Cybersecurity Analyst
Interview Questions.
15 practice questions across 13 skills — each with what the interviewer is really listening for. Prepare with intent, not guesswork.
Free · No signup · Grouped by skill
How to use this page
Don't memorise answers. For each question, read what the interviewer is looking for, then practise answering out loud in your own words with a real example. The notes describe strong answers and common red flags — they are for your prep, not a script.
Incident Response
1 questionWalk me through your response when a SIEM alert flags possible data exfiltration.
AdvancedWhat the interviewer is looking for: Strong answers follow a structured process — triage and validate, contain, investigate scope, eradicate, recover, and document — while preserving evidence. Pulling the plug or wiping the host immediately and destroying evidence is a red flag.
SIEM
1 questionHow do you tune a SIEM to reduce false positives without missing real threats?
AdvancedWhat the interviewer is looking for: Look for baselining normal behaviour, tuning rules, and correlation across sources, balancing noise and coverage. Either alerting on everything or suppressing alerts to quiet the queue are red flags.
Network Security
1 questionHow would you explain defence-in-depth for a typical corporate network?
IntermediateWhat the interviewer is looking for: Strong candidates describe layered controls — perimeter, segmentation, endpoint, identity, monitoring — so one failure is not catastrophic. Relying on a single firewall as 'the' defence is a red flag.
Vulnerability Assessment
1 questionHow do you prioritise which vulnerabilities to fix first from a scan of hundreds of findings?
IntermediateWhat the interviewer is looking for: Look for risk-based prioritisation — exploitability, exposure, asset criticality, and active exploitation — not just CVSS score. Patching top-to-bottom by score with no context is a red flag.
Threat Detection
1 questionWhat signals suggest an account has been compromised, and how do you confirm it?
IntermediateWhat the interviewer is looking for: Strong answers cite impossible-travel logins, unusual access patterns, and privilege changes, then corroborate across logs before acting. Reacting to a single weak signal without correlation is a red flag.
Linux
1 questionHow comfortable are you on the Linux command line for investigating a host?
IntermediateWhat the interviewer is looking for: Look for checking processes, network connections, logs, cron jobs, and file changes methodically. Being unable to investigate a host without a GUI is a limitation for this role.
MITRE ATT&CK
1 questionHow do you use the MITRE ATT&CK framework in your day-to-day analysis?
AdvancedWhat the interviewer is looking for: Strong candidates map observed behaviour to tactics and techniques to understand the attacker and find coverage gaps. Treating ATT&CK as a checklist with no analytical use is a red flag.
Attention to Detail
1 questionWhy is careful attention to detail so important when reviewing logs and alerts?
BasicWhat the interviewer is looking for: Look for recognising that attackers hide in small anomalies and that a missed detail can mean a missed breach. A casual attitude to log review is a red flag.
Working Under Pressure
1 questionDuring a possible active breach, how do you stay effective under pressure?
IntermediateWhat the interviewer is looking for: Strong answers describe following the playbook, clear communication, and methodical action rather than panic. Freezing or acting rashly and skipping documentation are red flags.
Communication
1 questionHow do you communicate a security risk to leadership who want to keep shipping fast?
IntermediateWhat the interviewer is looking for: Look for translating technical risk into business impact and likelihood, and proposing pragmatic mitigations. Pure fear-mongering or staying silent to avoid friction are red flags.
Critical Thinking
1 questionHow do you think like an attacker without becoming paranoid about everything?
IntermediateWhat the interviewer is looking for: Strong candidates reason about realistic threat models and prioritise by risk, not chase every theoretical attack. Treating every finding as critical dilutes real response and is a red flag.
Splunk
1 questionHow would you use Splunk (or similar) to hunt for a threat rather than wait for an alert?
AdvancedWhat the interviewer is looking for: Strong answers form a hypothesis, search across data sources for indicators, and pivot on findings. Only reacting to pre-built alerts with no proactive hunting is a limitation.
Firewalls
1 questionHow do firewalls fit into a layered defence, and what are their limits?
IntermediateWhat the interviewer is looking for: Look for understanding that firewalls control traffic but do not stop phishing, insider threats, or encrypted malicious traffic alone. Treating a firewall as complete security is a red flag.
Behavioural & role-general
2 questionsTell me about a security incident or exercise you were part of. What did you learn?
BasicWhat the interviewer is looking for: Look for a concrete situation, your role, and a systemic improvement afterward, with appropriate discretion about sensitive details. Oversharing confidential specifics or claiming solo heroics are red flags.
How do you keep up with a threat landscape that changes daily?
BasicWhat the interviewer is looking for: Strong answers cite threat intel feeds, advisories, labs, and community involvement. Vague 'I stay updated' with no sources is a red flag in security.