PwC Cybersecurity Analyst Interview Questions (2026)

1. 1Online Aptitude & Game-Based Assessment45 minMedium

   Timed numerical/logical tests plus gamified behavioral tasks that build an early fit profile.

2. 2Technical / Domain Interview45 minMedium

   Practice-specific depth: accounting standards and controls for assurance, SQL/cloud/delivery scenarios for AC technology roles.

3. 3Case / Analytics Round45 minMedium

   Work a mini-case: reconcile a dataset, spot control gaps, or structure a client problem with a clear recommendation.

4. 4Director / Partner Round45 minMedium

   Senior leader assesses maturity, client presence, ethics, and alignment to the PwC Professional framework.

5. 5HR Round30 minEasy

   Values-fit questions, compensation, mobility across engagements, and background checks.

1. Q1

   How would you plan disk, memory, and external media forensic collection? In your answer, cover scope boundaries, hash validation, and data-access validation

   Lead/ConsultantForensicsPwC-specific

   Context: A laptop may have been used to exfiltrate sensitive data before being powered off.

   How to answer: Planning forensic collection involves defining clear scope boundaries for disk, memory, and external media based on the incident, prioritizing volatile data first (memory), then non-volatile. Hash validation (e.g., MD5, SHA256) must be performed pre- and post-acquisition for all collected images to ensure data integrity and immutability. Data access validation requires documenting the chain of custody, using write-blockers for disk/external media, and ensuring authorized personnel with appropriate tools perform the collection to maintain evidential integrity.

2. Q2

   How would you plan disk, memory, and external media forensic collection? In your answer, cover legal hold requirements, timeline construction, and time-zone normalization

   EntryForensicsPwC-specific

   Context: A laptop may have been used to exfiltrate sensitive data before being powered off.

   How to answer: A strong plan for disk, memory, and external media forensic collection begins with establishing a legal hold to preserve all potentially relevant data. Next, prioritize volatile data (memory) collection, followed by disk imaging, and then external media. For each, document a detailed timeline including acquisition start/end times, hash calculations, and chain of custody. Finally, ensure all collected timestamps are normalized to Coordinated Universal Time (UTC) to avoid time zone discrepancies during analysis.

3. Q3

   How would you assess evidence integrity and collect artifacts safely? In your answer, cover timeline construction, legal hold requirements, and reporting language

   IntermediateForensicsPwC-specific

   Context: An endpoint was isolated automatically after a scheduled task created remotely, but the user continued working remotely.

   How to answer: A strong answer will detail the initial steps of securing the scene and documenting the evidence chain of custody to maintain integrity. It will then explain the process of creating a forensically sound copy of the data using write-blockers and hashing, followed by timeline construction using various system logs and artifacts. The candidate should also address legal hold requirements, emphasizing communication with legal counsel and preservation notices, and conclude with clear, defensible reporting language suitable for legal proceedings.

4. Q4

   How would you build a timeline using filesystem, web logs, process, and network artifacts? In your answer, cover timeline construction, forensic imaging, and data-access validation

   AdvancedForensicsPwC-specific

   Context: A web server compromise is suspected after unusual file modifications and outbound connections.

   How to answer: A strong candidate would outline a process beginning with forensically sound imaging of all relevant systems, ensuring data integrity through hashing. They would then describe extracting timestamps from filesystem metadata (MFT, Superblocks), web browser history, server logs, and network flow data (NetFlow/IPFIX). The candidate would explain correlating these disparate time sources, normalizing them to UTC, and using tools like `log2timeline.py` (plaso) to build a super timeline. Finally, they would detail validating data access by comparing hash values of the acquired images against the original source, and verifying log integrity through checksums or trusted log sources.

5. Q5

   What would you look for during memory analysis and how would you validate findings? In your answer, cover legal hold requirements, volatile evidence, and chain of custody

   Lead/ConsultantForensicsPwC-specific

   Context: A memory image from a service account contains suspicious network connections and injected processes.

   How to answer: During memory analysis, I would look for active processes, network connections, loaded modules, open handles, and evidence of rootkits or malware injection. Validation involves cross-referencing findings with other forensic artifacts, using multiple tools, and documenting each step. Legal hold requirements necessitate preserving the original memory image and related data, while volatile evidence must be captured immediately and securely. Maintaining a strict chain of custody is crucial from acquisition through analysis and reporting to ensure admissibility.

6. Q6

   How would you recover enough evidence to determine execution and impact? In your answer, cover integrity risks, timeline construction, and evidence storage

   EntryForensicsPwC-specific

   Context: A phishing attachment was deleted before analysis, but endpoint and email logs remain.

   How to answer: To determine execution and impact, I would first secure the affected system by creating a forensic image to preserve data integrity, ensuring a strong chain of custody. Next, I would analyze system logs (event logs, prefetch files, MFT) for execution artifacts and user activity, correlating timestamps to build a detailed timeline. Impact assessment would involve examining network connections, file modifications, and persistence mechanisms. All evidence would be stored securely with checksums, and a detailed report outlining findings, integrity measures, and the timeline would be compiled.

7. Q7

   Which browser, identity, and SaaS artifacts would help confirm the export? In your answer, cover legal hold requirements, forensic imaging, and time-zone normalization

   IntermediateForensicsPwC-specific

   Context: A browser-based SaaS export may have occurred from a file share.

   How to answer: To confirm a data export, browser artifacts like download history, cache, and autofill entries are crucial. Identity artifacts, such as MFA logs, session tokens, and cloud identity provider (IdP) logs, will show who accessed the system and when. SaaS application logs, including audit trails, export logs, and API calls, provide direct evidence of the export action. Throughout the investigation, ensure legal hold requirements are met by preserving all relevant data, perform forensic imaging of endpoints and cloud resources, and meticulously normalize all timestamps to UTC to avoid discrepancies.

8. Q8

   How would you collect and analyze evidence while respecting legal and HR requirements? In your answer, cover timeline construction, legal hold requirements, and data-access validation

   AdvancedForensicsPwC-specific

   Context: A suspected insider used a vendor VPN account to access files outside normal duties.

   How to answer: A strong answer would detail a systematic approach to endpoint evidence collection, emphasizing the preservation of integrity through write-blockers and forensic imaging, while establishing a robust chain of custody. It would then describe timeline construction using various system logs and artifacts (e.g., MFT, USN Journal, event logs, browser history) to reconstruct events. Crucially, the answer must integrate legal hold procedures from the outset, ensuring all potentially relevant data is identified and preserved, and outline a process for validating data access based on role, necessity, and documented authorization, adhering to privacy and HR policies.

9. Q9

   How would you document chain of custody, hashing, storage, and transfer? In your answer, cover data-access validation, legal hold requirements, and hash validation

   Lead/ConsultantForensicsPwC-specific

   Context: A forensic image must be shared with outside counsel and the client wants defensible handling.

   How to answer: Document chain of custody by creating a detailed log for each piece of evidence, noting acquisition details, date/time, and personnel involved. Hashing (e.g., SHA256, MD5) must be performed at acquisition and validated at each transfer or access point to ensure data integrity. Storage should be in a secure, access-controlled environment, with transfer documented via secure methods and signed receipts. Data-access validation involves strict authentication and authorization, while legal hold requirements dictate specific preservation and handling procedures, all meticulously logged.

10. Q10

    What forensic process would you follow from identification to final reporting? In your answer, cover chain of custody, integrity risks, and collection order

    EntryForensicsPwC-specific

    Context: A legal hold requires preserving evidence for a suspected breach in a merger-and-acquisition environment.

    How to answer: A strong answer would detail the forensic process starting with Identification, followed by Preservation, Collection, Examination, Analysis, and concluding with Reporting. Key elements to cover include establishing and maintaining a strict chain of custody throughout all phases, identifying and mitigating integrity risks like data alteration or contamination, and understanding the order of volatility for data collection (e.g., RAM before hard drives). Emphasize the importance of documentation at every step to ensure legal admissibility and reproducibility.

11. Q11

    How would you determine whether sensitive records were viewed, exported, or altered? In your answer, cover forensic imaging, chain of custody, and scope boundaries

    IntermediateForensicsPwC-specific

    Context: A database audit trail indicates unusual SELECT queries from a service account.

    How to answer: To determine if sensitive records were viewed, exported, or altered, I would begin by establishing clear scope boundaries and securing the relevant systems through forensic imaging to preserve data integrity. A strict chain of custody must be maintained for all collected evidence from acquisition through analysis. Analysis would then focus on system logs (e.g., event logs, access logs), application logs, and potentially network flow data to identify access patterns, file operations, and data egress. Timeline reconstruction, correlating events across multiple sources, would be crucial to pinpoint specific user actions and their impact on sensitive records.

12. Q12

    What artifacts would you examine to validate device usage and file movement? In your answer, cover data-access validation, volatile evidence, and integrity risks

    AdvancedForensicsPwC-specific

    Context: A USB device was connected to a VIP executive laptop shortly before sensitive files disappeared.

    How to answer: To validate device usage and file movement, I would examine MFT entries, USN Journal, and Windows Event Logs (Security, System, PowerShell Operational) for data-access validation. Volatile evidence like network connections, running processes, and open files from RAM/live acquisition would provide immediate context. Integrity risks are mitigated by hashing all acquired evidence, maintaining a strict chain of custody, and using write-blockers during acquisition to prevent alteration of the original media.

13. Q13

    What artifacts would you examine to validate device usage and file movement? In your answer, cover forensic imaging, time-zone normalization, and chain of custody

    Lead/ConsultantForensicsPwC-specific

    Context: A USB device was connected to a service account shortly before sensitive files disappeared.

    How to answer: To validate device usage and file movement, I would examine USB device artifacts (Registry keys like `USBSTOR`, `SetupAPI` logs), ShellBags for folder access, LNK files for shortcuts to accessed files/folders, and Jump Lists for recently opened documents. Additionally, I would analyze the MFT for file creation/modification/access times, and event logs (Security, System, PowerShell) for relevant activity. All analysis would begin with a forensically sound image, followed by time-zone normalization of all timestamps to UTC, and meticulous documentation of the chain of custody throughout the entire process.

14. Q14

    How would the reboot affect your forensic approach and what artifacts would still be useful? In your answer, cover chain of custody, artifact reliability, and volatile evidence

    EntryForensicsPwC-specific

    Context: A server shows signs of credential dumping, but administrators rebooted it before collection.

    How to answer: A reboot significantly impacts forensic investigations by destroying volatile memory contents, making it crucial to document the incident and preserve remaining evidence. The chain of custody must be meticulously maintained for any collected artifacts, noting the system's altered state. While volatile evidence like RAM contents and active network connections are lost, persistent artifacts on disk, such as log files, registry hives, and disk images, remain valuable for reconstructing events. The reliability of these remaining artifacts must be assessed, considering potential tampering or the system's altered state post-reboot.

15. Q15

    How would you reconcile conflicting timestamps, time zones, and log source reliability? In your answer, cover artifact reliability, legal hold requirements, and timeline construction

    IntermediateForensicsPwC-specific

    Context: Two analysts produce different incident timelines for lateral movement.

    How to answer: A strong candidate would emphasize establishing a 'source of truth' by prioritizing reliable time sources like NTP-synced domain controllers or cloud provider timestamps. They would detail the process of normalizing all timestamps to a common time zone (e.g., UTC) to eliminate discrepancies, while meticulously documenting the original time zone and offset. The answer should cover validating artifact reliability through hashing, digital signatures, and comparing across multiple log sources, and explain how legal hold requirements necessitate preserving original logs and metadata. Finally, they would describe a systematic approach to timeline construction, cross-referencing events from different sources to build a coherent narrative.

Practice these with instant AI feedback in a live mock interview → Start a PwC Cybersecurity Analyst mock

Focus your prep on the topics above, rehearse structured answers out loud, and do at least one full mock loop before the real thing.

Cybersecurity Analyst interviews at other companies