Curated interview practice questions with answers. These are practice scenarios, not a verified list of past interview questions.
About Tech Mahindra hiring for Cyber Security roles
Tech Mahindra is an Indian IT services and consulting company and part of the Mahindra Group. It is known for its strong telecom and communications practice and also serves banking, manufacturing and healthcare clients. In India it hires for software engineers, test engineers, network engineers, data analysts and data engineers.
For Cyber Security roles, this Tech Mahindra practice set focuses most on GRC and Compliance (6), Security Fundamentals (5), Identity and Access Management (4), SOC Operations and SIEM (4). It has 14 easy, 16 medium questions, so you can start easy and work up to the harder ones.
Company type
IT services
Headquarters
Pune, India
Main India offices
Pune, Hyderabad, Bengaluru, Noida, Chennai
Tech Mahindra Cyber Security interview process
Online assessment (aptitude + English essay)
Coding test
Technical interview
HR round
Typical pattern based on public candidate experiences. Rounds vary by role, team and year.
Solved for Tech MahindraStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
Create a table where each risk has an ID, description written as cause, event and impact, asset, owner, inherent likelihood and impact, existing controls, residual rating, treatment decision, action plan, due date and review date. Gather risks through workshops, audits, incidents and threat intelligence. Review the register monthly with owners and report top risks to leadership quarterly.
PAM protects powerful accounts like domain admins, root, database admins and cloud owners. It includes a vault for credentials with automatic rotation, just-in-time elevation, session brokering with recording, approval workflows and alerts on unusual use. Tools include CyberArk, BeyondTrust and Delinea. PAM is important because attackers aim for privileged credentials to move laterally and deploy ransomware across the network.
TPRM assesses and monitors the security of vendors that access your data or systems, since many breaches start with a supplier. It includes tiering vendors by risk, security questionnaires, reviewing SOC 2 or ISO 27001 reports, contract clauses for breach notification and audit rights, and continuous monitoring. High-risk vendors such as payroll or cloud providers get deeper reviews and annual reassessment.
04
What is multi-factor authentication and which factors are strongest?
MFA requires two or more factor types: something you know like a password, something you have like a phone or security key, and something you are like a fingerprint. SMS OTPs are vulnerable to SIM swap and phishing, and push approvals to MFA fatigue. Phishing-resistant methods such as FIDO2 security keys, passkeys and certificate-based authentication are strongest because they are bound to the real site.
05
How would you verify the integrity of a downloaded installer on Windows and Linux?
Compare the file's hash with the value published by the vendor over a trusted channel, or verify its digital signature. On Windows, use PowerShell and check the Authenticode signature. On Linux, use sha256sum and gpg for signed checksum files.
Get-FileHash .\setup.exe -Algorithm SHA256
Get-AuthenticodeSignature .\setup.exe
sha256sum tool.tar.gz
gpg --verify SHA256SUMS.asc SHA256SUMS
Chain of custody is the documented record of who collected evidence, when, how, where it was stored and every person who handled it. It proves evidence was not altered, which is essential if the case goes to court or regulators. Practices include hashing disk images at acquisition, using write blockers, storing evidence securely and logging every transfer with signatures and timestamps.
TLS secures data in transit. In the TLS 1.3 handshake the client and server agree on cipher suites, perform an ephemeral key exchange such as X25519 for forward secrecy, and the server proves its identity with a certificate signed by a trusted CA. Both derive session keys, then traffic is encrypted with an AEAD cipher like AES-GCM. TLS 1.0 and 1.1 are deprecated and should be disabled.
08
What is the difference between a threat, a vulnerability and a risk?
A vulnerability is a weakness, such as an unpatched server. A threat is anything that can exploit it, such as a ransomware group. Risk is the likelihood that the threat exploits the vulnerability multiplied by the business impact. For example, an unpatched internet-facing VPN is high risk, while the same flaw on an isolated lab machine is low risk because likelihood and impact are smaller.
09
What is the difference between a policy, a standard, a procedure and a guideline?
A policy is a high-level management statement of intent, such as all data must be classified. A standard sets mandatory specific requirements, like AES-256 for confidential data. A procedure gives step-by-step instructions to meet the standard. A guideline is recommended but optional advice. This hierarchy lets policies stay stable while standards and procedures change with technology.
A firewall enforces rules on traffic between networks. Packet-filtering firewalls check IP, port and protocol. Stateful firewalls track connections and allow return traffic automatically. Next-generation firewalls add application awareness, user identity, TLS inspection, IPS and URL filtering. Web application firewalls protect HTTP applications from attacks such as SQL injection. Host firewalls like Windows Defender Firewall or nftables protect individual machines.
11
How would you use Sysmon to improve endpoint visibility on Windows?
Sysmon is a free Microsoft Sysinternals tool that logs detailed endpoint events to the Windows event log. Useful events are ID 1 process creation with hashes and command line, ID 3 network connection, ID 11 file creation, ID 13 registry changes and ID 22 DNS queries. With a tuned configuration, it gives rich telemetry for SIEM detections when a full EDR is not available or as an extra source.
The Digital Personal Data Protection Act 2023 governs digital personal data. Data fiduciaries need valid consent or a legitimate use, must give clear notice, protect data with reasonable safeguards, notify breaches to the Data Protection Board and affected people, and delete data when no longer needed. Data principals have rights to access, correction and erasure. Penalties go up to 250 crore rupees. The DPDP Rules 2025 phase in obligations.
Defence in depth means using several independent layers of controls so that one failure does not lead to a breach. A typical stack has perimeter firewalls, email filtering, endpoint EDR, MFA, network segmentation, least privilege, logging and backups. If a phishing email gets past the filter, MFA and EDR can still stop the attacker. The trade-off is cost and complexity, so layers should target the most likely attack paths.
14
What is the shared responsibility model in cloud security?
The cloud provider secures the infrastructure: data centres, hardware, hypervisors and managed service internals. The customer secures what they put in the cloud: identities, data, configurations, network rules and their applications. The split changes by service type; with IaaS you patch the OS, with SaaS you mainly manage users and data settings. Most cloud breaches come from customer-side misconfiguration, not provider failures.
NAC checks devices and users before allowing them on the network, typically using 802.1X with a RADIUS server. It can verify certificates, patch level, EDR presence and user identity, then assign a VLAN or policy. Unknown or non-compliant devices go to a quarantine or guest network. NAC is important in offices with many personal devices and IoT equipment such as printers and cameras.
16
What is a false positive and a false negative in SOC alerts?
A false positive is an alert on benign activity, such as an admin running a legitimate script flagged as malicious. A false negative is a real attack that produced no alert, which is more dangerous. Too many false positives cause alert fatigue and missed real incidents. Analysts tune rules with allowlists, thresholds and context, and test detections against simulated attacks to find false negatives.
Use a dedicated password hashing library with Argon2id, which handles salts and parameters automatically.
from argon2 import PasswordHasher
ph = PasswordHasher()
stored = ph.hash(password)
try:
ph.verify(stored, attempt)
if ph.check_needs_rehash(stored):
stored = ph.hash(attempt)
except Exception:
deny_login()
Never use plain SHA-256 or MD5 for passwords.
Start from business needs and regulations, keep it short and clear, and state scope, purpose, roles, requirements and exceptions. Avoid technical detail that changes often; put that in standards. Get input from IT, HR and legal, then management approval. Publish it where staff can find it, train people, require acknowledgement and review it at least yearly or after major changes.
19
How would you design a joiner, mover, leaver process for a growing company?
JML is the identity lifecycle. Joiners get accounts and baseline access from HR data on day one. Movers change roles, and their old access must be removed, not just new access added, to avoid privilege creep. Leavers must be disabled promptly, ideally automatically when HR records their exit. Automating JML from the HR system to the identity platform reduces orphan accounts, which auditors frequently flag.
20
A TLS certificate expired on the main customer portal and caused an outage. How do you prevent this in future?
First renew and deploy the certificate to restore service. For prevention, build a certificate inventory from scanning and CT logs, automate issuance and renewal with ACME where possible, and set alerts at 30, 14 and 7 days before expiry to a team mailbox, not an individual. Assign an owner per certificate and add expiry checks to monitoring dashboards, since shorter lifetimes are coming.
21
What is the order of volatility in evidence collection?
Collect the most volatile evidence first because it disappears quickly. The order is CPU registers and cache, memory including running processes and network connections, temporary files, disk, remote logs, and finally archived media. That is why responders capture RAM before shutting down a machine, since malware running only in memory, decrypted keys and active connections are lost at power off.
22
A user reports a pop-up saying their files are encrypted. What are your first steps?
First, isolate the device from the network, ideally through EDR network containment, without powering it off so memory evidence is kept. Inform the incident lead and start a timeline. Check for the same indicators on other hosts, disable the user's sessions and reset credentials if needed, and identify the ransomware family from the note. Then confirm backups are intact and offline before any recovery begins.
23
A developer has hardcoded database passwords in a public code repository. What do you do?
Treat the secret as compromised immediately, even if the commit is removed, because public repos are scraped within minutes. Rotate the password and any related keys, check database logs for unknown logins since the commit time, and remove the secret from git history. Then fix the root cause by moving secrets to a vault or cloud secret manager and adding secret scanning to pre-commit hooks and the CI pipeline.
24
GuardDuty reports an EC2 instance communicating with a known crypto-mining pool. How do you respond?
Isolate the instance by changing its security group to a quarantine group with no traffic, and snapshot its volumes for analysis. Check how it was compromised: exposed SSH, vulnerable app or leaked key. Review CloudTrail for actions by its instance role. Terminate and rebuild from a clean image, rotate secrets the instance could access, and fix the root cause, such as closing public ports.
25
How do you design an access review for a critical application?
Define scope, such as all users with write or admin rights. Pull entitlements and last-login data from the app, and route each item to the user's manager and the app owner. Give clear choices of keep or revoke with a deadline, and revoke automatically if not reviewed. Capture evidence for auditors, and review exceptions with security. Run it quarterly for privileged access.
A blameless review covers the timeline, root cause, how the attacker got in, what detected it, what slowed response, business impact and decisions made. It ends with specific actions that have owners and dates, such as enabling MFA on all VPN users or adding a detection rule. Tracking these actions to completion matters more than the report itself, otherwise the same incident repeats.
The Payment Card Industry Data Security Standard applies to any organisation that stores, processes or transmits cardholder data. Version 4.0.1 is current, and its future-dated requirements became mandatory from March 2025. It has 12 requirement areas, including network security controls, protecting stored data, encryption in transit, vulnerability management, access control, logging and testing. Reducing scope through tokenisation and segmentation lowers compliance effort.
Public Key Infrastructure is the system of certificate authorities, certificates, policies and revocation services that binds public keys to identities. A CA signs a certificate saying this public key belongs to this domain or user. Browsers and operating systems trust a set of root CAs, which sign intermediate CAs, which sign end-entity certificates. Enterprises run internal PKI for device certificates, VPN, Wi-Fi 802.1X and code signing.
A SIEM collects and correlates logs to detect threats. SOAR, Security Orchestration, Automation and Response, takes alerts and runs playbooks that enrich, decide and act, for example looking up an IP's reputation, querying EDR, disabling a user and opening a ticket. SIEM answers what is happening; SOAR speeds up the response. Many platforms now combine both, but automation still needs human approval for disruptive actions.
30
How do you write a Splunk search to find brute-force attempts on Windows?
Search failed logon events, count per account and source, and filter high counts.
index=wineventlog EventCode=4625
| stats count AS failures dc(TargetUserName) AS users BY IpAddress
| where failures > 50
| sort - failures
A high distinct user count from one IP points to password spraying rather than a single account brute force.
Tips to crack the Tech Mahindra Cyber Security interview
Read about telecom basics like 4G, 5G and network operations, since communications is Tech Mahindra's largest vertical.
Practise English essay and verbal ability sections, which often appear in Tech Mahindra online assessments.
Revise SQL and one programming language, and prepare a clear two-minute explanation of your project.
Keep a one-minute story ready for every project on your CV: problem, your part, tools, result.
Practise the hard questions on this page aloud; Tech Mahindra interviewers usually ask follow-ups on your first answer.
Frequently asked questions
How many rounds are there in the Tech Mahindra Cyber Security interview?
Candidates usually go through 4 stages: Online assessment (aptitude + English essay); Coding test; Technical interview; HR round. The exact rounds change with the role, team, location and your experience, so confirm the process with the recruiter.
Which topics should I prepare for the Tech Mahindra Cyber Security interview?
This practice set leans on GRC and Compliance (6), Security Fundamentals (5), Identity and Access Management (4), SOC Operations and SIEM (4). Revise those first, then practise explaining one or two of your own projects end to end, because most Tech Mahindra interviewers ask you to walk through real work.
Are these the exact questions asked at Tech Mahindra?
No. These are curated practice questions that match the skills and difficulty usually tested in it services interviews like Tech Mahindra's. They are not a leaked or verified list of past questions.
Where does Tech Mahindra hire Cyber Security professionals in India?
Tech Mahindra has large teams in Pune, Hyderabad, Bengaluru, Noida, Chennai. Openings and locations change often, so check the Tech Mahindra careers page and filter by city and experience.