‹ Back to previous section Course home All page URLs

Top 50 Most Asked Cyber Security Interview Questions

The questions that appear most often across company-wise sets — master these first.

Why start here

We count how often each question appears across the 20 company-wise Cyber Security practice sets on this site and show the 50 most common. They are the safest questions to master first.

Solved — top 50Start practicing

3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.

3 questions free Unlock the rest in seconds

What is Network Access Control?

Network SecurityIn 9 company setsMedium

Show answer

NAC checks devices and users before allowing them on the network, typically using 802.1X with a RADIUS server. It can verify certificates, patch level, EDR presence and user identity, then assign a VLAN or policy. Unknown or non-compliant devices go to a quarantine or guest network. NAC is important in offices with many personal devices and IoT equipment such as printers and cameras.

A key log source stopped sending data to the SIEM two days ago. Why does it matter and what do you do?

SOC Operations and SIEMIn 9 company setsMedium

Show answer

Silent log gaps create blind spots where attacks go undetected, and they can also break compliance. Raise it as a priority issue, check the forwarder or agent health, network path, licence limits and parsing errors, and restore ingestion. Check whether the gap overlapped any suspicious activity. Then add log source health monitoring that alerts when expected volume drops, so gaps are found in hours, not days.

How do you collect audit evidence efficiently?

GRC and ComplianceIn 9 company setsMedium

Show answer

Map each control to the evidence an auditor will request, such as screenshots of configurations, system exports, tickets, logs and signed approvals. Keep a central evidence library organised by control ID with dates. Automate collection where possible through GRC tools that pull data from cloud, identity and ticketing systems. Sample in advance to confirm evidence covers the full audit period.

How do you decode and check a JWT during troubleshooting?

Identity and Access ManagementIn 8 company setsMedium

Show answer

A JWT has header, payload and signature separated by dots. Decode the first two parts to read claims, but never trust them without verifying the signature. echo $TOKEN | cut -d. -f2 | base64 -d 2>/dev/null Check iss, aud, exp and nbf claims. In code, verify with a library using the expected algorithm and issuer keys, and reject alg none.

What is network segmentation and why is it important?

Network SecurityIn 7 company setsMedium

Show answer

Segmentation splits a network into zones such as user, server, OT, guest and management, with controlled traffic between them using VLANs, firewalls and ACLs. It limits lateral movement, so ransomware on one laptop cannot reach every server. It also reduces compliance scope, for example isolating the cardholder data environment for PCI DSS. Micro-segmentation goes further with per-workload policies in data centres and cloud.

Your IDS alerts on outbound traffic from a database server to an unknown IP on port 443 at 3 AM. How do you investigate?

Network SecurityIn 7 company setsMedium

Show answer

Database servers rarely need internet access, so this is suspicious. I would check the destination's reputation and WHOIS, look at flow data for volume and duration, and identify the process making the connection using EDR. Then I review recent logins, scheduled tasks and new binaries on the server. If data volume is large or the process is unknown, I contain the host and escalate as a possible exfiltration.

What is the difference between a SIEM and a SOAR?

SOC Operations and SIEMIn 7 company setsEasy

Show answer

A SIEM collects and correlates logs to detect threats. SOAR, Security Orchestration, Automation and Response, takes alerts and runs playbooks that enrich, decide and act, for example looking up an IP's reputation, querying EDR, disabling a user and opening a ticket. SIEM answers what is happening; SOAR speeds up the response. Many platforms now combine both, but automation still needs human approval for disruptive actions.

What is the order of volatility in evidence collection?

Incident Response and ForensicsIn 7 company setsMedium

Show answer

Collect the most volatile evidence first because it disappears quickly. The order is CPU registers and cache, memory including running processes and network connections, temporary files, disk, remote logs, and finally archived media. That is why responders capture RAM before shutting down a machine, since malware running only in memory, decrypted keys and active connections are lost at power off.

What are the most common cloud security misconfigurations?

Cloud SecurityIn 7 company setsEasy

Show answer

Frequent issues are publicly accessible storage buckets, overly permissive IAM policies with wildcards, long-lived access keys, security groups open to 0.0.0.0/0 on SSH, RDP or databases, disabled audit logging, unencrypted snapshots shared publicly, and exposed instance metadata. Cloud Security Posture Management tools and native services such as AWS Security Hub, Microsoft Defender for Cloud and Google Security Command Center detect them continuously.

A developer has hardcoded database passwords in a public code repository. What do you do?

Security FundamentalsIn 6 company setsMedium

Show answer

Treat the secret as compromised immediately, even if the commit is removed, because public repos are scraped within minutes. Rotate the password and any related keys, check database logs for unknown logins since the commit time, and remove the secret from git history. Then fix the root cause by moving secrets to a vault or cloud secret manager and adding secret scanning to pre-commit hooks and the CI pipeline.

Your SOC sees heavy DNS traffic with long random subdomains from one workstation. Which DNS attacks should you consider and what defences apply?

Network SecurityIn 6 company setsMedium

Show answer

Key DNS attacks are cache poisoning, which inserts false records; DNS tunnelling, which hides data or command traffic inside queries; domain hijacking through registrar account takeover; and DNS amplification DDoS. Defences include DNSSEC to sign records, protective DNS resolvers that block malicious domains, monitoring for long or high-entropy subdomains, registrar lock with MFA, and rate limiting open resolvers.

How do you write basic Linux host firewall rules with nftables?

Network SecurityIn 6 company setsMedium

Show answer

Default deny inbound, allow established traffic, loopback and only required services. nft add table inet filter nft add chain inet filter input '{ type filter hook input priority 0; policy drop; }' nft add rule inet filter input ct state established,related accept nft add rule inet filter input iif lo accept nft add rule inet filter input tcp dport 22 ip saddr 10.10.1.0/24 accept nft add rule inet filter input tcp dport 443 accept Save the ruleset so it persists after reboot.

What is a false positive and a false negative in SOC alerts?

SOC Operations and SIEMIn 6 company setsEasy

Show answer

A false positive is an alert on benign activity, such as an admin running a legitimate script flagged as malicious. A false negative is a real attack that produced no alert, which is more dangerous. Too many false positives cause alert fatigue and missed real incidents. Analysts tune rules with allowlists, thresholds and context, and test detections against simulated attacks to find false negatives.

What is UEBA?

SOC Operations and SIEMIn 6 company setsMedium

Show answer

User and Entity Behaviour Analytics builds baselines of normal behaviour for users, hosts and service accounts, then flags anomalies such as logging in from a new country, accessing far more files than usual or a service account doing interactive logins. It helps detect insider threats and stolen credentials that look like normal logins. It needs good identity data and careful tuning to avoid noisy alerts.

What is memory forensics and which tool is commonly used?

Incident Response and ForensicsIn 6 company setsMedium

Show answer

Memory forensics analyses a RAM capture to find running processes, injected code, network connections, loaded DLLs, command history and encryption keys. It reveals fileless malware that leaves little on disk. Volatility 3 is the common open source framework, with plugins such as windows.pslist, windows.netscan and windows.malfind. Captures are taken with tools like WinPmem or through EDR live response.

What is Privileged Access Management?

Identity and Access ManagementIn 6 company setsMedium

Show answer

PAM protects powerful accounts like domain admins, root, database admins and cloud owners. It includes a vault for credentials with automatic rotation, just-in-time elevation, session brokering with recording, approval workflows and alerts on unusual use. Tools include CyberArk, BeyondTrust and Delinea. PAM is important because attackers aim for privileged credentials to move laterally and deploy ransomware across the network.

How do you design an access review for a critical application?

Identity and Access ManagementIn 6 company setsMedium

Show answer

Define scope, such as all users with write or admin rights. Pull entitlements and last-login data from the app, and route each item to the user's manager and the app owner. Give clear choices of keep or revoke with a deadline, and revoke automatically if not reviewed. Capture evidence for auditors, and review exceptions with security. Run it quarterly for privileged access.

Developers want admin access in the cloud to move fast. How do you balance speed and security?

Cloud SecurityIn 6 company setsMedium

Show answer

Give them freedom inside guardrails. Provide sandbox accounts where they have broad rights, but production changes go through IaC pipelines with scanning and review. Use permission boundaries and SCPs to block dangerous actions like disabling logging or making resources public. Offer pre-approved modules for common patterns. This keeps speed high while preventing the riskiest mistakes.

GuardDuty reports an EC2 instance communicating with a known crypto-mining pool. How do you respond?

Cloud SecurityIn 6 company setsMedium

Show answer

Isolate the instance by changing its security group to a quarantine group with no traffic, and snapshot its volumes for analysis. Check how it was compromised: exposed SSH, vulnerable app or leaked key. Review CloudTrail for actions by its instance role. Terminate and rebuild from a clean image, rotate secrets the instance could access, and fix the root cause, such as closing public ports.

What is third-party or vendor risk management?

GRC and ComplianceIn 6 company setsMedium

Show answer

TPRM assesses and monitors the security of vendors that access your data or systems, since many breaches start with a supplier. It includes tiering vendors by risk, security questionnaires, reviewing SOC 2 or ISO 27001 reports, contract clauses for breach notification and audit rights, and continuous monitoring. High-risk vendors such as payroll or cloud providers get deeper reviews and annual reassessment.

A US customer asks your Indian SaaS company for a SOC 2 report. What is it and which type should you aim for?

GRC and ComplianceIn 6 company setsMedium

Show answer

SOC 2 is an attestation report by an independent auditor on a service organisation's controls against the AICPA Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy. A Type I report checks control design at a point in time; a Type II checks operating effectiveness over a period, typically 6 to 12 months. Indian SaaS companies selling to US customers commonly need SOC 2 Type II.

How do you build a risk register?

GRC and ComplianceIn 6 company setsEasy

Show answer

Create a table where each risk has an ID, description written as cause, event and impact, asset, owner, inherent likelihood and impact, existing controls, residual rating, treatment decision, action plan, due date and review date. Gather risks through workshops, audits, incidents and threat intelligence. Review the register monthly with owners and report top risks to leadership quarterly.

What is defence in depth?

Security FundamentalsIn 5 company setsEasy

Show answer

Defence in depth means using several independent layers of controls so that one failure does not lead to a breach. A typical stack has perimeter firewalls, email filtering, endpoint EDR, MFA, network segmentation, least privilege, logging and backups. If a phishing email gets past the filter, MFA and EDR can still stop the attacker. The trade-off is cost and complexity, so layers should target the most likely attack paths.

Leadership wants to block all USB drives tomorrow. How would you handle this request?

Security FundamentalsIn 5 company setsMedium

Show answer

I would support the goal but plan the rollout to avoid breaking business work. First, find who genuinely needs USB, such as field engineers, using endpoint logs. Then apply a device control policy through EDR or Intune that blocks mass storage by default, allows approved encrypted devices by serial number, and logs exceptions. Communicate the change, pilot it with one department, then enforce company wide.

How would you verify the integrity of a downloaded installer on Windows and Linux?

Security FundamentalsIn 5 company setsEasy

Show answer

Compare the file's hash with the value published by the vendor over a trusted channel, or verify its digital signature. On Windows, use PowerShell and check the Authenticode signature. On Linux, use sha256sum and gpg for signed checksum files. Get-FileHash .\setup.exe -Algorithm SHA256 Get-AuthenticodeSignature .\setup.exe sha256sum tool.tar.gz gpg --verify SHA256SUMS.asc SHA256SUMS

Tell me about a time you explained a security risk to a non-technical person.

Security FundamentalsIn 5 company setsMedium

Show answer

Situation: my team lead in a support role wanted to share admin passwords on a spreadsheet. Task: change this without slowing the team. Action: I explained the risk as a house key copied for everyone, showed how one leaked laptop exposes all systems, and proposed a password manager with shared vaults. Result: we adopted it within a week and audit findings dropped.

A user on the office LAN reports repeated certificate warnings and you suspect ARP spoofing. What is happening and how do you stop it?

Network SecurityIn 5 company setsMedium

Show answer

ARP has no authentication, so an attacker on the same LAN can send fake ARP replies linking their MAC address to the gateway's IP. Victims then send traffic through the attacker, enabling man-in-the-middle interception. Defences include Dynamic ARP Inspection with DHCP snooping on switches, port security, network access control, and encrypting traffic end to end with TLS so intercepted data is useless.

What is TLS and what does the handshake achieve?

Network SecurityIn 5 company setsMedium

Show answer

TLS secures data in transit. In the TLS 1.3 handshake the client and server agree on cipher suites, perform an ephemeral key exchange such as X25519 for forward secrecy, and the server proves its identity with a certificate signed by a trusted CA. Both derive session keys, then traffic is encrypted with an AEAD cipher like AES-GCM. TLS 1.0 and 1.1 are deprecated and should be disabled.

Users complain that a new firewall rule broke an application. How do you troubleshoot?

Network SecurityIn 5 company setsMedium

Show answer

First check the firewall logs for denied traffic from the affected users or servers around the change time. Compare the change ticket with actual app requirements, since apps often use extra ports or dependencies. Use packet capture or a test connection to confirm. Then add a narrow rule for the real need, not an any-any rule, and update documentation so the next change does not repeat the problem.

How would you capture and analyse suspicious traffic using tcpdump and Wireshark?

Network SecurityIn 5 company setsMedium

Show answer

Capture on the right interface with a filter to limit size, save to a pcap file, then open it in Wireshark. sudo tcpdump -i eth0 host 10.10.0.15 and port 53 -w dns.pcap In Wireshark, use display filters such as dns, http.request or tls.handshake.type == 1, and Statistics > Conversations to spot top talkers. Protect pcaps because they may contain sensitive data.

What is forward secrecy?

Cryptography and PKIIn 5 company setsMedium

Show answer

Forward secrecy means that if a server's long-term private key is stolen later, previously recorded sessions still cannot be decrypted. It is achieved with ephemeral key exchange, such as ECDHE, where a new key pair is created for each session and discarded. TLS 1.3 makes forward secrecy mandatory by removing static RSA key exchange, which is one reason older TLS configurations are considered weak.

What is a man-in-the-middle attack on TLS and how do certificates prevent it?

Cryptography and PKIIn 5 company setsMedium

Show answer

In a MITM attack, an attacker intercepts traffic and pretends to be the server. Certificates prevent this because the client checks that the server certificate chains to a trusted root, matches the hostname and is valid. An attacker cannot produce a valid certificate without the private key or a compromised CA. Certificate warnings that users click through, and apps that skip validation, break this protection.

A TLS certificate expired on the main customer portal and caused an outage. How do you prevent this in future?

Cryptography and PKIIn 5 company setsMedium

Show answer

First renew and deploy the certificate to restore service. For prevention, build a certificate inventory from scanning and CT logs, automate issuance and renewal with ACME where possible, and set alerts at 30, 14 and 7 days before expiry to a team mailbox, not an individual. Assign an owner per certificate and add expiry checks to monitoring dashboards, since shorter lifetimes are coming.

What is a Security Operations Center?

SOC Operations and SIEMIn 5 company setsEasy

Show answer

A SOC is the team, processes and technology that monitor an organisation's environment around the clock, detect threats, triage alerts and coordinate response. Tier 1 analysts triage alerts, Tier 2 investigate and contain, and Tier 3 or threat hunters handle complex cases and build detections. A SOC can be in-house, outsourced to an MSSP or hybrid. Many Indian IT firms run global SOCs for international clients.

What is threat intelligence and what are IOCs and TTPs?

SOC Operations and SIEMIn 5 company setsMedium

Show answer

Threat intelligence is analysed information about adversaries, their tools and behaviour. Indicators of Compromise are artefacts like malicious IPs, domains and file hashes; they are easy to use but change quickly. TTPs, tactics, techniques and procedures, describe how attackers operate, and are harder for attackers to change. The Pyramid of Pain shows that detecting TTPs causes attackers more cost than blocking hashes.

You receive an alert for 300 failed logins on one account followed by a success. How do you triage it?

SOC Operations and SIEMIn 5 company setsMedium

Show answer

This pattern suggests brute force or password spraying that succeeded. Check source IPs, location and logon type, and whether MFA was used for the success. Review what the account did after login, such as mailbox rules, file access or new tokens. If suspicious, disable the account or revoke sessions, reset the password, block source IPs and check whether the same IPs targeted other accounts.

During triage you notice a user logged in from Mumbai and then from Frankfurt 20 minutes later. How do you handle it?

SOC Operations and SIEMIn 5 company setsMedium

Show answer

This is an impossible travel alert. First rule out benign causes like corporate VPN, cloud proxy egress or mobile networks. Check device IDs, user agents and MFA results for both logins. If the second login is from an unknown device without MFA, or followed by mailbox rule creation or data download, revoke sessions, reset credentials, review MFA methods and contact the user through a separate channel.

How do you write a Splunk search to find brute-force attempts on Windows?

SOC Operations and SIEMIn 5 company setsMedium

Show answer

Search failed logon events, count per account and source, and filter high counts. index=wineventlog EventCode=4625 | stats count AS failures dc(TargetUserName) AS users BY IpAddress | where failures > 50 | sort - failures A high distinct user count from one IP points to password spraying rather than a single account brute force.

What should a post-incident review include?

Incident Response and ForensicsIn 5 company setsEasy

Show answer

A blameless review covers the timeline, root cause, how the attacker got in, what detected it, what slowed response, business impact and decisions made. It ends with specific actions that have owners and dates, such as enabling MFA on all VPN users or adding a detection rule. Tracking these actions to completion matters more than the report itself, otherwise the same incident repeats.

What is the shared responsibility model in cloud security?

Cloud SecurityIn 5 company setsEasy

Show answer

The cloud provider secures the infrastructure: data centres, hardware, hypervisors and managed service internals. The customer secures what they put in the cloud: identities, data, configurations, network rules and their applications. The split changes by service type; with IaaS you patch the OS, with SaaS you mainly manage users and data settings. Most cloud breaches come from customer-side misconfiguration, not provider failures.

What is the role of IAM in AWS security?

Cloud SecurityIn 5 company setsMedium

Show answer

AWS IAM controls who can do what on which resources through users, groups, roles and JSON policies. Best practices are avoiding root account use and protecting it with MFA, using roles with temporary credentials instead of access keys, least privilege policies, permission boundaries, and Service Control Policies in AWS Organizations to set guardrails across accounts. IAM Access Analyzer helps find unused and external access.

What are key container and Kubernetes security practices?

Cloud SecurityIn 5 company setsHard

Show answer

Use minimal, scanned base images and sign them. Run containers as non-root with read-only filesystems and dropped capabilities. In Kubernetes, enforce Pod Security Standards, use RBAC with least privilege, network policies to restrict pod traffic, secrets from an external store, and keep the API server private. Enable audit logs and runtime detection such as Falco, and patch clusters regularly.

Tell me about a time you worked with developers to fix a security finding.

Cloud SecurityIn 5 company setsMedium

Show answer

Situation: a scan found a critical vulnerability in a library used by five microservices just before a release. Task: fix it without delaying the launch. Action: I paired with the lead developer, confirmed which services were truly exploitable, prepared tested upgrade pull requests and added a WAF rule as a temporary safeguard. Result: all services were patched in two days and release stayed on schedule.

How do you enable organisation-wide audit logging in AWS?

Cloud SecurityIn 5 company setsHard

Show answer

Create a multi-region organisation trail that sends logs to a bucket in a dedicated log archive account. aws cloudtrail create-trail --name org-trail \ --s3-bucket-name central-ct-logs --is-multi-region-trail \ --is-organization-trail --enable-log-file-validation aws cloudtrail start-logging --name org-trail Protect the bucket with Object Lock and an SCP that denies stopping CloudTrail.

What is the difference between a threat, a vulnerability and a risk?

Security FundamentalsIn 4 company setsEasy

Show answer

A vulnerability is a weakness, such as an unpatched server. A threat is anything that can exploit it, such as a ransomware group. Risk is the likelihood that the threat exploits the vulnerability multiplied by the business impact. For example, an unpatched internet-facing VPN is high risk, while the same flaw on an isolated lab machine is low risk because likelihood and impact are smaller.

What is social engineering and what are its common forms?

Security FundamentalsIn 4 company setsEasy

Show answer

Social engineering manipulates people rather than technology to gain access or information. Common forms are phishing emails, spear phishing aimed at specific staff, vishing over phone calls, smishing over SMS or WhatsApp, pretexting with a fake story, baiting with infected USB drives and tailgating into offices. Defences include awareness training, phishing simulations, call-back verification for payment changes, and technical controls such as MFA and email authentication.

What is Zero Trust security?

Security FundamentalsIn 4 company setsMedium

Show answer

Zero Trust removes implicit trust based on network location. Every request is verified using identity, device health and context, access is least privilege and granted per session, and the environment is assumed to be already breached. NIST SP 800-207 describes the model. In practice it means strong MFA, device posture checks, identity-aware proxies instead of flat VPN access, micro-segmentation and continuous monitoring. It is a journey, not a single product.

What is the difference between authentication, authorisation and accounting?

Security FundamentalsIn 4 company setsEasy

Show answer

Authentication proves who you are, for example password plus an OTP or passkey. Authorisation decides what you are allowed to do after login, such as read-only access to a finance folder. Accounting, or auditing, records what you actually did, like logins, file access and admin changes. Together they are called AAA. Weak accounting is a common gap, because without logs an incident cannot be investigated.

A user reports a pop-up saying their files are encrypted. What are your first steps?

Security FundamentalsIn 4 company setsMedium

Show answer

First, isolate the device from the network, ideally through EDR network containment, without powering it off so memory evidence is kept. Inform the incident lead and start a timeline. Check for the same indicators on other hosts, disable the user's sessions and reset credentials if needed, and identify the ransomware family from the note. Then confirm backups are intact and offline before any recovery begins.

What is the difference between TCP and UDP from a security point of view?

Network SecurityIn 4 company setsEasy

Show answer

TCP is connection oriented with a three-way handshake, which makes it reliable but open to SYN flood attacks. UDP is connectionless, so it is easy to spoof source addresses and is abused in amplification attacks using DNS, NTP or memcached. Firewalls track TCP state easily, while UDP state is inferred from timeouts. Security monitoring must cover both, since DNS tunnelling uses UDP 53.

Frequently asked questions

How is this list made?

We count how often each question appears across the 20 company-wise Cyber Security practice sets on this site and show the 50 most common. They are the safest questions to master first.

Is this enough to clear an interview?

It is the best starting point, not the finish line. After these, practise the company pages for your target employers and the sheets for your weaker topics.

More ways to practise

Company-wise Cyber Security questions Experience-wise Cyber Security questions Role-wise Cyber Security questions City-wise Cyber Security questions Scenario-based questions Practical / hands-on questions HR & behavioural questions Cyber Security mock interview Online assessment questions Technical round questions Managerial round questions Cyber Security topic sheets