Cybersecurity Interview Questions and Answers: 60 Questions from Easy to Hard
This guide is for students and freshers in India preparing for security analyst, SOC and application security interviews, and for engineers with a few years of experience moving into security roles. It has 60 questions with answers in three levels: the core ideas every fresher must explain clearly, such as the CIA triad, common attacks, MFA and hashing; the day-to-day work of an analyst, such as OWASP Top 10 fixes, SIEM rules, CVSS scoring, incident handling and cloud permissions; and the design questions asked of senior candidates. Hashes, scores and numbers in the answers were computed, not guessed. Everything is written from the defender's side. Answer each question aloud before reading ours, then take the mock test.
- 60 questions, 3 levels
- Updated
- CoreHRx Jobs
- 971 open Cybersecurity jobs
What cybersecurity interviews cover
- Foundations: the CIA triad, threats versus vulnerabilities versus risk, least privilege and defence in depth, and the common attacks: phishing, malware, ransomware and DDoS.
- Application security: the OWASP Top 10 (2021 edition), injection and XSS, broken access control, secure cookies and sessions, and how authentication and MFA really work.
- Cryptography and networks: hashing versus encryption, TLS and certificates, firewalls, IDS and IPS, VPNs, segmentation and zero trust.
- Security operations: SOC roles, SIEM alerts and triage, the incident response lifecycle, vulnerability management and CVSS scoring.
- For experienced roles: cloud security and the shared responsibility model, threat modelling, secrets and key management, and Indian duties such as CERT-In incident reporting and the DPDP Act 2023.
How to prepare (freshers and experienced)
- Freshers: learn the vocabulary precisely. Interviewers check whether you can tell a threat from a vulnerability, or authentication from authorisation, in one clear sentence each.
- Build a small lab on your own machine: a Linux VM with a firewall, a web server with TLS, and its logs sent to a free log or SIEM tool. Explaining what you saw beats reciting definitions.
- Practise the numbers: read a CVSS vector and work out its band, compute a SHA-256 hash and a base64 string with openssl, and check whether an IP address falls inside a subnet.
- Read the primary sources: the OWASP Top 10 pages, NIST SP 800-61 on incident response, and the CERT-In directions of April 2022, so you quote them correctly.
- Experienced candidates: prepare two or three real stories, such as an incident you handled, a vulnerability you drove to closure or a control you designed, with the trade-off and the result.
Common mistakes and interview-day tips
- Do not call encoding or hashing encryption. Base64 can be reversed by anyone, a hash cannot be reversed at all, and only encryption uses a key to get the data back.
- Do not treat a CVSS score as risk. Severity is one input; exposure, exploitation in the wild and the value of the asset decide what gets fixed first.
- Stay on the defensive side: explain how an attack works in concept and how to prevent and detect it. Never describe testing a system you are not authorised to test.
- In incident scenarios, contain and preserve evidence before you clean up, and say who you would inform: the incident lead, legal, CERT-In and affected people where the law requires it.
- If you do not know a tool or a standard, say so and explain how you would find out. Inventing a command or a clause is worse than an honest answer.
Cybersecurity interview questions: Easy questions (freshers)
20 questions1. What is the CIA triad? Give an example of each part.
The CIA triad is the three goals every security control serves: confidentiality, integrity and availability. Confidentiality means only authorised people can read data, for example salary slips visible only to the employee and HR. Integrity means data is not changed without authorisation, so a transfer amount cannot be altered in transit. Availability means systems work when needed, so a UPI app stays up on salary day. Controls can trade one for another: strong encryption protects confidentiality, but a lost key hurts availability.
2. What is the difference between a vulnerability, a threat, an exploit and a risk?
A vulnerability is a weakness, such as an unpatched web server or a weak password. A threat is someone or something that could take advantage of it, such as a ransomware group or a careless insider. An exploit is the technique or code that actually uses the weakness. Risk combines them: the likelihood that a threat uses a vulnerability, times the impact on the business. A critical bug on a laptop with no network access is lower risk than a medium bug on an internet-facing payment API.
3. What do least privilege and defence in depth mean?
Least privilege means every user, service and process gets only the access it needs, for only as long as it needs it. A support executive who reads tickets should not be able to export the whole customer table. Defence in depth means layering independent controls so one failure does not cause a breach: MFA, a firewall, patched servers, encryption, monitoring and backups. If phishing steals a password, MFA stops the login; if MFA is bypassed, least privilege limits what the attacker reaches, and monitoring raises an alert.
4. What is the difference between authentication and authorisation?
Authentication answers "who are you?" and authorisation answers "what are you allowed to do?". Logging in with a password and an OTP is authentication. Checking that the logged-in manager may approve leave only for their own team is authorisation. Authentication happens once per session, but authorisation must be checked on the server for every request and every object. Many breaches involve a properly logged-in user reading someone else's data because that check was missing, which is why Broken Access Control is A01 in the OWASP Top 10 2021.
5. What is multi-factor authentication, and are all second factors equally strong?
MFA requires two or more different kinds of proof: something you know (a password or PIN), something you have (a phone or a hardware key) or something you are (a fingerprint). Two passwords are not MFA because both are the same kind. Factors differ in strength. SMS OTPs can be lost to SIM swap fraud or typed into a fake page. Authenticator app codes are better, push approvals need number matching to resist MFA fatigue, and FIDO2 keys or passkeys are phishing-resistant because they are bound to the real website.
6. What does a good password policy look like today?
Modern guidance such as NIST SP 800-63B favours length over composition rules. Allow long passphrases, check new passwords against lists of breached and common passwords, and do not force periodic changes without a sign of compromise, because forced rotation turns Welcome@123 into Welcome@124. Allow paste so people can use password managers, rate-limit and lock out repeated failures, and add MFA. On the server, store passwords only as a slow salted hash such as Argon2id or bcrypt, never as plain text or reversible encryption.
7. What is the difference between encoding, hashing and encryption?
Encoding changes the format of data so it travels safely, and anyone can reverse it without a key: base64 turns admin:Pune@2025 into YWRtaW46UHVuZUAyMDI1 and back, as these openssl commands show. Hashing is one-way: SHA-256 turns any input into a fixed 256-bit digest that cannot be turned back, used for integrity checks and, with salts and slow algorithms, for passwords. Encryption is reversible only with a key, as with AES. HTTP Basic authentication only base64-encodes the password, so it is safe only inside TLS.
$ printf '%s' 'admin:Pune@2025' | openssl base64
YWRtaW46UHVuZUAyMDI1
$ echo 'YWRtaW46UHVuZUAyMDI1' | openssl base64 -d
admin:Pune@20258. What is the difference between symmetric and asymmetric encryption?
Symmetric encryption uses one shared secret key to encrypt and decrypt, as in AES. It is very fast, so it protects bulk data such as disks and the body of a TLS session, but both sides must already share the key safely. Asymmetric encryption uses a key pair: a public key anyone may have and a private key kept secret, as in RSA or elliptic-curve cryptography. It solves key exchange and enables digital signatures, but it is much slower. TLS combines them: asymmetric keys authenticate the server and agree on a session key, then AES or ChaCha20 encrypts the data.
9. What does HTTPS protect, and what does the padlock NOT tell you?
HTTPS is HTTP over TLS. It encrypts traffic in transit, so people on the same Wi-Fi or along the network path cannot read or silently change it, and the certificate proves the server controls the domain name shown. The padlock does not mean the site is honest: a phishing site on a look-alike domain can get a valid certificate for free. It also says nothing about how the server stores your data, whether it is patched, or whether a page has an XSS bug. Users should check the exact domain, not just the padlock.
10. What are the common types of phishing, and how do you spot one?
Phishing tricks people into clicking a link, opening an attachment or sharing credentials. Spear phishing targets a named person with researched details, whaling targets senior leaders, smishing uses SMS and vishing uses calls, such as a fake bank KYC update. Business email compromise impersonates a vendor or the CFO to redirect a payment. Warning signs are urgency, a sender domain that is slightly off, a link whose real address differs from its text and requests to skip the normal process. Back training with email filtering, SPF, DKIM, DMARC and MFA.
11. What are the main types of malware?
A virus attaches to a file or program and spreads when it is run. A worm spreads by itself across a network by abusing a vulnerability, with no user action. A trojan pretends to be useful software, such as a cracked app, and carries a hidden payload. Ransomware encrypts files and demands payment, and modern groups often steal data first. Spyware and keyloggers capture activity, and a rootkit hides deep in the system. Defences are layered: endpoint protection or EDR, patching, application allow-listing, least privilege, email filtering and user awareness.
12. How does ransomware usually get in, and how do you limit the damage?
Common entry points are phishing emails, stolen VPN or remote desktop passwords without MFA, and unpatched internet-facing servers. Once inside, attackers move laterally, gain admin rights, delete backups and then encrypt, often after stealing data for double extortion. Prevention is MFA on remote access, fast patching of exposed systems, least privilege and segmentation. The key recovery control is the 3-2-1 rule: three copies of data on two kinds of media with one offsite, plus at least one offline or immutable copy the attacker cannot delete. Test restores regularly.
13. What is the difference between a DoS and a DDoS attack, and how are they mitigated?
A denial-of-service attack tries to make a service unavailable, attacking the A in the CIA triad. A DoS comes from one source, so blocking that source often works. A distributed DoS comes from thousands of compromised devices in a botnet, such as hacked cameras and routers, so simple IP blocking fails. Volumetric attacks flood bandwidth, protocol attacks such as SYN floods exhaust connection tables, and application-layer attacks send costly but valid-looking requests. Mitigation includes DDoS protection services or a CDN, rate limiting, caching and a plan agreed with the ISP in advance.
14. What does a firewall do, and what is the difference between stateless and stateful filtering?
A firewall allows or blocks traffic by rules on addresses, ports and protocols, and the safest base rule is deny by default. These ufw rules on an Ubuntu web server block all incoming traffic except SSH from the office network 10.20.0.0/16 and HTTPS from anywhere. A stateless filter judges each packet alone, so reply traffic needs its own rules. A stateful firewall tracks connections and allows replies to traffic it already permitted; ufw is stateful because it uses netfilter connection tracking. Next-generation firewalls add application awareness and intrusion prevention.
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow from 10.20.0.0/16 to any port 22 proto tcp
sudo ufw allow 443/tcp
sudo ufw enable15. What is the difference between an IDS and an IPS?
An intrusion detection system watches network or host activity and raises alerts; it is passive and stops nothing. An intrusion prevention system sits inline in the traffic path and can drop or block malicious traffic in real time. Both use signatures for known attacks and anomaly detection for unusual behaviour. The trade-off is false positives: an IDS false positive costs an analyst some time, but an IPS false positive blocks real customers, so new IPS rules often run in detect-only mode first. Snort and Suricata are well-known open-source engines that support both modes.
16. What does a VPN protect, and what does it not protect?
A VPN creates an encrypted tunnel between a device and a network, so an employee working from a Hyderabad hotel can reach internal systems without anyone on the hotel Wi-Fi reading the traffic. Site-to-site VPNs, often IPsec, link offices over the internet. A VPN does not make the device safe: a laptop with malware brings the malware inside. It also tends to grant broad network access, and VPN gateways are a favourite target when unpatched or protected by a password alone. So add MFA, patch VPN appliances fast and move towards per-application zero trust access.
17. What is the OWASP Top 10? Name the categories in the 2021 edition.
It is an awareness list of the most critical web application security risks, built from vulnerability data and a community survey. The 2021 list: A01 Broken Access Control, A02 Cryptographic Failures, A03 Injection (now including XSS), A04 Insecure Design, A05 Security Misconfiguration, A06 Vulnerable and Outdated Components, A07 Identification and Authentication Failures, A08 Software and Data Integrity Failures, A09 Security Logging and Monitoring Failures, A10 Server-Side Request Forgery. It is a starting point; OWASP ASVS is the detailed checklist.
18. What is SQL injection, and how does a parameterised query prevent it?
SQL injection happens when user input is pasted into an SQL string, so quotes or SQL keywords in the input change the query itself and can expose or modify data. A parameterised query fixes the SQL text and sends the value separately, so the database always treats it as data. With this sqlite3 function, Pune returns Asha, a value with an apostrophe such as D'Souza is handled safely, and input stuffed with quotes and OR conditions matches no city and returns an empty list. Add least-privilege database accounts as an extra layer, and never rely on escaping alone.
import sqlite3
def find_by_city(conn, city):
# Unsafe would be: f"... WHERE city = '{city}'"
sql = "SELECT emp_id, name FROM employees WHERE city = ?"
return conn.execute(sql, (city,)).fetchall()19. What is a SOC, and what does a SIEM do?
A Security Operations Centre is the team, process and tools that monitor an organisation around the clock, investigate alerts and respond to incidents. L1 analysts triage alerts, L2 analysts investigate deeper, and L3 analysts or threat hunters handle complex cases and improve detections. A SIEM (security information and event management) system collects logs from firewalls, servers, endpoints, cloud accounts and applications, normalises them, correlates events with rules, raises alerts and keeps logs searchable. A SIEM is only as good as its log sources: missing logs mean missing detections.
20. What are CVE, CWE and CVSS?
A CVE ID names one specific, publicly known vulnerability in a product, such as CVE-2021-44228 for Log4Shell in Apache Log4j. A CWE names the type of weakness behind it, such as CWE-89 for SQL injection or CWE-79 for cross-site scripting. CVSS gives a severity score from 0.0 to 10.0; in version 3.1, 0.1 to 3.9 is Low, 4.0 to 6.9 Medium, 7.0 to 8.9 High and 9.0 to 10.0 Critical. Together they let a team track, classify and prioritise fixes. A common mistake is to treat the CVSS score as the business risk.
Ready to check yourself? Take the free Cybersecurity mock test
Cybersecurity interview questions: Medium questions (1-3 years)
20 questions21. Why is plain SHA-256 a bad way to store passwords?
SHA-256 is built to be fast, and fast is bad for passwords. Welcome@123 always gives the same digest shown here, so every user with that password has an identical hash, and attackers can precompute tables or test billions of guesses per second on GPUs. A random per-user salt makes the hashes differ (adding the salt k9Q2 gives a completely different value), which defeats precomputed tables, but it does not slow guessing. Use a slow, memory-hard algorithm such as Argon2id, scrypt or bcrypt with a tuned cost; they handle the salt for you.
>>> import hashlib
>>> hashlib.sha256(b'Welcome@123').hexdigest()
'c75f28325cfa028ea13872f977a29e0e87c99a4f390fe260f24d7e1f05fb8d75'
>>> hashlib.sha256(b'k9Q2' + b'Welcome@123').hexdigest()[:16]
'325ad57708ad3910'22. How does a browser decide to trust a website's certificate, and how do you inspect one?
Trust comes from a chain: the server certificate is signed by an intermediate CA, which is signed by a root CA in the browser or operating system trust store. The browser checks each signature up the chain, that today falls inside the validity dates, that the hostname matches a Subject Alternative Name, and, in a way that varies by browser, that it is not revoked. In this openssl output the subject and the issuer are the same, so the certificate is self-signed and browsers will warn. In audits, also check expiry dates and that the server sends the full intermediate chain.
$ openssl x509 -in server.crt -noout -subject -issuer -dates -ext subjectAltName
subject=CN = portal.example.in
issuer=CN = portal.example.in
notBefore=Nov 14 13:48:18 2026 GMT
notAfter=Feb 12 13:48:18 2027 GMT
X509v3 Subject Alternative Name:
DNS:portal.example.in, DNS:www.portal.example.in23. What happens in a TLS 1.3 handshake, and what is forward secrecy?
The client sends a ClientHello with its cipher suites and an ephemeral (EC)DHE key share; the server answers with its own key share, and both derive session keys. The server then proves its identity with its certificate and a signature, already encrypted, so a full handshake needs one round trip. TLS 1.3 removed static RSA key exchange and old ciphers, keeping only AEAD suites such as AES-GCM and ChaCha20-Poly1305. Because every session uses fresh ephemeral keys, stealing the server's private key later cannot decrypt recorded traffic. That is forward secrecy.
24. What is an IDOR, and how should an API prevent it?
An insecure direct object reference is a broken access control bug: the API trusts an ID from the request without checking that this user may access that object. If GET /payslips/502 returns Vikram's slip to Asha just because she is logged in, that is an IDOR. The fix is a server-side check on every request. This function returns 200 for Asha's own slip, 403 for a colleague's and 404 for another company's, while HR sees slips in its own company only. Random IDs make guessing harder, but they are not access control; the ownership check is.
def get_payslip(slip_id, user):
slip = SLIPS.get(slip_id)
# Another company's record looks the same as a missing one
if slip is None or slip['org_id'] != user['org_id']:
return 404
if slip['emp_id'] != user['emp_id'] and user['role'] != 'hr':
return 403
return 20025. What are the types of XSS, and how do you defend against them?
Cross-site scripting lets attacker-supplied script run in another user's browser on your site, where it can steal data or act as that user. Stored XSS is saved in the database, such as in a comment; reflected XSS bounces off a request parameter; DOM-based XSS happens in client-side code that writes untrusted data into the page. The main defence is context-aware output encoding (HTML, attribute, JavaScript and URL contexts differ) with frameworks that escape by default. A Content Security Policy like this one is a second layer that blocks inline and third-party scripts.
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'26. What is CSRF, and how do SameSite cookies and tokens prevent it?
Cross-site request forgery makes a logged-in user's browser send an unwanted request to your site from another site, such as a hidden form that changes the payout bank account, because the browser attaches the session cookie automatically. Defences: a random anti-CSRF token in every state-changing form or header, checked by the server; SameSite=Lax or Strict cookies, which browsers do not send on most cross-site requests; and never changing state with GET. In this header, Secure keeps the cookie on HTTPS and HttpOnly hides it from JavaScript.
Set-Cookie: sid=YOUR_SESSION_ID; Path=/; Secure; HttpOnly; SameSite=Lax27. Give real examples of security misconfiguration (OWASP A05:2021) and how to catch them.
Misconfiguration is a secure product set up insecurely. Examples: default admin passwords on a router or database, a public cloud storage bucket, directory listing turned on, stack traces and SQL errors shown to users, an exposed .env or .git folder on a web server, debug mode in production, needless open ports and missing security headers. Catch them with hardened base images, reviewed configuration as code, CIS benchmarks, scanners and cloud posture tools, and a deploy check that requests sensitive paths and expects a 403 or 404. Re-check often, because configuration drifts.
28. How would you write a SIEM rule to detect a brute-force login attempt?
Count failures per source and account in a time window and alert above a threshold. On a sample table this query returns one row: 11 failures for ravi.k from 203.0.113.45 between 02:01:05 and 02:04:50, while anita.s, with one typo and then a success, is ignored. The strongest signal is a success right after the failures, here at 02:05:10, so a good rule joins the two and raises severity. Also watch one IP failing across many accounts (password spraying) and tune thresholds to your baseline. SIEMs have their own query languages, but the logic is the same.
-- login_events(ts, user, src_ip, result)
SELECT src_ip, user, COUNT(*) AS fails,
MIN(ts) AS first_fail, MAX(ts) AS last_fail
FROM login_events
WHERE result = 'fail'
AND ts >= '2025-03-10 02:00:00'
AND ts < '2025-03-10 02:10:00'
GROUP BY src_ip, user
HAVING COUNT(*) >= 10;29. An L1 SOC analyst gets an alert. How should they triage it?
First understand the alert: which rule fired, on which asset and user, and which raw events triggered it. Then add context: is the asset critical, is the user a VIP or a service account, has this alert been a false positive before, and do threat intelligence sources know the IP, domain or file hash? Check related activity in a window around the event. Then decide: false positive (document it and suggest tuning), benign true positive (expected admin work) or true positive (escalate to L2 with a clear timeline). Write notes in the ticket so the next analyst can follow your reasoning.
30. What are the phases of incident response?
NIST SP 800-61 Rev. 2 describes four phases. Preparation: plans, contacts, tools, logging and training before anything happens. Detection and analysis: confirming an incident, its scope and its severity. Containment, eradication and recovery: isolating affected systems, removing the cause and restoring safely. Post-incident activity: lessons learned and improvements. SANS splits the same work into six steps, and Rev. 3 (2025) maps it onto the NIST CSF 2.0 functions. The key idea is a cycle: lessons from each incident feed better preparation and detection for the next one.
31. A laptop in your Pune office shows signs of compromise. Why should you not simply switch it off and reimage it?
Switching off destroys volatile evidence: running processes, network connections, logged-in sessions and malware that lives only in memory. Reimaging at once destroys the disk evidence too, so you never learn how the attacker got in or what else they touched. Instead, isolate the device from the network (EDR network containment is ideal) while keeping it powered, capture memory and key artefacts in order of volatility, then image the disk. Record who handled each item and when, with hashes of the images, to keep a chain of custody. Reimage only after the investigation is done.
32. Read this CVSS v3.1 vector. What is its base score, and what does each metric mean?
The vector says: attack vector network (reachable remotely), attack complexity low, no privileges required, no user interaction, scope unchanged, and high impact on confidentiality, integrity and availability. With the FIRST v3.1 formulas the impact sub-score is about 5.87 and exploitability about 3.89; their sum, rounded up, gives 9.8, Critical. With PR:L and impact C:H/I:N/A:N instead, the score falls to 6.5, Medium, because the attacker needs an account and can only read data. Always quote the vector with the score so others can check the reasoning.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H33. Why is patching by CVSS score alone a poor prioritisation strategy?
A CVSS base score measures the technical severity of a flaw in general, not the risk to your company. A 9.8 on an isolated test server may matter less than a 7.5 on an internet-facing payment gateway that attackers are already exploiting. Better prioritisation combines severity with evidence of exploitation (the CISA Known Exploited Vulnerabilities catalogue, EPSS probabilities from FIRST), exposure, asset criticality, data sensitivity and compensating controls such as a WAF rule. Set fix deadlines by that combined risk, and give every exception an owner and an expiry date.
34. What is the difference between a vulnerability scan, a penetration test and a red team exercise?
A vulnerability scan is automated and broad: a tool checks systems for known missing patches and misconfigurations, often weekly, and reports many findings, including false positives. A penetration test is a time-boxed manual assessment by authorised testers who confirm which weaknesses are really exploitable and how they chain, within an agreed scope. A red team exercise is goal-based and covert, testing whether the SOC detects and responds to a realistic adversary. All need written authorisation and rules of engagement; unauthorised access can attract penalties under India's IT Act, 2000.
35. Explain the cloud shared responsibility model with IaaS, PaaS and SaaS examples.
The provider always secures the data centres, hardware and core infrastructure; the customer always owns its data, identities and access decisions. The middle depends on the service. With IaaS, such as a virtual machine, the customer patches the operating system, sets firewall rules and secures the application. With PaaS, such as a managed database, the provider patches the engine, but the customer still controls network access, users and encryption settings. With SaaS, such as email, the customer mainly manages users, MFA and sharing. Most cloud breaches are customer-side misconfigurations.
36. In AWS IAM, how would you write a least-privilege policy for a service that only reads one folder of a bucket?
This policy allows exactly one action, reading objects, on one prefix of one bucket; IAM denies by default, so unless another policy grants them, listing, writing, deleting and other prefixes stay blocked. Common mistakes are wildcards such as s3:* or Resource *, attaching policies to long-lived users instead of roles with temporary credentials, and keeping permissions after a project ends. Start narrow, use the access analyser and last-used data to remove unused rights, and add conditions where needed. The Version value is the fixed date of the policy language, not today's date.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "ReadMumbaiReports",
"Effect": "Allow",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::payroll-reports-prod/mumbai/*"
}
]
}37. A firewall rule allows 192.168.40.0/21. Which of these addresses does it cover?
A /21 mask is 255.255.248.0, leaving 11 host bits, so the block holds 2,048 addresses: 192.168.40.0 to 192.168.47.255. The third octet steps in eights (40, 48, 56), so 192.168.47.200 is inside, while 192.168.48.10 and 192.168.39.255 are outside, as Python's ipaddress module confirms. This matters in rule reviews: a rule meant for one /24 office VLAN but written as a /21 silently opens access to eight /24 networks. Check ranges with a tool rather than by eye, and use the smallest range that works.
>>> import ipaddress
>>> net = ipaddress.ip_network('192.168.40.0/21')
>>> net[0], net[-1], net.num_addresses
(IPv4Address('192.168.40.0'), IPv4Address('192.168.47.255'), 2048)
>>> [ipaddress.ip_address(a) in net for a in
... ('192.168.47.200', '192.168.48.10', '192.168.39.255')]
[True, False, False]38. How do you estimate password strength in bits of entropy, and why are passphrases recommended?
For a secret chosen truly at random, entropy is length times log2 of the alphabet size. Eight random lowercase letters give about 37.6 bits, about 2 x 10^11 guesses, which a rig testing 10 billion fast hashes a second exhausts in about 21 seconds. Twelve random characters from letters and digits give about 71.5 bits. Four random words from a 7,776-word list give about 51.7 bits and six give 77.5, while staying easy to remember. The formula holds only for random choice: Welcome@123 has far less real entropy, because attackers guess common patterns first.
39. What do the CERT-In directions of April 2022 require from organisations in India?
The directions of 28 April 2022, issued under section 70B of the IT Act, require service providers, intermediaries, data centres, body corporates and government bodies to report specified cyber incidents to CERT-In within 6 hours of noticing them or being told of them. They must keep ICT system logs for a rolling 180 days within India and synchronise clocks with the NTP servers of NIC or NPL, or servers traceable to them. Data centre, VPS, cloud and VPN providers must also keep certain subscriber records. Check the current text and FAQs, since guidance is updated.
40. What does India's DPDP Act 2023 mean for a security team?
The Digital Personal Data Protection Act, 2023 covers digital personal data. The organisation that decides why and how data is processed is the data fiduciary, the person is the data principal, and a vendor processing for it is a data processor. For security teams the key duties are reasonable safeguards to prevent a personal data breach, the same from vendors, and, after a breach, informing the Data Protection Board of India and each affected data principal. As enacted, failing to take reasonable safeguards can draw a penalty of up to Rs 250 crore. The Rules set the detailed timelines.
Ready to check yourself? Take the free Cybersecurity mock test
Cybersecurity interview questions: Hard questions (experienced)
20 questions41. How would you threat model a new UPI payment feature in a Bengaluru fintech app?
Start with a data flow diagram: the mobile app, API gateway, payment service, database, the bank or payment provider and its callback, with trust boundaries wherever data crosses from the phone, internet or a third party. Walk each element through STRIDE: spoofing (a forged callback), tampering (changing the amount between app and server), repudiation (no audit trail), information disclosure (UPI IDs in logs), denial of service and elevation of privilege. Record a mitigation, owner and test for each, such as signed callbacks and server-side amount checks.
42. What is zero trust, and how is it different from a VPN-based perimeter?
The perimeter model trusts whatever is inside the network: once a user or malware is on the VPN, it can reach many systems. Zero trust, described in NIST SP 800-207, removes trust based on network location. Each request to each resource is authenticated and authorised by a policy engine using identity, device health and context, and enforced close to the resource, with least privilege and continuous monitoring. In practice: strong MFA, device posture checks, an identity-aware proxy per application instead of network-wide access, and micro-segmentation. It is a programme, not a product.
43. What are the common security mistakes with JWT-based sessions?
First, a JWT is signed, not encrypted: the header decoded here and the payload are plain base64url, so never put secrets or sensitive personal data in them. Validation mistakes are common: accepting alg none, letting the token choose its algorithm so an RSA public key gets used as an HMAC secret, skipping expiry, issuer and audience checks, or a weak HMAC secret. Long-lived tokens are hard to revoke. Use a vetted library with a fixed algorithm, short-lived access tokens, rotating refresh tokens tracked server-side so they can be revoked, and HttpOnly cookies in browsers.
>>> import base64
>>> base64.urlsafe_b64decode('eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9')
b'{"alg":"HS256","typ":"JWT"}'44. Why are passkeys and FIDO2 keys called phishing-resistant, when OTPs are not?
An OTP is a code the user types, so a convincing fake login page can relay the password and OTP to the real site in real time and take the session; push approvals can be abused by MFA fatigue spam. With FIDO2 and WebAuthn, the authenticator holds a separate key pair per site and signs a challenge together with data that includes the real origin. A look-alike domain cannot get a valid response for the genuine site, and the server stores only a public key, so there is no shared secret to steal. The trade-offs are account recovery and older devices.
45. How does envelope encryption with a KMS work, and why use it?
Each piece of data is encrypted with its own data encryption key (DEK), for example with AES-256-GCM, and the DEK is then encrypted with a key encryption key (KEK) that never leaves the key management service or HSM. The encrypted DEK is stored beside the data. To read, the service asks the KMS to decrypt the DEK, a call that is authorised and logged, then decrypts locally. This keeps bulk encryption fast, limits what one leaked DEK exposes, makes KEK rotation cheap because only small DEKs are re-wrapped, and gives an audit trail of every key use.
46. Why should you never use AES in ECB mode, and what goes wrong if a GCM nonce is reused?
ECB encrypts each 16-byte block on its own with the same key, so equal plaintext blocks give equal ciphertext blocks. This test with a throwaway key shows two repeated blocks encrypting to the same bytes: patterns leak without AES being broken. CBC and GCM mix in an IV or nonce, so repeats are hidden. GCM also authenticates the data, but its 96-bit nonce must never repeat under one key: a repeat exposes the XOR of the two plaintexts and lets an attacker forge authentication tags. Use a library's high-level AEAD API that manages nonces for you.
$ printf 'ATTENDANCE-OK-01ATTENDANCE-OK-01' | openssl enc \
-aes-128-ecb -nosalt -nopad \
-K 000102030405060708090a0b0c0d0e0f | xxd -p -c 16
13ac51304888cade0521fb04b371d9c7
13ac51304888cade0521fb04b371d9c747. How should a server verify a payment gateway's webhook signature?
Compute an HMAC-SHA256 of the exact raw request body with the shared secret and compare it with the signature header. In a test, the genuine body returns True, while a wrong signature or a body with a changed amount both return False. Details matter: hash the raw bytes before any JSON parsing, use compare_digest because an ordinary string compare can leak timing, keep the secret in a vault rather than in code, and reject old or repeated events by timestamp or event ID so a captured request cannot be replayed. A plain SHA-256 of body plus secret is no substitute for HMAC.
import hashlib, hmac
def verify_sig(raw_body: bytes, received: str, secret: bytes) -> bool:
expected = hmac.new(secret, raw_body, hashlib.sha256).hexdigest()
return hmac.compare_digest(expected, received)48. How would you design a SIEM and detection programme for a mid-sized Indian company?
Start from risks, not tools: list the attacks that matter (phishing to account takeover, ransomware, cloud misconfiguration, insider data theft) and map them to MITRE ATT&CK techniques. Onboard the log sources that detect them first: identity provider, EDR, email, firewall, VPN, cloud audit logs and key applications, with synced clocks. Control cost with hot storage for recent data and cheaper archives, keeping at least the 180 days the CERT-In directions require. Write detections as code with tests, track false-positive rates, measure time to detect and review coverage gaps every quarter.
49. How does an impossible-travel detection work, and how do you avoid false alarms?
Compare consecutive logins of the same user: take the great-circle distance between their geolocated IPs and divide by the time gap. Mumbai to Frankfurt is about 6,560 km by the haversine formula, so this 40-minute gap implies nearly 9,850 km/h, far beyond any flight, which points to stolen credentials or a stolen session. False positives come from VPNs, corporate proxies and cloud egress IPs that geolocate far away, and from mobile networks. Exclude known company egress IPs, use device and session IDs, and combine it with other signals such as a new device.
user time city lat lon
ravi.k 10:00 Mumbai 19.0760 72.8777
ravi.k 10:40 Frankfurt 50.1109 8.682150. You lead the response to ransomware spreading across a Chennai manufacturer's file servers. What do you do in the first hours?
Contain first: isolate affected hosts and segments, disable compromised accounts and cut the attacker's remote access, keeping systems powered for evidence. Start the incident plan with IT, leadership, legal and PR. Protect backups at once by confirming offline or immutable copies are untouched. Scope it: find the first infected host, the entry point and any data theft. Report to CERT-In within the 6-hour window of its 2022 directions, and assess DPDP breach duties if personal data is involved. Restore from clean backups only after the entry point is closed, or you will be reinfected.
51. How do you calculate MTTD and MTTR, and what do they tell you?
Mean time to detect is the average gap from the start of an incident to its detection; mean time to respond, as defined here, is the average gap from detection to resolution. For these three incidents the detection gaps are 3.5, 8 and 0.75 hours, so MTTD is about 4.08 hours; the response gaps are 3.5, 3.5 and 2.5 hours, so MTTR is about 3.17 hours. The overnight INC-2 pulls MTTD up: the median of 3.5 hours shows the typical case, and the pattern points to weak night-time monitoring. Define each timestamp clearly, because teams measure differently.
incident started detected resolved
INC-1 2025-04-02 08:00 2025-04-02 11:30 2025-04-02 15:00
INC-2 2025-04-09 22:10 2025-04-10 06:10 2025-04-10 09:40
INC-3 2025-04-18 13:00 2025-04-18 13:45 2025-04-18 16:1552. What does Scope mean in CVSS v3.1, and what changed in CVSS v4.0?
Scope is changed when exploiting one component affects resources beyond its security authority, such as stored XSS in a web app whose script runs in the victim's browser. This vector, a typical stored XSS needing a low-privilege account and a victim's click, scores 5.4, Medium; with S:U it would be 4.6, because a changed scope raises both the impact and the privilege weight. CVSS v4.0, published by FIRST in November 2023, drops Scope and rates impact on the vulnerable and subsequent systems separately, adds Attack Requirements and splits User Interaction into passive and active.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N53. How would you set up a vulnerability management programme that actually reduces risk?
It starts with an accurate asset inventory, including cloud and shadow IT, because you cannot patch what you do not know about. Scan continuously with authenticated scans, add software composition analysis for applications, and give every asset an owner. Prioritise by risk (exploited in the wild, exposure, asset criticality), set fix deadlines per risk tier and push tickets straight into the owning team's backlog. Allow exceptions only with compensating controls, an approver and an expiry date. Measure deadline compliance, mean time to remediate and the backlog of exploited flaws.
54. What is software supply chain risk, and how do you defend against it?
Most of an application is third-party code, so a vulnerable or malicious dependency becomes your problem: Log4Shell (CVE-2021-44228) showed one library flaw affecting thousands of products. OWASP covers this as A06 Vulnerable and Outdated Components and A08 Software and Data Integrity Failures. Keep an SBOM in SPDX or CycloneDX so you can answer "are we affected?" in minutes, run composition analysis in CI, pin versions with lock files, use trusted registries against typosquatted packages, sign build artefacts, for example with Sigstore, and protect CI/CD credentials.
55. What is SSRF, why is it dangerous in the cloud, and how do you defend against it?
Server-side request forgery (A10:2021) happens when a feature fetches a user-supplied URL, such as an image import, and the server is steered to internal addresses the user cannot reach. In the cloud the classic target is the metadata service at 169.254.169.254, which can hand out credentials. Use an allow-list of destinations where possible; otherwise resolve the host and reject non-public addresses (this check rejects 169.254.169.254, 127.0.0.1, 10.1.2.3 and 100.64.0.1 in Python 3.12), connect to the checked IP, block redirects and enforce IMDSv2.
import ipaddress
def is_public(addr: str) -> bool:
ip = ipaddress.ip_address(addr)
if ip.version == 6 and ip.ipv4_mapped:
ip = ip.ipv4_mapped
return ip.is_global and not ip.is_multicast56. How do you keep a large cloud estate securely configured across many accounts?
Combine guardrails, detection and automation. Guardrails: organisation-level policies (such as service control policies) that block risky actions like disabling audit logs or making buckets public, plus approved infrastructure-as-code modules scanned in CI before deployment. Detection: a cloud security posture management tool and native services check for misconfigurations continuously, with central, tamper-protected audit logs in a separate account. Automation: auto-fix low-risk issues and route the rest to owners with deadlines. Tag every resource with an owner.
57. How do teams detect leaked secrets in code, and what should happen when one is found?
Secret scanners combine patterns for known key formats with Shannon entropy, the average bits of information per character. Ordinary words score low (password is 2.75 bits per character) while random keys score near the maximum for their length: this 32-character token scores 5.0. Entropy alone flags hashes and IDs too, so scanners add context. Scan in pre-commit hooks, in CI and across the whole git history. When a secret leaks, rotate it at once and review its usage logs; deleting the commit is not enough, because clones keep it. Prefer short-lived credentials from a vault.
import math
from collections import Counter
def shannon(t):
n = len(t)
return -sum(c / n * math.log2(c / n) for c in Counter(t).values())
# password 2.75 bits per character
# 9fK2xQ7LmZ4pT8vR 4.0
# Tz8pQ1vR6wK3nX9bL2mY5cJ7hF0dS4gA 5.058. Where do SAST, DAST, SCA and manual security testing fit in a CI/CD pipeline?
SAST scans source code for insecure patterns, such as SQL built from strings; it runs early, on every pull request, but gives false positives and cannot see runtime configuration. SCA checks dependencies for known vulnerabilities and licences on every build. DAST tests the running application from outside in staging, finding issues like missing headers, but needs authenticated coverage. Secret and IaC scanning run on every commit. None replaces threat modelling or manual testing of business logic, such as one user approving another team's expense. Block builds only on sure findings.
59. How do you design security logging that meets CERT-In log retention and still respects DPDP data minimisation?
The two goals pull in opposite directions: the 2022 CERT-In directions expect ICT logs for a rolling 180 days in India, while the DPDP Act expects personal data to be limited, protected and erased when no longer needed. Log events, not content: who did what, when and from where, using user IDs rather than names, and never passwords, OTPs, tokens or full card or Aadhaar numbers. Pseudonymise identifiers where investigations allow, encrypt log stores, restrict and audit access to them, and delete automatically after the documented retention period, with the legal basis written into policy.
60. How would you protect a public API from large DDoS attacks while keeping it available?
Layer the defence. At the edge, use an anycast CDN or DDoS protection service that absorbs volumetric floods across many locations, and hide the origin IP so attackers cannot go around it. Against protocol attacks, rely on SYN cookies and connection limits at the load balancer. For application-layer floods, use rate limits per IP, user and API key, WAF rules, caching of expensive responses and challenges for suspicious clients. Design for graceful degradation: autoscale with budget caps, shed non-critical features first and protect login and payments. Rehearse the runbook with your provider.
Practice questions for November 2026
New every month3 questions from the Cybersecurity mock test, the way they appear in it. A new set comes on the 1st of every month. Pick your answer, then open it.
-
How many characters long is a SHA-256 hash when it is written in hexadecimal?
- 64
- 32
- 40
- 256
Show the answer
Answer: 64. SHA-256 always gives 256 bits, whatever the input size. Each hex character holds 4 bits, so the hex form is 256 / 4 = 64 characters. 32 hex characters is the MD5 length and 40 is SHA-1; 256 is the bit count.
-
What does the -servername option do in this command?
openssl s_client -connect shop.example.com:443 \ -servername shop.example.com -showcerts- It sends SNI, so a server hosting many sites returns the right certificate
- It forces the connection to use TLS 1.0 for compatibility with old servers
- It renames the local machine so the server sees a trusted client name
- It checks that the certificate's CN equals the name and aborts otherwise
Show the answer
Answer: It sends SNI, so a server hosting many sites returns the right certificate. Many sites share one IP, so the client names the host it wants in the ClientHello (SNI). Without it, the server may send a default certificate and the check looks wrong. -showcerts prints the chain the server sends.
-
For segmentation you split 10.20.0.0/22 into equal /25 subnets, one per department. How many subnets do you get, and how many usable hosts does each have?
- 16 subnets of 62 usable hosts
- 8 subnets of 126 usable hosts
- 4 subnets of 254 usable hosts
- 8 subnets of 128 usable hosts
Show the answer
Answer: 8 subnets of 126 usable hosts. Going from /22 to /25 adds 3 bits, so 2 to the power 3 = 8 subnets. Each /25 has 128 addresses, and removing the network and broadcast addresses leaves 126 for hosts.
Ready to apply?
There are 971 open jobs asking for Cybersecurity on CoreHRx right now. Create a free profile once and apply with it.