Intermediate Networking

Q&A for SOC Analysts

[Link]
1. What is a VLAN and how does it enhance network security?

A VLAN (Virtual Local Area Network) is a logical grouping of devices within a larger physical
network that are segmented to limit broadcast domains and improve security and performance.

Why VLANs Matter in SOC:

Isolate sensitive traffic (e.g., Sales, HR, IT)
Control access using ACLs and VLAN IDs
Reduce internal threat propagation
Used with firewalls to enforce inter-VLAN policies.

2. Explain DNS and its role in cybersecurity.

DNS (Domain Name System) translates domain names (like [Link]) into IP addresses (like
[Link]).
How DNS Works:
Client requests domain
Resolver queries root → TLD → Authoritative server
Response with IP → Connection made
SOC Use Cases:
Monitor for DNS tunneling (data exfiltration)
Detect malicious domains (via threat intel feeds)
Use tools like dnstop, Passive DNS, Splunk DNS parsing

Attackers often use dynamic/malware-hosting domains. DNS logs help track them.
3. What are IDS and IPS? How do they differ in functionality?

IDS (Intrusion Detection

Feature IPS (Intrusion Prevention System)
System)

Out-of-band (sniffing
Placement Inline (active traffic path)
mode)

Response Detects & Alerts Detects & Blocks

Control Passive monitoring Active enforcement

False Positive Impact Low High (can block legitimate traffic)

Example Tools Snort (IDS), Zeek Suricata, Cisco Firepower, Palo Alto

SOC Relevance:
SOC teams often use IDS for alert triage and IPS for active prevention in critical zones.

4. What is a packet sniffer and how is it used by SOC analysts?

A packet sniffer is a tool that captures and analyzes packets flowing over a network.
Popular Tools: Wireshark, tcpdump, Tshark
SOC Use:
Investigate suspicious traffic
Reconstruct sessions during incident response
Detect payload anomalies or exfiltration

Packet sniffers are essential in deep-dive forensics and breach validation.

5. What is traceroute and how can it help in network troubleshooting?

Traceroute maps the path a packet takes from source to destination, showing each hop's IP and
response time.

SOC Relevance:
Identify network latency points
Spot traffic detours (possibly from routing attacks)
Diagnose DDoS paths or network segmentation issues
Use command:

tracert [Link] (Windows)

traceroute [Link] (Linux)

6. How does a firewall work and what are the types of firewalls?

A firewall filters network traffic based on pre-defined rules to allow or block data packets.

Types of Firewalls:

Type Function

Packet Filtering Checks IP, port, protocol

Stateful Inspection Tracks state of connections

Proxy Firewall Acts as intermediary for requests

Next-Gen Firewall (NGFW) Includes deep packet inspection, IDS/IPS features

SOC analysts monitor firewall logs to detect policy violations and anomalies.

7. How can you detect and mitigate ARP spoofing attacks?

ARP Spoofing is when an attacker sends falsified ARP messages to link their MAC with the IP of
another device (e.g., gateway).

Detection:
Unusual or duplicate MAC-IP pairs in ARP table
Use tools: arpwatch, XArp, IDS alerts

Mitigation:
Enable Dynamic ARP Inspection (DAI) on switches
Use static ARP entries for critical systems
Monitor with SIEM & alerts on ARP changes

ARP spoofing can lead to MITM or DoS attacks – critical for SOC to detect early.
8. What are honeypots in network security and how are they useful in a SOC?
A honeypot is a decoy system designed to attract attackers and study their behavior without
risk to actual systems.
Benefits for SOC Teams:
Detect early-stage intrusions
Gather threat intelligence (IPs, payloads, tools)
Divert attackers from production assets

Tools: Honeyd, Kippo, T-Pot, Canary Tokens

Type Description Example Use Case

Low-Interaction Emulates services (e.g., fake SSH) Alerting & basic fingerprinting

Full OS with real services Advanced attack study, APT

High-Interaction
(monitored) detection

Track malicious servers &

Client Honeypots Simulates vulnerable clients
payloads

9. What is the difference between symmetric and asymmetric encryption?

Feature Symmetric Encryption Asymmetric Encryption

Key Type One shared key Public & private key pair

Speed Fast Slower

Used For Encrypting large data Key exchange, digital signatures

Common Algorithms AES, DES, Blowfish RSA, ECC, DSA

TLS/SSL handshake, email

SOC Use Cases VPNs, file encryption
security

SOC Insight:
Encryption is essential for secure communications, but analysts must also monitor for
encrypted C2 traffic using behavioral analysis.
10. What is the difference between a proxy server and a VPN?

Feature Proxy Server VPN (Virtual Private Network)

Scope Application-level (e.g., browser) System-wide encryption

Encryption Usually none Strong encryption (e.g., IPsec, SSL)

IP Masking Yes Yes

Monitor browsing, block

Use in SOC Secure remote access, hide traffic
domains

SOC analysts monitor proxy/VPN logs to track risky behavior and external access attempts.
 Zero Trust Architecture Implementation Checklist

Cybervie Certified SOC Analyst

The Certified SOC Analyst (CCSA) by Cybervie is a job-ready training program designed to
prepare individuals for real-world roles in a Security Operations Center (SOC). Focused on hands-
on skills, live labs, and industry tools, this program ensures you graduate with the confidence and
expertise employers demand.

Key Modules
Security Basics & Networking – Core networking and cybersecurity fundamentals.
SOC Fundamentals – SOC processes, workflows, and monitoring.
SIEM Tools Training – Practical exposure to Splunk, QRadar, Microsoft Sentinel, and more.
Incident Response – Detection, triage, and response to incidents.
Malware Analysis – Identifying and mitigating malicious code.
Threat Intelligence – Using frameworks like MITRE ATT&CK;, ISO 27001, NICE 2.0.
Career Readiness – Resume building, mock interviews, and assessments.

Unique Value Proposition

Beginner-Friendly – No prior experience or coding required.
Hands-On Learning – Labs, quizzes, real-world simulations.
Industry Alignment – Curriculum mapped to SOC roles (SOC Analyst L1–L3, Security Analyst,
SIEM Engineer, Incident Responder, Threat Detection Engineer).
Future-Focused – SIEM, SOAR, XDR, and AI-driven SOC operations.

Why Choose Cybervie’s CCSA?

• Structured curriculum with live interactive training.
• Delivered by industry practitioners with SOC expertise.
• Industry-recognized certification trusted by professionals.
• Practical skills aligned to market demand.
• Proven track record with learners and corporate partners.

📌Click to Enroll : Cybervie Certified SOC Analyst

Cybervie’s CCSA is more than a certification — it’s your launchpad
into the fastest-growing cybersecurity career path.

Contact Us
Website: [Link] Phone: +91-9959208874
Email: info@[Link] Office: Hyderabad, India Scan & Enroll Now