Cyber security interview preparation: what to study in the last 30 days

With a month to go, the mistake is breadth. Candidates try to cover everything and end up able to define terms but unable to answer "what would you do first?".

This timeline is built the other way round: rehearsal first, revision in support of it.

Days 1–7: fix your foundations, narrowly

Revise only what gets asked:

• TCP/IP, DNS, HTTP/HTTPS, common ports, what each log source contains
• Windows security events (4624, 4625, 4688, 4720), Linux auth logs
• Authentication vs authorisation, MFA fatigue, token theft, privilege escalation
• Malware categories and the phishing-to-execution chain
• The CIA triad and risk vocabulary, stated in one sentence each, not memorised paragraphs

End each day by saying one concept out loud as if answering an interviewer. If it takes more than 45 seconds, it is not ready.

Days 8–14: scenario patterns

Almost every scenario question fits one of five patterns:

1. Suspicious login — impossible travel, brute force, MFA bypass
2. Phishing — user clicked, what now
3. Malware execution — process tree, persistence, lateral movement
4. Data exfiltration — large outbound transfer, unusual destination
5. Vulnerability response — critical CVE announced Friday evening

For each, rehearse the same skeleton: contain, preserve evidence, investigate the adjacent data source, assess scope, escalate with a recommendation. Practise all five out loud. Work through 20 scenario questions Indian SOC interviewers ask.

Days 15–21: your own story

Interviewers spend a third of the round on your resume. Prepare:

• A 90-second introduction that ends on why security
• One lab or project you can narrate end to end, including what went wrong
• Answers for gaps, low marks or a non-technical background — short, factual, no apology
• Three questions for them that show you understand the role's realities (shift pattern, tooling, escalation model)

If your resume does not support this, rebuild it using the fresher resume guide.

Days 22–27: full mock rounds

Do complete, timed rounds — no notes, out loud, unfamiliar questions. Record yourself and watch it once. Most candidates discover two things: they talk too fast, and they answer definitions when a decision was requested.

Fix in this order: structure, then pace, then vocabulary.

Days 28–30: taper

No new material. Revise your own notes, sleep properly, and confirm the logistics: joining link, ID, a quiet room, a tested microphone. Arrive with two printed copies if it is in person.

What to deliberately ignore

• Advanced exploit development for an L1 SOC role
• Memorising every MITRE ATT&CK technique ID
• A second certification started in the same month
• Long tutorial playlists that produce no artefact and no spoken practice

Frequently asked questions

How many mock interviews are enough?

Three full rounds is the point where most candidates stop freezing. The first is always the worst; that is the point of it.

Should I memorise answers?

Memorise structures, not sentences. Interviewers change one variable in the scenario to test whether you understood or recited.

What if I do not know an answer?

Say what you would check and how you would find out. "I have not worked with that, but I would start by looking at X" scores far better than silence or invention.

Next steps

Pair this with the 90-day plan if you are earlier in your preparation.

[Take a free 5-question AI mock interview](/free-mock-interview) — it is voice-based, so it tests the thing this month is actually about.