Cyber Security Interview Questions for Freshers (2026): 40 Questions with Answers

Short answer: fresher cyber security interviews test fundamentals far more than tools. Be ready to explain the CIA triad, threat vs vulnerability vs risk, encryption vs hashing vs encoding, networking basics (OSI, TCP vs UDP, common ports, DNS), the main web attacks (SQL injection, XSS, broken access control), how a SOC handles an alert, and the phases of a penetration test. Expect scenario questions such as “a user reports a suspicious email; what do you do?” Clear, correct basics plus a home lab or project to talk about will set you apart.

New to the field? Read the cyber security roadmap for freshers first, and see ethical hacking vs cyber security to choose between offensive and defensive roles.

Security fundamentals

1. What is the CIA triad?

Confidentiality (only authorised people can see data), Integrity (data is accurate and not tampered with) and Availability (systems and data are accessible when needed). Most security controls protect one or more of these.

2. What is the difference between a threat, a vulnerability and a risk?

A vulnerability is a weakness, such as an unpatched server. A threat is something that could exploit it, such as a ransomware group. Risk is the likelihood and impact of the threat exploiting the vulnerability.

3. What is the difference between authentication and authorisation?

Authentication proves who you are (password, OTP, biometrics). Authorisation decides what you are allowed to do once logged in.

4. What is multi-factor authentication?

Using two or more different factor types: something you know (password), something you have (phone or security key) and something you are (fingerprint). Phishing-resistant methods such as passkeys and hardware keys are stronger than SMS codes.

5. What is the principle of least privilege?

Giving users and systems only the access they need to do their job, and nothing more, so a compromised account causes less damage.

6. What is defence in depth?

Layering several controls, such as firewalls, endpoint protection, MFA, logging and backups, so that if one fails, others still protect the system.

7. What are common types of malware?

Viruses (attach to files), worms (spread on their own), trojans (pretend to be legitimate software), ransomware (encrypts data for ransom), spyware, rootkits and botnets.

8. What is social engineering?

Manipulating people into revealing information or taking unsafe actions. Phishing emails, vishing calls, smishing texts and fake “IT support” requests are common examples.

Networking

9. Explain the OSI model.

Seven layers: Physical, Data Link, Network, Transport, Session, Presentation and Application. Knowing the layer helps you place attacks and controls, for example ARP spoofing at Layer 2 and SQL injection at Layer 7.

10. What is the difference between TCP and UDP?

TCP is connection-oriented and reliable, using a three-way handshake (SYN, SYN-ACK, ACK) and retransmission. UDP is connectionless and faster but does not guarantee delivery, so it suits DNS queries, streaming and VoIP.

11. Name some common ports.

12. How does DNS work, and what is DNS spoofing?

DNS translates domain names into IP addresses. DNS spoofing or cache poisoning feeds a resolver false records so users are sent to an attacker’s server.

13. What is ARP spoofing?

An attacker on the local network sends fake ARP replies to link their MAC address with another device’s IP, such as the gateway, so traffic passes through them in a man-in-the-middle attack.

14. What is the difference between a firewall, an IDS and an IPS?

A firewall allows or blocks traffic based on rules. An intrusion detection system (IDS) monitors traffic and alerts on suspicious activity. An intrusion prevention system (IPS) sits inline and can block that activity automatically.

15. What is a VPN?

A virtual private network creates an encrypted tunnel between a device and a network, protecting traffic on untrusted networks and allowing secure remote access.

Cryptography

16. What is the difference between encoding, encryption and hashing?

17. What is the difference between symmetric and asymmetric encryption?

Symmetric encryption uses one shared key (AES) and is fast. Asymmetric encryption uses a public and private key pair (RSA, elliptic curve) and solves key exchange. HTTPS uses both: asymmetric cryptography to agree on keys, then symmetric encryption for the data.

18. What is salting?

Adding a unique random value to each password before hashing, so identical passwords produce different hashes and precomputed rainbow-table attacks fail. Passwords should be stored with slow algorithms designed for the job, such as bcrypt, scrypt or Argon2.

19. What does a digital certificate do?

It binds a public key to an identity, such as a website’s domain, and is signed by a trusted certificate authority so browsers can verify they are talking to the real site.

Web application security

20. What is the OWASP Top 10?

A widely used awareness list of the most critical web application security risks. The 2025 edition is led by Broken Access Control, followed by Security Misconfiguration and Software Supply Chain Failures, and also includes Cryptographic Failures, Injection, Insecure Design and Authentication Failures.

21. What is SQL injection and how do you prevent it?

An attacker inserts SQL into an input so the database runs unintended commands, for example to bypass login or dump data. Prevent it with parameterised queries (prepared statements), input validation and least-privilege database accounts.

22. What are the types of XSS?

Stored XSS (the script is saved on the server and shown to other users), reflected XSS (the script comes from the request, such as a URL parameter) and DOM-based XSS (the flaw is in client-side JavaScript). Prevent it with output encoding, safe frameworks and a Content Security Policy.

23. What is CSRF?

Cross-site request forgery tricks a logged-in user’s browser into sending an unwanted request, such as changing their email. Defences include anti-CSRF tokens and SameSite cookies.

24. What is IDOR?

Insecure direct object reference: changing an identifier, such as /invoice?id=1001 to 1002, shows another user’s data because the server does not check ownership. It is a classic broken access control flaw.

25. Which tool is used most for web application testing?

Burp Suite, an intercepting proxy that lets you inspect, modify and replay requests. OWASP ZAP is a popular free alternative.

SOC and incident response

26. What does a SOC do?

A security operations centre monitors an organisation’s systems around the clock, triages alerts, investigates incidents and coordinates the response. Freshers usually join as L1 analysts who triage alerts and escalate real incidents.

27. What is a SIEM?

Security information and event management: a platform that collects logs from many sources, correlates them and raises alerts. Splunk, Microsoft Sentinel, IBM QRadar, Elastic and the open-source Wazuh are common examples.

28. What is the difference between a false positive and a false negative?

A false positive is an alert for harmless activity. A false negative is real malicious activity that raised no alert, which is more dangerous.

29. What are the phases of incident response?

A common model is preparation, detection and analysis, containment, eradication, recovery, and lessons learned. Each incident should end with improvements so it does not happen again.

30. What is MITRE ATT&CK?

A public knowledge base of attacker tactics and techniques based on real-world observations. Analysts use it to map alerts, understand attacks and find detection gaps.

31. Which Windows event IDs should a fresher know?

4624 (successful logon), 4625 (failed logon), 4720 (user account created) and 4688 (new process created) are frequently discussed in SOC interviews.

VAPT and ethical hacking

32. What is the difference between vulnerability assessment and penetration testing?

A vulnerability assessment finds and lists weaknesses, often with scanners. A penetration test goes further and safely exploits them to prove real impact, within an agreed scope.

33. What are the phases of a penetration test?

Planning and scoping (with written authorisation), reconnaissance, scanning and enumeration, exploitation, post-exploitation, and reporting with remediation advice.

34. What is the difference between black-box, grey-box and white-box testing?

Black-box testers start with no internal knowledge, grey-box testers have partial knowledge such as a user account, and white-box testers have full access to source code and architecture.

35. What does Nmap do?

It discovers hosts, open ports, running services and versions on a network. For example, nmap -sV target detects service versions. Only scan systems you are authorised to test.

36. What is CVE and CVSS?

CVE is a public identifier for a known vulnerability, such as CVE-2021-44228 (Log4Shell). CVSS is a scoring system that rates its severity from 0 to 10.

Scenario questions

37. A user reports a suspicious email. What do you do?

Ask them not to click anything. Check the sender and reply-to addresses, headers, links and attachments in a safe way (sandbox or reputation tools). If it is malicious, block the sender and URLs, search for and remove the same email from other inboxes, check whether anyone clicked or entered credentials, reset affected passwords and document the incident.

38. You see many failed logins followed by a success from a new country. What does it suggest?

A possible brute-force or password-spraying attack that succeeded. Verify with the user, check for impossible travel and MFA prompts, disable the session or account if suspicious, reset credentials and look for follow-up activity such as mailbox rules or data downloads.

39. How would you secure a new web application before launch?

Threat-model it, use secure coding practices, test against the OWASP Top 10, enforce HTTPS and secure headers, use MFA for admin accounts, patch dependencies, enable logging and monitoring, and run a penetration test.

40. Why do you want to work in cyber security?

Be specific: mention what you have built or practised, such as a home lab, CTF challenges or a vulnerability you reported responsibly, and which role you are aiming for.

How to prepare

• Build a home lab with Kali Linux and intentionally vulnerable machines, and practise on legal training platforms.
• Revise networking and Linux commands until you can explain them without notes.
• Write up two or three practice findings as short reports: issue, impact, steps to reproduce and fix.
• Know the law and ethics: never test systems without written permission. Unauthorised access is an offence under India’s Information Technology Act, 2000.
• Read our SOC analyst roadmap if you are aiming for a blue-team role.

For general interview strategy, see the tech interview preparation guide.

Learn cyber security at TryCatch Classes

TryCatch Classes’ Cyber Security Training covers security fundamentals, networking with Wireshark, lab setup with Kali Linux, Linux, cryptography, web technologies, Burp Suite, Python for security automation, OSINT, scanning and enumeration, web and API penetration testing, vulnerability assessment and VAPT reporting, ending with a capstone project and interview preparation. For a broader offensive-security syllabus, see Ethical Hacking Training. Learn at our Borivali West classroom or live online, with a 100% placement guarantee.

Frequently asked questions

Which cyber security role is best for freshers?

SOC analyst (L1) is the most common entry role. VAPT or penetration testing trainee roles also hire freshers who can show practical lab work and reports.

Do I need coding for cyber security interviews?

Not always, but basic Python or Bash scripting and the ability to read code help a lot, especially for VAPT and automation tasks.

Which certifications help freshers?

Entry-level options include CompTIA Security+ and ISC2 Certified in Cybersecurity (CC). CEH is widely recognised in India for ethical hacking roles. Practical skills still matter more than certificates.

How do I answer questions I do not know?

Say so honestly, explain how you would find the answer, and relate it to something you do know. Interviewers value honesty and reasoning over guessing.

Cover image: photo by FlyD on Unsplash.