Free guides, interview Q&As, and job responsibility breakdowns — curated by industry veterans to help you crack MNC interviews
Every organization today — whether a small startup or a global bank — stores huge amounts of digital information: customer data, employee records, financial details, and trade secrets. This information is constantly under threat from hackers, malware, insider mistakes, and natural disasters. At the same time, governments and industry bodies have created strict laws and standards that organizations must follow to protect this data. Security & Compliance Basics is the foundation knowledge that helps a person understand how organizations protect their information (Security) and how they prove to regulators, customers, and partners that they are protecting it properly (Compliance).
Security and Compliance are closely related but not the same thing. Security is about actually keeping systems and data safe using technical and physical measures. Compliance is about following the specific rules, laws, and standards set by governments or industries, and being able to prove it through audits and documentation. A mature organization needs both — being compliant does not automatically mean you are secure, and being secure does not automatically mean you are compliant.
📖 DEFINITION
Security & Compliance refers to the combined set of policies, technologies, processes, and controls that an organization puts in place to (a) protect its information systems, networks, and data from unauthorized access, damage, or disruption, and (b) ensure that all these protective measures meet the specific legal, regulatory, and industry standards that apply to that organization's location and sector.
💡 EASY HINGLISH EXPLANATION
Security & Compliance ka matlab hai — company apna data aur systems ko secure rakhe, aur saath hi saath government/industry ke banaye gaye rules (compliance) ko bhi follow kare, jisse proof mil sake ki sab kuch sahi tarike se ho raha hai.
🌍 DAY-TO-DAY EXAMPLE
A hospital installing CCTV cameras and password-protected computer systems is practicing Security. When the same hospital ensures patient records are handled exactly as required by HIPAA (a healthcare data protection law), that is Compliance. Together, both keep patient data safe and legal.
Without proper security, an organization's sensitive data can be stolen, altered, or destroyed by attackers, causing financial loss and reputational damage. Without compliance, an organization can face heavy legal fines, lawsuits, and loss of business licenses — even if no actual breach occurred. Below are the main reasons why Security & Compliance matters for every organization:
Security & Compliance is not a single action — it is an ongoing cycle of assessing risk, applying protections, monitoring, and proving compliance. Below is the general working process explained step-by-step:
💡 EASY HINGLISH EXPLANATION
Yeh process ek ghar ki suraksha jaisa hai — pehle dekhna ki ghar mein kya kya chori ho sakta hai (risk assessment), fir taale aur CCTV lagana (controls), roz check karna ki sab theek hai (monitoring), aur agar chori ho jaye to turant response karna (incident response). Compliance matlab yeh sab cheezein kisi official checklist ke hisaab se sahi tarike se ki gayi hain, iska proof dena.
Security & Compliance is not a one-time project — it operates continuously across the entire lifecycle of data and systems. Here are common situations when it comes into play:
Security & Compliance principles are applied across virtually every industry that handles digital data or operates critical infrastructure. Some common areas of application include:
Multiple people and teams play a role in making Security & Compliance successful. Understanding each role helps clarify who does what.
| Role | Responsibility |
|---|---|
| End User / Employee | Follows security policies (strong passwords, reporting suspicious emails) in daily work. |
| Security Analyst / SOC Team | Monitors systems for threats, investigates alerts, and responds to incidents. |
| Compliance Officer | Ensures the organization follows relevant laws and standards; prepares for audits. |
| CISO (Chief Information Security Officer) | Senior leader responsible for the overall security strategy of the organization. |
| Risk Manager | Identifies, evaluates, and prioritizes risks to the organization's assets. |
| Internal / External Auditor | Independently reviews controls and processes to verify compliance with standards. |
| IT / Network Administrator | Implements and maintains technical controls like firewalls, access rules, and patches. |
| Legal Team | Interprets laws and regulations and advises on contractual and regulatory obligations. |
Below are the essential terms every Security & Compliance learner must understand clearly, along with simple explanations and examples.
📖 DEFINITION
Confidentiality is the principle of ensuring that information is accessible only to those who are authorized to view it. It involves protecting sensitive data from being disclosed to unauthorized individuals, entities, or systems, using tools like encryption and access controls.
💡 EASY HINGLISH EXPLANATION
Confidentiality ka matlab hai ki sirf authorized log hi data ko dekh sakein, baaki koi nahi — jaise ek locked diary jo sirf malik hi padh sakta hai.
🌍 DAY-TO-DAY EXAMPLE
A company encrypts customer credit card numbers so that even if the database is stolen, the attacker cannot read the actual card numbers without the decryption key.
📖 DEFINITION
Integrity refers to maintaining the accuracy, consistency, and trustworthiness of data over its entire lifecycle. It means data must not be altered or tampered with in an unauthorized or accidental way, whether it is being stored, processed, or transmitted.
💡 EASY HINGLISH EXPLANATION
Integrity matlab data apni original, sahi form mein rahe — koi bina permission ke usse change na kar sake.
🌍 DAY-TO-DAY EXAMPLE
When money is transferred between two bank accounts, integrity checks ensure the exact amount is deducted from one account and credited to the other, with no unauthorized modification in between.
📖 DEFINITION
Availability means ensuring that authorized users can access information and systems whenever they need them, with minimal downtime. This is achieved through backup systems, redundancy, disaster recovery plans, and protection against attacks like Denial-of-Service (DoS).
💡 EASY HINGLISH EXPLANATION
Availability ka matlab hai ki system aur data jab bhi chahiye, tab available/accessible ho — bina rukawat ke.
🌍 DAY-TO-DAY EXAMPLE
An e-commerce website uses multiple backup servers so that even if one server crashes during a big sale, customers can still access the site and complete their purchases.
📖 DEFINITION
Authentication is the process of verifying that a user, device, or system is genuinely who or what it claims to be, typically done by checking a password, biometric scan, security token, or other credential before granting access.
💡 EASY HINGLISH EXPLANATION
Authentication matlab 'aap kaun ho' yeh verify karna — jaise login karte waqt password ya fingerprint check hota hai.
🌍 DAY-TO-DAY EXAMPLE
When you log in to your email using a password and then confirm a code sent to your phone, the system is authenticating that you are truly the account owner.
📖 DEFINITION
Authorization is the process that determines what an already-authenticated user is actually allowed to do or access within a system. While authentication confirms identity, authorization defines the specific permissions and access levels granted to that identity.
💡 EASY HINGLISH EXPLANATION
Authorization decide karta hai ki login hone ke baad user kya kya kar sakta hai — jaise ek employee sirf apni file dekh sakta hai, dusre ki nahi.
🌍 DAY-TO-DAY EXAMPLE
A regular employee can view their own salary slip, but only an HR manager is authorized to view and edit salary details of all employees in the system.
📖 DEFINITION
MFA is a security method that requires a user to provide two or more independent verification factors (something you know, something you have, something you are) to gain access to an account or system, making it much harder for attackers to break in even if they know the password.
💡 EASY HINGLISH EXPLANATION
MFA matlab login ke liye sirf password kaafi nahi, ek aur extra verification (jaise OTP ya fingerprint) bhi chahiye hoti hai.
🌍 DAY-TO-DAY EXAMPLE
When logging into a banking app, you enter your password (something you know) and then an OTP sent to your phone (something you have) — this combination is MFA.
📖 DEFINITION
Encryption is the process of converting readable data (plaintext) into a coded, unreadable format (ciphertext) using a mathematical algorithm and a key, so that only someone with the correct decryption key can convert it back into its original readable form.
💡 EASY HINGLISH EXPLANATION
Encryption matlab data ko ek secret code mein badal dena, taaki bina sahi key ke koi usse padh na sake.
🌍 DAY-TO-DAY EXAMPLE
When you shop online and see 'https' with a padlock icon in your browser, your payment details are being encrypted before they travel over the internet, protecting them from eavesdroppers.
📖 DEFINITION
A Firewall is a network security device or software that monitors and filters incoming and outgoing network traffic based on an organization's previously established security rules, acting as a barrier between a trusted internal network and untrusted external networks like the internet.
💡 EASY HINGLISH EXPLANATION
Firewall ek security guard jaisa hai jo decide karta hai ki konsa data network ke andar aa sakta hai aur konsa bahar ja sakta hai.
🌍 DAY-TO-DAY EXAMPLE
A company's firewall blocks all incoming traffic from a known malicious IP address while allowing normal employee web browsing traffic to pass through.
📖 DEFINITION
A Vulnerability is a weakness or flaw in a system, application, network, or process that could potentially be exploited by a threat to gain unauthorized access, cause damage, or disrupt normal operations. Vulnerabilities can exist in software code, configurations, or even human behavior.
💡 EASY HINGLISH EXPLANATION
Vulnerability matlab system mein koi kamzori ya loophole jiska fayda uthake attacker nuksan pahucha sakta hai.
🌍 DAY-TO-DAY EXAMPLE
An outdated version of software with a known unpatched bug is a vulnerability — attackers can specifically target that bug to break into the system.
📖 DEFINITION
A Threat is any potential danger or malicious act — such as a hacker, malware, natural disaster, or even an careless employee — that could exploit a vulnerability to cause harm to an organization's systems or data.
💡 EASY HINGLISH EXPLANATION
Threat matlab woh khatra ya attacker jo vulnerability ka fayda uthake nuksan pahuchane ki koshish karta hai.
🌍 DAY-TO-DAY EXAMPLE
A hacker group sending phishing emails to steal employee passwords is a threat, especially if employees have not been trained to recognize such emails (a vulnerability).
📖 DEFINITION
Risk is the potential for loss or damage when a threat successfully exploits a vulnerability. It is generally calculated as a combination of the likelihood of an event happening and the impact it would have on the organization if it did happen.
💡 EASY HINGLISH EXPLANATION
Risk matlab agar threat aur vulnerability dono milke kuch nuksan karein, to uska kitna asar (impact) padega.
🌍 DAY-TO-DAY EXAMPLE
A hospital storing unencrypted patient records on an internet-connected server faces high risk, because the likelihood of a breach is high and the impact on patient privacy would be severe.
📖 DEFINITION
Malware (malicious software) is any software intentionally designed to cause damage, disruption, or unauthorized access to a computer, server, or network. Common types include viruses, worms, ransomware, spyware, and trojans.
💡 EASY HINGLISH EXPLANATION
Malware ek harmful software hai jo computer ya network ko nuksan pahuchane ya data churane ke liye banaya jata hai.
🌍 DAY-TO-DAY EXAMPLE
An employee accidentally downloads an infected email attachment, which installs ransomware that locks all company files until a ransom is paid.
📖 DEFINITION
Phishing is a social engineering attack where a criminal sends fraudulent communications, usually emails, that appear to come from a trustworthy source, in order to trick the victim into revealing sensitive information like passwords or clicking a malicious link.
💡 EASY HINGLISH EXPLANATION
Phishing ek fraud tactic hai jisme attacker asli company jaisa dikhne wala fake email bhejta hai taaki user apni details de de.
🌍 DAY-TO-DAY EXAMPLE
An employee receives an email that looks exactly like it's from their bank asking them to 'verify their account' by clicking a link — this is a classic phishing attempt.
📖 DEFINITION
The Principle of Least Privilege states that a user, program, or process should be granted only the minimum levels of access — or permissions — needed to perform its required function, and nothing more, in order to reduce the potential damage from mistakes or attacks.
💡 EASY HINGLISH EXPLANATION
Least Privilege ka matlab hai ki kisi ko sirf utni hi access do jitni uske kaam ke liye zaroori hai, extra access mat do.
🌍 DAY-TO-DAY EXAMPLE
A marketing intern is given access only to the marketing shared drive, not to the finance department's confidential files, following the least privilege principle.
📖 DEFINITION
Access Control is a security technique that regulates who or what can view, use, or access resources in a computing environment. It combines authentication (verifying identity) and authorization (defining permissions) to protect systems from unauthorized use.
💡 EASY HINGLISH EXPLANATION
Access Control decide karta hai kaun kaunse system ya data ko access kar sakta hai, based on unki identity aur role.
🌍 DAY-TO-DAY EXAMPLE
In an office building, employee ID cards are programmed so that only HR staff can badge into the HR records room, while other employees cannot.
📖 DEFINITION
An Audit is a systematic, independent examination of an organization's security controls, processes, and records to verify whether they comply with a specific standard, law, or internal policy, and to identify any gaps that need correction.
💡 EASY HINGLISH EXPLANATION
Audit ek official checking process hai jisme dekha jata hai ki company ke security aur compliance rules sahi tarike se follow ho rahe hain ya nahi.
🌍 DAY-TO-DAY EXAMPLE
An external auditor reviews a bank's access logs, encryption practices, and employee training records once a year to certify that it meets PCI-DSS requirements.
📖 DEFINITION
Data Privacy refers to the proper handling, processing, storage, and usage of personal information, ensuring that individuals' data is collected and used only with appropriate consent and for legitimate purposes, in line with applicable privacy laws.
💡 EASY HINGLISH EXPLANATION
Data Privacy ka matlab hai logon ki personal information ko sahi tarike se, unki permission ke saath, aur sirf zaroori kaam ke liye use karna.
🌍 DAY-TO-DAY EXAMPLE
A mobile app must ask for a user's explicit consent before collecting their location data, and must clearly explain why that data is being collected — this is data privacy in practice.
📖 DEFINITION
A Data Breach is a security incident in which sensitive, protected, or confidential data is accessed, disclosed, copied, transmitted, or stolen by an unauthorized individual, often resulting in financial loss, legal consequences, and reputational damage.
💡 EASY HINGLISH EXPLANATION
Data Breach tab hota hai jab kisi unauthorized person ke paas company ka sensitive data leak ho jata hai ya chori ho jata hai.
🌍 DAY-TO-DAY EXAMPLE
A retail company discovers that hackers accessed its database and stole millions of customers' credit card numbers — this event is officially classified as a data breach.
📖 DEFINITION
A Compliance Framework or Standard is a structured set of guidelines, controls, and best practices published by a government body or industry organization that companies must follow (or choose to follow) to demonstrate that their security and data-handling practices meet an accepted benchmark.
💡 EASY HINGLISH EXPLANATION
Compliance Framework ek official rulebook hai (jaise ISO 27001, GDPR) jise follow karke company prove karti hai ki uske security practices standard ke mutabik hain.
🌍 DAY-TO-DAY EXAMPLE
A cloud company gets ISO 27001 certified, which involves following a detailed international standard for information security management and passing an independent audit.
📖 DEFINITION
Incident Response is the organized, structured approach an organization takes to identify, contain, eradicate, and recover from a cybersecurity incident such as a breach, malware infection, or system compromise, with the goal of minimizing damage and recovery time.
💡 EASY HINGLISH EXPLANATION
Incident Response matlab jab koi security incident (jaise hacking attempt) ho jaye, to usse turant aur systematic tarike se handle karna.
🌍 DAY-TO-DAY EXAMPLE
When a company detects ransomware spreading on its network, its incident response team immediately isolates the infected computers from the network to stop it from spreading further.
Confidentiality, Integrity, and Availability together form the foundation of almost every security concept discussed above. This is called the CIA Triad.
Figure 1: The CIA Triad — the three pillars of Information Security
These three terms are often confused, but they mean different things and are a very common interview topic. Understanding the distinction clearly is essential.
| Aspect | Security | Compliance | Privacy |
|---|---|---|---|
| Meaning | Actual technical & physical protection of systems/data | Following specific laws, rules & standards | Proper handling & consent for personal data |
| Goal | Prevent breaches & attacks | Prove adherence to a standard | Respect individual data rights |
| Nature | Continuous, technical | Point-in-time, documented | Policy & consent driven |
| Example | Firewalls, encryption, MFA | ISO 27001 certificate, GDPR audit | Cookie consent banners, opt-outs |
| Who Checks | Security team / SOC | Auditors / Regulators | Data Protection Officer (DPO) |
| Failure Result | Data breach, system downtime | Legal fines, loss of certification | Privacy violation lawsuits |
Figure 2: Security vs Compliance at a glance
💡 EASY HINGLISH EXPLANATION
Security matlab asal mein data ko protect karna (jaise taala lagana). Compliance matlab yeh prove karna ki taala sahi standard ka hai (audit se). Privacy matlab logon ki personal info ko sahi tarike se, unki permission se use karna. Teeno alag hain lekin ek dusre ko support karte hain.
When a security incident (like a breach or malware attack) occurs, organizations follow a structured lifecycle to handle it effectively. Here is a detailed breakdown of each stage:
| Step | What Happens | Responsible |
|---|---|---|
| 1. Identify | Suspicious activity is detected via monitoring tools, user reports, or alerts | SOC Team / Monitoring Tools |
| 2. Log & Classify | Incident is logged with details; severity and type are classified | Security Analyst |
| 3. Contain | Affected systems are isolated to stop the incident from spreading further | Incident Response Team |
| 4. Eradicate | The root cause (malware, vulnerability, unauthorized access) is completely removed | Security Engineers |
| 5. Recover | Affected systems are restored to normal operation from clean backups | IT / Infrastructure Team |
| 6. Review & Report | A post-incident review is conducted; lessons learned are documented | CISO / Compliance Officer |
Figure 3: Security Incident Response Lifecycle
📖 DEFINITION
Defense in Depth is a security strategy that layers multiple independent defensive controls throughout an organization's systems — physical, network, host, application, and data levels — so that if one layer fails or is bypassed by an attacker, other layers still provide protection.
💡 EASY HINGLISH EXPLANATION
Defense in Depth ka matlab hai security ki multiple layers lagana, jaise ek ke baad ek — agar ek layer fail ho jaye, to doosri layer phir bhi data ko bachati hai.
🌍 DAY-TO-DAY EXAMPLE
A bank uses security guards and CCTV (physical layer), a firewall (network layer), antivirus software on computers (host layer), login screens on its banking application (application layer), and encryption of the actual account data (data layer) — all working together.
Figure 4: Defense in Depth — layered security around data
There are many compliance frameworks, each relevant to a specific industry or region. Below are the most commonly discussed ones:
| Framework | Full Form / Focus | Applies To |
|---|---|---|
| GDPR | General Data Protection Regulation — protects personal data of EU citizens | Any company handling EU citizens' data, globally |
| HIPAA | Health Insurance Portability and Accountability Act — protects patient health data | Healthcare providers & related businesses in the US |
| PCI-DSS | Payment Card Industry Data Security Standard — protects cardholder data | Any organization that processes card payments |
| ISO 27001 | International standard for Information Security Management Systems (ISMS) | Any organization wanting certified security practices |
| SOC 2 | Service Organization Control 2 — evaluates security, availability & privacy controls | Cloud & SaaS service providers |
| SOX | Sarbanes-Oxley Act — ensures accuracy of financial reporting and controls | Publicly traded companies in the US |
Security controls are generally grouped into three categories based on how they work. Knowing this classification is a common interview question.
| Control Type | Meaning | Example |
|---|---|---|
| Administrative (Policy-based) | Rules, policies, and training that guide human behavior | Security awareness training, acceptable use policy |
| Technical (Logical) | Technology-based mechanisms that protect systems directly | Firewalls, encryption, MFA, antivirus |
| Physical | Controls that protect the actual physical environment | CCTV cameras, biometric door locks, security guards |
Controls can also be classified by their purpose:
| Purpose Type | Meaning | Example |
|---|---|---|
| Preventive | Stops an incident before it happens | Firewall blocking unauthorized traffic |
| Detective | Identifies an incident while or after it happens | Intrusion Detection System (IDS), audit logs |
| Corrective | Fixes/restores systems after an incident | Restoring data from backup after an attack |
To measure whether a Security & Compliance program is effective, teams track several Key Performance Indicators (KPIs):
| Metric | What It Measures |
|---|---|
| Mean Time to Detect (MTTD) | Average time taken to detect a security incident after it occurs. |
| Mean Time to Respond (MTTR) | Average time taken to contain and resolve a security incident. |
| Number of Vulnerabilities Found | Total open vulnerabilities identified through scans, indicating exposure level. |
| Patch Compliance Rate | Percentage of systems updated with the latest security patches on time. |
| Audit Findings / Non-Conformities | Number of gaps identified during a compliance audit that need correction. |
| Phishing Simulation Click Rate | Percentage of employees who click on simulated phishing test emails. |
| Security Awareness Training Completion | Percentage of employees who have completed required security training. |
These practical scenarios test your understanding of how Security & Compliance concepts apply in real situations.
Q1. An employee receives an email that looks exactly like it is from the company's IT department, asking them to click a link and enter their password. What kind of attack is this, and what should the employee do?
Answer: This is a Phishing attack. The employee should not click the link or enter any credentials, and should instead report the email to the security team immediately.
Why / Reason: Phishing relies on tricking users into believing a fraudulent message is genuine. Reporting suspicious emails without interacting with them prevents credential theft and allows the security team to warn other employees.
Q2. A company's database containing customer credit card numbers is stolen by hackers, but the data was fully encrypted. Is this still considered a serious data breach?
Answer: It is technically still classified as a data breach (unauthorized access occurred), but the actual risk and impact are significantly lower because the encrypted data is unreadable without the decryption key.
Why / Reason: Encryption protects the Confidentiality of data even when a breach occurs. This is exactly why encryption is considered one of the most critical security controls for sensitive data.
Q3. A new intern joins the finance team and is automatically given full administrator access to all company systems, even though they only need access to expense reports. Which security principle is being violated here?
Answer: This violates the Principle of Least Privilege, which states that users should only be given the minimum access required to do their job.
Why / Reason: Excessive access increases the potential damage if that intern's account is compromised or misused, whether accidentally or intentionally. Least privilege limits this exposure.
Q4. During a routine compliance audit, an auditor discovers that a hospital has not encrypted any of its patient data, violating HIPAA requirements. What is the likely consequence, and what should the hospital do?
Answer: The hospital may face legal fines, penalties, and reputational damage. It should immediately implement encryption for patient data and create a remediation plan to fix the non-conformity found in the audit.
Why / Reason: Non-compliance with a mandatory regulation like HIPAA carries direct legal and financial consequences, separate from whether an actual breach has happened. Audits exist specifically to catch such gaps before they lead to real incidents.
Q5. A company detects that ransomware has started encrypting files on several employee laptops. What should be the very first step in the incident response process?
Answer: The first step is Containment — immediately isolating (disconnecting) the affected laptops from the network to prevent the ransomware from spreading to other systems.
Why / Reason: Following the Incident Response Lifecycle, containment must happen before eradication or recovery; otherwise, the ransomware could keep spreading and cause more widespread damage while the team works on the fix.
Q6. An online shopping website goes down for six hours during a major sale due to a Denial-of-Service (DoS) attack flooding its servers with fake traffic. Which part of the CIA Triad was primarily affected?
Answer: Availability was primarily affected, since legitimate customers could not access the website during the attack, even though no data was necessarily stolen or altered.
Why / Reason: The CIA Triad separates Confidentiality (data secrecy), Integrity (data accuracy), and Availability (system access). A DoS attack specifically targets a system's ability to remain accessible, making this an Availability issue.
Q7. A company wants to start doing business with European customers and needs to prove it handles personal data lawfully. Which compliance framework is most relevant here?
Answer: GDPR (General Data Protection Regulation) is the most relevant framework, since it governs how personal data of EU citizens must be collected, stored, and processed.
Why / Reason: GDPR applies to any organization worldwide that handles the personal data of EU residents, not just companies based in Europe, making it directly relevant to this scenario.
Q8. A security analyst notices that a login attempt was made using a correct password, but the multi-factor authentication (MFA) code was entered incorrectly three times. What does this suggest, and what should happen next?
Answer: This suggests the password may have been compromised (e.g., stolen or guessed) but the attacker does not have access to the second authentication factor. The account should be flagged for review, and the user should be asked to reset their password.
Why / Reason: This scenario demonstrates exactly why MFA is effective — even with a stolen password, an attacker is blocked by the second layer of authentication, buying time for the security team to respond.
1. What is the difference between Security and Compliance?
Security is the actual technical and physical protection of systems and data from threats, while Compliance is following specific laws, regulations, and industry standards, and being able to prove adherence to them through documentation and audits.
2. What is the CIA Triad?
The CIA Triad stands for Confidentiality (only authorized access), Integrity (data remains accurate and untampered), and Availability (systems and data are accessible when needed). It forms the foundation of information security.
3. What is the difference between Authentication and Authorization?
Authentication verifies who a user is (e.g., checking a password), while Authorization determines what that verified user is allowed to do or access within a system.
4. What is the difference between a Threat, a Vulnerability, and a Risk?
A Vulnerability is a weakness in a system, a Threat is a potential danger that could exploit that weakness, and Risk is the potential impact/loss that would occur if a threat successfully exploits a vulnerability.
5. What is the Principle of Least Privilege?
It is the practice of giving users, programs, or processes only the minimum level of access needed to perform their required tasks, reducing potential damage from errors or attacks.
6. Name a few common compliance frameworks.
Common frameworks include GDPR (data privacy for EU citizens), HIPAA (healthcare data in the US), PCI-DSS (payment card data), ISO 27001 (information security management), and SOC 2 (service provider controls).
1. If you discover that a colleague is sharing their login password with others, what would you do?
I would explain to them why password sharing violates security policy and increases risk, and I would report it to the security or compliance team so it can be documented and corrected, since this is required for maintaining accountability and audit trails.
2. How would you explain to a non-technical manager why the company needs to invest in security training for employees?
I would explain that most breaches start with human error, such as clicking phishing links, so training employees to recognize threats is one of the most cost-effective ways to reduce risk, alongside technical controls like firewalls.
3. What would you do if you found a critical vulnerability in a production system during a scan?
I would immediately report it through the proper incident/vulnerability management process, assess its severity and potential impact, and work with the relevant team to prioritize and apply a patch or workaround as quickly as possible.
4. How do you balance strong security controls with employee productivity?
I would apply risk-based controls — stricter protections (like MFA) for sensitive systems, and lighter, well-designed controls for lower-risk activities — so security does not create unnecessary friction while still protecting critical assets.
5. If an audit found that your company was not compliant with a required standard, what steps would you take?
I would document the specific gaps identified, create a prioritized remediation plan with clear owners and deadlines, implement the required fixes, and prepare evidence for the next audit cycle to confirm the gaps have been closed.
