Short answer: Common cyber security interview questions test the CIA triad, firewalls, IDS/IPS, symmetric vs asymmetric encryption, hashing, VAPT, the OWASP Top 10, and threats like XSS, SQL injection, phishing and DDoS. Interviewers grade clear definitions plus real-world reasoning, so learn the concept and one practical example for each.
Whether you are targeting a SOC analyst, security engineer, or entry-level cyber security role in India, interviewers move from fundamentals to scenario-based problem solving. This guide groups the top 50 cyber security interview questions by level, with concise, accurate answers you can actually use. If you are still building fundamentals, read our primer on what is cyber security first.
Beginner Cyber Security Interview Questions
What is the CIA triad?
The CIA triad is the core model of information security: Confidentiality (only authorised people access data), Integrity (data is accurate and unaltered), and Availability (systems and data are accessible when needed). Almost every control maps to one of these three goals.
What is the difference between a threat, a vulnerability, and a risk?
A vulnerability is a weakness (unpatched software), a threat is something that can exploit it (a hacker or malware), and risk is the potential loss when a threat exploits a vulnerability. Risk = threat x vulnerability x impact.
What is a firewall?
A firewall is a network security device or software that filters incoming and outgoing traffic based on defined rules. It sits between trusted and untrusted networks and blocks unauthorised connections. Types include packet-filtering, stateful, and next-generation firewalls (NGFW) that add deep packet inspection and application awareness.
What is the difference between IDS and IPS?
An IDS (Intrusion Detection System) monitors traffic and raises alerts on suspicious activity but does not block it. An IPS (Intrusion Prevention System) sits inline and actively blocks or drops malicious traffic in real time. IDS is passive; IPS is active.
What is the difference between symmetric and asymmetric encryption?
Symmetric encryption uses one shared secret key for both encryption and decryption (fast; examples AES, DES). Asymmetric encryption uses a public/private key pair (slower; examples RSA, ECC). In practice, systems like TLS use asymmetric encryption to exchange a symmetric session key, then switch to symmetric for speed.
What is hashing, and how is it different from encryption?
Hashing is a one-way function that converts data into a fixed-length digest (SHA-256, bcrypt) and cannot be reversed. Encryption is two-way and can be decrypted with a key. Hashing verifies integrity and stores passwords; encryption protects confidentiality of recoverable data.
What is a VPN and why is it used?
A VPN (Virtual Private Network) creates an encrypted tunnel between a user and a network over the public internet. It protects data in transit, hides the user's IP, and lets remote employees securely access internal resources. Common protocols include OpenVPN, WireGuard, and IPsec.
What are common well-known ports you should know?
Interviewers expect: 21 FTP, 22 SSH, 23 Telnet, 25 SMTP, 53 DNS, 80 HTTP, 443 HTTPS, 3389 RDP, 3306 MySQL. Knowing ports helps you read scan results and firewall rules quickly.
What is phishing?
Phishing is a social-engineering attack where attackers impersonate a trusted entity via email, SMS (smishing), or calls (vishing) to trick victims into revealing credentials or clicking malicious links. Defences include user awareness, email filtering, MFA, and DMARC/SPF/DKIM.
What is malware, and what are its main types?
Malware is malicious software. Main types: viruses (attach to files), worms (self-replicate over networks), trojans (disguised as legit software), ransomware (encrypts data for ransom), spyware, and rootkits (hide deep in the OS).
What is two-factor authentication (2FA/MFA)?
MFA requires two or more independent factors to log in: something you know (password), something you have (OTP/authenticator/token), or something you are (biometric). It dramatically reduces account takeover even when passwords leak.
What is the difference between authentication and authorization?
Authentication verifies who you are (login). Authorization decides what you are allowed to do (permissions/roles). Authentication always comes first.
Intermediate Cyber Security Interview Questions
What is the OWASP Top 10?
The OWASP Top 10 is a regularly updated list of the most critical web application security risks. It includes Broken Access Control, Cryptographic Failures, Injection (SQLi), Insecure Design, Security Misconfiguration, Vulnerable Components, Identification/Authentication Failures, Software and Data Integrity Failures, Security Logging Failures, and SSRF. It is the standard reference for secure web development.
What is Cross-Site Scripting (XSS)?
XSS injects malicious JavaScript into a web page that runs in other users' browsers. Types: Stored (saved on the server), Reflected (in the request/response), and DOM-based. Impact includes session theft and defacement. Fix with output encoding, input validation, and a Content Security Policy (CSP).
What is SQL Injection (SQLi)?
SQLi occurs when unsanitised user input is inserted into an SQL query, letting attackers read, modify, or delete database data or bypass login. Prevent it with parameterised queries/prepared statements, ORMs, input validation, and least-privilege database accounts.
What is a DDoS attack, and how do you mitigate it?
A Distributed Denial of Service attack floods a target with traffic from many compromised machines (a botnet) to exhaust resources and cause downtime. Mitigation: rate limiting, WAF, CDN/anti-DDoS services (Cloudflare, AWS Shield), traffic scrubbing, and blackholing.
What is VAPT?
VAPT stands for Vulnerability Assessment and Penetration Testing. Vulnerability assessment scans broadly to find and rank weaknesses; penetration testing actively exploits them to prove real impact. Together they give both coverage and depth. Learn more in our guide to what is ethical hacking.
Explain the TCP three-way handshake.
TCP establishes a connection in three steps: the client sends SYN, the server replies SYN-ACK, and the client sends ACK. Only then does data flow. A SYN flood attack abuses this by sending many SYNs without completing the handshake, exhausting server resources.
What is a zero-day vulnerability?
A zero-day is a flaw unknown to the vendor with no available patch, so defenders have "zero days" to fix it before exploitation. Defence relies on behaviour-based detection, network segmentation, virtual patching, and rapid patch management once a fix appears.
What is the difference between vulnerability assessment and penetration testing?
A vulnerability assessment is broad and largely automated, producing a prioritised list of weaknesses. A penetration test is targeted and manual, actively exploiting weaknesses to demonstrate business impact. VA answers "what is wrong"; PT answers "what can an attacker actually do".
What is a man-in-the-middle (MITM) attack?
In a MITM attack the attacker secretly intercepts and possibly alters communication between two parties (via ARP spoofing, rogue Wi-Fi, or SSL stripping). Defences: TLS everywhere, HSTS, certificate pinning, and avoiding untrusted networks.
What is the difference between IDS signatures and anomaly-based detection?
Signature-based detection matches known attack patterns (fast, low false positives, misses new attacks). Anomaly-based detection learns normal behaviour and flags deviations (catches unknown attacks but more false positives). Modern systems combine both.
What are salting and peppering in password storage?
A salt is a unique random value added to each password before hashing, defeating rainbow tables and making identical passwords hash differently. A pepper is a secret value stored separately (not in the database) added to all passwords for extra protection. Use slow hashes like bcrypt, scrypt, or Argon2.
What is a security misconfiguration?
Security misconfiguration is when systems are deployed with insecure defaults, open ports, verbose errors, default credentials, or unnecessary services enabled. It is one of the most common and easily exploited issues. Fix with hardening baselines and configuration management.
What is the principle of least privilege?
Least privilege means giving users, processes, and services only the minimum access they need to do their job, nothing more. It limits the blast radius of a compromised account and is a foundational security control.
Advanced Cyber Security Interview Questions
Explain the difference between symmetric key exchange problems and how TLS solves them.
Symmetric encryption is fast but sharing the key securely over the internet is the hard part. TLS solves this with an asymmetric handshake: the client and server use public-key cryptography (RSA/ECDHE) to agree on a shared symmetric session key, then encrypt the actual data with fast symmetric ciphers like AES-GCM. ECDHE also provides forward secrecy.
What is lateral movement, and how do you detect it?
Lateral movement is how an attacker, after initial access, pivots to other systems to reach high-value targets (using stolen credentials, pass-the-hash, or RDP). Detect it with EDR, unusual authentication patterns, network segmentation, and monitoring privileged account use.
What is the cyber kill chain?
The Lockheed Martin Cyber Kill Chain describes attack stages: Reconnaissance, Weaponisation, Delivery, Exploitation, Installation, Command and Control (C2), and Actions on Objectives. Defenders aim to break the chain at the earliest possible stage.
What is the difference between blue team, red team, and purple team?
Red team attacks (offensive, simulating adversaries), blue team defends (detection and response), and purple team is the collaboration between them, where red team findings directly improve blue team detection and controls.
How does SIEM work?
A SIEM (Security Information and Event Management) collects and correlates logs from across the environment, applies detection rules and analytics, and raises alerts for investigation. Examples: Splunk, Wazuh, Microsoft Sentinel, Elastic. It is the analyst's central workbench in a SOC.
What is threat modelling?
Threat modelling systematically identifies what you are protecting, who might attack, how, and what controls reduce the risk, usually early in design. STRIDE (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege) is a popular framework.
Explain defence in depth.
Defence in depth layers multiple independent controls (network, host, application, data, identity, physical) so that if one fails, others still protect the asset. No single control is trusted to stop everything.
What is a false positive vs a false negative in security detection?
A false positive is a benign event flagged as malicious (alert fatigue). A false negative is a real attack that goes undetected (the more dangerous one). Tuning aims to reduce both while prioritising catching true threats.
How would you respond to a ransomware incident?
Isolate affected systems from the network, preserve evidence, identify the strain and entry point, do not pay if avoidable, restore from clean offline backups, rotate credentials, patch the initial vector, and run a post-incident review. Reporting to authorities may be required.
What is the difference between encryption at rest and in transit?
Encryption in transit protects data moving across networks (TLS, VPN). Encryption at rest protects stored data on disks and databases (AES, disk encryption, TDE). Strong security requires both.
What is SSRF (Server-Side Request Forgery)?
SSRF tricks a server into making requests to internal or unintended resources (like cloud metadata endpoints), often to reach systems behind the firewall. Prevent with allowlists, disabling unused URL schemes, and network segmentation.
What is the difference between hashing algorithms MD5, SHA-1, and SHA-256?
MD5 and SHA-1 are broken (collision attacks) and should not be used for security. SHA-256 (SHA-2 family) is currently secure for integrity. For passwords specifically, use adaptive hashes (bcrypt/Argon2), not plain SHA.
What is privilege escalation?
Privilege escalation is gaining higher access than granted. Vertical escalation moves from low to admin/root; horizontal escalation accesses another user's data at the same level. Causes include misconfigurations, unpatched kernels, and weak permissions.
What is a honeypot?
A honeypot is a decoy system deliberately exposed to attract and study attackers, detect intrusions early, and gather threat intelligence without risking real assets.
How do you keep your security skills current?
Follow CVE feeds and vendor advisories, practise on platforms like TryHackMe and Hack The Box, read the OWASP and MITRE ATT&CK frameworks, do CTFs, and pursue certifications. Continuous learning is expected in this field.
Cyber Security Jobs and Salaries in India
Entry-level SOC analysts in India typically earn around Rs 3.5-6 LPA, mid-level security engineers Rs 8-15 LPA, and senior roles such as penetration testers, security architects, and CISOs command Rs 18 LPA to well over Rs 40 LPA. Certifications and hands-on lab experience move salaries fastest. Structured training helps you clear both the technical rounds and the scenario questions above.
At Cyber Defence (cyberdefence.org.in), founded by Amit Kumar (CEH, CRTA) and headquartered in Hisar, Haryana, our beginner-friendly cyber security course is Rs 15,000 (3-4 months) and the ethical hacking / CEH-aligned program is Rs 60,000 (6 months), with EMI options (EC-Council exam voucher is separate). We are ISO-certified and GeM-registered, and classes run live online and in classroom. Explore our best cyber security online course to prepare for interviews with real labs.
FAQ
How do I prepare for a cyber security interview as a fresher?
Master the fundamentals in this guide (CIA triad, encryption, OWASP Top 10, networking basics), build a home lab, practise on TryHackMe or Hack The Box, and prepare one real example for each concept. Hands-on proof beats memorised definitions.
What are the most asked cyber security interview questions?
The CIA triad, difference between symmetric and asymmetric encryption, IDS vs IPS, OWASP Top 10, XSS and SQL injection, the TCP handshake, hashing vs encryption, and how you would respond to a specific incident are asked in almost every interview.
Do I need certifications to get a cyber security job in India?
Certifications like CompTIA Security+, CEH, or CRTA strengthen your resume and help clear HR screening, but employers ultimately hire on demonstrable skills. A mix of one recognised certification plus practical projects works best.
What is the difference between VA and PT in interviews?
Vulnerability Assessment is broad, automated scanning that lists and ranks weaknesses; Penetration Testing is targeted, manual exploitation that proves real business impact. Interviewers love this comparison, so answer it crisply.
Which topics should a SOC analyst candidate focus on?
SIEM concepts, log analysis, the cyber kill chain, MITRE ATT&CK, incident response steps, common attack types, and how to reduce false positives. Scenario questions dominate SOC interviews.
Does Cyber Defence help with interview preparation?
Yes. Our courses include hands-on labs, real-world scenarios, and doubt support that map directly to interview rounds. See our cyber security training in Hisar and online options.
Ready to build interview-ready skills? Talk to the Cyber Defence team about our cyber security and ethical hacking courses. Call or WhatsApp +91-75175-72000 to book a free counselling session.