Skip to content
Cyber Security
All coursesPlacement Report
‹ Back to previous sectionCourse homeAll page URLs

Cyber Security Managerial Round Questions & Answers

35 questions for the managerial round stage — 26 medium, 9 hard.

About the managerial round round

The managerial round is usually with a hiring manager or team lead. It mixes real-work scenarios, prioritisation and stakeholder questions with behavioural questions about ownership, conflict and learning.

Tips for the managerial round round

  • Use the STAR format for every story: Situation, Task, Action, Result.
  • Show trade-offs: what you chose, what you gave up and why.
  • Be honest about mistakes and focus on what you changed afterwards.
  • Ask the manager about team goals and how success is measured in the role.
Solved — managerial roundStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
3 questions free Unlock the rest in seconds
01

A business unit wants to accept a high risk instead of fixing it. How do you handle it?

GRC and ComplianceMedium
Save to ▾
Show answer
Risk acceptance is a business decision, but it must be informed. I would document the risk, likely impact, cost of fixing and compensating controls, and confirm it exceeds or meets risk appetite. If it is high, escalate to the right authority, such as the CISO or risk committee, for formal sign-off with an expiry date. I record it in the risk register and review it on schedule.
02

Attackers bypassed MFA by sending repeated push notifications until a user approved. How do you prevent this?

Identity and Access ManagementMedium
Save to ▾
Show answer
This is MFA fatigue. Enable number matching and show app and location context in push requests, limit the number of prompts, and alert on repeated denials. Move high-risk users and admins to phishing-resistant methods such as FIDO2 keys or passkeys. Train users to report unexpected prompts. Also revoke the attacker's sessions and review what they accessed.
03

How do you run a tabletop exercise?

Incident Response and ForensicsMedium
Save to ▾
Show answer
Pick a realistic scenario, such as ransomware on a weekend, and invite IT, security, legal, communications and business leaders. A facilitator releases injects step by step, like a ransom note appearing or a journalist calling, and participants explain decisions using the real plan. Record gaps in contacts, authority, backups and reporting timelines. Share findings and track fixes, and repeat at least twice a year.
04

A pentest shows an SSRF flaw in your app can reach the cloud metadata endpoint. Why is that serious and how do you fix it?

Cloud SecurityHard
Save to ▾
Show answer
Cloud VMs can query a local metadata endpoint at 169.254.169.254 to get instance details and temporary role credentials. If an application has a server-side request forgery flaw, an attacker can make it fetch these credentials. AWS IMDSv2 requires a session token obtained with a PUT request and limits hops, which blocks most SSRF abuse. Enforce IMDSv2 and give instance roles minimal permissions.
05

Tell me about a time you improved a process with automation.

Cloud SecurityMedium
Save to ▾
Show answer
Situation: our team checked cloud accounts manually every week for public buckets, which took hours. Task: make it faster and continuous. Action: I wrote a small script using the cloud CLI, scheduled it, and sent findings to a team channel with owner tags, then moved it into the CSPM tool. Result: checks ran hourly and average exposure time dropped from days to under an hour.
06

What SOC metrics matter most?

SOC Operations and SIEMMedium
Save to ▾
Show answer
Important metrics are mean time to detect, mean time to respond, alert volume per analyst, false positive rate per rule, percentage of alerts closed within SLA, detection coverage against priority ATT&CK techniques and log source health. Metrics should drive improvement, not punish analysts. For example, a rule with 95 percent false positives should be tuned, and long response times may point to missing automation.
07

How do you handle a network team that refuses a security change you recommended?

Network SecurityMedium
Save to ▾
Show answer
Situation: the network team rejected my request to block outbound SMB at the firewall, fearing outages. Task: reduce the risk without damaging the relationship. Action: I shared flow data showing only two servers needed it, proposed an allowlist for them and a one-week monitor-only phase. Result: the team agreed, the rule went live with zero incidents, and we now review rules together monthly.
08

A finance employee transferred money after a fake email from the CEO. What do you do?

Incident Response and ForensicsMedium
Save to ▾
Show answer
Contact the bank immediately to try to stop or recall the transfer; speed matters most. Report to the cybercrime portal and police. Investigate the email: was the CEO mailbox compromised or spoofed? Check sign-in logs, forwarding rules and other targeted staff. Reset credentials, enforce MFA and DMARC, and add a call-back rule for payment changes. Include legal and management throughout.
09

Your manager asks why the company needs security when it already has antivirus on every laptop. How do you explain?

Security FundamentalsMedium
Save to ▾
Show answer
I would explain that antivirus mainly blocks known malicious files, while most modern attacks use stolen credentials, phishing links, living-off-the-land tools like PowerShell, or cloud misconfigurations that antivirus never sees. I would map our top risks to missing controls, such as MFA, EDR, logging and backups, and use a recent real incident pattern to show business impact in downtime and regulatory reporting cost.
10

An alert shows Microsoft Word spawning PowerShell with an encoded command. What does it mean and what do you do?

SOC Operations and SIEMMedium
Save to ▾
Show answer
Office apps rarely start PowerShell, so this usually means a malicious macro or document exploit. Decode the Base64 command to see what it does, check the process tree and any network connections for downloads, and find the source email. Isolate the host through EDR, block the sender and URLs, search for the same email in other mailboxes and hunt for the same command line elsewhere.
11

Describe a time you worked under pressure during an incident.

Incident Response and ForensicsMedium
Save to ▾
Show answer
Situation: during a phishing campaign, 40 users received a credential-harvesting email on a Friday evening. Task: contain it before attackers used stolen accounts. Action: I purged the email across mailboxes, identified six users who clicked, reset their passwords, revoked sessions and blocked the domain, while updating my lead every 30 minutes. Result: no account misuse was found and the playbook was updated.
12

A TLS certificate expired on the main customer portal and caused an outage. How do you prevent this in future?

Cryptography and PKIMedium
Save to ▾
Show answer
First renew and deploy the certificate to restore service. For prevention, build a certificate inventory from scanning and CT logs, automate issuance and renewal with ACME where possible, and set alerts at 30, 14 and 7 days before expiry to a team mailbox, not an individual. Assign an owner per certificate and add expiry checks to monitoring dashboards, since shorter lifetimes are coming.
13

What is memory forensics and which tool is commonly used?

Incident Response and ForensicsMedium
Save to ▾
Show answer
Memory forensics analyses a RAM capture to find running processes, injected code, network connections, loaded DLLs, command history and encryption keys. It reveals fileless malware that leaves little on disk. Volatility 3 is the common open source framework, with plugins such as windows.pslist, windows.netscan and windows.malfind. Captures are taken with tools like WinPmem or through EDR live response.
14

Tell me about a time you worked with developers to fix a security finding.

Cloud SecurityMedium
Save to ▾
Show answer
Situation: a scan found a critical vulnerability in a library used by five microservices just before a release. Task: fix it without delaying the launch. Action: I paired with the lead developer, confirmed which services were truly exploitable, prepared tested upgrade pull requests and added a WAF rule as a temporary safeguard. Result: all services were patched in two days and release stayed on schedule.
15

A vendor announces a zero-day in your internet-facing appliance with no patch yet. What does that mean and how do you protect the company?

Security FundamentalsHard
Save to ▾
Show answer
A zero-day is a flaw that the vendor does not know about or has not yet patched, so defenders have had zero days to fix it. Exploits for zero-days are valuable and often used in targeted attacks. Since patches are unavailable, defence relies on layered controls: EDR behaviour detection, network segmentation, least privilege, virtual patching with WAF or IPS rules, and fast patching once a fix is released.
16

A key log source stopped sending data to the SIEM two days ago. Why does it matter and what do you do?

SOC Operations and SIEMMedium
Save to ▾
Show answer
Silent log gaps create blind spots where attacks go undetected, and they can also break compliance. Raise it as a priority issue, check the forwarder or agent health, network path, licence limits and parsing errors, and restore ingestion. Check whether the gap overlapped any suspicious activity. Then add log source health monitoring that alerts when expected volume drops, so gaps are found in hours, not days.
17

The board asks how secure the company is. How would you answer?

GRC and ComplianceHard
Save to ▾
Show answer
I would avoid a single score and present risk in business terms: the top five cyber risks, such as ransomware and third-party breach, with likelihood, impact and trend. Show maturity against NIST CSF 2.0 with current and target levels, key metrics like MFA coverage, patch timeliness and incident response times, and the investments needed to close gaps. Keep it to a few slides.
18

Your servers can reach any internet destination freely. Why is this a problem and how do you introduce egress filtering?

Network SecurityHard
Save to ▾
Show answer
Egress filtering controls outbound traffic, allowing only needed destinations and ports. It blocks malware call-backs, data exfiltration and servers reaching the internet directly. Many networks allow all outbound traffic because it is easier and legacy apps have undocumented dependencies. A practical approach is forcing web traffic through a proxy, blocking direct outbound from servers, and allowing exceptions only with business justification.
19

A scan shows an S3 bucket with customer documents is publicly readable. What do you do?

Cloud SecurityMedium
Save to ▾
Show answer
Block public access on the bucket immediately and confirm with the owner whether any public access was intended. Check access logs and CloudTrail data events, if enabled, to see who downloaded files and when. If personal data was accessed, start the incident and breach notification process with legal. Then enable account-level block public access, add a preventive guardrail and alert on policy changes.
20

Your IDS alerts on outbound traffic from a database server to an unknown IP on port 443 at 3 AM. How do you investigate?

Network SecurityMedium
Save to ▾
Show answer
Database servers rarely need internet access, so this is suspicious. I would check the destination's reputation and WHOIS, look at flow data for volume and duration, and identify the process making the connection using EDR. Then I review recent logins, scheduled tasks and new binaries on the server. If data volume is large or the process is unknown, I contain the host and escalate as a possible exfiltration.
21

You find a web shell on a public web server. What steps do you take?

Incident Response and ForensicsHard
Save to ▾
Show answer
Do not just delete it. Capture the file, web logs and a memory image if possible, then identify when it was created and which request uploaded it. Search logs for commands executed through it and lateral movement from the server. Contain by isolating the server or blocking the path at the WAF, then patch the vulnerable application, rebuild from a clean image and rotate any credentials stored on it.
22

What is PCI DSS?

GRC and ComplianceMedium
Save to ▾
Show answer
The Payment Card Industry Data Security Standard applies to any organisation that stores, processes or transmits cardholder data. Version 4.0.1 is current, and its future-dated requirements became mandatory from March 2025. It has 12 requirement areas, including network security controls, protecting stored data, encryption in transit, vulnerability management, access control, logging and testing. Reducing scope through tokenisation and segmentation lowers compliance effort.
23

A user on the office LAN reports repeated certificate warnings and you suspect ARP spoofing. What is happening and how do you stop it?

Network SecurityMedium
Save to ▾
Show answer
ARP has no authentication, so an attacker on the same LAN can send fake ARP replies linking their MAC address to the gateway's IP. Victims then send traffic through the attacker, enabling man-in-the-middle interception. Defences include Dynamic ARP Inspection with DHCP snooping on switches, port security, network access control, and encrypting traffic end to end with TLS so intercepted data is useless.
24

During a major breach, an engineer asks why legal and communications must join the war room. How do you explain?

Incident Response and ForensicsHard
Save to ▾
Show answer
Legal advises on regulatory notification, such as CERT-In within six hours and the Data Protection Board and affected people under the DPDP Act, contractual duties to clients, evidence handling and privilege. Communications manage messaging to customers, staff, media and investors so statements are accurate and consistent. Technical teams should involve them early, because poor communication can cause more damage than the incident itself.
25

Developers share one admin account for a production database. What do you propose?

Identity and Access ManagementMedium
Save to ▾
Show answer
Shared accounts break accountability and are hard to rotate. Give each person an individual named account with least privilege, and provide admin access through PAM with just-in-time approval and session recording. Store the remaining break-glass credential in the vault with alerts on use. Use read-only roles for daily troubleshooting. Roll out with the team so it does not slow urgent fixes.
26

What are the key points of India's DPDP Act?

GRC and ComplianceMedium
Save to ▾
Show answer
The Digital Personal Data Protection Act 2023 governs digital personal data. Data fiduciaries need valid consent or a legitimate use, must give clear notice, protect data with reasonable safeguards, notify breaches to the Data Protection Board and affected people, and delete data when no longer needed. Data principals have rights to access, correction and erasure. Penalties go up to 250 crore rupees. The DPDP Rules 2025 phase in obligations.
27

An audit finds hundreds of service accounts with no owner and keys older than three years. What are the risks and which controls do you put in place?

Identity and Access ManagementHard
Save to ▾
Show answer
Service accounts and API keys often have broad privileges, never expire, are shared among teams and are excluded from MFA. Machine identities now outnumber human ones in cloud environments. Risks include hardcoded secrets and silent abuse. Controls are an inventory with owners, least privilege, managed identities or workload identity federation instead of static keys, secret rotation, and monitoring for interactive logins.
28

How do you create a forensic disk image and verify it?

Incident Response and ForensicsMedium
Save to ▾
Show answer
Use a write blocker or a forensic tool, image the whole disk, and hash both source and image. sudo dc3dd if=/dev/sdb of=/evidence/case12.img hash=sha256 log=/evidence/case12.log sha256sum /evidence/case12.img Record the hashes, time, examiner and device details in the chain of custody form. Analyse a working copy, never the original.
29

A US customer asks your Indian SaaS company for a SOC 2 report. What is it and which type should you aim for?

GRC and ComplianceMedium
Save to ▾
Show answer
SOC 2 is an attestation report by an independent auditor on a service organisation's controls against the AICPA Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy. A Type I report checks control design at a point in time; a Type II checks operating effectiveness over a period, typically 6 to 12 months. Indian SaaS companies selling to US customers commonly need SOC 2 Type II.
30

What is CSPM, CWPP and CNAPP?

Cloud SecurityHard
Save to ▾
Show answer
CSPM, Cloud Security Posture Management, checks cloud configurations against benchmarks like CIS and flags risks. CWPP, Cloud Workload Protection Platform, protects running workloads such as VMs, containers and serverless with vulnerability scanning and runtime detection. CNAPP combines these with identity analysis, IaC scanning and attack path analysis in one platform. The goal is to prioritise risks that combine, like a public VM with a critical flaw and admin role.
31

What is a man-in-the-middle attack on TLS and how do certificates prevent it?

Cryptography and PKIMedium
Save to ▾
Show answer
In a MITM attack, an attacker intercepts traffic and pretends to be the server. Certificates prevent this because the client checks that the server certificate chains to a trusted root, matches the hostname and is valid. An attacker cannot produce a valid certificate without the private key or a compromised CA. Certificate warnings that users click through, and apps that skip validation, break this protection.
32

A user reports a pop-up saying their files are encrypted. What are your first steps?

Security FundamentalsMedium
Save to ▾
Show answer
First, isolate the device from the network, ideally through EDR network containment, without powering it off so memory evidence is kept. Inform the incident lead and start a timeline. Check for the same indicators on other hosts, disable the user's sessions and reset credentials if needed, and identify the ransomware family from the note. Then confirm backups are intact and offline before any recovery begins.
33

A firewall audit finds 40 percent of rules have not been hit in a year. What do you do?

Network SecurityMedium
Save to ▾
Show answer
Unused rules expand attack surface and slow audits. I would export rule hit counts, confirm no seasonal apps like year-end batch jobs depend on them, and contact rule owners listed in tickets. Rules with no owner are disabled first, not deleted, and monitored for a month. After that they are removed. I would also add rule expiry dates and quarterly reviews to the change process.
34

An employee who is leaving copied large volumes of data to a personal cloud drive. How do you handle it?

Incident Response and ForensicsMedium
Save to ▾
Show answer
Treat it as a potential insider incident and involve HR and legal before contacting the employee. Preserve evidence such as DLP alerts, proxy logs, endpoint file activity and cloud app logs, and document what data was involved and its sensitivity. Restrict the user's access as advised. Legal decides on next steps, such as requesting deletion with an undertaking. Then improve DLP and offboarding controls.
35

How do you prioritise 500 vulnerabilities found in a scan?

Security FundamentalsHard
Save to ▾
Show answer
CVSS alone is not enough. I combine severity with exploitability and exposure: check the CISA Known Exploited Vulnerabilities list and EPSS score, whether the asset is internet facing, and how critical the business data on it is. Internet-facing systems with known exploited flaws are fixed first, often within days. Internal low-severity findings go into normal patch cycles. Group fixes by patch to reduce effort.

Frequently asked questions

What happens in the Cyber Security managerial round round?

The managerial round is usually with a hiring manager or team lead. It mixes real-work scenarios, prioritisation and stakeholder questions with behavioural questions about ownership, conflict and learning.

How do I clear the managerial round round?

Use the STAR format for every story: Situation, Task, Action, Result. Show trade-offs: what you chose, what you gave up and why. Be honest about mistakes and focus on what you changed afterwards.

Which round comes next?

A typical order is online assessment, telephonic screening, one or two technical rounds, a managerial round and HR. Use the other round pages to practise each stage.

Practise every interview round

Online Assessment questionsTelephonic Interview questionsTechnical Round questionsRapid-Fire questionsHR & behavioural questionsFull mock interview

More ways to practise

Company-wise Cyber Security questionsExperience-wise Cyber Security questionsRole-wise Cyber Security questionsCity-wise Cyber Security questionsMost asked Cyber Security questionsScenario-based questionsPractical / hands-on questionsHR & behavioural questionsCyber Security mock interviewOnline assessment questionsTechnical round questionsManagerial round questionsCyber Security topic sheets