Cybersecurity Interview Pack
300 questions • 9 topic guides • English + Roman Urdu • Examples, diagrams, practical tasks and course outcomes
4–6 hours dailyBeginner to intermediateOffline-readable guidesStart here
Open this file in a browser, then select a topic below. Each guide contains its own beginner and intermediate learning path, measurable outcomes, question explanations, practical tasks, two original diagrams, a quick revision sheet and official tutorial links. The guide text and diagrams work offline; external tutorials need internet access.
Yeh file browser mein kholo aur neeche topic choose karo. Har guide mein English aur Roman Urdu, examples, practice tasks, beginner/intermediate path aur course outcomes hain. References kholne ke liye internet chahiye.
These are 300 distinct representative questions built around commonly tested skills. They are not copied employer interview banks or a promise that these exact questions will be asked. Use lab evidence and explain your own experience honestly.
Your nine guides
| Topic | Questions | Beginner hours | Intermediate additional hours | Total suggested hours |
|---|---|---|---|---|
| Microsoft Sentinel / KQL | 50 | 36 | 96 | 132 |
| Defender for Endpoint | 40 | 28 | 72 | 100 |
| Entra ID / MFA | 30 | 24 | 60 | 84 |
| Microsoft Intune | 30 | 28 | 72 | 100 |
| ServiceNow | 20 | 16 | 32 | 48 |
| Active Directory | 30 | 24 | 60 | 84 |
| Microsoft 365 Defender / Defender XDR | 40 | 28 | 72 | 100 |
| PowerShell | 40 | 28 | 80 | 108 |
| Wireshark | 20 | 20 | 48 | 68 |
| Total | 300 | 232 | 592 | 824 |
Combined course direction: 24-week planning framework
At six study days a week, 4–6 hours daily gives 24–36 focused hours weekly, or 576–864 hours over 24 weeks. The topic plans total 824 hours; skill overlap and existing experience can reduce repetition. At four hours a day, completing every suggested hour sequentially takes about 35 weeks; at six hours it takes about 23 weeks. Use 24 weeks as a framework and extend it when the practical outcomes need more work.
With your infrastructure background, first assess AD, ticketing, Intune and identity basics. Spend the saved time on KQL, threat investigation and cross-product scenarios. Beginner familiarity across the pack may be achievable in roughly 6–10 weeks of focused work, but broad intermediate competence needs repeated practical evidence and may take longer than the course framework.
Roz 4–6 ghantay aur haftay ke chhay din se 24–36 hours bante hain. Aap ka infrastructure experience basics mein madad karega. Jo topic pehle se aata hai us ka practical check karo aur saved time KQL aur investigations ko do. Sirf hours complete karna intermediate level ki guarantee nahin.
| Weeks | Main direction | Required practical outcome |
|---|---|---|
| 1–3 | Baseline assessment; AD, ServiceNow and PowerShell foundations | Explain a lockout case, complete five good tickets and export a read-only report |
| 4–6 | Entra, MFA and Intune foundations; PowerShell practice continues | Trace a blocked sign-in, compare join/enrolment/compliance and verify a test deployment |
| 7–10 | Sentinel and KQL fundamentals, then detections | Write and explain ten queries, investigate a simple incident and test two detections |
| 11–14 | Defender for Endpoint investigations and response | Build a process timeline, hunt across devices and verify a lab response or tabletop plan |
| 15–18 | Defender XDR and email-to-identity investigation | Scope a fictional campaign and distinguish targeting, delivery, clicks and confirmed impact |
| 19–21 | Wireshark and deeper troubleshooting; complete unfinished topic stages | Explain DNS/TCP evidence, correlate clocks and report visibility limitations |
| 22–24 | Cross-topic capstones, repetition and mock interviews | Produce three defensible reports and complete three mock interviews with unscripted follow-ups |
The stage order is a suggested direction, not a fixed requirement. Continue incomplete intermediate work alongside later topics. For an imminent SOC interview, begin with Sentinel/KQL, MDE and XDR while revising your existing infrastructure skills.
Daily routine: 4–6 hours
| Activity | Core 4 hours | Optional extra 2 hours |
|---|---|---|
| Concepts and official tutorial | 60 minutes | — |
| Hands-on lab or evidence exercise | 120 minutes | 90 minutes: a harder case or failed scenario |
| Interview answers aloud | 30 minutes | 30 minutes: mock interview and follow-ups |
| Review and evidence log | 30 minutes | — |
Roman Urdu: Roz aik ghanta concepts, do ghantay practical, aadha ghanta answers bol kar aur aadha ghanta review karo. Extra do ghantay hon to difficult lab aur mock interview karo. Har haftay chhay study days aur aik rest/catch-up day rakho.
Study time means focused work, excluding breaks. Allocate at least half to practical work. If no tenant or lab is available, analyse supplied data and diagrams, but record that limitation and revisit the task when you have access.
Overall course outcomes
Beginner outcome
- Explain each tool's purpose, data and role boundaries.
- Handle basic guided identity, device, log and ticket tasks.
- Write basic KQL and PowerShell and read simple packet evidence.
- Record evidence, recognise limitations and escalate clearly.
Basic guided tasks, queries aur evidence notes complete kar saken ge aur escalation ki zaroorat samajh saken ge.
Intermediate outcome
- Investigate common security scenarios across endpoint, email and identity data.
- Explain and test detection logic and false-positive trade-offs.
- Troubleshoot common policy, data, access and deployment failures.
- Plan authorised response, verify outcomes and write clear reports.
- Answer scenario follow-ups using practical evidence.
Common scenarios independently investigate, reasoning explain, response verify aur report kar saken ge. Advanced specialist experience alag cheez hai.
Track progress and readiness
Use Practice_Worksheet.html as a printable practice worksheet, or copy its headings into your preferred notes app. Record the question/task, environment, evidence, mistakes, time and next practice date. The worksheet contains no private data.
Rate each topic: 0 not studied; 1 can explain; 2 can perform with a guide; 3 can perform and troubleshoot a common case independently. A memorised answer alone is level 1. Use official documentation during practice, then explain the reasoning without reading.
Har topic ko 0 se 3 rate karo. Sirf answer yaad ho to 1; guide ke saath task ho to 2; common issue independently solve aur explain ho to 3.
Weekly checkpoint: review ten questions, repeat one failed practical task, write one short report and record a mock scenario answer. Keep English interview answers clear; use Roman Urdu to understand the concepts.