Fresher · 0–1 years · 17 questions with answers
Freshers rarely lose interviews on knowledge. They lose them by answering in one line, by having no project they can describe in detail, and by freezing on "tell me about yourself". These questions and answers fix all three.
You'll answer these out loud, under time pressure, with an interviewer asking follow-ups. Do a free 5-question AI mock interview and get scored feedback in minutes — no card needed.
Start free mock interviewNinety seconds, three parts: where you're coming from academically, what you've actually done hands-on in security, and what role you're targeting and why. End on the role. Do not narrate your school history — the interviewer has your resume.
Give the moment it clicked and what you did after it. "I broke my own college portal's login during a project, reported it, and spent the next month on web security labs" tells them you're driven by curiosity, which is the actual predictor of success in this field.
Convert practice into evidence: the lab you run, the CTFs you've solved, the write-ups you've published, how fast you learned a tool. Then say what you'd need from them in the first month. Confidence plus a learning plan is what entry-level hiring managers are buying.
Pick a strength you can prove with an example and a weakness that's real but improving with a concrete step — "I used to over-investigate low-severity alerts in my lab, so I now time-box triage." Avoid the fake weakness; experienced interviewers discount it immediately.
Confidentiality, Integrity, Availability. Add a one-line example each: encryption, hashing, redundancy. Then say which one a specific business would prioritise — for a bank, integrity; for an e-commerce site during a sale, availability.
IDS detects and alerts out of band; IPS is inline and blocks. Follow with the trade-off: a false positive in an IPS becomes downtime, so organisations often run new rules in detect mode first.
A control point that permits or denies traffic based on rules. Mention stateful inspection — it tracks connection state rather than judging each packet alone — and that modern firewalls also match on application and user identity.
"The application asks the database a question and pastes the user's text into it. If the text is crafted, it changes the question — so someone types into a login box and the database answers with the whole customer table." Then say the fix is parameterised queries. This question tests communication as much as knowledge.
Fraudulent messages that harvest credentials or deliver malware. Signals: mismatched sender domain, urgency and threat, link text that doesn't match the destination, unexpected attachments, and requests that bypass normal process. Say you'd verify through a known channel rather than replying.
Software built to harm or gain unauthorised access — viruses, worms, trojans, ransomware, spyware, rootkits, and loaders. Add how they differ in propagation: a worm spreads by itself, a trojan needs the user to run it.
Many sources flood a service so real users can't reach it. Volumetric attacks saturate bandwidth, protocol attacks exhaust connection state, application-layer attacks hit expensive endpoints with few requests. Mitigation is upstream scrubbing, rate limiting and caching.
Tracking, testing and deploying updates across the estate. It gets neglected because patching risks breaking production and requires downtime windows, so organisations need a risk-based order — internet-facing and actively exploited first.
grep and awk to filter logs, last and lastb for logins, ps and top for processes, netstat or ss for connections, find with -mtime for recently changed files, and journalctl or /var/log/auth.log for authentication history. Naming what you'd look for beats listing commands.
You'll answer these out loud, under time pressure, with an interviewer asking follow-ups. Do a free 5-question AI mock interview and get scored feedback in minutes — no card needed.
Start free mock interviewDescribe one lab in depth: what you deployed (a Windows VM, Sysmon, a SIEM), what you attacked it with, what the detection showed, and what you changed after. One deep project beats five listed tools.
For entry level in India, CompTIA Security+ or the vendor-neutral fundamentals plus a hands-on badge like TryHackMe or Blue Team labs are enough to clear screening. Say what you're studying now and by when — commitment reads better than a shelf of unused certificates.
If yes, name the platform and describe one challenge end to end — what the hint was, what you tried, what worked. If no, say what you're starting with this month. Never claim CTF experience you can't discuss; the follow-up will expose it.
Official documentation for the data model, a lab instance to break, one realistic task to complete end to end, and a written cheat sheet. Interviewers ask this because tooling changes and learning speed is the transferable skill.
It varies widely by city, company type and role, so research current listings for your specific target city and role rather than relying on a single figure. In the interview, it's fine to say your expectation is aligned to the market band for the role and ask what range they've budgeted.
Not strictly. A demonstrable home lab, clear fundamentals and good communication often outperform certificates at entry level, though a fundamentals certification helps get past resume screening.
Sixty to ninety seconds for technical questions, around ninety for behavioural ones. One-line answers read as lack of depth; three-minute answers read as lack of structure.
You'll answer these out loud, under time pressure, with an interviewer asking follow-ups. Do a free 5-question AI mock interview and get scored feedback in minutes — no card needed.
Start free mock interview