‹ Back to previous section Course home All page URLs

Practical Cyber Security Interview Questions

45 questions with answers. Hands-on questions where you write code, a query, a formula or concrete steps.

How to approach these questions

Talk while you work: say your approach first, write the simplest correct version, then improve it and mention edge cases.

Solved — practicalStart practicing

3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.

3 questions free Unlock the rest in seconds

How would you verify the integrity of a downloaded installer on Windows and Linux?

Security FundamentalsEasy

Show answer

Compare the file's hash with the value published by the vendor over a trusted channel, or verify its digital signature. On Windows, use PowerShell and check the Authenticode signature. On Linux, use sha256sum and gpg for signed checksum files. Get-FileHash .\setup.exe -Algorithm SHA256 Get-AuthenticodeSignature .\setup.exe sha256sum tool.tar.gz gpg --verify SHA256SUMS.asc SHA256SUMS

How do you generate a strong random secret or password from the command line?

Security FundamentalsEasy

Show answer

Use a cryptographically secure source, never a simple random function. OpenSSL and Python's secrets module both use the operating system CSPRNG. openssl rand -base64 32 python3 -c "import secrets; print(secrets.token_urlsafe(32))" Store the output in a password manager or secret vault, not in a text file or chat message.

How would you run a basic threat model for a new web application?

Security FundamentalsMedium

Show answer

Draw a data flow diagram showing users, the web app, APIs, databases and third parties, and mark trust boundaries. Then apply STRIDE to each element: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service and Elevation of privilege. For each threat, record the existing control, a risk rating and an owner. Repeat the model whenever the architecture changes, ideally during design reviews.

How do you check which ports are listening on a server you manage?

Security FundamentalsEasy

Show answer

List listening sockets with the owning process, then compare against what the server should expose. Anything unexpected needs an owner or should be closed. # Linux sudo ss -tulpn # Windows netstat -ano | findstr LISTENING Get-NetTCPConnection -State Listen Map the PID to a process name in Task Manager or with ps to identify the service.

How do you scan your own network for open ports with Nmap, with permission?

Network SecurityEasy

Show answer

Only scan networks you own or have written approval for. Start with host discovery, then service and version detection on key ports. nmap -sn 10.10.0.0/24 nmap -sV -T3 -p 1-1000 10.10.0.15 nmap -sV --top-ports 100 -oA scan_results 10.10.0.0/24 Compare results with the approved service list and raise tickets for unexpected open ports.

How would you capture and analyse suspicious traffic using tcpdump and Wireshark?

Network SecurityMedium

Show answer

Capture on the right interface with a filter to limit size, save to a pcap file, then open it in Wireshark. sudo tcpdump -i eth0 host 10.10.0.15 and port 53 -w dns.pcap In Wireshark, use display filters such as dns, http.request or tls.handshake.type == 1, and Statistics > Conversations to spot top talkers. Protect pcaps because they may contain sensitive data.

How do you write basic Linux host firewall rules with nftables?

Network SecurityMedium

Show answer

Default deny inbound, allow established traffic, loopback and only required services. nft add table inet filter nft add chain inet filter input '{ type filter hook input priority 0; policy drop; }' nft add rule inet filter input ct state established,related accept nft add rule inet filter input iif lo accept nft add rule inet filter input tcp dport 22 ip saddr 10.10.1.0/24 accept nft add rule inet filter input tcp dport 443 accept Save the ruleset so it persists after reboot.

How do you check a server's TLS configuration?

Network SecurityMedium

Show answer

Check supported protocol versions, ciphers and certificate details. OpenSSL gives a quick view, and tools like testssl.sh give a full report. openssl s_client -connect example.com:443 -tls1_2 openssl s_client -connect example.com:443 -servername example.com | openssl x509 -noout -dates -issuer ./testssl.sh example.com Disable TLS 1.0 and 1.1, weak ciphers like RC4 and 3DES, and fix expiring certificates.

How do you create a private key and CSR with OpenSSL?

Cryptography and PKIMedium

Show answer

Generate a key, then a certificate signing request to send to a CA. openssl ecparam -genkey -name prime256v1 -out server.key openssl req -new -key server.key -out server.csr \ -subj "/CN=portal.example.in" \ -addext "subjectAltName=DNS:portal.example.in" openssl req -in server.csr -noout -text Keep server.key private with restricted file permissions.

How do you inspect a certificate and check its chain?

Cryptography and PKIEasy

Show answer

Use OpenSSL to view the fields and verify the chain against the CA bundle. openssl x509 -in cert.pem -noout -subject -issuer -dates -ext subjectAltName openssl verify -CAfile chain.pem cert.pem openssl s_client -connect portal.example.in:443 -showcerts Check the SAN matches the hostname, the dates are valid, and the server sends intermediate certificates.

How do you encrypt and decrypt a file using GPG?

Cryptography and PKIEasy

Show answer

For sharing, use the recipient's public key; for personal storage, use symmetric mode with a strong passphrase. gpg --encrypt --recipient analyst@example.in report.pdf gpg --output report.pdf --decrypt report.pdf.gpg gpg --symmetric --cipher-algo AES256 backup.tar Verify the recipient key fingerprint out of band before trusting it.

How would you hash passwords correctly in Python?

Cryptography and PKIMedium

Show answer

Use a dedicated password hashing library with Argon2id, which handles salts and parameters automatically. from argon2 import PasswordHasher ph = PasswordHasher() stored = ph.hash(password) try: ph.verify(stored, attempt) if ph.check_needs_rehash(stored): stored = ph.hash(attempt) except Exception: deny_login() Never use plain SHA-256 or MD5 for passwords.

How do you build a cryptography inventory for an organisation?

Cryptography and PKIHard

Show answer

Combine several sources: scan network services for TLS versions, ciphers and certificate keys; query CT logs and internal PKI for issued certificates; use code scanning to find crypto library calls and hardcoded keys; and export KMS and HSM key lists. Record algorithm, key length, owner, data sensitivity and expiry. This inventory supports compliance, certificate renewals and planning the post-quantum migration.

How would you set up envelope encryption for application data in the cloud?

Cryptography and PKIHard

Show answer

Create a customer managed key in the cloud KMS with strict IAM so only the app role can use it. The app asks KMS for a data key, encrypts records locally with AES-GCM using the plaintext data key, stores the encrypted data key next to the data, and discards the plaintext key. To decrypt, it sends the encrypted data key to KMS. Enable key rotation and audit logging.

How would you use Sysmon to improve endpoint visibility on Windows?

SOC Operations and SIEMMedium

Show answer

Sysmon is a free Microsoft Sysinternals tool that logs detailed endpoint events to the Windows event log. Useful events are ID 1 process creation with hashes and command line, ID 3 network connection, ID 11 file creation, ID 13 registry changes and ID 22 DNS queries. With a tuned configuration, it gives rich telemetry for SIEM detections when a full EDR is not available or as an extra source.

How do you write a Splunk search to find brute-force attempts on Windows?

SOC Operations and SIEMMedium

Show answer

Search failed logon events, count per account and source, and filter high counts. index=wineventlog EventCode=4625 | stats count AS failures dc(TargetUserName) AS users BY IpAddress | where failures > 50 | sort - failures A high distinct user count from one IP points to password spraying rather than a single account brute force.

Write a KQL query in Microsoft Sentinel to find sign-ins from many countries for one user.

SOC Operations and SIEMHard

Show answer

Use SigninLogs, summarise distinct countries per user over a day and flag outliers. SigninLogs | where TimeGenerated > ago(1d) | where ResultType == 0 | summarize Countries = dcount(Location), List = make_set(Location) by UserPrincipalName | where Countries > 2 | order by Countries desc Review results with known travel and VPN egress points before escalating.

What does a Sigma rule look like?

SOC Operations and SIEMHard

Show answer

Sigma is a generic YAML detection format that converts to SIEM queries. title: Office Spawning PowerShell logsource: product: windows category: process_creation detection: selection: ParentImage|endswith: ['\winword.exe', '\excel.exe'] Image|endswith: '\powershell.exe' condition: selection level: high tags: [attack.execution, attack.t1059.001]

How do you analyse a suspicious email reported by a user?

SOC Operations and SIEMEasy

Show answer

Get the original email with full headers. Check SPF, DKIM and DMARC results, the real sender and Reply-To, and the received path. Extract URLs and attachments without clicking, check them in a sandbox and reputation services, and compare the sender domain for lookalikes. If malicious, search for the same message across mailboxes, purge it, block indicators and check whether anyone clicked or entered credentials.

How do you onboard a new log source into a SIEM properly?

SOC Operations and SIEMMedium

Show answer

Define why the source is needed and which detections it supports. Configure collection through an agent, syslog or API, verify time sync and time zone, and ensure parsing maps fields to the SIEM's data model. Check volume and licence impact, set retention, and test with sample events. Finally build or enable detections and add health monitoring so the team knows if it stops.

How would you build a basic home SOC lab?

SOC Operations and SIEMEasy

Show answer

Use a laptop with virtualisation, run a Windows VM with Sysmon, a Linux server and a free SIEM such as Elastic or Splunk Free, or Wazuh as an open source option. Forward logs, then simulate attacks safely with Atomic Red Team tests on your own VMs. Write detections for each test, document them on GitHub and explain them in interviews.

How do you collect basic triage data from a suspected compromised Windows host?

Incident Response and ForensicsMedium

Show answer

Collect volatile data first, ideally with EDR live response or a trusted triage tool. Useful built-in commands: tasklist /v netstat -ano schtasks /query /fo LIST /v wmic service get name,pathname,startmode reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run wevtutil epl Security C:\IR\security.evtx Save output to external media and hash every file.

How do you create a forensic disk image and verify it?

Incident Response and ForensicsMedium

Show answer

Use a write blocker or a forensic tool, image the whole disk, and hash both source and image. sudo dc3dd if=/dev/sdb of=/evidence/case12.img hash=sha256 log=/evidence/case12.log sha256sum /evidence/case12.img Record the hashes, time, examiner and device details in the chain of custody form. Analyse a working copy, never the original.

How do you analyse a memory dump with Volatility 3?

Incident Response and ForensicsHard

Show answer

Run plugins to list processes, network connections and injected code, then dig into suspicious items. vol -f mem.raw windows.info vol -f mem.raw windows.pstree vol -f mem.raw windows.netscan vol -f mem.raw windows.cmdline vol -f mem.raw windows.malfind Look for unusual parent-child processes, processes in odd paths and connections to unknown IPs.

What does a simple YARA rule look like?

Incident Response and ForensicsHard

Show answer

YARA matches files or memory by strings and conditions, and is used for hunting and classifying malware. rule Suspicious_Invoice_Dropper { strings: $a = "invoice_payload" ascii $b = { 4D 5A 90 00 } $c = "powershell -enc" nocase condition: $b at 0 and ($a or $c) } Test rules against clean files to avoid false positives.

How would you build a forensic timeline of an incident?

Incident Response and ForensicsHard

Show answer

Collect timestamps from many sources: Windows event logs, file system MFT records, prefetch, browser history, EDR telemetry, proxy, firewall and cloud logs. Normalise all of them to UTC, then merge them using tools like Plaso and Timeline Explorer. Mark key points such as initial access, privilege escalation, lateral movement and exfiltration. The timeline drives scoping, root cause and the incident report.

How do you run a tabletop exercise?

Incident Response and ForensicsMedium

Show answer

Pick a realistic scenario, such as ransomware on a weekend, and invite IT, security, legal, communications and business leaders. A facilitator releases injects step by step, like a ransom note appearing or a journalist calling, and participants explain decisions using the real plan. Record gaps in contacts, authority, backups and reporting timelines. Share findings and track fixes, and repeat at least twice a year.

How would you design a joiner, mover, leaver process for a growing company?

Identity and Access ManagementMedium

Show answer

JML is the identity lifecycle. Joiners get accounts and baseline access from HR data on day one. Movers change roles, and their old access must be removed, not just new access added, to avoid privilege creep. Leavers must be disabled promptly, ideally automatically when HR records their exit. Automating JML from the HR system to the identity platform reduces orphan accounts, which auditors frequently flag.

How do you find stale and privileged accounts in Active Directory with PowerShell?

Identity and Access ManagementMedium

Show answer

Use the ActiveDirectory module. Search-ADAccount -AccountInactive -TimeSpan 90.00:00:00 -UsersOnly | Select Name, LastLogonDate Get-ADGroupMember 'Domain Admins' -Recursive | Select Name, SamAccountName Get-ADUser -Filter {PasswordNeverExpires -eq $true} | Select Name Review results with owners before disabling anything.

How do you decode and check a JWT during troubleshooting?

Identity and Access ManagementMedium

Show answer

A JWT has header, payload and signature separated by dots. Decode the first two parts to read claims, but never trust them without verifying the signature. echo $TOKEN | cut -d. -f2 | base64 -d 2>/dev/null Check iss, aud, exp and nbf claims. In code, verify with a library using the expected algorithm and issuer keys, and reject alg none.

How would you roll out MFA to 5000 employees?

Identity and Access ManagementMedium

Show answer

Start with admins and remote access, then high-risk groups like finance. Pick methods, preferring authenticator app number matching and passkeys or FIDO2 keys for admins. Pilot with one department, prepare helpdesk scripts and self-service registration, and communicate clearly with deadlines. Use conditional access in report-only mode to find gaps, then enforce. Block legacy authentication and track registration rates weekly.

How do you design an access review for a critical application?

Identity and Access ManagementMedium

Show answer

Define scope, such as all users with write or admin rights. Pull entitlements and last-login data from the app, and route each item to the user's manager and the app owner. Give clear choices of keep or revoke with a deadline, and revoke automatically if not reviewed. Capture evidence for auditors, and review exceptions with security. Run it quarterly for privileged access.

How do you set up a break-glass account safely?

Identity and Access ManagementHard

Show answer

Create two cloud-only emergency accounts excluded from normal conditional access but protected by FIDO2 keys stored in a safe. Use long random passwords, store them split between two senior people or in a sealed vault, and give them the minimum emergency role. Alert the SOC on any sign-in, and test them every quarter. They exist for identity provider outages or misconfigured policies.

How would you implement just-in-time privileged access in the cloud?

Identity and Access ManagementHard

Show answer

Remove standing admin roles. Make users eligible for roles through a PIM or PAM tool, so they request activation with justification, MFA and optional approval, for a limited time like two hours. Log every activation and alert on unusual ones. For automation, use workload identities with narrow roles instead of admin keys. Review eligible assignments quarterly to keep the list small.

How do you find overly permissive security groups with the AWS CLI?

Cloud SecurityMedium

Show answer

Query security groups that allow ingress from anywhere, then review each. aws ec2 describe-security-groups \ --filters Name=ip-permission.cidr,Values=0.0.0.0/0 \ --query 'SecurityGroups[*].[GroupId,GroupName]' --output table Pay attention to ports 22, 3389, 3306 and 5432. Replace them with VPN, bastion or session manager access.

Write a least-privilege AWS IAM policy that allows reading one S3 bucket.

Cloud SecurityMedium

Show answer

Allow only listing that bucket and reading its objects. { "Version": "2012-10-17", "Statement": [ {"Effect": "Allow", "Action": "s3:ListBucket", "Resource": "arn:aws:s3:::reports-prod"}, {"Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::reports-prod/*"} ] } Attach it to a role, not a user with long-lived keys.

How do you scan a container image for vulnerabilities in CI?

Cloud SecurityEasy

Show answer

Use a scanner like Trivy or Grype and fail the build on serious findings. trivy image --severity HIGH,CRITICAL --exit-code 1 myapp:1.4.2 trivy config ./terraform Run it on every build, rescan images in the registry daily because new CVEs appear, and prefer minimal base images to reduce findings.

How do you enable organisation-wide audit logging in AWS?

Cloud SecurityHard

Show answer

Create a multi-region organisation trail that sends logs to a bucket in a dedicated log archive account. aws cloudtrail create-trail --name org-trail \ --s3-bucket-name central-ct-logs --is-multi-region-trail \ --is-organization-trail --enable-log-file-validation aws cloudtrail start-logging --name org-trail Protect the bucket with Object Lock and an SCP that denies stopping CloudTrail.

How would you check a cloud account against CIS benchmarks?

Cloud SecurityEasy

Show answer

Enable the native posture service, such as AWS Security Hub with the CIS AWS Foundations standard, Microsoft Defender for Cloud with the CIS Azure benchmark, or Security Command Center on Google Cloud. Open source tools like Prowler or ScoutSuite also work. Export findings, prioritise critical ones like root MFA, public storage and open admin ports, assign owners and track remediation over time.

How do you replace static cloud keys in CI/CD pipelines?

Cloud SecurityHard

Show answer

Use workload identity federation with OIDC. The CI system issues a short-lived signed token for each job, and the cloud provider trusts that issuer and exchanges the token for temporary credentials of a narrow role. Restrict the trust policy to a specific repository and branch. This removes long-lived secrets from pipeline settings, so a leaked log or variable no longer gives permanent access.

How do you write an effective security policy?

GRC and ComplianceEasy

Show answer

Start from business needs and regulations, keep it short and clear, and state scope, purpose, roles, requirements and exceptions. Avoid technical detail that changes often; put that in standards. Get input from IT, HR and legal, then management approval. Publish it where staff can find it, train people, require acknowledgement and review it at least yearly or after major changes.

How do you build a risk register?

GRC and ComplianceEasy

Show answer

Create a table where each risk has an ID, description written as cause, event and impact, asset, owner, inherent likelihood and impact, existing controls, residual rating, treatment decision, action plan, due date and review date. Gather risks through workshops, audits, incidents and threat intelligence. Review the register monthly with owners and report top risks to leadership quarterly.

How do you calculate annual loss expectancy?

GRC and ComplianceMedium

Show answer

Single Loss Expectancy is asset value times exposure factor, and Annual Loss Expectancy is SLE times Annual Rate of Occurrence. SLE = Asset Value x Exposure Factor ALE = SLE x ARO Example: a server worth 20 lakh rupees, 50 percent loss per incident, expected once in four years: SLE = 20,00,000 x 0.5 = 10,00,000 ALE = 10,00,000 x 0.25 = 2,50,000 per year

How do you collect audit evidence efficiently?

GRC and ComplianceMedium

Show answer

Map each control to the evidence an auditor will request, such as screenshots of configurations, system exports, tickets, logs and signed approvals. Keep a central evidence library organised by control ID with dates. Automate collection where possible through GRC tools that pull data from cloud, identity and ticketing systems. Sample in advance to confirm evidence covers the full audit period.

How would you run a data protection impact assessment under the DPDP Act?

GRC and ComplianceHard

Show answer

Describe the processing: what personal data, purpose, legal basis, data flows, storage, retention and vendors. Assess risks to individuals, such as unauthorised access or excessive collection, and evaluate safeguards like encryption, access control and minimisation. Recommend changes, get sign-off from the data protection officer or privacy lead, and review it when processing changes. Significant data fiduciaries must perform periodic DPIAs and audits.

Frequently asked questions

Why are practical questions important?

Most technical rounds include at least one live task. Practising the exact typing and reasoning makes you calm and fast in the real round.

How should I answer them?

Talk while you work: say your approach first, write the simplest correct version, then improve it and mention edge cases.

More ways to practise

Company-wise Cyber Security questions Experience-wise Cyber Security questions Role-wise Cyber Security questions City-wise Cyber Security questions Most asked Cyber Security questions Scenario-based questions HR & behavioural questions Cyber Security mock interview Online assessment questions Technical round questions Managerial round questions Cyber Security topic sheets