Entry-level cyber security interviews, for roles such as SOC analyst or security analyst, focus on networking basics, common attacks, core security concepts, and how you would respond to an alert. These 30 questions are the ones freshers meet most often, with short, practical answers.
If you are just starting, read how to start a career in cyber security with no experience first.
Core security concepts
1. What is the CIA triad?
Confidentiality (only authorised people can read data), Integrity (data is not changed without permission) and Availability (systems are up when needed). Almost every security control protects one of these three.
2. Vulnerability vs threat vs risk?
A vulnerability is a weakness, such as an unpatched server. A threat is something that could exploit it, such as ransomware. Risk is the likelihood and impact of that threat exploiting the weakness.
3. Authentication vs authorisation?
Authentication proves who you are (password, fingerprint, one-time code). Authorisation decides what you are allowed to do after logging in.
4. What is multi-factor authentication?
Using two or more different factors: something you know (password), something you have (phone or security key) and something you are (biometrics). It blocks most attacks that rely on stolen passwords.
5. What is the principle of least privilege?
Giving users and systems only the access they need to do their job, and nothing more. It limits damage if an account is compromised.
6. Symmetric vs asymmetric encryption?
| Symmetric | Asymmetric |
|---|---|
| One shared key encrypts and decrypts | A public key encrypts, a private key decrypts |
| Fast, used for bulk data | Slower, used for key exchange and signatures |
| Example: AES | Example: RSA, ECC |
7. Hashing vs encryption?
Encryption is reversible with the right key. Hashing is one-way and produces a fixed-length value, used to store passwords and check file integrity. Use slow, salted hashes such as bcrypt or Argon2 for passwords.
Networking questions
8. Name the layers of the OSI model.
Physical, Data Link, Network, Transport, Session, Presentation, Application. Analysts mostly work with layers 3 (IP), 4 (TCP and UDP) and 7 (HTTP, DNS).
9. Which common ports should you know?
| Port | Service |
|---|---|
| 22 | SSH |
| 25 | SMTP (email) |
| 53 | DNS |
| 80 / 443 | HTTP / HTTPS |
| 3389 | RDP (Windows remote desktop) |
| 445 | SMB (file sharing) |
10. Explain the TCP three-way handshake.
The client sends SYN, the server replies SYN-ACK, and the client sends ACK. A SYN flood attack sends many SYN packets without finishing the handshake to exhaust server resources.
11. What does a firewall do?
Allows or blocks traffic based on rules such as source, destination, port and protocol. Next-generation firewalls also inspect applications and content.
12. IDS vs IPS?
An Intrusion Detection System watches traffic and raises alerts. An Intrusion Prevention System sits inline and can block malicious traffic automatically.
13. What is a VPN?
An encrypted tunnel between a device and a network, protecting data on untrusted networks and letting remote staff reach internal systems.
Attacks and threats
14. What is phishing and how do you spot it?
A fake message that tricks people into clicking a link, opening a file or sharing credentials. Warning signs: urgent language, a sender domain that is slightly wrong, unexpected attachments, and links whose real address differs from the text.
15. What is SQL injection?
An attacker puts SQL code into an input field so the application runs it against the database. Prevent it with parameterised queries, input validation and least-privilege database accounts.
16. What is cross-site scripting (XSS)?
Injecting malicious JavaScript into a page that other users load, often to steal session cookies. Prevent it by encoding output, validating input and using a Content Security Policy.
17. What is ransomware and how do you defend against it?
Malware that encrypts files and demands payment. Defend with offline and tested backups, patching, email filtering, endpoint protection, MFA and network segmentation.
18. What is a DDoS attack?
Flooding a service with traffic from many machines so real users cannot reach it. Mitigation includes CDNs, rate limiting and DDoS protection services from cloud providers.
19. What is a man-in-the-middle attack?
An attacker secretly intercepts communication between two parties, for example on public Wi-Fi. HTTPS with valid certificates and VPNs prevent most of these attacks.
20. What is social engineering?
Manipulating people rather than technology: fake support calls, pretexting, tailgating into offices. Training and verification procedures are the main defences.
SOC and incident response
21. What does a SOC analyst do?
Monitors alerts from tools such as a SIEM and EDR, triages them, investigates suspicious activity, escalates real incidents, and documents findings. Level 1 analysts focus on triage; higher levels handle deep investigation.
22. What is a SIEM?
Security Information and Event Management. It collects logs from servers, firewalls and applications, correlates them, and raises alerts. Examples are Splunk, Microsoft Sentinel and the Elastic stack.
23. What are the phases of incident response?
Preparation, identification, containment, eradication, recovery and lessons learned (based on the NIST and SANS frameworks).
24. You see many failed logins followed by one success. What do you do?
- Check the source IP, location and time against the user’s normal pattern.
- Look at what the account did after logging in.
- If suspicious, disable the account or reset the password and revoke sessions.
- Block the source IP if needed and escalate following the playbook.
- Document everything in the ticket.
25. What is a false positive?
An alert that looks malicious but is harmless, such as a backup job flagged as data exfiltration. Tuning rules to reduce false positives is a big part of SOC work.
26. What are indicators of compromise?
Evidence that a system may be breached: known malicious IPs or domains, file hashes of malware, unusual processes, new admin accounts or unexpected outbound traffic.
27. What is the MITRE ATT&CK framework?
A public knowledge base of attacker tactics and techniques based on real attacks. Analysts use it to map alerts and find gaps in detection.
Practical and personal questions
28. Which tools have you used?
Be honest. Common lab tools are Wireshark, Nmap, Burp Suite, a SIEM such as Splunk Free or Elastic, and Kali Linux. Describe one thing you found with each.
29. How do you stay updated?
Mention specific sources: CERT-In advisories, vendor security blogs, the CISA known exploited vulnerabilities list, security podcasts, and practice platforms such as TryHackMe or Hack The Box.
30. Tell me about a lab or project.
For example: building a home lab with a Windows machine and a Linux server, forwarding logs to a free SIEM, simulating a brute-force attack, and writing a detection rule. Explain what you learned from it.
Frequently asked questions
Which certification is best for freshers?
CompTIA Security+ is the most widely recognised entry certificate. Many SOC roles also value hands-on platforms and vendor certificates such as Microsoft SC-200.
Do cyber security interviews include coding?
Entry roles rarely need full coding, but basic Python or PowerShell scripting and reading logs are strong advantages.
Is networking knowledge really necessary?
Yes. Most alerts involve IP addresses, ports and protocols. Strong networking basics are what interviewers test first.
Read more cyber security tutorials, and prepare the general rounds with our HR interview questions for freshers.
