SOC
INTERVIEW QUESTIONS
(CYBER SECURITY ANALYST)
1. What do you know about the company?
The “company” is one of the global telecommunications technology leaders that deliver
innovative IT solutions and offers wireless products and services including cybersecurity
operations centers. “The company” is an American company founded in 2000 and
headquartered in New York. “The company” has over 135K employees in 150 global locations.
“The company” has opened 10th security operation center in Canberra providing SOC
services to both public and private sector.
2. What is cybersecurity and why do companies need it?
Cybersecurity is the combination and implementation of security software, hardware,
policies, and procedures in computer, network, and information technology systems to
protect devices, sensitive data, and services from unauthorized access and modification.
Companies need very well-equipped and operated cybersecurity strategies to prevent any
damage from occurring to their valuable assets and business.
3. What do you have in your home network?
I set up a very strong user name and password for my router and Wi-Fi, its broadcasting
feature is disabled. I set up MAC address filtering on the router and I use WPA2 (Wi-Fi
protected access 2) security encryption technology. It encrypts the traffic on wi-fi networks. I
disabled the remote access feature. I use a firewall and configure its security measures and it
is always on.
4. What is the CIA triad? (Confidentiality, Integrity, Availability)
CIA is an abbreviation of Confidentiality, Integrity, and Availability. In cybersecurity, these
three are the core elements of information security that are kept in place and protected from
adverse impacts of incidents such as unauthorized access, disruption, misuse, disclosure,
corruption, deletion, modification, etc.
Confidentiality is the term used to describe information/data privacy which means the
information is not made available or disclosed to unauthorized entities or individuals.
Integrity is the term used to describe information/data accuracy and completeness
throughout its lifecycle. That means that the data cannot be modified by unauthorized
entities or individuals.
Availability is the term used to describe information/data being available when needed.
Availability systems need to remain available at all times preventing service disruptions due
to power outages, hardware failures or system upgrades.
5. Explain the difference between process, guidelines, and policies?
These are the most popular Cyber Security Interview Questions asked in an interview. A
process can be defined in this way; it is step-by-step information that helps in specifying
what would be the next action and an implementation part. Guidelines are referred to as the
recommendation is given to the applications or network, which can be customized and
these can be used while creating any procedures. Policies are defined as the criteria for
security objectives and the organization’s security framework.
6. What is the meaning of AAA?
AAA stands for Authentication, Authorization, and Accounting.
Authentication is the process of determining if a user is legitimate to use the system and
the network. Authentication is usually done using login and password. For example, you
will use a username and password to access your email. The email server authenticates
your username and password and provides further access.
Authorization refers to access control rights. This implies every user on the network is
allowed access to certain portions of data and information and applications according to
his/her level in the organization. For example, a marketing person will not be able to
record financial transactions. Hence, a user is authorized to perform only certain
functions on the network system. These authorization levels are defined by the system
administrator who has access to all the resources and user policies in the network.
Accounting is known as network accounting which is used to gather all activity on the
network for each use.
Hence, AAA is a framework for network security that is used to control user access,
implement policies, audit usage and keep track of all activities in the network. AAA helps
the system administrators and security experts to identify any malicious activity on the
network.
7. What is Risk, Threat and Vulnerability in a network?
Risk is any potential loss of, damage, or destruction of an asset as a result of a threat
exploiting a vulnerability. Risk is the intersection of assets, threats, and vulnerabilities.
Threat: Anything that can exploit a vulnerability, intentionally or unintentionally, to obtain,
damage, or destroying an asset.
Vulnerability: Weaknesses or gaps in a network, software or system that can be exploited by
any threats to gain unauthorized access to an asset.
8. What are IDS and IPS and How do you differentiate between IDS and IPS system?
IDS is an Intrusion Detection System that analyses network traffic for signatures of
incidents/events that match known cyberattacks.
IPS is Intrusion Prevention System also analyses packets, but can also stop the packet from
being delivered.
They are both parts of the network infrastructure. They both compare network packets to
cyberthreat databases containing known signatures of cyberattacks and flag any matching
packets.
The main difference between them is that IDS is a monitoring system, while IPS is a control
system. IDS does not alter the network packets in any way whereas IPS prevents the packet
from delivery based on the contents much like how a firewall prevents traffic by IP address.
IDS requires a human or another system to look at the results.
Many IDS/IPS systems are integrated with firewalls to create unified threat management
[Link] and IPS are located in the same area where the firewall is located between
the outside world and the internal [Link]/IPS system covers Automation, compliance,
and policy enforcement.
A traditional firewall implements rules that prevent network traffic based on protocol,
source/destination address, and/or source/destination port. Firewalls can help you
implement access control lists and prevent the use of insecure [Link] works by
analyzing the headers and payloads of packets and if suspicious behavior is detected, it can
drop the packets. In short, by analyzing the entirety of network packets, IPS can detect
potentially malicious behavior that does not inherently violate firewall rules. There are
host-based IDS and IPS and also Network-based IPS/IDS anomaly-based detection first
creates a baseline of network activity and then compares traffic to that baseline. If network
traffic deviates significantly from the baseline, it can be interpreted as a threat.
Security information and event management, SIEMs help make IPS and IDS more scalable
and can better enable organizations to achieve compliance, improve reporting, and identify
correlations that can indicate a broader threat. In short, SIEMs enable organizations to
scale their IDS and IPS data into a more complete security solution.
Some IPS/IDS tools SolarWinds Security Event Manager
SNORT
Security Onion
WinPatrol
Osquery
Splunk
OSSEC
9. What do you know about cybersecurity frameworks
An information security framework is a series of documented, agreed, and understood
policies, procedures, and processes that define how information is managed in a business
to lower risk and vulnerability and increase confidence.
Some of the most common frameworks are:
International Standards Organisation (ISO) 27K
Australian Signal Directorate (ASD) Essential 8 -> ASD agency is responsible for cyber
welfare and information security. The ASD’s cyber division is known as the Australian Cyber
Security Centre (ACSC). The ACSC provides information, advice, and assistance to prevent
and combat cybersecurity threats in public and private sectors.
US National Institute of Standards and Technology (NIST)-> US agency for industry
standardisation and measurements.
Industry-Specific Standards
CIS (Critical Security Controls)
10. What is a SIEM?
SIEM is Security Information and Event Management software that provides a holistic view of
what is happening on a network in real-time and help cybersecurity analyst to be more
proactive in the fight against security threats.
SEM security event management carries out analysis of the event and logs data in real-time
to provide event correlation, threat monitoring, and incident response
SIM security information management retrieves and analyses log data and generate a report.
For the organization that wants complete visibility and control over what is happening on
their network in real-time, SIEM solutions are critical.
How Does SIEM work?
SIEM collects log and event data that is generated by host systems, security devices, and
applications throughout an organization’s network infrastructure and collating it on a
centralized platform. From antivirus events to firewall logs, SIEM software identifies this data
and sorts it into categories, such as malware activity, failed and successful logins, and other
potentially malicious activity.
When software identifies activity that could signify a threat, alerts are generated to indicate a
potential security issue. These alerts can be set either low or high priority using pre-defined
rules.
SIEM solutions provide a powerful method of threat detection, real-time reporting, and
monitoring, long term analytics of security logs and events.
A single alert from an antivirus filter may not be a cause of panic on its own, but if traffic
anomaly alerts are received from the firewall at the same time, this could signify that a
severe breach is in progress. SIEM collects all of these alerts in a centralized console,
allowing fast and thorough analysis.
Splunk
SIEMonster
AlienVault
IBM QRadar
SolarWinds
11. What is weak information security policy?
An information security policy must be strong in terms of distribution, review,
comprehension, compliance, and uniformity. Information security considered weak if:
The policy has not made readily available for review by all employees.
An organisation is unable to prove that employees reviewed and understood the
content of the policy.
12. How can identity theft be prevented?
Ensure strong password
Avoid sharing confidential information online on social media
Shop from known and trusted websites
Use the latest version of browsers
Install advanced malware and spyware protection tools
Update your system and software
13. How can you prevent Man-in-the-middle-attack?
MITM attack happens when a communication between two parties is intruded or
intercepted by an outside entity.
Use encryption (public-key encryption) between both parties
Avoid using open wi-fi networks.
Use HTTPS, forced TLS or VPN.
14. What is a DDOS attack and how is it mitigated?
DDOS (Distributed Denial of Service) is when a network is flooded with a large number of
requests which is not recognized to handle and making the server unavailable to the
legitimate requests.
DDOS can be mitigated by analyzing and filtering the traffic in the scrubbing centers. The
scrubbing centers are centralized data cleansing stations wherein the traffic to a website
is analyzed and the malicious traffic is removed.
15. What is a brute-force attack and how is it mitigated?
In a brute force attack, the attacker tries to determine the password for a target through
permutation or fuzzing process. As it is a lengthy task, attackers usually employ software
such as fuzzer or hydra, to automate the process of creating numerous passwords to be
tested against a target.
In order to avoid such attacks-password best practices should be followed, mainly on
critical resources like servers, routers.
16. Why do you need DNS (Domain Name System) monitoring?
When you add your domain(s) to a DNS provider’s name servers, you are making those
name servers authoritative for answering your domain’s incoming queries. DNS is the first
point of contact between you and your clients, so it is crucial to keep an eye on the service
you trust to manage it.
DNS monitoring uses network monitoring tools to test connectivity between your
authoritative name servers and local recursive servers. The queries have to ask multiple
servers for the DNS information until they finally reach the name server authoritative for
the domain. We can also monitor the connection between actual clients and the
authoritative name servers.
What you can control is actually the most important part of the DNS process, the
performance of your authoritative name server answering the recursive name server on the
return trip.
Sonar offers an automated monitoring service that checks your domain as often as every
30 seconds for performance changes. You can also set up instant alerts to email or text you
when there are any significant deviations.
Inspecting DNS traffic between the client’s devices and your local recursive resolver could
be revealing a wealth of information for forensic analysis. DNS queries can reveal bot
botnets and malware is connecting to the C&C server, so this is why DNS monitoring is very
essential.
17. What are encoding, hashing and encryption?
Encoding: Converts the data in the desired format required for exchange between
different systems.
Hashing: Maintains the integrity of a message or data. Any change did any day could be
noticed.
Encryption: Ensures that the data is secure and one needs a digital verification code or
image in order to open it or access it.
18. What steps will you take to secure a server?
Secure servers use the SSL (Secure Sockets Layer) protocol for data encryption and
decryption to protect data.
Have a secure password for the root and administrator users.
Make new users that you use to manage the system.
Remove remote access from default.
Configure firewall rules for remote access.
19. What is black hat, white hat and grey hat hackers?
Black hat hackers: are those who hack without authority
White hat hackers: are authorized to perform a hacking attempt under signed NDA (non-
disclosure agreement)
Grey hat hackers: are white hat hackers who sometimes perform unauthorized activities.
20. What do you know about application security?
It is the practice of improving the security of applications using software, hardware, and
other procedural methods.
Countermeasures are taken to ensure application security, the most common one is an
application firewall that limits the execution of files or the handling of data by specific
installed programs.
21. Can you tell me about common cyber-attacks?
Malware: Malicious software that infects your computer, such as computer viruses,
worms, Trojan horses, spyware, and adware.
DDOS: A distributed denial-of-service (DDoS) attack — or DDoS attack — is when a
malicious the user gets a network of zombie computers to sabotage a specific website or
server.
Hacking: Hacking is a term used to describe actions taken by someone to gain
unauthorized access to a computer.
Phishing: Fake emails, text messages, and websites created to look like they’re from
authentic companies. They’re sent by criminals to steal personal and financial
information from you. This is also known as “spoofing”.
22. What are the OSI layers and what is the job of network layer?
It is Open System Interconnection is a reference model for how applications communicate
over a network. There 7 layers in OSI which are:
Application layer ->Data -> network process and apps -> SMTP, telnet, HTTP, FTP, etc.
Presentation Layer ->Data -> Data formatting and encryption -> JPG, HTTPS, SSL
Session layer ->Data -> establishes/ends connections between two hosts -> NetBIOS, PPTP
Transport layer ->Segments -> end-to-end connections and reliability -> TCP, UDP
Network layer -> Packets -> Path determination and IP (logical addressing) -> routers and
layer3 switches
Data link layer -> Frames -> Physical addressing – > switches
Physical layer -> Bits -> Send data on to the physical wire -> Hubs, NICS, cables
23. How would you reset a password-protected BIOS configuration?
Pop-out the CMOS or set the factory by using the default password.
24. What is 2FA and how can it be implemented for the public websites?
2FA (two-factor authentication) is an extra layer of security that requires not the only
username and password but also something that only the user knows or have
(knowledge, possession, inherence)
Authenticator apps replace the need to obtain a verification code via text, voice call or
email.
25. What are the three main transmission modes between devices in computer
network?
Simplex mode: data can be sent only in one direction i.e. communication is
unidirectional. We cannot send a message back to the sender.
Half-duplex mode: data can be transmitted in both directions on a signal carrier, but not
at the same time.
Full duplex mode: we can send data in both directions as it is bidirectional at the same
time, in other words, data can be sent in both directions simultaneously.
26. What are the network types?
LAN, WAN, personal area, WLAN, Metropolitan, Storage area network, System area
network.
27. What is data centre multi-tier model design?
This design consists primarily of the web, application, and database server tiers running on
various platforms including blade servers, one rack unit (1RU) servers, and mainframes. Core,
aggregation, and access.
28. What are TCP header flags and what they do?
Source port: Sending port (16 bits)
Destination Port (16 bits): receiving port
Flags:
SYN
URG
ACK
PSH
RST
FIN
29. What is SSDP?
Simple service discovery protocol: The Simple Service Discovery Protocol (SSDP) is a
network protocol based on the Internet protocol suite for the advertisement and discovery
of network services and presence information.
A Simple Service Discovery Protocol (SSDP) attack is a reflection-based distributed denial-
of-service (DDoS) the attack that exploits Universal Plug and Play (UPnP) networking
protocols in order to send an amplified amount of traffic to a targeted victim, overwhelming
the target’s infrastructure and taking their web resource offline.
Source port, destination port, length, checksum, data.
30. What are intrusion detection methods? Explain them
The intrusion detection system is a device or software that monitors a network or systems
for malicious activity any violation is reported to the SIEM system. IDS types can be host-
based and network-based. IDS can detect a malicious activity based on a signature-based
approach or anomaly-based approach or a combination of both.
31. What is SNMP?
SNMP (Simple network management protocol) is an internet standard protocol for
collecting and organizing information about managed devices on IP networks and for
modifying that information to change device behavior. It is an application layer protocol
32. What are sniffing attacks? Explain them
A sniffer attack corresponds to theft or interception of data by capturing the network traffic
using a sniffer. When data is transmitted across the network, if the data is not encrypted the
data within the network packet can be read using a sniffer such as Wireshark.
33. What is MAC spoofing? Explain
MAC address is virtually etched to the hardware by the manufacturer. Users are not able to
change or rewrite the MAC address but it is possible to mask it on the software side. This
masking is what is referred to as MAC spoofing.
Hackers use this method of attack to conceal their own identity and imitate another.
34. What is ARP and ARP poisoning (Flooding)?
ARP (Address resolution protocol) is a protocol for mapping an IP address to a physical
machine address (MAC address) that is recognized in the local network.
When an incoming packet destined for a host machine on a particular local area network
arrives ar a gateway, the gateway asks ARP program to find a physical host or MAC address
that matches the IP address.
The ARP program looks in the ARP cache and If it finds the address in the ARP cache it
provides the MAC address so that the packet can be converted to the right packet length and
format and sent to the destination machine. If no IP address is found, ARP broadcasts the
request in a special format to all the machines on the LAN to see if one machine knows that IP
address associated with it.
ARP poisoning is ARP spoofing, ARP cache poisoning, or ARP poison routing, is a technique by
which an attacker sends (spoofed) Address Resolution Protocol (ARP) messages onto a local
area network. Generally, the aim is to associate the attacker’s MAC address with the IP address
of another host, such as the default gateway, causing any traffic meant for that IP address to be
sent to the attacker instead.
ARP spoofing may allow an attacker to intercept data frames on a network, modify the traffic, or
stop all traffic. Often the attack is used as an opening for other attacks, such as denial of service,
man in the middle, or session hijacking attacks.
35. What are three main data transmission methods in layer 2?
Unicast, Broadcast, Multicast (Explain each one)
36. What is DHCP?
DHCP is a dynamic host configuration protocol. When it is activated, DHCP assigns IP
addresses to devices on the network.
37. What is VLAN? What is the difference between VPN and VLAN?
VPN: it is related to remote access to a network with a secured and encrypted tunnel. Saves
the data from prying eye while in transit and no one on the net can capture the packets.
VLAN: Helps to group work stations that are not within the same locations into the same
broadcast domain. Logically segregates networks without physical segregation with
switches. Does not involve any encryption.
38. What is port blocking within LAN?
Restricting users from accessing a set of services within the local area network is called port
blocking.
Stopping the source not to access the destination node via port as the application works on
the ports are blocked to restrict access.
39. What tools are commonly used to secure a standard network?
Firewalls, end-point antiviruses, security policies and procedures, IDS/IPS, password
managers.
40. How do you keep up-to-date outside the normal working hours?
I follow security professionals on LinkedIn and read their articles
Browse security-related social media topics
Follow the SANS page
Browse National vulnerability database and CVE (common vulnerabilities and exposures)
websites
ACCC website
CISCO security blog
twitter