Interview prep · 🛡️ Security Engineer (SOC / Infra Security)
Security Engineer interview questionsand answers (30, by level).
The questions Indian employers actually ask for this role — fresher, mid-level and senior — with model answers written by engineers who sit on the other side of the table. Use with the role path and the 30-day lab plan.
Fresher / L1
Fundamentals they test on day one
1CIA triad — explain with an example each.
Confidentiality (encryption of a backup), Integrity (checksums/signing of packages), Availability (DDoS protection, redundancy).
2Difference between vulnerability, threat and risk?
Vulnerability: a weakness; threat: an actor/event that can exploit it; risk: likelihood × impact. Risk is what you prioritise.
3What is the OWASP Top 10? Name three.
The most common web risks: Broken access control, Injection, Cryptographic failures, Security misconfiguration, SSRF…
4Symmetric vs asymmetric encryption?
Symmetric uses one shared key (AES, fast, bulk data); asymmetric uses public/private pairs (RSA/ECC) for key exchange and signatures. TLS uses both.
5What is hashing and salting?
Hashing is one-way fixed-length output (SHA-256); salting adds random data per password so identical passwords hash differently; use bcrypt/argon2 for passwords.
6How does a SIEM work in simple terms?
Collects logs from endpoints, servers, firewalls; normalises; correlates with rules/ML to raise alerts; analysts triage in the SOC.
7What is phishing and how would you spot it?
Social engineering via email/SMS; check sender domain, links hover, urgency, attachments; report via the phish button; DMARC helps the organisation.
8What is MFA and why does SMS OTP fall short?
Second factor beyond password; SMS can be SIM-swapped or intercepted; authenticator apps/FIDO2 keys are stronger.
9Ports for SSH, RDP, HTTPS, DNS, SMB?
22, 3389, 443, 53, 445. Expect a follow-up: which should never face the internet (RDP, SMB).
10What is a CVE and CVSS?
CVE is a public ID for a vulnerability; CVSS scores severity 0–10; use EPSS/KEV to prioritise by real exploitation.
2–5 years / L2
What a working engineer must know
1Walk through investigating a suspicious login alert.
Validate source (IP, geo, impossible travel), user context, device, MFA result, concurrent sessions; check for mailbox rules/persistence; contain (reset, revoke tokens), scope, document.
2How do you harden a Linux server?
Patching, minimal packages, SSH keys only + no root login, firewall default deny, fail2ban, auditd, file integrity (AIDE), least-privilege sudo, CIS benchmark, centralised logs.
3Explain the MITRE ATT&CK framework and how you use it.
Taxonomy of adversary tactics/techniques; map detections and gaps, build hunts, describe incidents consistently.
4What is lateral movement and how do you detect it?
Attacker moving between hosts (PsExec, WMI, RDP, pass-the-hash). Detect via unusual admin logons, 4624/4648 patterns, EDR telemetry, network segmentation alerts.
5Vulnerability management lifecycle?
Discover assets, scan (Nessus/OpenVAS/Qualys), prioritise (CVSS + exploitability + exposure), remediate with owners and SLAs, verify, report trends.
6How does TLS 1.3 differ from 1.2?
Fewer round trips, only AEAD ciphers, forward secrecy mandatory, removed RSA key exchange and weak ciphers; encrypted handshake portions.
7What is DMARC and how do you roll it out?
Policy for SPF/DKIM alignment; start p=none with rua reports, fix senders, move to quarantine then reject; use our DNS tool to check.
8Ransomware hits a file server at 2 AM — first 60 minutes?
Isolate host/network segment, preserve evidence, identify strain/scope, disable compromised accounts, check backups are offline/immutable, notify incident lead and legal/CERT-In (6-hour rule), begin restore plan.
9What is an IDS vs IPS; where would you place them?
IDS detects (out of band, SPAN); IPS blocks inline; place at perimeter and internal segment boundaries; tune to reduce false positives.
10Explain OAuth2 vs SAML vs OIDC briefly.
SAML: XML SSO for enterprise web apps. OAuth2: delegated authorisation (tokens). OIDC: identity layer on OAuth2 (ID tokens) for modern apps/mobile.
Senior / L3
Design, judgement and leadership
1Design a SOC for a 500-employee company on a budget.
Log sources prioritised (identity, endpoints, firewall, cloud), open-source or mid-tier SIEM (Wazuh/Elastic/Sentinel), EDR, playbooks, 8×5 with on-call then 24×7 via MSSP, metrics (MTTD/MTTR), tabletop exercises.
2How do you build an ISO 27001 ISMS from scratch?
Scope, risk assessment methodology, Statement of Applicability, policies, controls (Annex A), awareness, internal audit, management review, then certification audit; keep evidence continuous, not yearly.
3Zero-trust architecture — a 12-month roadmap?
Identity first (MFA, conditional access), device posture, ZTNA replacing VPN, micro-segmentation for crown jewels, data classification/DLP, continuous monitoring.
4Cloud security: top misconfigurations you hunt first?
Public S3/Blob, over-privileged IAM, keys in code, open security groups, no logging (CloudTrail/Activity), unencrypted snapshots, missing MFA on root.
5How do you measure and report security to the board?
Risk-based: top risks and treatment, patch SLAs, phishing click rate, MTTD/MTTR, coverage of critical assets, third-party risk, budget vs outcomes — not tool counts.
6Describe a threat model for a public-facing API.
Assets, entry points, trust boundaries; STRIDE per component; mitigations: auth (OAuth2), rate limits, input validation, secrets management, WAF, logging; abuse cases.
7Secrets management at scale?
Vault/KMS, dynamic short-lived credentials, no secrets in repos (scanning), rotation, least privilege, audit; CI uses OIDC federation not static keys.
8DPDP Act 2023 — what must an Indian company do technically?
Consent and purpose limitation, data inventory, retention/deletion, breach notification to the DPB, security safeguards, grievance officer, processor contracts; cross-border transfer rules.
9How do you run a purple-team exercise?
Define scenarios from ATT&CK, red executes, blue observes detections, gaps become tuning tasks; repeat quarterly.
10Supply-chain security for software?
SBOMs, dependency scanning, signed builds (Sigstore), pinned versions, private registries, least-privilege CI, review of third-party actions.
How to answer
Four habits that pass interviews
- Say the structure first“I’d check three things: …” — interviewers reward a method more than a lucky answer.
- Numbers and namesMention real tools, versions and figures from your lab; vague answers lose.
- Admit gaps cleanly“I haven’t run X in production; here is how I’d approach it” beats bluffing.
- Ask about the environmentScale, on-call, tooling — it shows you think like an operator.
Ready to be hired, or ready to hire?
Engineers: join our vetted network for projects and placements. Companies: we shortlist security engineers within 48 hours.