Deloitte Cybersecurity Analyst Interview Questions (2026)

1. 1Online Assessment60 minMedium

   Timed aptitude, technical MCQs, and English proficiency sections that gate the interview shortlist.

2. 2JAM / Group Discussion25 minEasy

   Speak for a minute on a surprise topic or debate in a group; screens articulation and composure.

3. 3Technical Interview45 minMedium

   Projects, core fundamentals (SQL, OOP, or domain), and applied scenario questions for the service line.

4. 4Senior / Manager Round45 minMedium

   Manager runs a case-let or client scenario plus deep project probing to judge consulting readiness.

5. 5HR Discussion30 minEasy

   Values-fit conversation, compensation, location, and background verification expectations.

1. Q1

   How would you determine whether sensitive records were viewed, exported, or altered? In your answer, cover timeline construction, volatile evidence, and chain of custody

   IntermediateForensicsDeloitte-specific

   Context: A database audit trail indicates unusual SELECT queries from a break-glass account.

   How to answer: To determine if sensitive records were viewed, exported, or altered, I would first focus on collecting volatile evidence from cloud environments, such as active sessions, memory dumps (if applicable and permissible), and running processes, as these provide immediate insights into current activity. Next, I'd construct a detailed timeline by analyzing cloud provider logs (e.g., CloudTrail, Azure Monitor, GCP Cloud Logging) for data access, administrative actions, and API calls related to the sensitive records, correlating these with any available application-level logs. Throughout this process, maintaining a strict chain of custody for all collected digital evidence is paramount, documenting acquisition methods, timestamps, and hash values to ensure integrity and admissibility.

2. Q2

   What evidence would you preserve first and how would you avoid contaminating it? In your answer, cover scope boundaries, reporting language, and hash validation

   AdvancedForensicsDeloitte-specific

   Context: Deloitte is asked to investigate a cloud storage bucket after new mailbox forwarding rules to an external address is reported in a global banking client. The asset owner is unavailable.

   How to answer: A strong answer would prioritize volatile data preservation (RAM, network connections, running processes) using a forensically sound method like a live acquisition tool (e.g., FTK Imager Lite, KAPE) to a trusted external drive. It would define scope boundaries clearly, distinguishing between the affected endpoint and potentially related systems, and detail the chain of custody. The answer should emphasize using precise, objective reporting language, avoiding speculation, and validating all acquired data with cryptographic hashes (e.g., SHA256, MD5) both before and after transfer to ensure integrity.

3. Q3

   How would you assess evidence integrity and collect artifacts safely? In your answer, cover time-zone normalization, reporting language, and artifact reliability

   Lead/ConsultantForensicsDeloitte-specific

   Context: An endpoint was isolated automatically after a sudden spike in DNS TXT queries, but the user continued working remotely.

   How to answer: A strong candidate would emphasize establishing a secure forensic environment and using write-blockers for disk imaging to maintain evidence integrity. They would detail the importance of calculating and verifying cryptographic hashes (MD5, SHA256) before and after collection. For time-zone normalization, they would discuss converting all timestamps to Coordinated Universal Time (UTC) for consistent analysis, regardless of the original system's locale. Reporting should be clear, concise, and use precise technical language, often in English for international consistency, while also considering the client's preferred language. Artifact reliability assessment involves cross-referencing multiple sources and understanding the limitations of each artifact type.

4. Q4

   How would you assess evidence integrity and collect artifacts safely? In your answer, cover timeline construction, legal hold requirements, and artifact reliability

   EntryForensicsDeloitte-specific

   Context: An endpoint was isolated automatically after PowerShell downloading content from a rare domain, but the user continued working remotely.

   How to answer: A strong answer will emphasize the 'forensic triad' (acquisition, authentication, analysis) for evidence integrity, starting with a documented chain of custody. For safe collection, discuss volatile data first, using write-blockers for disk imaging, and creating cryptographic hashes (MD5/SHA256) before and after acquisition. Timeline construction involves correlating system logs, network traffic, and file metadata, while legal hold requires immediate action to prevent data alteration, ensuring all relevant data sources are identified and preserved. Artifact reliability is assessed by cross-referencing multiple sources and understanding the collection method's impact.

5. Q5

   Which cloud forensic artifacts would you collect to determine actions taken and data accessed? In your answer, cover artifact reliability, chain of custody, and evidence storage

   IntermediateForensicsDeloitte-specific

   Context: A cloud account shows suspicious API calls during a 15-minute window.

   How to answer: To determine actions and data accessed in a cloud environment, I would collect cloud provider logs (e.g., CloudTrail, Azure Monitor, GCP Cloud Logging) for API calls, resource access, and management plane activities. These logs are generally reliable, though integrity must be verified. Chain of custody is maintained by documenting collection methods, hashing artifacts, and using secure transfer protocols. Evidence should be stored in immutable, encrypted storage with strict access controls, adhering to legal and company policies.

6. Q6

   How would you document chain of custody, hashing, storage, and transfer? In your answer, cover collection order, forensic imaging, and hash validation

   AdvancedForensicsDeloitte-specific

   Context: A forensic image must be shared with outside counsel and the client wants defensible handling.

   How to answer: A strong answer will detail the meticulous documentation of each step, starting with the collection order (volatile to persistent). It will explain how forensic imaging is performed using write-blockers and specialized tools, ensuring bit-for-bit copies. The answer will then cover the critical role of hashing (e.g., SHA256) for integrity validation, performed both pre- and post-imaging. Finally, it will describe secure storage (e.g., Faraday bags, locked evidence lockers) and documented transfer protocols, all tied back to a comprehensive chain of custody log.

7. Q7

   How would you recover enough evidence to determine execution and impact? In your answer, cover data-access validation, timeline construction, and time-zone normalization

   Lead/ConsultantForensicsDeloitte-specific

   Context: A phishing attachment was deleted before analysis, but endpoint and email logs remain.

   How to answer: To recover evidence of execution and impact, memory forensics is crucial. Begin by acquiring a volatile memory dump, then use tools like Volatility to extract process lists, network connections, loaded modules, and command history. Data-access validation involves hashing the memory dump and verifying its integrity against the acquisition tool's logs. Timeline construction requires correlating timestamps from various artifacts (e.g., MFT, event logs, memory artifacts) and normalizing all timestamps to Coordinated Universal Time (UTC) to avoid discrepancies and accurately sequence events.

8. Q8

   How would the reboot affect your forensic approach and what artifacts would still be useful? In your answer, cover artifact reliability, hash validation, and integrity risks

   EntryForensicsDeloitte-specific

   Context: A server shows signs of data staging, but administrators rebooted it before collection.

   How to answer: A system reboot significantly impacts forensic analysis by volatile data loss, requiring a shift to persistent storage artifacts. While RAM contents (like active processes, network connections, and some malware states) are lost, disk-based artifacts such as event logs, registry hives, filesystem metadata, and disk images remain crucial. Reliability of these artifacts can be assessed through timestamps and cross-referencing, with hash validation of disk images being paramount for integrity. Integrity risks increase post-reboot due to potential OS modifications or anti-forensic actions, necessitating careful documentation and chain of custody.

9. Q9

   What artifacts would you examine to validate device usage and file movement? In your answer, cover forensic imaging, reporting language, and chain of custody

   IntermediateForensicsDeloitte-specific

   Context: A USB device was connected to a privileged admin workstation shortly before sensitive files disappeared.

   How to answer: To validate device usage and file movement, I would examine Windows event logs (Security, System, PowerShell), MFT entries for file system activity, USB device connection logs (SetupAPI.dev.log, registry keys), and browser history/download logs. Forensic imaging ensures data integrity, using write-blockers and hashing for a forensically sound copy. Reporting language must be clear, objective, and defensible, detailing findings, methodologies, and conclusions. A meticulous chain of custody log is crucial, documenting every handler, location, and action taken on evidence from seizure to presentation, maintaining its admissibility.

10. Q10

    How would the reboot affect your forensic approach and what artifacts would still be useful? In your answer, cover hash validation, forensic imaging, and time-zone normalization

    AdvancedForensicsDeloitte-specific

    Context: A server shows signs of cloud key misuse, but administrators rebooted it before collection.

    How to answer: A reboot significantly impacts endpoint forensics by volatile memory, active network connections, and process states. While live acquisition of RAM is lost, disk-based artifacts remain largely intact, though their timestamps might be affected by system shutdown/startup. My approach would shift from live response to a focus on persistent storage, prioritizing a forensically sound disk image. Hash validation would be crucial for verifying the integrity of the disk image and any extracted files, while time-zone normalization is essential for accurate timeline reconstruction across different systems and log sources.

11. Q11

    How would you build a timeline using filesystem, web logs, process, and network artifacts? In your answer, cover time-zone normalization, timeline construction, and hash validation

    Lead/ConsultantForensicsDeloitte-specific

    Context: A web server compromise is suspected after unusual file modifications and outbound connections.

    How to answer: A strong answer would detail the collection of various artifacts (filesystem metadata, web server logs, process execution logs, network flow data) and the critical step of normalizing all timestamps to a common reference (e.g., UTC) to account for time zone differences. It would then describe the process of ingesting these normalized artifacts into a timeline analysis tool (e.g., `log2timeline.py`/Plaso, Splunk) to correlate events across different sources. Finally, the answer should emphasize the importance of hash validation for all collected evidence to ensure data integrity and authenticity throughout the forensic process.

12. Q12

    How would you determine whether sensitive records were viewed, exported, or altered? In your answer, cover volatile evidence, forensic imaging, and integrity risks

    EntryForensicsDeloitte-specific

    Context: A database audit trail indicates unusual SELECT queries from a dormant contractor account.

    How to answer: To determine if sensitive records were viewed, exported, or altered, one must first prioritize volatile evidence collection (e.g., RAM, network connections) before system shutdown. Subsequently, a forensic image of all relevant storage devices (hard drives, USBs) must be created using write-blockers to preserve the original evidence. Analysis of logs (system, application, security), file system metadata (access, modification, creation times), and potentially memory dumps will reveal user activity. Throughout this process, maintaining a strict chain of custody and validating image integrity with hashing is crucial to ensure admissibility and prevent integrity risks.

13. Q13

    How would you reconcile conflicting timestamps, time zones, and log source reliability? In your answer, cover collection order, volatile evidence, and hash validation

    IntermediateForensicsDeloitte-specific

    Context: Two analysts produce different incident timelines for lateral movement.

    How to answer: To reconcile conflicting timestamps, prioritize evidence collection starting with the most volatile sources (e.g., RAM, network connections) before less volatile ones (e.g., disk images), ensuring a clear collection order. Standardize all timestamps to Coordinated Universal Time (UTC) to eliminate time zone discrepancies. Validate log source reliability by cross-referencing with other logs and using hash validation on collected evidence to ensure integrity and detect tampering, thereby establishing a chain of custody.

14. Q14

    Which browser, identity, and SaaS artifacts would help confirm the export? In your answer, cover reporting language, time-zone normalization, and collection order

    AdvancedForensicsDeloitte-specific

    Context: A browser-based SaaS export may have occurred from a privileged admin workstation.

    How to answer: To confirm a data export, analyze browser history for cloud storage/SaaS upload activity, download directories for exported file remnants, and autofill/form data for entered credentials or filenames. Identity artifacts include Windows Event Logs (4688, 4663) for process execution and file access, and SAM/NTDS.dit for user account changes or new account creation. SaaS artifacts involve reviewing cloud access logs (e.g., Microsoft 365 audit logs, Google Workspace audit logs) for export events, unusual logins, or large data transfers, correlating timestamps and normalizing to UTC for accurate reporting and reconstruction of the event timeline.

15. Q15

    How would you assess evidence integrity and collect artifacts safely? In your answer, cover legal hold requirements, data-access validation, and evidence storage

    Lead/ConsultantForensicsDeloitte-specific

    Context: An endpoint was isolated automatically after a sudden spike in DNS TXT queries, but the user continued working remotely.

    How to answer: A strong answer will emphasize the critical importance of maintaining a documented chain of custody from the moment evidence is identified. It should detail the use of write-blockers for disk imaging, cryptographic hashing (MD5/SHA256) for integrity verification before and after collection, and secure, access-controlled storage. The candidate must also address legal hold by ensuring all relevant data is preserved without alteration and validate data access through authorized personnel and documented procedures, often involving a forensic workstation.

Practice these with instant AI feedback in a live mock interview → Start a Deloitte Cybersecurity Analyst mock

Prepare aptitude, case/technical and behavioral; communicate structured thinking

Cybersecurity Analyst interviews at other companies