Accenture Cybersecurity Analyst Interview Questions (2026)

1. 1Cognitive & Technical Assessment60 minMedium

   Timed online MCQs on aptitude, English, pseudocode, networking, and MS Office/cloud fundamentals.

2. 2Coding Assessment45 minMedium

   1-2 straightforward coding problems in a language of choice; correctness over optimization.

3. 3Communication Assessment30 minEasy

   Automated spoken-English evaluation (listening, pronunciation, fluency) that gates client-facing readiness.

4. 4Technical Interview45 minMedium

   Project walk-through, language/skill-track fundamentals, and scenario questions for the assigned practice.

5. 5Managerial / Client-Fit Round45 minMedium

   Delivery manager probes client-handling scenarios, estimation, escalations, and team leadership for experienced hires.

6. 6HR Discussion30 minEasy

   Compensation, location/shift flexibility, relocation, and joining timeline; light behavioral questions.

1. Q1

   How would you plan disk, memory, and external media forensic collection? In your answer, cover time-zone normalization, hash validation, and artifact reliability

   EntryForensicsAccenture-specific

   Context: A laptop may have been used to exfiltrate sensitive data before being powered off.

   How to answer: Planning forensic collection involves prioritizing volatile data (memory) before non-volatile (disk, external media). For each, secure the collection tools, ensure write-blockers for disk/external media, and use a forensically sound boot environment. Time-zone normalization is crucial for accurate event correlation, often involving converting all timestamps to UTC. Hash validation (e.g., MD5, SHA256) must be performed pre- and post-collection to ensure data integrity and chain of custody. Artifact reliability is assessed by understanding the source, potential for manipulation, and corroborating with other evidence.

2. Q2

   What forensic process would you follow from identification to final reporting? In your answer, cover artifact reliability, integrity risks, and collection order

   IntermediateForensicsAccenture-specific

   Context: A legal hold requires preserving evidence for a suspected breach in a managed XDR service.

   How to answer: A strong answer outlines the forensic process: Identification, Preservation, Collection, Examination, Analysis, and Reporting. It emphasizes the importance of maintaining a strict chain of custody and prioritizing volatile data collection (e.g., RAM, network connections) before persistent data (e.g., disk images). The answer should also discuss validating artifact reliability through multiple sources and hashing, while mitigating integrity risks via write-blockers and secure storage.

3. Q3

   How would you plan disk, memory, and external media forensic collection? In your answer, cover chain of custody, evidence storage, and time-zone normalization

   AdvancedForensicsAccenture-specific

   Context: A laptop may have been used to exfiltrate sensitive data before being powered off.

   How to answer: Planning forensic collection involves prioritizing volatile data (memory) before persistent storage (disk, external media) to minimize data loss. A robust chain of custody must be established immediately, documenting every step from acquisition to analysis, including hashing and photographic evidence. Evidence storage requires secure, write-blocked environments with proper labeling and environmental controls. Time-zone normalization is critical during analysis, converting all timestamps to Coordinated Universal Time (UTC) to ensure accurate event correlation across different systems and locations.

4. Q4

   How would you recover enough evidence to determine execution and impact? In your answer, cover collection order, forensic imaging, and evidence storage

   Lead/ConsultantForensicsAccenture-specific

   Context: A phishing attachment was deleted before analysis, but endpoint and email logs remain.

   How to answer: To recover evidence for execution and impact, prioritize volatile data collection starting with RAM, then CPU registers and network state. Next, perform a full forensic image of all persistent storage (e.g., hard drives, SSDs) using write-blockers and validated tools, ensuring cryptographic hashes are generated for integrity. Finally, store all collected evidence, including memory dumps and disk images, on secure, air-gapped storage with strict access controls and a detailed chain of custody log to maintain admissibility.

5. Q5

   What artifacts would you examine to validate device usage and file movement? In your answer, cover timeline construction, chain of custody, and artifact reliability

   EntryForensicsAccenture-specific

   Context: A USB device was connected to a Kubernetes cluster shortly before sensitive files disappeared.

   How to answer: To validate device usage and file movement, I would examine Windows Event Logs (Security, System, Application), MFT (Master File Table) entries for file creation/modification/access times, USN Journal for changes, and browser history/download logs. For timeline construction, these artifacts would be correlated using their timestamps, prioritizing the most reliable sources like the USN Journal and MFT. Chain of custody is maintained through strict documentation of acquisition, hashing, and analysis steps. Artifact reliability varies; MFT and USN Journal are generally highly reliable for file system events, while user-modified timestamps or application logs can be less trustworthy.

6. Q6

   How would you recover enough evidence to determine execution and impact? In your answer, cover legal hold requirements, collection order, and timeline construction

   IntermediateForensicsAccenture-specific

   Context: A phishing attachment was deleted before analysis, but endpoint and email logs remain.

   How to answer: To recover evidence for execution and impact in a cloud environment, first establish a legal hold on all relevant cloud resources and accounts to prevent data loss. Next, prioritize collection starting with volatile data (e.g., memory snapshots, running processes) followed by persistent storage (e.g., disk images, logs from compute, network, and identity services). Finally, construct a detailed timeline by correlating timestamps from various collected artifacts, including cloud provider logs (CloudTrail, VPC Flow Logs), application logs, and system logs from compromised instances, to reconstruct the attack chain and determine the full impact.

7. Q7

   How would the reboot affect your forensic approach and what artifacts would still be useful? In your answer, cover timeline construction, scope boundaries, and legal hold requirements

   AdvancedForensicsAccenture-specific

   Context: A server shows signs of business email compromise, but administrators rebooted it before collection.

   How to answer: A reboot significantly impacts endpoint forensics by volatile data loss, requiring a shift to persistent artifacts. Timeline construction will rely heavily on event logs, filesystem metadata, and registry hives, with an emphasis on 'last access' and 'last write' times. Scope boundaries must be re-evaluated to include network artifacts and other endpoints, as the reboot might have been an attempt to clean up or spread. Legal hold requirements remain critical, necessitating immediate preservation of all available data, including disk images and network captures, before further changes occur.

8. Q8

   Which cloud forensic artifacts would you collect to determine actions taken and data accessed? In your answer, cover chain of custody, time-zone normalization, and reporting language

   Lead/ConsultantForensicsAccenture-specific

   Context: A cloud account shows suspicious API calls during an overnight shift.

   How to answer: To determine actions and data access in a cloud forensic investigation, I would prioritize collecting logs from CloudTrail (AWS), Azure Monitor/Activity Logs (Azure), or Cloud Logging (GCP) for API calls and management plane activities. Additionally, I'd gather VPC Flow Logs/NSG Flow Logs for network traffic analysis, object storage access logs (S3, Azure Blob, GCP Cloud Storage) for data exfiltration indicators, and potentially snapshot/image data of compromised instances for deeper host-level analysis. Throughout this process, strict chain of custody documentation is paramount, time-zone normalization to UTC is critical for correlating events, and reporting language must be clear, objective, and legally defensible.

9. Q9

   How would you determine whether sensitive records were viewed, exported, or altered? In your answer, cover chain of custody, legal hold requirements, and evidence storage

   EntryForensicsAccenture-specific

   Context: A database audit trail indicates unusual SELECT queries from a developer account.

   How to answer: To determine if sensitive records were viewed, exported, or altered, I would first secure the affected systems and establish a robust chain of custody for all collected evidence. This involves imaging relevant drives, capturing volatile memory, and logging network traffic, ensuring all steps are documented and witnessed. Concurrently, I would initiate a legal hold to prevent data spoliation and ensure all potentially relevant data sources are preserved. Evidence would then be stored in a forensically sound manner, such as write-protected media in a secure, access-controlled facility, with strict logging of access.

10. Q10

    How would you assess evidence integrity and collect artifacts safely? In your answer, cover forensic imaging, legal hold requirements, and integrity risks

    IntermediateForensicsAccenture-specific

    Context: An endpoint was isolated automatically after a newly registered domain appearing in proxy logs, but the user continued working remotely.

    How to answer: A strong answer would detail the process of forensic imaging using write-blockers and specialized tools (e.g., FTK Imager, EnCase) to create bit-for-bit copies, ensuring the original evidence remains unaltered. It would then explain the critical role of hashing (MD5, SHA256) before and after imaging to verify integrity, documenting all steps in a chain of custody. The candidate should also discuss legal hold requirements, emphasizing the proactive preservation of all potentially relevant data, and identify integrity risks such as accidental modification, data corruption, or unauthorized access, along with mitigation strategies.

11. Q11

    What artifacts would you examine to validate device usage and file movement? In your answer, cover artifact reliability, time-zone normalization, and reporting language

    AdvancedForensicsAccenture-specific

    Context: A USB device was connected to a developer workstation shortly before sensitive files disappeared.

    How to answer: To validate device usage and file movement, examine Windows Event Logs (Security, System, PowerShell, RDP), USB device artifacts (Registry, SetupAPI logs, LNK files, Shellbags), and MFT entries. Discuss the reliability of each artifact, noting potential for anti-forensics. Emphasize the critical need for time-zone normalization to UTC across all timestamps for accurate correlation. Finally, explain how to present findings clearly in a report, using precise technical language while translating complex details for non-technical stakeholders.

12. Q12

    How would you reconstruct the timeline and determine whether mail was accessed or exfiltrated? In your answer, cover chain of custody, scope boundaries, and collection order

    Lead/ConsultantForensicsAccenture-specific

    Context: Email headers, mailbox audit logs, and forwarding rules suggest possible business email compromise.

    How to answer: To reconstruct the timeline and determine mail access/exfiltration, first establish a robust chain of custody for all collected evidence. Define clear scope boundaries based on the incident, including affected systems and potential exfiltration vectors. Prioritize volatile data collection (RAM, network connections) before less volatile data (disk images, logs) to preserve critical evidence. Analyze memory forensics for active processes, network connections, and loaded modules, then correlate with disk artifacts (browser history, mail client logs, USB device usage) and network logs (proxy, firewall) to build a comprehensive timeline and identify suspicious activity.

13. Q13

    How would you reconstruct the timeline and determine whether mail was accessed or exfiltrated? In your answer, cover artifact reliability, integrity risks, and reporting language

    EntryForensicsAccenture-specific

    Context: Email headers, mailbox audit logs, and forwarding rules suggest possible business email compromise.

    How to answer: To reconstruct the timeline, I would start by examining email server logs (SMTP, IMAP/POP3, OWA), firewall logs, and endpoint logs (event viewer, browser history, mail client logs). I'd correlate timestamps across these sources, paying attention to IP addresses, user agents, and authentication events to identify access. For exfiltration, I'd look for large outbound email volumes, unusual attachments, access from unknown IPs, and activity in 'Sent Items' or 'Deleted Items' that doesn't align with normal user behavior. Artifact reliability varies; server logs are generally more reliable than endpoint logs, but all are susceptible to tampering or rotation, necessitating integrity checks and corroboration.

14. Q14

    How would you determine whether sensitive records were viewed, exported, or altered? In your answer, cover time-zone normalization, data-access validation, and chain of custody

    IntermediateForensicsAccenture-specific

    Context: A database audit trail indicates unusual SELECT queries from a shared operations mailbox.

    How to answer: To determine if sensitive records were viewed, exported, or altered, I would primarily analyze cloud service logs (e.g., AWS CloudTrail, Azure Monitor, GCP Cloud Logging) for relevant API calls and user activity. Time-zone normalization is critical to accurately correlate events across different log sources and systems. Data-access validation involves cross-referencing log entries with authorized access policies and user roles to identify unauthorized activity. Maintaining a robust chain of custody for all collected forensic artifacts is paramount to ensure their integrity and admissibility.

15. Q15

    How would you reconcile conflicting timestamps, time zones, and log source reliability? In your answer, cover scope boundaries, reporting language, and legal hold requirements

    AdvancedForensicsAccenture-specific

    Context: Two analysts produce different incident timelines for unauthorized SaaS data export.

    How to answer: A strong candidate would emphasize establishing a 'timeline of truth' by prioritizing reliable sources (e.g., hardware clocks, domain controllers) and converting all timestamps to a common, standardized time zone (e.g., UTC). They would discuss defining clear scope boundaries for data collection and analysis, documenting all reconciliation steps, and using precise language in reporting to reflect confidence levels and potential discrepancies. Finally, they would integrate legal hold requirements by ensuring all original data, reconciliation artifacts, and analysis notes are preserved meticulously.

Practice these with instant AI feedback in a live mock interview → Start a Accenture Cybersecurity Analyst mock

Clear aptitude + fundamentals; communicate well; prepare basic technical + HR questions

Cybersecurity Analyst interviews at other companies