Skip to content
Cyber Security
All coursesPlacement Report
‹ Back to previous sectionCourse homeAll page URLs

Cyber Security Telephonic Interview Questions & Answers

30 questions for the telephonic interview stage — 18 easy, 11 medium, 1 hard.

About the telephonic interview round

The telephonic or screening round is a 15-30 minute call with a recruiter or engineer. It checks your basics, your CV and whether you can explain Cyber Security concepts clearly without a screen to point at.

Tips for the telephonic interview round

  • Keep your CV in front of you and be ready to explain every line on it.
  • Answer in short, clear sentences; there is no whiteboard, so structure matters.
  • Take the call somewhere quiet and confirm the time in advance.
  • Prepare one question to ask the interviewer at the end.
Solved — telephonic interviewStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
3 questions free Unlock the rest in seconds
01

Which cloud logs are essential for security monitoring?

Cloud SecurityMedium
Save to ▾
Show answer
Essential sources are control plane audit logs such as AWS CloudTrail, Azure Activity Log and Entra sign-in logs, and Google Cloud Audit Logs. Add network flow logs, DNS logs, load balancer and WAF logs, storage access logs for sensitive buckets, and Kubernetes audit logs. Send them to a central account or SIEM that workload owners cannot delete, and enable threat detection services like GuardDuty.
02

What is the difference between a threat, a vulnerability and a risk?

Security FundamentalsEasy
Save to ▾
Show answer
A vulnerability is a weakness, such as an unpatched server. A threat is anything that can exploit it, such as a ransomware group. Risk is the likelihood that the threat exploits the vulnerability multiplied by the business impact. For example, an unpatched internet-facing VPN is high risk, while the same flaw on an isolated lab machine is low risk because likelihood and impact are smaller.
03

What is the difference between encoding, encryption and obfuscation?

Cryptography and PKIEasy
Save to ▾
Show answer
Encoding, like Base64 or URL encoding, changes data format for transport and is reversible by anyone, so it gives no security. Encryption makes data unreadable without a key. Obfuscation makes code or data harder to understand but does not use a secret key, so a determined analyst can reverse it. A common mistake is treating Base64 credentials in config files as protected.
04

Tell me about a time you had to convince a team to follow a compliance requirement they disliked.

GRC and ComplianceMedium
Save to ▾
Show answer
Situation: developers resisted mandatory code review evidence for SOC 2, seeing it as paperwork. Task: get compliance without slowing releases. Action: I explained the audit risk to customer deals and showed that branch protection rules could create evidence automatically. Result: we enabled required reviews in the repository settings, evidence became automatic and the audit passed with no finding.
05

What are the four risk treatment options?

GRC and ComplianceEasy
Save to ▾
Show answer
Mitigate by adding controls to reduce likelihood or impact, such as MFA. Transfer by shifting financial impact to others, like cyber insurance or contracts. Avoid by stopping the risky activity, for example retiring an old system. Accept when the risk is within appetite and formally documented with an owner and review date. Risk acceptance should be signed by a business owner, not just the security team.
06

What are the key points of India's DPDP Act?

GRC and ComplianceMedium
Save to ▾
Show answer
The Digital Personal Data Protection Act 2023 governs digital personal data. Data fiduciaries need valid consent or a legitimate use, must give clear notice, protect data with reasonable safeguards, notify breaches to the Data Protection Board and affected people, and delete data when no longer needed. Data principals have rights to access, correction and erasure. Penalties go up to 250 crore rupees. The DPDP Rules 2025 phase in obligations.
07

What is a salt and why is it used in password hashing?

Cryptography and PKIEasy
Save to ▾
Show answer
A salt is a unique random value stored with each password hash. It makes identical passwords produce different hashes, so precomputed rainbow tables are useless and attackers must crack each hash separately. Salts are not secret. A pepper is an additional secret kept outside the database. Combined with slow algorithms like Argon2id, bcrypt or scrypt, salting makes offline cracking much more expensive.
08

What is multi-factor authentication and which factors are strongest?

Identity and Access ManagementEasy
Save to ▾
Show answer
MFA requires two or more factor types: something you know like a password, something you have like a phone or security key, and something you are like a fingerprint. SMS OTPs are vulnerable to SIM swap and phishing, and push approvals to MFA fatigue. Phishing-resistant methods such as FIDO2 security keys, passkeys and certificate-based authentication are strongest because they are bound to the real site.
09

Users complain that a new firewall rule broke an application. How do you troubleshoot?

Network SecurityMedium
Save to ▾
Show answer
First check the firewall logs for denied traffic from the affected users or servers around the change time. Compare the change ticket with actual app requirements, since apps often use extra ports or dependencies. Use packet capture or a test connection to confirm. Then add a narrow rule for the real need, not an any-any rule, and update documentation so the next change does not repeat the problem.
10

What is the difference between a SIEM and a SOAR?

SOC Operations and SIEMEasy
Save to ▾
Show answer
A SIEM collects and correlates logs to detect threats. SOAR, Security Orchestration, Automation and Response, takes alerts and runs playbooks that enrich, decide and act, for example looking up an IP's reputation, querying EDR, disabling a user and opening a ticket. SIEM answers what is happening; SOAR speeds up the response. Many platforms now combine both, but automation still needs human approval for disruptive actions.
11

What is Certificate Transparency?

Cryptography and PKIHard
Save to ▾
Show answer
Certificate Transparency requires publicly trusted CAs to log every issued certificate in public append-only logs. Browsers require proof of logging before trusting a certificate. Domain owners can monitor these logs to detect certificates issued for their domains without permission, for example by a compromised CA or a phishing actor. Security teams also use CT logs for subdomain discovery and asset inventory.
12

What is the difference between IDS and IPS?

Network SecurityEasy
Save to ▾
Show answer
An Intrusion Detection System monitors traffic or hosts and raises alerts but does not block. An Intrusion Prevention System sits inline and can drop malicious packets in real time. IDS is safer for tuning because false positives do not break traffic, while IPS gives active protection. Detection can be signature based, as in Snort and Suricata rules, or anomaly based using baselines of normal behaviour.
13

How do you write a Splunk search to find brute-force attempts on Windows?

SOC Operations and SIEMMedium
Save to ▾
Show answer
Search failed logon events, count per account and source, and filter high counts. index=wineventlog EventCode=4625 | stats count AS failures dc(TargetUserName) AS users BY IpAddress | where failures > 50 | sort - failures A high distinct user count from one IP points to password spraying rather than a single account brute force.
14

What is the difference between hashing and encryption?

Security FundamentalsEasy
Save to ▾
Show answer
Encryption is reversible with the right key and protects confidentiality. Hashing is a one-way function that produces a fixed-length digest and is used for integrity checks and password storage. SHA-256 of a file lets you detect tampering, but you cannot get the file back from the hash. Passwords should be stored with slow salted hashes such as Argon2id or bcrypt, never encrypted or with plain SHA-256.
15

Explain the difference between symmetric and asymmetric encryption at a basic level.

Security FundamentalsEasy
Save to ▾
Show answer
Symmetric encryption uses one shared key for encryption and decryption, such as AES; it is fast and used for bulk data. Asymmetric encryption uses a public and private key pair, such as RSA or elliptic curve keys; it is slower but solves key distribution and enables digital signatures. Real protocols like TLS combine them: asymmetric methods agree on a session key, then AES encrypts the traffic.
16

How does a VPN protect traffic and what are its limits?

Network SecurityMedium
Save to ▾
Show answer
A VPN creates an encrypted tunnel, using IPsec, WireGuard or TLS, between a client and a network, protecting data on untrusted networks. Its limits are important: once connected, users often get broad network access, and VPN appliances are a frequent target for exploited vulnerabilities. That is why many companies move to Zero Trust Network Access, which grants per-application access after identity and device checks.
17

What is a SIEM and what does it do?

SOC Operations and SIEMEasy
Save to ▾
Show answer
A Security Information and Event Management platform collects logs from firewalls, endpoints, servers, cloud and applications, normalises them, stores them for search and correlates events to raise alerts. Examples are Splunk, Microsoft Sentinel, IBM QRadar, Elastic Security and Google Security Operations. A SIEM supports detection, investigation, dashboards and compliance reporting. Its value depends on good log sources, parsing and tuned rules.
18

A developer wants to write their own encryption algorithm for customer data. How do you respond?

Cryptography and PKIEasy
Save to ▾
Show answer
I would advise against it. Custom cryptography almost always has flaws that experts would find, and it fails audits. Instead, use well-reviewed libraries such as libsodium, platform crypto APIs, or the cloud KMS with AES-GCM and envelope encryption. I would offer to help choose the right library and key management design, and include a security review in the feature's pull request.
19

What are India's CERT-In incident reporting requirements?

Incident Response and ForensicsMedium
Save to ▾
Show answer
Under the CERT-In directions issued in April 2022, service providers, intermediaries, data centres and body corporates must report specified cyber incidents to CERT-In within six hours of noticing them. They must also keep ICT system logs for 180 days within India and synchronise clocks with NTP servers of NIC or NPL. Reportable incidents include ransomware, data breaches, and attacks on servers and cloud systems.
20

What is a firewall and what types exist?

Network SecurityEasy
Save to ▾
Show answer
A firewall enforces rules on traffic between networks. Packet-filtering firewalls check IP, port and protocol. Stateful firewalls track connections and allow return traffic automatically. Next-generation firewalls add application awareness, user identity, TLS inspection, IPS and URL filtering. Web application firewalls protect HTTP applications from attacks such as SQL injection. Host firewalls like Windows Defender Firewall or nftables protect individual machines.
21

You receive an alert for 300 failed logins on one account followed by a success. How do you triage it?

SOC Operations and SIEMMedium
Save to ▾
Show answer
This pattern suggests brute force or password spraying that succeeded. Check source IPs, location and logon type, and whether MFA was used for the success. Review what the account did after login, such as mailbox rules, file access or new tokens. If suspicious, disable the account or revoke sessions, reset the password, block source IPs and check whether the same IPs targeted other accounts.
22

Describe a time you had to admit you did not know something in a technical discussion.

Cryptography and PKIEasy
Save to ▾
Show answer
Situation: in a design review, an architect asked me whether our VPN supported post-quantum key exchange. Task: give an accurate answer. Action: I said I did not know rather than guessing, checked the vendor documentation and release notes that afternoon and shared a short summary with options. Result: the team trusted my answers more, and the finding was added to our cryptography roadmap.
23

A user on the office LAN reports repeated certificate warnings and you suspect ARP spoofing. What is happening and how do you stop it?

Network SecurityMedium
Save to ▾
Show answer
ARP has no authentication, so an attacker on the same LAN can send fake ARP replies linking their MAC address to the gateway's IP. Victims then send traffic through the attacker, enabling man-in-the-middle interception. Defences include Dynamic ARP Inspection with DHCP snooping on switches, port security, network access control, and encrypting traffic end to end with TLS so intercepted data is useless.
24

What is business continuity and disaster recovery, and what are RTO and RPO?

GRC and ComplianceEasy
Save to ▾
Show answer
Business continuity keeps critical business functions running during disruption, while disaster recovery restores IT systems. Recovery Time Objective is the maximum acceptable downtime, and Recovery Point Objective is the maximum acceptable data loss measured in time. A payments system may need an RTO of one hour and an RPO near zero, which needs replication, while an internal wiki may accept a day.
25

What are passkeys?

Identity and Access ManagementMedium
Save to ▾
Show answer
Passkeys are FIDO2 credentials that replace passwords. The device creates a key pair per website; the private key stays in the device or synced password manager, protected by biometrics or PIN, and the server stores only the public key. Login is a signature over a challenge tied to the real domain, so passkeys resist phishing and cannot be reused across sites. They also remove password reset load.
26

What is the difference between a policy, a standard, a procedure and a guideline?

GRC and ComplianceEasy
Save to ▾
Show answer
A policy is a high-level management statement of intent, such as all data must be classified. A standard sets mandatory specific requirements, like AES-256 for confidential data. A procedure gives step-by-step instructions to meet the standard. A guideline is recommended but optional advice. This hierarchy lets policies stay stable while standards and procedures change with technology.
27

How do you keep your cloud security skills updated?

Cloud SecurityEasy
Save to ▾
Show answer
I follow provider security blogs and release notes, since services change monthly, and read incident write-ups to learn real attack paths. I practise in personal free-tier accounts with budget alerts, using deliberately vulnerable labs. I hold a cloud security certification and plan the next one. I also share short notes with my team, which helps me learn more deeply.
28

What is the principle of least privilege?

Security FundamentalsEasy
Save to ▾
Show answer
Least privilege means every user, service and application gets only the minimum access needed for its job, and only for as long as needed. It limits the damage from compromised accounts and insider mistakes. Examples are giving developers read-only production access, using separate admin accounts, and just-in-time elevation that expires after a few hours. Regular access reviews are needed because permissions tend to grow over time.
29

What is Identity and Access Management?

Identity and Access ManagementEasy
Save to ▾
Show answer
IAM is the set of processes and tools that manage digital identities and control their access to systems. It covers user provisioning and deprovisioning, authentication, authorisation, single sign-on, MFA, privileged access, access reviews and audit. Since most breaches involve stolen or misused credentials, IAM is a core security control. Common platforms include Microsoft Entra ID, Okta, Ping Identity and SailPoint for governance.
30

Attackers bypassed MFA by sending repeated push notifications until a user approved. How do you prevent this?

Identity and Access ManagementMedium
Save to ▾
Show answer
This is MFA fatigue. Enable number matching and show app and location context in push requests, limit the number of prompts, and alert on repeated denials. Move high-risk users and admins to phishing-resistant methods such as FIDO2 keys or passkeys. Train users to report unexpected prompts. Also revoke the attacker's sessions and review what they accessed.

Frequently asked questions

What happens in the Cyber Security telephonic interview round?

The telephonic or screening round is a 15-30 minute call with a recruiter or engineer. It checks your basics, your CV and whether you can explain Cyber Security concepts clearly without a screen to point at.

How do I clear the telephonic interview round?

Keep your CV in front of you and be ready to explain every line on it. Answer in short, clear sentences; there is no whiteboard, so structure matters. Take the call somewhere quiet and confirm the time in advance.

Which round comes next?

A typical order is online assessment, telephonic screening, one or two technical rounds, a managerial round and HR. Use the other round pages to practise each stage.

Practise every interview round

Online Assessment questionsTechnical Round questionsManagerial Round questionsRapid-Fire questionsHR & behavioural questionsFull mock interview

More ways to practise

Company-wise Cyber Security questionsExperience-wise Cyber Security questionsRole-wise Cyber Security questionsCity-wise Cyber Security questionsMost asked Cyber Security questionsScenario-based questionsPractical / hands-on questionsHR & behavioural questionsCyber Security mock interviewOnline assessment questionsTechnical round questionsManagerial round questionsCyber Security topic sheets