Skip to content
Cyber Security
All coursesPlacement Report
‹ Back to previous sectionCourse homeAll page URLs

Cyber Security Technical Round Questions & Answers

40 questions for the technical round stage — 2 easy, 29 medium, 9 hard.

About the technical round round

The technical round is the core of a Cyber Security interview: concept questions with follow-ups, a live hands-on task and a deep dive into one of your projects. Interviewers check depth, not just definitions.

Tips for the technical round round

  • Say your approach out loud before you start writing.
  • After a correct answer, expect 'why?' and 'what if?' follow-ups; go one level deeper than the question.
  • Pick one project you can explain end to end, including what you would do differently.
  • If you get stuck, explain what you would try next instead of going silent.
Solved — technical roundStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
3 questions free Unlock the rest in seconds
01

What is the Cyber Kill Chain?

Security FundamentalsMedium
Save to ▾
Show answer
The Lockheed Martin Cyber Kill Chain describes seven stages of an intrusion: reconnaissance, weaponisation, delivery, exploitation, installation, command and control, and actions on objectives. Defenders use it to map controls to each stage, for example email filtering at delivery and egress filtering at command and control. Its weakness is a perimeter focus, so many teams pair it with MITRE ATT&CK for detailed techniques after initial access.
02

How do you design an access review for a critical application?

Identity and Access ManagementMedium
Save to ▾
Show answer
Define scope, such as all users with write or admin rights. Pull entitlements and last-login data from the app, and route each item to the user's manager and the app owner. Give clear choices of keep or revoke with a deadline, and revoke automatically if not reviewed. Capture evidence for auditors, and review exceptions with security. Run it quarterly for privileged access.
03

An employee who is leaving copied large volumes of data to a personal cloud drive. How do you handle it?

Incident Response and ForensicsMedium
Save to ▾
Show answer
Treat it as a potential insider incident and involve HR and legal before contacting the employee. Preserve evidence such as DLP alerts, proxy logs, endpoint file activity and cloud app logs, and document what data was involved and its sensitivity. Restrict the user's access as advised. Legal decides on next steps, such as requesting deletion with an undertaking. Then improve DLP and offboarding controls.
04

What is the difference between OAuth 2.0 and OpenID Connect?

Identity and Access ManagementMedium
Save to ▾
Show answer
OAuth 2.0 is an authorisation framework; it lets an app get an access token to call an API on a user's behalf, without the user's password. It does not define who the user is. OpenID Connect adds an identity layer with an ID token, a signed JWT containing user claims, and a userinfo endpoint. Use OIDC for login, and OAuth access tokens for API authorisation.
05

What SOC metrics matter most?

SOC Operations and SIEMMedium
Save to ▾
Show answer
Important metrics are mean time to detect, mean time to respond, alert volume per analyst, false positive rate per rule, percentage of alerts closed within SLA, detection coverage against priority ATT&CK techniques and log source health. Metrics should drive improvement, not punish analysts. For example, a rule with 95 percent false positives should be tuned, and long response times may point to missing automation.
06

What are the key points of India's DPDP Act?

GRC and ComplianceMedium
Save to ▾
Show answer
The Digital Personal Data Protection Act 2023 governs digital personal data. Data fiduciaries need valid consent or a legitimate use, must give clear notice, protect data with reasonable safeguards, notify breaches to the Data Protection Board and affected people, and delete data when no longer needed. Data principals have rights to access, correction and erasure. Penalties go up to 250 crore rupees. The DPDP Rules 2025 phase in obligations.
07

How do you onboard a new log source into a SIEM properly?

SOC Operations and SIEMMedium
Save to ▾
Show answer
Define why the source is needed and which detections it supports. Configure collection through an agent, syslog or API, verify time sync and time zone, and ensure parsing maps fields to the SIEM's data model. Check volume and licence impact, set retention, and test with sample events. Finally build or enable detections and add health monitoring so the team knows if it stops.
08

A US customer asks your Indian SaaS company for a SOC 2 report. What is it and which type should you aim for?

GRC and ComplianceMedium
Save to ▾
Show answer
SOC 2 is an attestation report by an independent auditor on a service organisation's controls against the AICPA Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy. A Type I report checks control design at a point in time; a Type II checks operating effectiveness over a period, typically 6 to 12 months. Indian SaaS companies selling to US customers commonly need SOC 2 Type II.
09

How do you create a forensic disk image and verify it?

Incident Response and ForensicsMedium
Save to ▾
Show answer
Use a write blocker or a forensic tool, image the whole disk, and hash both source and image. sudo dc3dd if=/dev/sdb of=/evidence/case12.img hash=sha256 log=/evidence/case12.log sha256sum /evidence/case12.img Record the hashes, time, examiner and device details in the chain of custody form. Analyse a working copy, never the original.
10

What is a DDoS attack and how is it mitigated?

Network SecurityMedium
Save to ▾
Show answer
A Distributed Denial of Service attack floods a target from many sources to exhaust bandwidth, connection tables or application resources. Types are volumetric floods, protocol attacks like SYN floods, and application layer floods hitting costly pages. Mitigation uses upstream scrubbing services or CDN providers, anycast networks, rate limiting, SYN cookies, autoscaling, and a tested runbook agreed with the ISP before an attack.
11

Attackers bypassed MFA by sending repeated push notifications until a user approved. How do you prevent this?

Identity and Access ManagementMedium
Save to ▾
Show answer
This is MFA fatigue. Enable number matching and show app and location context in push requests, limit the number of prompts, and alert on repeated denials. Move high-risk users and admins to phishing-resistant methods such as FIDO2 keys or passkeys. Train users to report unexpected prompts. Also revoke the attacker's sessions and review what they accessed.
12

What is UEBA?

SOC Operations and SIEMMedium
Save to ▾
Show answer
User and Entity Behaviour Analytics builds baselines of normal behaviour for users, hosts and service accounts, then flags anomalies such as logging in from a new country, accessing far more files than usual or a service account doing interactive logins. It helps detect insider threats and stolen credentials that look like normal logins. It needs good identity data and careful tuning to avoid noisy alerts.
13

How would you roll out MFA to 5000 employees?

Identity and Access ManagementMedium
Save to ▾
Show answer
Start with admins and remote access, then high-risk groups like finance. Pick methods, preferring authenticator app number matching and passkeys or FIDO2 keys for admins. Pilot with one department, prepare helpdesk scripts and self-service registration, and communicate clearly with deadlines. Use conditional access in report-only mode to find gaps, then enforce. Block legacy authentication and track registration rates weekly.
14

What is the difference between static and dynamic malware analysis?

Incident Response and ForensicsMedium
Save to ▾
Show answer
Static analysis examines a sample without running it: hashes, strings, imports, PE headers, YARA rule matches and disassembly. Dynamic analysis runs it in an isolated sandbox to observe processes, file changes, registry edits and network calls. Static is safe and fast but defeated by packing; dynamic shows real behaviour but malware may detect sandboxes. Analysts usually combine both in a controlled lab.
15

What does a simple YARA rule look like?

Incident Response and ForensicsHard
Save to ▾
Show answer
YARA matches files or memory by strings and conditions, and is used for hunting and classifying malware. rule Suspicious_Invoice_Dropper { strings: $a = "invoice_payload" ascii $b = { 4D 5A 90 00 } $c = "powershell -enc" nocase condition: $b at 0 and ($a or $c) } Test rules against clean files to avoid false positives.
16

What is Certificate Transparency?

Cryptography and PKIHard
Save to ▾
Show answer
Certificate Transparency requires publicly trusted CAs to log every issued certificate in public append-only logs. Browsers require proof of logging before trusting a certificate. Domain owners can monitor these logs to detect certificates issued for their domains without permission, for example by a compromised CA or a phishing actor. Security teams also use CT logs for subdomain discovery and asset inventory.
17

What is the difference between hashing and encryption?

Security FundamentalsEasy
Save to ▾
Show answer
Encryption is reversible with the right key and protects confidentiality. Hashing is a one-way function that produces a fixed-length digest and is used for integrity checks and password storage. SHA-256 of a file lets you detect tampering, but you cannot get the file back from the hash. Passwords should be stored with slow salted hashes such as Argon2id or bcrypt, never encrypted or with plain SHA-256.
18

A scan shows an S3 bucket with customer documents is publicly readable. What do you do?

Cloud SecurityMedium
Save to ▾
Show answer
Block public access on the bucket immediately and confirm with the owner whether any public access was intended. Check access logs and CloudTrail data events, if enabled, to see who downloaded files and when. If personal data was accessed, start the incident and breach notification process with legal. Then enable account-level block public access, add a preventive guardrail and alert on policy changes.
19

What is threat hunting?

SOC Operations and SIEMMedium
Save to ▾
Show answer
Threat hunting is proactive searching for attackers who evaded existing detections. Hunters start from a hypothesis, for example that attackers use scheduled tasks for persistence, then query EDR and SIEM data to confirm or reject it. Findings become new detection rules. Hunting requires good data retention, knowledge of normal behaviour and frameworks like MITRE ATT&CK to guide hypotheses.
20

Your CISO asks whether the company needs to act on quantum computing risk now. What do you advise?

Cryptography and PKIHard
Save to ▾
Show answer
Large quantum computers could break RSA and elliptic curve cryptography using Shor's algorithm. NIST published post-quantum standards in 2024: ML-KEM for key exchange, and ML-DSA and SLH-DSA for signatures. Attackers can harvest encrypted traffic now and decrypt it later, so long-lived sensitive data is at risk. Organisations should inventory cryptography, prefer crypto agility, and test hybrid key exchange that browsers already support.
21

What is third-party or vendor risk management?

GRC and ComplianceMedium
Save to ▾
Show answer
TPRM assesses and monitors the security of vendors that access your data or systems, since many breaches start with a supplier. It includes tiering vendors by risk, security questionnaires, reviewing SOC 2 or ISO 27001 reports, contract clauses for breach notification and audit rights, and continuous monitoring. High-risk vendors such as payroll or cloud providers get deeper reviews and annual reassessment.
22

What are the main containment strategies?

Incident Response and ForensicsMedium
Save to ▾
Show answer
Short-term containment stops the spread quickly, for example isolating hosts through EDR, disabling accounts, blocking IPs or domains and segmenting networks. Long-term containment keeps business running while preparing clean systems, such as rebuilding servers in a separate network. Responders must balance speed with evidence preservation and avoid alerting a sophisticated attacker too early if they need to understand the full scope.
23

Write a KQL query in Microsoft Sentinel to find sign-ins from many countries for one user.

SOC Operations and SIEMHard
Save to ▾
Show answer
Use SigninLogs, summarise distinct countries per user over a day and flag outliers. SigninLogs | where TimeGenerated > ago(1d) | where ResultType == 0 | summarize Countries = dcount(Location), List = make_set(Location) by UserPrincipalName | where Countries > 2 | order by Countries desc Review results with known travel and VPN egress points before escalating.
24

Your SOC sees heavy DNS traffic with long random subdomains from one workstation. Which DNS attacks should you consider and what defences apply?

Network SecurityMedium
Save to ▾
Show answer
Key DNS attacks are cache poisoning, which inserts false records; DNS tunnelling, which hides data or command traffic inside queries; domain hijacking through registrar account takeover; and DNS amplification DDoS. Defences include DNSSEC to sign records, protective DNS resolvers that block malicious domains, monitoring for long or high-entropy subdomains, registrar lock with MFA, and rate limiting open resolvers.
25

What is a man-in-the-middle attack on TLS and how do certificates prevent it?

Cryptography and PKIMedium
Save to ▾
Show answer
In a MITM attack, an attacker intercepts traffic and pretends to be the server. Certificates prevent this because the client checks that the server certificate chains to a trusted root, matches the hostname and is valid. An attacker cannot produce a valid certificate without the private key or a compromised CA. Certificate warnings that users click through, and apps that skip validation, break this protection.
26

What are India's CERT-In incident reporting requirements?

Incident Response and ForensicsMedium
Save to ▾
Show answer
Under the CERT-In directions issued in April 2022, service providers, intermediaries, data centres and body corporates must report specified cyber incidents to CERT-In within six hours of noticing them. They must also keep ICT system logs for 180 days within India and synchronise clocks with NTP servers of NIC or NPL. Reportable incidents include ransomware, data breaches, and attacks on servers and cloud systems.
27

What are the data residency rules relevant to cloud in India?

Cloud SecurityHard
Save to ▾
Show answer
The DPDP Act 2023 allows cross-border transfer of personal data except to countries the government restricts, though sector rules can be stricter. RBI requires payment system data to be stored only in India. CERT-In requires ICT logs to be kept in India for 180 days. SEBI and IRDAI have their own requirements for regulated entities. Cloud architects choose Indian regions such as Mumbai or Hyderabad for compliance.
28

What is Network Access Control?

Network SecurityMedium
Save to ▾
Show answer
NAC checks devices and users before allowing them on the network, typically using 802.1X with a RADIUS server. It can verify certificates, patch level, EDR presence and user identity, then assign a VLAN or policy. Unknown or non-compliant devices go to a quarantine or guest network. NAC is important in offices with many personal devices and IoT equipment such as printers and cameras.
29

How do you analyse a memory dump with Volatility 3?

Incident Response and ForensicsHard
Save to ▾
Show answer
Run plugins to list processes, network connections and injected code, then dig into suspicious items. vol -f mem.raw windows.info vol -f mem.raw windows.pstree vol -f mem.raw windows.netscan vol -f mem.raw windows.cmdline vol -f mem.raw windows.malfind Look for unusual parent-child processes, processes in odd paths and connections to unknown IPs.
30

How would you implement just-in-time privileged access in the cloud?

Identity and Access ManagementHard
Save to ▾
Show answer
Remove standing admin roles. Make users eligible for roles through a PIM or PAM tool, so they request activation with justification, MFA and optional approval, for a limited time like two hours. Log every activation and alert on unusual ones. For automation, use workload identities with narrow roles instead of admin keys. Review eligible assignments quarterly to keep the list small.
31

Developers want admin access in the cloud to move fast. How do you balance speed and security?

Cloud SecurityMedium
Save to ▾
Show answer
Give them freedom inside guardrails. Provide sandbox accounts where they have broad rights, but production changes go through IaC pipelines with scanning and review. Use permission boundaries and SCPs to block dangerous actions like disabling logging or making resources public. Offer pre-approved modules for common patterns. This keeps speed high while preventing the riskiest mistakes.
32

A guest Wi-Fi user can reach internal printers. What is wrong and how do you fix it?

Network SecurityMedium
Save to ▾
Show answer
Guest traffic is not properly isolated, likely because the guest SSID shares a VLAN with internal devices or the firewall allows inter-VLAN routing. Fix by placing guests on a separate VLAN with internet-only access, applying ACLs that deny all RFC 1918 internal ranges, and enabling client isolation on the wireless controller. Then test from a guest device and document the design.
33

What is RBAC and ABAC?

Identity and Access ManagementMedium
Save to ▾
Show answer
Role-Based Access Control grants permissions to roles such as Finance Analyst, and users get roles; it is simple to manage and audit. Attribute-Based Access Control decides using attributes of the user, resource and context, such as department, data classification, location and time. ABAC is more flexible but harder to reason about. Many organisations use RBAC as the base and add attribute conditions for sensitive cases.
34

A Kubernetes pod in production is running a cryptominer. How do you investigate?

Cloud SecurityHard
Save to ▾
Show answer
Capture the pod spec, image digest, logs and runtime alerts before deleting anything. Check how it got in: a vulnerable app, a compromised image in the registry or an exposed dashboard or kubelet. Review Kubernetes audit logs for who created the workload and what service account it used. Cordon affected nodes, rotate service account tokens and secrets, patch the entry point and enforce image signing.
35

Your IDS alerts on outbound traffic from a database server to an unknown IP on port 443 at 3 AM. How do you investigate?

Network SecurityMedium
Save to ▾
Show answer
Database servers rarely need internet access, so this is suspicious. I would check the destination's reputation and WHOIS, look at flow data for volume and duration, and identify the process making the connection using EDR. Then I review recent logins, scheduled tasks and new binaries on the server. If data volume is large or the process is unknown, I contain the host and escalate as a possible exfiltration.
36

What is MITRE ATT&CK and how is it used?

Security FundamentalsMedium
Save to ▾
Show answer
MITRE ATT&CK is a public knowledge base of adversary tactics and techniques observed in real attacks, organised in matrices for Enterprise, Mobile and ICS. Tactics are the goal, such as Persistence, and techniques are the method, such as T1053 Scheduled Task. Teams use it to map detection coverage, write threat-informed detections, plan red and purple team exercises, and describe incidents in a common language.
37

How do you write basic Linux host firewall rules with nftables?

Network SecurityMedium
Save to ▾
Show answer
Default deny inbound, allow established traffic, loopback and only required services. nft add table inet filter nft add chain inet filter input '{ type filter hook input priority 0; policy drop; }' nft add rule inet filter input ct state established,related accept nft add rule inet filter input iif lo accept nft add rule inet filter input tcp dport 22 ip saddr 10.10.1.0/24 accept nft add rule inet filter input tcp dport 443 accept Save the ruleset so it persists after reboot.
38

You find a web shell on a public web server. What steps do you take?

Incident Response and ForensicsHard
Save to ▾
Show answer
Do not just delete it. Capture the file, web logs and a memory image if possible, then identify when it was created and which request uploaded it. Search logs for commands executed through it and lateral movement from the server. Contain by isolating the server or blocking the path at the WAF, then patch the vulnerable application, rebuild from a clean image and rotate any credentials stored on it.
39

You receive an alert for 300 failed logins on one account followed by a success. How do you triage it?

SOC Operations and SIEMMedium
Save to ▾
Show answer
This pattern suggests brute force or password spraying that succeeded. Check source IPs, location and logon type, and whether MFA was used for the success. Review what the account did after login, such as mailbox rules, file access or new tokens. If suspicious, disable the account or revoke sessions, reset the password, block source IPs and check whether the same IPs targeted other accounts.
40

What is social engineering and what are its common forms?

Security FundamentalsEasy
Save to ▾
Show answer
Social engineering manipulates people rather than technology to gain access or information. Common forms are phishing emails, spear phishing aimed at specific staff, vishing over phone calls, smishing over SMS or WhatsApp, pretexting with a fake story, baiting with infected USB drives and tailgating into offices. Defences include awareness training, phishing simulations, call-back verification for payment changes, and technical controls such as MFA and email authentication.

Frequently asked questions

What happens in the Cyber Security technical round round?

The technical round is the core of a Cyber Security interview: concept questions with follow-ups, a live hands-on task and a deep dive into one of your projects. Interviewers check depth, not just definitions.

How do I clear the technical round round?

Say your approach out loud before you start writing. After a correct answer, expect 'why?' and 'what if?' follow-ups; go one level deeper than the question. Pick one project you can explain end to end, including what you would do differently.

Which round comes next?

A typical order is online assessment, telephonic screening, one or two technical rounds, a managerial round and HR. Use the other round pages to practise each stage.

Practise every interview round

Online Assessment questionsTelephonic Interview questionsManagerial Round questionsRapid-Fire questionsHR & behavioural questionsFull mock interview

More ways to practise

Company-wise Cyber Security questionsExperience-wise Cyber Security questionsRole-wise Cyber Security questionsCity-wise Cyber Security questionsMost asked Cyber Security questionsScenario-based questionsPractical / hands-on questionsHR & behavioural questionsCyber Security mock interviewOnline assessment questionsTechnical round questionsManagerial round questionsCyber Security topic sheets