confirm backups are intact and offline before any recovery begins.
02
A key log source stopped sending data to the SIEM two days ago. Why does it matter and what do you do?
Silent log gaps create blind spots where attacks go undetected, and they can also break compliance. Raise it as a priority issue, check the forwarder or agent health, network path, licence limits and parsing errors, and restore ingestion. Check whether the gap overlapped any suspicious activity. Then add log source health monitoring that alerts when expected volume drops, so gaps are found in hours, not days.
03
Leadership wants to block all USB drives tomorrow. How would you handle this request?
I would support the goal but plan the rollout to avoid breaking business work. First, find who genuinely needs USB, such as field engineers, using endpoint logs. Then apply a device control policy through EDR or Intune that blocks mass storage by default, allows approved encrypted devices by serial number, and logs exceptions. Communicate the change, pilot it with one department, then enforce company wide.
04
How would you run a basic threat model for a new web application?
Draw a data flow diagram showing users, the web app, APIs, databases and third parties, and mark trust boundaries. Then apply STRIDE to each element: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service and Elevation of privilege. For each threat, record the existing control, a risk rating and an owner. Repeat the model whenever the architecture changes, ideally during design reviews.
05
Your IDS alerts on outbound traffic from a database server to an unknown IP on port 443 at 3 AM. How do you investigate?
Database servers rarely need internet access, so this is suspicious. I would check the destination's reputation and WHOIS, look at flow data for volume and duration, and identify the process making the connection using EDR. Then I review recent logins, scheduled tasks and new binaries on the server. If data volume is large or the process is unknown, I contain the host and escalate as a possible exfiltration.
06
How do you write basic Linux host firewall rules with nftables?
This is MFA fatigue. Enable number matching and show app and location context in push requests, limit the number of prompts, and alert on repeated denials. Move high-risk users and admins to phishing-resistant methods such as FIDO2 keys or passkeys. Train users to report unexpected prompts. Also revoke the attacker's sessions and review what they accessed.
Pick a realistic scenario, such as ransomware on a weekend, and invite IT, security, legal, communications and business leaders. A facilitator releases injects step by step, like a ransom note appearing or a journalist calling, and participants explain decisions using the real plan. Record gaps in contacts, authority, backups and reporting timelines. Share findings and track fixes, and repeat at least twice a year.
09
GuardDuty reports an EC2 instance communicating with a known crypto-mining pool. How do you respond?
Isolate the instance by changing its security group to a quarantine group with no traffic, and snapshot its volumes for analysis. Check how it was compromised: exposed SSH, vulnerable app or leaked key. Review CloudTrail for actions by its instance role. Terminate and rebuild from a clean image, rotate secrets the instance could access, and fix the root cause, such as closing public ports.
Certificate Transparency requires publicly trusted CAs to log every issued certificate in public append-only logs. Browsers require proof of logging before trusting a certificate. Domain owners can monitor these logs to detect certificates issued for their domains without permission, for example by a compromised CA or a phishing actor. Security teams also use CT logs for subdomain discovery and asset inventory.
11
A user on the office LAN reports repeated certificate warnings and you suspect ARP spoofing. What is happening and how do you stop it?
ARP has no authentication, so an attacker on the same LAN can send fake ARP replies linking their MAC address to the gateway's IP. Victims then send traffic through the attacker, enabling man-in-the-middle interception. Defences include Dynamic ARP Inspection with DHCP snooping on switches, port security, network access control, and encrypting traffic end to end with TLS so intercepted data is useless.
12
A finance employee transferred money after a fake email from the CEO. What do you do?
Contact the bank immediately to try to stop or recall the transfer; speed matters most. Report to the cybercrime portal and police. Investigate the email: was the CEO mailbox compromised or spoofed? Check sign-in logs, forwarding rules and other targeted staff. Reset credentials, enforce MFA and DMARC, and add a call-back rule for payment changes. Include legal and management throughout.
13
Developers share one admin account for a production database. What do you propose?
Shared accounts break accountability and are hard to rotate. Give each person an individual named account with least privilege, and provide admin access through PAM with just-in-time approval and session recording. Store the remaining break-glass credential in the vault with alerts on use. Use read-only roles for daily troubleshooting. Roll out with the team so it does not slow urgent fixes.
14
Your company is moving a banking application to the cloud. What security controls would you require?
I would require a landing zone with separate accounts, Indian region hosting for data residency, private networking with no public database endpoints, WAF and DDoS protection, customer managed KMS keys, PAM for admin access, central immutable logging to the SIEM, CSPM against CIS benchmarks, vulnerability scanning in CI, and a tested backup and disaster recovery plan. All mapped to RBI and audit requirements.
15
A vendor announces a zero-day in your internet-facing appliance with no patch yet. What does that mean and how do you protect the company?
A zero-day is a flaw that the vendor does not know about or has not yet patched, so defenders have had zero days to fix it. Exploits for zero-days are valuable and often used in targeted attacks. Since patches are unavailable, defence relies on layered controls: EDR behaviour detection, network segmentation, least privilege, virtual patching with WAF or IPS rules, and fast patching once a fix is released.
16
Describe a time you dealt with a user who was upset about losing access.
Situation: after an access review removed a sales manager's export rights, he escalated angrily before a client deadline. Task: solve his need while keeping the control. Action: I listened, explained why bulk exports were restricted, and arranged a time-bound approved export through his manager within an hour. Result: he met the deadline, and we added a documented request path for such cases.
17
During a major breach, an engineer asks why legal and communications must join the war room. How do you explain?
Legal advises on regulatory notification, such as CERT-In within six hours and the Data Protection Board and affected people under the DPDP Act, contractual duties to clients, evidence handling and privilege. Communications manage messaging to customers, staff, media and investors so statements are accurate and consistent. Technical teams should involve them early, because poor communication can cause more damage than the incident itself.
NAC checks devices and users before allowing them on the network, typically using 802.1X with a RADIUS server. It can verify certificates, patch level, EDR presence and user identity, then assign a VLAN or policy. Unknown or non-compliant devices go to a quarantine or guest network. NAC is important in offices with many personal devices and IoT equipment such as printers and cameras.
19
What are key container and Kubernetes security practices?
Use minimal, scanned base images and sign them. Run containers as non-root with read-only filesystems and dropped capabilities. In Kubernetes, enforce Pod Security Standards, use RBAC with least privilege, network policies to restrict pod traffic, secrets from an external store, and keep the API server private. Enable audit logs and runtime detection such as Falco, and patch clusters regularly.
20
Explain the difference between symmetric and asymmetric encryption at a basic level.
Symmetric encryption uses one shared key for encryption and decryption, such as AES; it is fast and used for bulk data. Asymmetric encryption uses a public and private key pair, such as RSA or elliptic curve keys; it is slower but solves key distribution and enables digital signatures. Real protocols like TLS combine them: asymmetric methods agree on a session key, then AES encrypts the traffic.
21
Tell me about a time you made a mistake at work and how you handled it.
Situation: as a Tier 1 analyst I closed an alert as false positive without checking the user's later activity. Task: my lead found it was a real phishing compromise. Action: I owned the mistake, helped contain it, and proposed a checklist for credential alerts that includes reviewing activity after login. Result: the checklist was adopted by the shift and similar misses stopped.
22
How would you run a data protection impact assessment under the DPDP Act?
Describe the processing: what personal data, purpose, legal basis, data flows, storage, retention and vendors. Assess risks to individuals, such as unauthorised access or excessive collection, and evaluate safeguards like encryption, access control and minimisation. Recommend changes, get sign-off from the data protection officer or privacy lead, and review it when processing changes. Significant data fiduciaries must perform periodic DPIAs and audits.
Role-Based Access Control grants permissions to roles such as Finance Analyst, and users get roles; it is simple to manage and audit. Attribute-Based Access Control decides using attributes of the user, resource and context, such as department, data classification, location and time. ABAC is more flexible but harder to reason about. Many organisations use RBAC as the base and add attribute conditions for sensitive cases.
Start with admins and remote access, then high-risk groups like finance. Pick methods, preferring authenticator app number matching and passkeys or FIDO2 keys for admins. Pilot with one department, prepare helpdesk scripts and self-service registration, and communicate clearly with deadlines. Use conditional access in report-only mode to find gaps, then enforce. Block legacy authentication and track registration rates weekly.
25
Your company website is under an application layer DDoS attack. What actions do you take?
Confirm it is an attack and not a traffic spike by checking request patterns, user agents and source spread. Enable or tighten the CDN or WAF bot protection and rate limits on targeted URLs, add challenge pages for suspicious clients, and cache heavy pages. Inform the ISP or DDoS provider and management. After the attack, review logs, tune rules and update the runbook.
User and Entity Behaviour Analytics builds baselines of normal behaviour for users, hosts and service accounts, then flags anomalies such as logging in from a new country, accessing far more files than usual or a service account doing interactive logins. It helps detect insider threats and stolen credentials that look like normal logins. It needs good identity data and careful tuning to avoid noisy alerts.
27
What is a false positive and a false negative in SOC alerts?
A false positive is an alert on benign activity, such as an admin running a legitimate script flagged as malicious. A false negative is a real attack that produced no alert, which is more dangerous. Too many false positives cause alert fatigue and missed real incidents. Analysts tune rules with allowlists, thresholds and context, and test detections against simulated attacks to find false negatives.
Single Loss Expectancy is asset value times exposure factor, and Annual Loss Expectancy is SLE times Annual Rate of Occurrence.
SLE = Asset Value x Exposure Factor
ALE = SLE x ARO
Example: a server worth 20 lakh rupees, 50 percent loss per incident, expected once in four years:
SLE = 20,00,000 x 0.5 = 10,00,000
ALE = 10,00,000 x 0.25 = 2,50,000 per year
Create a table where each risk has an ID, description written as cause, event and impact, asset, owner, inherent likelihood and impact, existing controls, residual rating, treatment decision, action plan, due date and review date. Gather risks through workshops, audits, incidents and threat intelligence. Review the register monthly with owners and report top risks to leadership quarterly.
30
An alert shows Microsoft Word spawning PowerShell with an encoded command. What does it mean and what do you do?
Office apps rarely start PowerShell, so this usually means a malicious macro or document exploit. Decode the Base64 command to see what it does, check the process tree and any network connections for downloads, and find the source email. Isolate the host through EDR, block the sender and URLs, search for the same email in other mailboxes and hunt for the same command line elsewhere.
Tips to crack the KPMG Cyber Security interview
Learn basics of IT audit, internal controls and risk frameworks, since advisory roles often combine data with governance work.
Practise structured answers for guesstimates and business problems, explaining assumptions clearly step by step.
Prepare examples of working with stakeholders and meeting deadlines, which are common themes in Big Four interviews.
Keep a one-minute story ready for every project on your CV: problem, your part, tools, result.
Practise the hard questions on this page aloud; KPMG interviewers usually ask follow-ups on your first answer.
Frequently asked questions
How many rounds are there in the KPMG Cyber Security interview?
Candidates usually go through 4 stages: Online assessment or screening test; Technical interview; Managerial or case round; Partner or HR round. The exact rounds change with the role, team, location and your experience, so confirm the process with the recruiter.
Which topics should I prepare for the KPMG Cyber Security interview?
This practice set leans on Security Fundamentals (5), SOC Operations and SIEM (5), Network Security (5), Identity and Access Management (5). Revise those first, then practise explaining one or two of your own projects end to end, because most KPMG interviewers ask you to walk through real work.
Are these the exact questions asked at KPMG?
No. These are curated practice questions that match the skills and difficulty usually tested in consulting interviews like KPMG's. They are not a leaked or verified list of past questions.
Where does KPMG hire Cyber Security professionals in India?
KPMG has large teams in Gurugram, Bengaluru, Mumbai, Hyderabad, Pune. Openings and locations change often, so check the KPMG careers page and filter by city and experience.