Skip to content
Cyber Security
All coursesPlacement Report
‹ Back to previous sectionCourse homeAll page URLs

Medium Cyber Security Interview Questions

95 medium questions with answers. Applied questions that check whether you can use the concepts on real work.

Topics in the medium set

Network Security: 16 Identity and Access Management: 15 SOC Operations and SIEM: 13 Incident Response and Forensics: 13 GRC and Compliance: 12 Cloud Security: 11 Security Fundamentals: 9 Cryptography and PKI: 6
Solved — mediumStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
3 questions free Unlock the rest in seconds
01

What is the Cyber Kill Chain?

Security FundamentalsMedium
Save to ▾
Show answer
The Lockheed Martin Cyber Kill Chain describes seven stages of an intrusion: reconnaissance, weaponisation, delivery, exploitation, installation, command and control, and actions on objectives. Defenders use it to map controls to each stage, for example email filtering at delivery and egress filtering at command and control. Its weakness is a perimeter focus, so many teams pair it with MITRE ATT&CK for detailed techniques after initial access.
02

What is MITRE ATT&CK and how is it used?

Security FundamentalsMedium
Save to ▾
Show answer
MITRE ATT&CK is a public knowledge base of adversary tactics and techniques observed in real attacks, organised in matrices for Enterprise, Mobile and ICS. Tactics are the goal, such as Persistence, and techniques are the method, such as T1053 Scheduled Task. Teams use it to map detection coverage, write threat-informed detections, plan red and purple team exercises, and describe incidents in a common language.
03

What is Zero Trust security?

Security FundamentalsMedium
Save to ▾
Show answer
Zero Trust removes implicit trust based on network location. Every request is verified using identity, device health and context, access is least privilege and granted per session, and the environment is assumed to be already breached. NIST SP 800-207 describes the model. In practice it means strong MFA, device posture checks, identity-aware proxies instead of flat VPN access, micro-segmentation and continuous monitoring. It is a journey, not a single product.
04

Your manager asks why the company needs security when it already has antivirus on every laptop. How do you explain?

Security FundamentalsMedium
Save to ▾
Show answer
I would explain that antivirus mainly blocks known malicious files, while most modern attacks use stolen credentials, phishing links, living-off-the-land tools like PowerShell, or cloud misconfigurations that antivirus never sees. I would map our top risks to missing controls, such as MFA, EDR, logging and backups, and use a recent real incident pattern to show business impact in downtime and regulatory reporting cost.
05

A user reports a pop-up saying their files are encrypted. What are your first steps?

Security FundamentalsMedium
Save to ▾
Show answer
First, isolate the device from the network, ideally through EDR network containment, without powering it off so memory evidence is kept. Inform the incident lead and start a timeline. Check for the same indicators on other hosts, disable the user's sessions and reset credentials if needed, and identify the ransomware family from the note. Then confirm backups are intact and offline before any recovery begins.
06

A developer has hardcoded database passwords in a public code repository. What do you do?

Security FundamentalsMedium
Save to ▾
Show answer
Treat the secret as compromised immediately, even if the commit is removed, because public repos are scraped within minutes. Rotate the password and any related keys, check database logs for unknown logins since the commit time, and remove the secret from git history. Then fix the root cause by moving secrets to a vault or cloud secret manager and adding secret scanning to pre-commit hooks and the CI pipeline.
07

Leadership wants to block all USB drives tomorrow. How would you handle this request?

Security FundamentalsMedium
Save to ▾
Show answer
I would support the goal but plan the rollout to avoid breaking business work. First, find who genuinely needs USB, such as field engineers, using endpoint logs. Then apply a device control policy through EDR or Intune that blocks mass storage by default, allows approved encrypted devices by serial number, and logs exceptions. Communicate the change, pilot it with one department, then enforce company wide.
08

How would you run a basic threat model for a new web application?

Security FundamentalsMedium
Save to ▾
Show answer
Draw a data flow diagram showing users, the web app, APIs, databases and third parties, and mark trust boundaries. Then apply STRIDE to each element: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service and Elevation of privilege. For each threat, record the existing control, a risk rating and an owner. Repeat the model whenever the architecture changes, ideally during design reviews.
09

Tell me about a time you explained a security risk to a non-technical person.

Security FundamentalsMedium
Save to ▾
Show answer
Situation: my team lead in a support role wanted to share admin passwords on a spreadsheet. Task: change this without slowing the team. Action: I explained the risk as a house key copied for everyone, showed how one leaked laptop exposes all systems, and proposed a password manager with shared vaults. Result: we adopted it within a week and audit findings dropped.
10

What is network segmentation and why is it important?

Network SecurityMedium
Save to ▾
Show answer
Segmentation splits a network into zones such as user, server, OT, guest and management, with controlled traffic between them using VLANs, firewalls and ACLs. It limits lateral movement, so ransomware on one laptop cannot reach every server. It also reduces compliance scope, for example isolating the cardholder data environment for PCI DSS. Micro-segmentation goes further with per-workload policies in data centres and cloud.
11

How does a VPN protect traffic and what are its limits?

Network SecurityMedium
Save to ▾
Show answer
A VPN creates an encrypted tunnel, using IPsec, WireGuard or TLS, between a client and a network, protecting data on untrusted networks. Its limits are important: once connected, users often get broad network access, and VPN appliances are a frequent target for exploited vulnerabilities. That is why many companies move to Zero Trust Network Access, which grants per-application access after identity and device checks.
12

Your SOC sees heavy DNS traffic with long random subdomains from one workstation. Which DNS attacks should you consider and what defences apply?

Network SecurityMedium
Save to ▾
Show answer
Key DNS attacks are cache poisoning, which inserts false records; DNS tunnelling, which hides data or command traffic inside queries; domain hijacking through registrar account takeover; and DNS amplification DDoS. Defences include DNSSEC to sign records, protective DNS resolvers that block malicious domains, monitoring for long or high-entropy subdomains, registrar lock with MFA, and rate limiting open resolvers.
13

A user on the office LAN reports repeated certificate warnings and you suspect ARP spoofing. What is happening and how do you stop it?

Network SecurityMedium
Save to ▾
Show answer
ARP has no authentication, so an attacker on the same LAN can send fake ARP replies linking their MAC address to the gateway's IP. Victims then send traffic through the attacker, enabling man-in-the-middle interception. Defences include Dynamic ARP Inspection with DHCP snooping on switches, port security, network access control, and encrypting traffic end to end with TLS so intercepted data is useless.
14

What is a DDoS attack and how is it mitigated?

Network SecurityMedium
Save to ▾
Show answer
A Distributed Denial of Service attack floods a target from many sources to exhaust bandwidth, connection tables or application resources. Types are volumetric floods, protocol attacks like SYN floods, and application layer floods hitting costly pages. Mitigation uses upstream scrubbing services or CDN providers, anycast networks, rate limiting, SYN cookies, autoscaling, and a tested runbook agreed with the ISP before an attack.
15

What is TLS and what does the handshake achieve?

Network SecurityMedium
Save to ▾
Show answer
TLS secures data in transit. In the TLS 1.3 handshake the client and server agree on cipher suites, perform an ephemeral key exchange such as X25519 for forward secrecy, and the server proves its identity with a certificate signed by a trusted CA. Both derive session keys, then traffic is encrypted with an AEAD cipher like AES-GCM. TLS 1.0 and 1.1 are deprecated and should be disabled.
16

What is Network Access Control?

Network SecurityMedium
Save to ▾
Show answer
NAC checks devices and users before allowing them on the network, typically using 802.1X with a RADIUS server. It can verify certificates, patch level, EDR presence and user identity, then assign a VLAN or policy. Unknown or non-compliant devices go to a quarantine or guest network. NAC is important in offices with many personal devices and IoT equipment such as printers and cameras.
17

How do you handle a network team that refuses a security change you recommended?

Network SecurityMedium
Save to ▾
Show answer
Situation: the network team rejected my request to block outbound SMB at the firewall, fearing outages. Task: reduce the risk without damaging the relationship. Action: I shared flow data showing only two servers needed it, proposed an allowlist for them and a one-week monitor-only phase. Result: the team agreed, the rule went live with zero incidents, and we now review rules together monthly.
18

Your IDS alerts on outbound traffic from a database server to an unknown IP on port 443 at 3 AM. How do you investigate?

Network SecurityMedium
Save to ▾
Show answer
Database servers rarely need internet access, so this is suspicious. I would check the destination's reputation and WHOIS, look at flow data for volume and duration, and identify the process making the connection using EDR. Then I review recent logins, scheduled tasks and new binaries on the server. If data volume is large or the process is unknown, I contain the host and escalate as a possible exfiltration.
19

Users complain that a new firewall rule broke an application. How do you troubleshoot?

Network SecurityMedium
Save to ▾
Show answer
First check the firewall logs for denied traffic from the affected users or servers around the change time. Compare the change ticket with actual app requirements, since apps often use extra ports or dependencies. Use packet capture or a test connection to confirm. Then add a narrow rule for the real need, not an any-any rule, and update documentation so the next change does not repeat the problem.
20

A firewall audit finds 40 percent of rules have not been hit in a year. What do you do?

Network SecurityMedium
Save to ▾
Show answer
Unused rules expand attack surface and slow audits. I would export rule hit counts, confirm no seasonal apps like year-end batch jobs depend on them, and contact rule owners listed in tickets. Rules with no owner are disabled first, not deleted, and monitored for a month. After that they are removed. I would also add rule expiry dates and quarterly reviews to the change process.
21

A guest Wi-Fi user can reach internal printers. What is wrong and how do you fix it?

Network SecurityMedium
Save to ▾
Show answer
Guest traffic is not properly isolated, likely because the guest SSID shares a VLAN with internal devices or the firewall allows inter-VLAN routing. Fix by placing guests on a separate VLAN with internet-only access, applying ACLs that deny all RFC 1918 internal ranges, and enabling client isolation on the wireless controller. Then test from a guest device and document the design.
22

How would you capture and analyse suspicious traffic using tcpdump and Wireshark?

Network SecurityMedium
Save to ▾
Show answer
Capture on the right interface with a filter to limit size, save to a pcap file, then open it in Wireshark. sudo tcpdump -i eth0 host 10.10.0.15 and port 53 -w dns.pcap In Wireshark, use display filters such as dns, http.request or tls.handshake.type == 1, and Statistics > Conversations to spot top talkers. Protect pcaps because they may contain sensitive data.
23

How do you write basic Linux host firewall rules with nftables?

Network SecurityMedium
Save to ▾
Show answer
Default deny inbound, allow established traffic, loopback and only required services. nft add table inet filter nft add chain inet filter input '{ type filter hook input priority 0; policy drop; }' nft add rule inet filter input ct state established,related accept nft add rule inet filter input iif lo accept nft add rule inet filter input tcp dport 22 ip saddr 10.10.1.0/24 accept nft add rule inet filter input tcp dport 443 accept Save the ruleset so it persists after reboot.
24

How do you check a server's TLS configuration?

Network SecurityMedium
Save to ▾
Show answer
Check supported protocol versions, ciphers and certificate details. OpenSSL gives a quick view, and tools like testssl.sh give a full report. openssl s_client -connect example.com:443 -tls1_2 openssl s_client -connect example.com:443 -servername example.com | openssl x509 -noout -dates -issuer ./testssl.sh example.com Disable TLS 1.0 and 1.1, weak ciphers like RC4 and 3DES, and fix expiring certificates.
25

Describe a time you handled a stressful outage or security issue.

Network SecurityMedium
Save to ▾
Show answer
Situation: during my internship the office internet went down during a client demo because of a broadcast storm. Task: restore service quickly. Action: I checked switch logs, found a looped cable creating a loop, removed it, and then enabled spanning tree and storm control with my senior. Result: service returned in 20 minutes, and I wrote a short runbook so the team could resolve similar issues faster.
26

What is forward secrecy?

Cryptography and PKIMedium
Save to ▾
Show answer
Forward secrecy means that if a server's long-term private key is stolen later, previously recorded sessions still cannot be decrypted. It is achieved with ephemeral key exchange, such as ECDHE, where a new key pair is created for each session and discarded. TLS 1.3 makes forward secrecy mandatory by removing static RSA key exchange, which is one reason older TLS configurations are considered weak.
27

What is certificate revocation and how is it checked?

Cryptography and PKIMedium
Save to ▾
Show answer
Revocation invalidates a certificate before expiry, for example when its private key leaks. Methods are CRLs, which are signed lists of revoked serial numbers, and OCSP, where the client asks a responder about one certificate. OCSP stapling lets the server attach a fresh response to the handshake. Because revocation checking is unreliable, the industry is moving to much shorter certificate lifetimes, which reduces exposure.
28

What is a man-in-the-middle attack on TLS and how do certificates prevent it?

Cryptography and PKIMedium
Save to ▾
Show answer
In a MITM attack, an attacker intercepts traffic and pretends to be the server. Certificates prevent this because the client checks that the server certificate chains to a trusted root, matches the hostname and is valid. An attacker cannot produce a valid certificate without the private key or a compromised CA. Certificate warnings that users click through, and apps that skip validation, break this protection.
29

A TLS certificate expired on the main customer portal and caused an outage. How do you prevent this in future?

Cryptography and PKIMedium
Save to ▾
Show answer
First renew and deploy the certificate to restore service. For prevention, build a certificate inventory from scanning and CT logs, automate issuance and renewal with ACME where possible, and set alerts at 30, 14 and 7 days before expiry to a team mailbox, not an individual. Assign an owner per certificate and add expiry checks to monitoring dashboards, since shorter lifetimes are coming.
30

How do you create a private key and CSR with OpenSSL?

Cryptography and PKIMedium
Save to ▾
Show answer
Generate a key, then a certificate signing request to send to a CA. openssl ecparam -genkey -name prime256v1 -out server.key openssl req -new -key server.key -out server.csr \ -subj "/CN=portal.example.in" \ -addext "subjectAltName=DNS:portal.example.in" openssl req -in server.csr -noout -text Keep server.key private with restricted file permissions.
31

How would you hash passwords correctly in Python?

Cryptography and PKIMedium
Save to ▾
Show answer
Use a dedicated password hashing library with Argon2id, which handles salts and parameters automatically. from argon2 import PasswordHasher ph = PasswordHasher() stored = ph.hash(password) try: ph.verify(stored, attempt) if ph.check_needs_rehash(stored): stored = ph.hash(attempt) except Exception: deny_login() Never use plain SHA-256 or MD5 for passwords.
32

Which Windows event IDs should a SOC analyst know?

SOC Operations and SIEMMedium
Save to ▾
Show answer
Key Security log events are 4624 successful logon, 4625 failed logon, 4672 special privileges assigned, 4688 process creation, 4720 user created, 4728 and 4732 user added to privileged groups, 4740 account lockout, 1102 audit log cleared, 4698 scheduled task created and 7045 service installed in the System log. Logon type in 4624, such as 3 for network and 10 for RDP, adds important context.
33

How would you use Sysmon to improve endpoint visibility on Windows?

SOC Operations and SIEMMedium
Save to ▾
Show answer
Sysmon is a free Microsoft Sysinternals tool that logs detailed endpoint events to the Windows event log. Useful events are ID 1 process creation with hashes and command line, ID 3 network connection, ID 11 file creation, ID 13 registry changes and ID 22 DNS queries. With a tuned configuration, it gives rich telemetry for SIEM detections when a full EDR is not available or as an extra source.
34

What is threat intelligence and what are IOCs and TTPs?

SOC Operations and SIEMMedium
Save to ▾
Show answer
Threat intelligence is analysed information about adversaries, their tools and behaviour. Indicators of Compromise are artefacts like malicious IPs, domains and file hashes; they are easy to use but change quickly. TTPs, tactics, techniques and procedures, describe how attackers operate, and are harder for attackers to change. The Pyramid of Pain shows that detecting TTPs causes attackers more cost than blocking hashes.
35

What is threat hunting?

SOC Operations and SIEMMedium
Save to ▾
Show answer
Threat hunting is proactive searching for attackers who evaded existing detections. Hunters start from a hypothesis, for example that attackers use scheduled tasks for persistence, then query EDR and SIEM data to confirm or reject it. Findings become new detection rules. Hunting requires good data retention, knowledge of normal behaviour and frameworks like MITRE ATT&CK to guide hypotheses.
36

What SOC metrics matter most?

SOC Operations and SIEMMedium
Save to ▾
Show answer
Important metrics are mean time to detect, mean time to respond, alert volume per analyst, false positive rate per rule, percentage of alerts closed within SLA, detection coverage against priority ATT&CK techniques and log source health. Metrics should drive improvement, not punish analysts. For example, a rule with 95 percent false positives should be tuned, and long response times may point to missing automation.
37

What is UEBA?

SOC Operations and SIEMMedium
Save to ▾
Show answer
User and Entity Behaviour Analytics builds baselines of normal behaviour for users, hosts and service accounts, then flags anomalies such as logging in from a new country, accessing far more files than usual or a service account doing interactive logins. It helps detect insider threats and stolen credentials that look like normal logins. It needs good identity data and careful tuning to avoid noisy alerts.
38

You receive an alert for 300 failed logins on one account followed by a success. How do you triage it?

SOC Operations and SIEMMedium
Save to ▾
Show answer
This pattern suggests brute force or password spraying that succeeded. Check source IPs, location and logon type, and whether MFA was used for the success. Review what the account did after login, such as mailbox rules, file access or new tokens. If suspicious, disable the account or revoke sessions, reset the password, block source IPs and check whether the same IPs targeted other accounts.
39

An alert shows Microsoft Word spawning PowerShell with an encoded command. What does it mean and what do you do?

SOC Operations and SIEMMedium
Save to ▾
Show answer
Office apps rarely start PowerShell, so this usually means a malicious macro or document exploit. Decode the Base64 command to see what it does, check the process tree and any network connections for downloads, and find the source email. Isolate the host through EDR, block the sender and URLs, search for the same email in other mailboxes and hunt for the same command line elsewhere.
40

During triage you notice a user logged in from Mumbai and then from Frankfurt 20 minutes later. How do you handle it?

SOC Operations and SIEMMedium
Save to ▾
Show answer
This is an impossible travel alert. First rule out benign causes like corporate VPN, cloud proxy egress or mobile networks. Check device IDs, user agents and MFA results for both logins. If the second login is from an unknown device without MFA, or followed by mailbox rule creation or data download, revoke sessions, reset credentials, review MFA methods and contact the user through a separate channel.
41

A key log source stopped sending data to the SIEM two days ago. Why does it matter and what do you do?

SOC Operations and SIEMMedium
Save to ▾
Show answer
Silent log gaps create blind spots where attacks go undetected, and they can also break compliance. Raise it as a priority issue, check the forwarder or agent health, network path, licence limits and parsing errors, and restore ingestion. Check whether the gap overlapped any suspicious activity. Then add log source health monitoring that alerts when expected volume drops, so gaps are found in hours, not days.
42

How do you write a Splunk search to find brute-force attempts on Windows?

SOC Operations and SIEMMedium
Save to ▾
Show answer
Search failed logon events, count per account and source, and filter high counts. index=wineventlog EventCode=4625 | stats count AS failures dc(TargetUserName) AS users BY IpAddress | where failures > 50 | sort - failures A high distinct user count from one IP points to password spraying rather than a single account brute force.
43

How do you onboard a new log source into a SIEM properly?

SOC Operations and SIEMMedium
Save to ▾
Show answer
Define why the source is needed and which detections it supports. Configure collection through an agent, syslog or API, verify time sync and time zone, and ensure parsing maps fields to the SIEM's data model. Check volume and licence impact, set retention, and test with sample events. Finally build or enable detections and add health monitoring so the team knows if it stops.
44

Tell me about a time you made a mistake at work and how you handled it.

SOC Operations and SIEMMedium
Save to ▾
Show answer
Situation: as a Tier 1 analyst I closed an alert as false positive without checking the user's later activity. Task: my lead found it was a real phishing compromise. Action: I owned the mistake, helped contain it, and proposed a checklist for credential alerts that includes reviewing activity after login. Result: the checklist was adopted by the shift and similar misses stopped.
45

What are India's CERT-In incident reporting requirements?

Incident Response and ForensicsMedium
Save to ▾
Show answer
Under the CERT-In directions issued in April 2022, service providers, intermediaries, data centres and body corporates must report specified cyber incidents to CERT-In within six hours of noticing them. They must also keep ICT system logs for 180 days within India and synchronise clocks with NTP servers of NIC or NPL. Reportable incidents include ransomware, data breaches, and attacks on servers and cloud systems.
46

What is the order of volatility in evidence collection?

Incident Response and ForensicsMedium
Save to ▾
Show answer
Collect the most volatile evidence first because it disappears quickly. The order is CPU registers and cache, memory including running processes and network connections, temporary files, disk, remote logs, and finally archived media. That is why responders capture RAM before shutting down a machine, since malware running only in memory, decrypted keys and active connections are lost at power off.
47

What are the main containment strategies?

Incident Response and ForensicsMedium
Save to ▾
Show answer
Short-term containment stops the spread quickly, for example isolating hosts through EDR, disabling accounts, blocking IPs or domains and segmenting networks. Long-term containment keeps business running while preparing clean systems, such as rebuilding servers in a separate network. Responders must balance speed with evidence preservation and avoid alerting a sophisticated attacker too early if they need to understand the full scope.
48

What is memory forensics and which tool is commonly used?

Incident Response and ForensicsMedium
Save to ▾
Show answer
Memory forensics analyses a RAM capture to find running processes, injected code, network connections, loaded DLLs, command history and encryption keys. It reveals fileless malware that leaves little on disk. Volatility 3 is the common open source framework, with plugins such as windows.pslist, windows.netscan and windows.malfind. Captures are taken with tools like WinPmem or through EDR live response.
49

What is the difference between static and dynamic malware analysis?

Incident Response and ForensicsMedium
Save to ▾
Show answer
Static analysis examines a sample without running it: hashes, strings, imports, PE headers, YARA rule matches and disassembly. Dynamic analysis runs it in an isolated sandbox to observe processes, file changes, registry edits and network calls. Static is safe and fast but defeated by packing; dynamic shows real behaviour but malware may detect sandboxes. Analysts usually combine both in a controlled lab.
50

What is a business email compromise attack?

Incident Response and ForensicsMedium
Save to ▾
Show answer
In BEC, attackers take over or impersonate an executive, vendor or finance mailbox to trick staff into making payments or changing bank details. It often uses no malware, just a compromised account, mailbox forwarding rules and convincing requests. Controls include MFA, DMARC enforcement, alerts on new inbox rules, and a mandatory call-back process on a known number for any change to payment details.
51

A finance employee transferred money after a fake email from the CEO. What do you do?

Incident Response and ForensicsMedium
Save to ▾
Show answer
Contact the bank immediately to try to stop or recall the transfer; speed matters most. Report to the cybercrime portal and police. Investigate the email: was the CEO mailbox compromised or spoofed? Check sign-in logs, forwarding rules and other targeted staff. Reset credentials, enforce MFA and DMARC, and add a call-back rule for payment changes. Include legal and management throughout.
52

An employee who is leaving copied large volumes of data to a personal cloud drive. How do you handle it?

Incident Response and ForensicsMedium
Save to ▾
Show answer
Treat it as a potential insider incident and involve HR and legal before contacting the employee. Preserve evidence such as DLP alerts, proxy logs, endpoint file activity and cloud app logs, and document what data was involved and its sensitivity. Restrict the user's access as advised. Legal decides on next steps, such as requesting deletion with an undertaking. Then improve DLP and offboarding controls.
53

How do you collect basic triage data from a suspected compromised Windows host?

Incident Response and ForensicsMedium
Save to ▾
Show answer
Collect volatile data first, ideally with EDR live response or a trusted triage tool. Useful built-in commands: tasklist /v netstat -ano schtasks /query /fo LIST /v wmic service get name,pathname,startmode reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run wevtutil epl Security C:\IR\security.evtx Save output to external media and hash every file.
54

How do you create a forensic disk image and verify it?

Incident Response and ForensicsMedium
Save to ▾
Show answer
Use a write blocker or a forensic tool, image the whole disk, and hash both source and image. sudo dc3dd if=/dev/sdb of=/evidence/case12.img hash=sha256 log=/evidence/case12.log sha256sum /evidence/case12.img Record the hashes, time, examiner and device details in the chain of custody form. Analyse a working copy, never the original.
55

How do you run a tabletop exercise?

Incident Response and ForensicsMedium
Save to ▾
Show answer
Pick a realistic scenario, such as ransomware on a weekend, and invite IT, security, legal, communications and business leaders. A facilitator releases injects step by step, like a ransom note appearing or a journalist calling, and participants explain decisions using the real plan. Record gaps in contacts, authority, backups and reporting timelines. Share findings and track fixes, and repeat at least twice a year.
56

Describe a time you worked under pressure during an incident.

Incident Response and ForensicsMedium
Save to ▾
Show answer
Situation: during a phishing campaign, 40 users received a credential-harvesting email on a Friday evening. Task: contain it before attackers used stolen accounts. Action: I purged the email across mailboxes, identified six users who clicked, reset their passwords, revoked sessions and blocked the domain, while updating my lead every 30 minutes. Result: no account misuse was found and the playbook was updated.
57

How do you communicate technical incident details to senior management?

Incident Response and ForensicsMedium
Save to ▾
Show answer
I lead with business impact: what is affected, current status, risk to customers or data, and decisions needed from them. Technical details go in an appendix. For example, in a past incident I gave updates every two hours in a fixed format: what we know, what we are doing, what we need, next update time. This kept leaders calm and decisions quick.
58

What are passkeys?

Identity and Access ManagementMedium
Save to ▾
Show answer
Passkeys are FIDO2 credentials that replace passwords. The device creates a key pair per website; the private key stays in the device or synced password manager, protected by biometrics or PIN, and the server stores only the public key. Login is a signature over a challenge tied to the real domain, so passkeys resist phishing and cannot be reused across sites. They also remove password reset load.
59

What is the difference between OAuth 2.0 and OpenID Connect?

Identity and Access ManagementMedium
Save to ▾
Show answer
OAuth 2.0 is an authorisation framework; it lets an app get an access token to call an API on a user's behalf, without the user's password. It does not define who the user is. OpenID Connect adds an identity layer with an ID token, a signed JWT containing user claims, and a userinfo endpoint. Use OIDC for login, and OAuth access tokens for API authorisation.
60

What is RBAC and ABAC?

Identity and Access ManagementMedium
Save to ▾
Show answer
Role-Based Access Control grants permissions to roles such as Finance Analyst, and users get roles; it is simple to manage and audit. Attribute-Based Access Control decides using attributes of the user, resource and context, such as department, data classification, location and time. ABAC is more flexible but harder to reason about. Many organisations use RBAC as the base and add attribute conditions for sensitive cases.
61

What is Privileged Access Management?

Identity and Access ManagementMedium
Save to ▾
Show answer
PAM protects powerful accounts like domain admins, root, database admins and cloud owners. It includes a vault for credentials with automatic rotation, just-in-time elevation, session brokering with recording, approval workflows and alerts on unusual use. Tools include CyberArk, BeyondTrust and Delinea. PAM is important because attackers aim for privileged credentials to move laterally and deploy ransomware across the network.
62

How would you design a joiner, mover, leaver process for a growing company?

Identity and Access ManagementMedium
Save to ▾
Show answer
JML is the identity lifecycle. Joiners get accounts and baseline access from HR data on day one. Movers change roles, and their old access must be removed, not just new access added, to avoid privilege creep. Leavers must be disabled promptly, ideally automatically when HR records their exit. Automating JML from the HR system to the identity platform reduces orphan accounts, which auditors frequently flag.
63

Describe a time you dealt with a user who was upset about losing access.

Identity and Access ManagementMedium
Save to ▾
Show answer
Situation: after an access review removed a sales manager's export rights, he escalated angrily before a client deadline. Task: solve his need while keeping the control. Action: I listened, explained why bulk exports were restricted, and arranged a time-bound approved export through his manager within an hour. Result: he met the deadline, and we added a documented request path for such cases.
64

What is conditional access?

Identity and Access ManagementMedium
Save to ▾
Show answer
Conditional access applies policies based on signals at sign-in, such as user, group, device compliance, location, application and risk score. For example, allow finance apps only from managed devices with MFA, block legacy authentication, and require a password change when sign-in risk is high. It is a key Zero Trust building block in platforms like Microsoft Entra ID. Policies need testing in report-only mode first.
65

Attackers bypassed MFA by sending repeated push notifications until a user approved. How do you prevent this?

Identity and Access ManagementMedium
Save to ▾
Show answer
This is MFA fatigue. Enable number matching and show app and location context in push requests, limit the number of prompts, and alert on repeated denials. Move high-risk users and admins to phishing-resistant methods such as FIDO2 keys or passkeys. Train users to report unexpected prompts. Also revoke the attacker's sessions and review what they accessed.
66

An audit finds 200 active accounts belonging to employees who left. How do you fix it?

Identity and Access ManagementMedium
Save to ▾
Show answer
Disable the accounts immediately after confirming with HR, then check each for recent logins, since any use after the exit date is a potential incident. Find the root cause, usually manual offboarding or apps not connected to SSO. Integrate the HR system with the identity platform for automatic disabling, connect apps to SSO and SCIM provisioning, and run monthly orphan account reports.
67

Developers share one admin account for a production database. What do you propose?

Identity and Access ManagementMedium
Save to ▾
Show answer
Shared accounts break accountability and are hard to rotate. Give each person an individual named account with least privilege, and provide admin access through PAM with just-in-time approval and session recording. Store the remaining break-glass credential in the vault with alerts on use. Use read-only roles for daily troubleshooting. Roll out with the team so it does not slow urgent fixes.
68

How do you find stale and privileged accounts in Active Directory with PowerShell?

Identity and Access ManagementMedium
Save to ▾
Show answer
Use the ActiveDirectory module. Search-ADAccount -AccountInactive -TimeSpan 90.00:00:00 -UsersOnly | Select Name, LastLogonDate Get-ADGroupMember 'Domain Admins' -Recursive | Select Name, SamAccountName Get-ADUser -Filter {PasswordNeverExpires -eq $true} | Select Name Review results with owners before disabling anything.
69

How do you decode and check a JWT during troubleshooting?

Identity and Access ManagementMedium
Save to ▾
Show answer
A JWT has header, payload and signature separated by dots. Decode the first two parts to read claims, but never trust them without verifying the signature. echo $TOKEN | cut -d. -f2 | base64 -d 2>/dev/null Check iss, aud, exp and nbf claims. In code, verify with a library using the expected algorithm and issuer keys, and reject alg none.
70

How would you roll out MFA to 5000 employees?

Identity and Access ManagementMedium
Save to ▾
Show answer
Start with admins and remote access, then high-risk groups like finance. Pick methods, preferring authenticator app number matching and passkeys or FIDO2 keys for admins. Pilot with one department, prepare helpdesk scripts and self-service registration, and communicate clearly with deadlines. Use conditional access in report-only mode to find gaps, then enforce. Block legacy authentication and track registration rates weekly.
71

How do you design an access review for a critical application?

Identity and Access ManagementMedium
Save to ▾
Show answer
Define scope, such as all users with write or admin rights. Pull entitlements and last-login data from the app, and route each item to the user's manager and the app owner. Give clear choices of keep or revoke with a deadline, and revoke automatically if not reviewed. Capture evidence for auditors, and review exceptions with security. Run it quarterly for privileged access.
72

Tell me about a time you had to say no to a senior person's access request.

Identity and Access ManagementMedium
Save to ▾
Show answer
Situation: a senior manager asked for permanent admin rights on production to speed up reports. Task: protect production without blocking the work. Action: I explained the audit and breach risk, then offered a read-only reporting role and a scheduled export within a day. Result: the manager got the data faster than before, and the audit later had no finding on that system.
73

What is the role of IAM in AWS security?

Cloud SecurityMedium
Save to ▾
Show answer
AWS IAM controls who can do what on which resources through users, groups, roles and JSON policies. Best practices are avoiding root account use and protecting it with MFA, using roles with temporary credentials instead of access keys, least privilege policies, permission boundaries, and Service Control Policies in AWS Organizations to set guardrails across accounts. IAM Access Analyzer helps find unused and external access.
74

Which cloud logs are essential for security monitoring?

Cloud SecurityMedium
Save to ▾
Show answer
Essential sources are control plane audit logs such as AWS CloudTrail, Azure Activity Log and Entra sign-in logs, and Google Cloud Audit Logs. Add network flow logs, DNS logs, load balancer and WAF logs, storage access logs for sensitive buckets, and Kubernetes audit logs. Send them to a central account or SIEM that workload owners cannot delete, and enable threat detection services like GuardDuty.
75

What is Infrastructure as Code security scanning?

Cloud SecurityMedium
Save to ▾
Show answer
IaC scanning checks Terraform, CloudFormation, Bicep or Kubernetes manifests for misconfigurations before deployment, such as public buckets or unencrypted databases. Tools include Checkov, tfsec in Trivy, and KICS. It shifts security left, so issues are fixed in a pull request rather than in production. Combine it with policy as code, like OPA, and drift detection to catch manual changes made in the console.
76

Tell me about a time you worked with developers to fix a security finding.

Cloud SecurityMedium
Save to ▾
Show answer
Situation: a scan found a critical vulnerability in a library used by five microservices just before a release. Task: fix it without delaying the launch. Action: I paired with the lead developer, confirmed which services were truly exploitable, prepared tested upgrade pull requests and added a WAF rule as a temporary safeguard. Result: all services were patched in two days and release stayed on schedule.
77

How does encryption work for data at rest in the cloud?

Cloud SecurityMedium
Save to ▾
Show answer
Most cloud storage, databases and disks encrypt data at rest by default with provider-managed keys. For more control, use customer managed keys in KMS, with key policies, rotation and logs of every use, or bring and hold your own keys for strict regulatory needs. Encryption at rest protects against physical media theft, but not against someone with valid IAM permissions, so access control remains critical.
78

A scan shows an S3 bucket with customer documents is publicly readable. What do you do?

Cloud SecurityMedium
Save to ▾
Show answer
Block public access on the bucket immediately and confirm with the owner whether any public access was intended. Check access logs and CloudTrail data events, if enabled, to see who downloaded files and when. If personal data was accessed, start the incident and breach notification process with legal. Then enable account-level block public access, add a preventive guardrail and alert on policy changes.
79

Developers want admin access in the cloud to move fast. How do you balance speed and security?

Cloud SecurityMedium
Save to ▾
Show answer
Give them freedom inside guardrails. Provide sandbox accounts where they have broad rights, but production changes go through IaC pipelines with scanning and review. Use permission boundaries and SCPs to block dangerous actions like disabling logging or making resources public. Offer pre-approved modules for common patterns. This keeps speed high while preventing the riskiest mistakes.
80

GuardDuty reports an EC2 instance communicating with a known crypto-mining pool. How do you respond?

Cloud SecurityMedium
Save to ▾
Show answer
Isolate the instance by changing its security group to a quarantine group with no traffic, and snapshot its volumes for analysis. Check how it was compromised: exposed SSH, vulnerable app or leaked key. Review CloudTrail for actions by its instance role. Terminate and rebuild from a clean image, rotate secrets the instance could access, and fix the root cause, such as closing public ports.
81

How do you find overly permissive security groups with the AWS CLI?

Cloud SecurityMedium
Save to ▾
Show answer
Query security groups that allow ingress from anywhere, then review each. aws ec2 describe-security-groups \ --filters Name=ip-permission.cidr,Values=0.0.0.0/0 \ --query 'SecurityGroups[*].[GroupId,GroupName]' --output table Pay attention to ports 22, 3389, 3306 and 5432. Replace them with VPN, bastion or session manager access.
82

Write a least-privilege AWS IAM policy that allows reading one S3 bucket.

Cloud SecurityMedium
Save to ▾
Show answer
Allow only listing that bucket and reading its objects. { "Version": "2012-10-17", "Statement": [ {"Effect": "Allow", "Action": "s3:ListBucket", "Resource": "arn:aws:s3:::reports-prod"}, {"Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::reports-prod/*"} ] } Attach it to a role, not a user with long-lived keys.
83

Tell me about a time you improved a process with automation.

Cloud SecurityMedium
Save to ▾
Show answer
Situation: our team checked cloud accounts manually every week for public buckets, which took hours. Task: make it faster and continuous. Action: I wrote a small script using the cloud CLI, scheduled it, and sent findings to a team channel with owner tags, then moved it into the CSPM tool. Result: checks ran hourly and average exposure time dropped from days to under an hour.
84

What is the NIST Cybersecurity Framework 2.0?

GRC and ComplianceMedium
Save to ▾
Show answer
NIST CSF 2.0, released in 2024, organises cyber security outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover. Govern was added to cover strategy, roles, policy and supply chain risk. Each function has categories and subcategories. Organisations create current and target profiles to find gaps and plan improvements. It is voluntary and widely used to report maturity to boards.
85

What are the key points of India's DPDP Act?

GRC and ComplianceMedium
Save to ▾
Show answer
The Digital Personal Data Protection Act 2023 governs digital personal data. Data fiduciaries need valid consent or a legitimate use, must give clear notice, protect data with reasonable safeguards, notify breaches to the Data Protection Board and affected people, and delete data when no longer needed. Data principals have rights to access, correction and erasure. Penalties go up to 250 crore rupees. The DPDP Rules 2025 phase in obligations.
86

What is the difference between qualitative and quantitative risk assessment?

GRC and ComplianceMedium
Save to ▾
Show answer
Qualitative assessment rates likelihood and impact on scales like low, medium and high, and is quick and easy to communicate. Quantitative assessment uses numbers, such as single loss expectancy times annual rate of occurrence to get annual loss expectancy, or FAIR models. Quantitative helps justify budgets but needs data that is often uncertain. Many teams start qualitative and quantify the top risks.
87

What is PCI DSS?

GRC and ComplianceMedium
Save to ▾
Show answer
The Payment Card Industry Data Security Standard applies to any organisation that stores, processes or transmits cardholder data. Version 4.0.1 is current, and its future-dated requirements became mandatory from March 2025. It has 12 requirement areas, including network security controls, protecting stored data, encryption in transit, vulnerability management, access control, logging and testing. Reducing scope through tokenisation and segmentation lowers compliance effort.
88

What is third-party or vendor risk management?

GRC and ComplianceMedium
Save to ▾
Show answer
TPRM assesses and monitors the security of vendors that access your data or systems, since many breaches start with a supplier. It includes tiering vendors by risk, security questionnaires, reviewing SOC 2 or ISO 27001 reports, contract clauses for breach notification and audit rights, and continuous monitoring. High-risk vendors such as payroll or cloud providers get deeper reviews and annual reassessment.
89

A US customer asks your Indian SaaS company for a SOC 2 report. What is it and which type should you aim for?

GRC and ComplianceMedium
Save to ▾
Show answer
SOC 2 is an attestation report by an independent auditor on a service organisation's controls against the AICPA Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy. A Type I report checks control design at a point in time; a Type II checks operating effectiveness over a period, typically 6 to 12 months. Indian SaaS companies selling to US customers commonly need SOC 2 Type II.
90

A business unit wants to accept a high risk instead of fixing it. How do you handle it?

GRC and ComplianceMedium
Save to ▾
Show answer
Risk acceptance is a business decision, but it must be informed. I would document the risk, likely impact, cost of fixing and compensating controls, and confirm it exceeds or meets risk appetite. If it is high, escalate to the right authority, such as the CISO or risk committee, for formal sign-off with an expiry date. I record it in the risk register and review it on schedule.
91

An auditor finds that access reviews were not done for two quarters. What do you do?

GRC and ComplianceMedium
Save to ▾
Show answer
Acknowledge the finding and agree a remediation plan. Immediately run the overdue reviews for in-scope systems, prioritising privileged access, and revoke unneeded access. Find the cause, such as no owner or a manual process, and fix it by assigning owners, automating campaigns in the IGA tool and adding reminders and escalations. Provide evidence of completed reviews to close the finding.
92

A new vendor will process customer personal data. What checks do you perform before onboarding?

GRC and ComplianceMedium
Save to ▾
Show answer
Classify the vendor as high risk. Review their security questionnaire, ISO 27001 certificate or SOC 2 Type II report, data location, subprocessors, encryption, access controls and incident response capability. Under the DPDP Act, we remain responsible as data fiduciary, so the contract needs data processing terms, breach notification timelines, deletion on exit and audit rights. Track any gaps with deadlines.
93

How do you calculate annual loss expectancy?

GRC and ComplianceMedium
Save to ▾
Show answer
Single Loss Expectancy is asset value times exposure factor, and Annual Loss Expectancy is SLE times Annual Rate of Occurrence. SLE = Asset Value x Exposure Factor ALE = SLE x ARO Example: a server worth 20 lakh rupees, 50 percent loss per incident, expected once in four years: SLE = 20,00,000 x 0.5 = 10,00,000 ALE = 10,00,000 x 0.25 = 2,50,000 per year
94

How do you collect audit evidence efficiently?

GRC and ComplianceMedium
Save to ▾
Show answer
Map each control to the evidence an auditor will request, such as screenshots of configurations, system exports, tickets, logs and signed approvals. Keep a central evidence library organised by control ID with dates. Automate collection where possible through GRC tools that pull data from cloud, identity and ticketing systems. Sample in advance to confirm evidence covers the full audit period.
95

Tell me about a time you had to convince a team to follow a compliance requirement they disliked.

GRC and ComplianceMedium
Save to ▾
Show answer
Situation: developers resisted mandatory code review evidence for SOC 2, seeing it as paperwork. Task: get compliance without slowing releases. Action: I explained the audit risk to customer deals and showed that branch protection rules could create evidence automatically. Result: we enabled required reviews in the repository settings, evidence became automatic and the audit passed with no finding.

Frequently asked questions

Who should practise medium Cyber Security questions?

Anyone with some hands-on practice: most real interview time is spent on medium questions like these.

How should I practise these?

Answer each question aloud before opening the answer, mark it as solved only when your answer matches the key idea, and save misses to Last-Minute Revision.

Other difficulty levels

Easy questionsHard questions

More ways to practise

Company-wise Cyber Security questionsExperience-wise Cyber Security questionsRole-wise Cyber Security questionsCity-wise Cyber Security questionsMost asked Cyber Security questionsScenario-based questionsPractical / hands-on questionsHR & behavioural questionsCyber Security mock interviewOnline assessment questionsTechnical round questionsManagerial round questionsCyber Security topic sheets