Cybersecurity Analyst — Job-Ready Notes
Easy-language study guide for Junior / SOC / Cybersecurity Analyst roles
Goal: Build practical understanding of networking, security, Linux, Windows, SIEM, incident response, vulnerabilities,
and interview questions.
How to use: Learn one topic, practice the commands/tools, then explain it aloud in simple words. For a fresher role,
practical labs and clear troubleshooting matter more than memorizing definitions.
1. Cybersecurity Basics
Cybersecurity: Protecting computers, networks, applications, cloud systems and data from unauthorized access,
damage, disruption or theft.
CIA Triad
• Confidentiality: Only authorized people can see data. Example: passwords and access controls.
• Integrity: Data stays accurate and is not changed without permission. Example: hashes and file permissions.
• Availability: Systems and data are available when needed. Example: backups, redundancy and DDoS protection.
AAA: Authentication = who are you? Authorization = what are you allowed to do? Accounting = what did you do?
2. Common Cyber Threats
• Malware: malicious software. Types include virus, worm, Trojan, ransomware, spyware, rootkit and botnet.
• Phishing: fake message/site designed to steal information.
• Brute force: repeatedly trying passwords.
• DoS/DDoS: overwhelming a service so legitimate users cannot access it.
• MITM: attacker positions between two communicating parties.
• Insider threat: risk caused by an authorized user intentionally or accidentally.
• Social engineering: manipulating people to reveal information or perform unsafe actions.
3. Methods of Infiltration
Attackers may enter through phishing, weak/reused passwords, exposed services, unpatched software, malicious
attachments, infected websites, stolen credentials, misconfigured cloud resources, vulnerable applications and
removable media. Analyst focus: identify the initial access method, affected account/device, indicators, timeline and
containment action.
4. Networking for Security Analysts
OSI model: 7 Physical, 6 Data Link, 5 Session, 4 Transport, 3 Network, 2 Presentation, 1 Application. A simple
memory aid: Please Do Not Throw Sausage Pizza Away.
Important protocols/ports: HTTP 80, HTTPS 443, DNS 53, DHCP 67/68, SSH 22, FTP 21, SMTP 25, RDP 3389,
Telnet 23, SNMP 161/162, LDAP 389, SMB 445.
TCP vs UDP: TCP is connection-oriented and reliable; UDP is connectionless and faster but does not guarantee
delivery.
IP, MAC, ARP: IP identifies a device/interface at the network layer; MAC is a Layer-2 hardware address; ARP maps an
IPv4 address to a MAC address on a local network.
5. Network Security Devices
• Firewall: allows/blocks traffic using rules.
• IDS: detects suspicious activity and alerts.
• IPS: detects and can actively block traffic.
• VPN: creates an encrypted tunnel for traffic over an untrusted network.
• Proxy: intermediary between client and destination.
• WAF: protects web applications against web-layer attacks.
6. Authentication & Access Control
Use strong unique passwords, MFA, least privilege, account lockout/rate limiting and role-based access control
(RBAC). Least privilege means a user or process gets only the permissions required for its job.
7. Cryptography
Encryption: converts readable plaintext into ciphertext so unauthorized people cannot understand it.
Symmetric: same secret key encrypts and decrypts (fast; e.g., AES).
Asymmetric: uses public/private key pairs (e.g., RSA, ECC).
Hashing: one-way transformation used for integrity and password storage; examples include SHA-256 and SHA-3. A
hash is not encryption.
Digital signature: helps verify authenticity and integrity.
8. Malware Analysis Basics
Useful indicators include suspicious files, hashes, domains, IP addresses, URLs, registry changes, unusual processes,
persistence mechanisms, command-line activity and unexpected network connections. IOC = Indicator of Compromise.
IOA = Indicator of Attack.
9. Vulnerability Management
Vulnerability: weakness that can be exploited. Threat: potential cause of harm. Risk: likelihood and impact of a threat
exploiting a weakness.
Basic process: discover assets → scan → validate findings → prioritize by severity/business impact → patch or
mitigate → verify → document. CVSS is commonly used to communicate vulnerability severity.
10. SIEM & SOC
SIEM: Security Information and Event Management. It collects and correlates logs from endpoints, servers, firewalls,
applications, identity systems and other sources.
SOC analyst workflow: monitor alerts → validate alert → collect context → determine severity → investigate →
contain/escalate → document → close or continue monitoring.
Common logs: Windows Event Logs, Linux auth logs, firewall logs, DNS logs, VPN logs, web server logs, EDR alerts
and cloud audit logs.
11. Incident Response
A practical lifecycle: Preparation → Identification → Containment → Eradication → Recovery → Lessons
Learned.
Example ransomware alert: isolate affected endpoint, preserve evidence/logs, identify scope and initial access, disable
compromised accounts if appropriate, remove malware/persistence, patch the root cause, restore from trusted
backups, monitor for recurrence and document the incident.
12. Linux Basics for Analysts
Useful commands: pwd (current directory), ls (list files), cd (change directory), cat (view file), grep (search text), find
(find files), ps (processes), top (live processes), ss (network sockets), ip a (interfaces), ping (reachability), curl (HTTP
requests), chmod (permissions), sudo (run with elevated privileges).
13. Windows Basics
Know Event Viewer, Task Manager, Services, Windows Defender/EDR, PowerShell, Windows Firewall, local
users/groups and basic networking commands such as ipconfig, ping, tracert, nslookup and netstat.
14. Wireshark Basics
Wireshark captures and analyzes network packets. Start by identifying source/destination IPs, protocols, ports, DNS
queries, TCP handshakes, HTTP/HTTPS behavior and unusual traffic. Useful display filters include [Link] ==
[Link], dns, http, tcp and [Link] == 443.
15. Common Web Attacks
• SQL Injection: malicious SQL input changes a database query.
• XSS: attacker-controlled script executes in a victim's browser context.
• CSRF: tricks an authenticated browser into sending an unwanted request.
• Broken access control: user can access resources/actions they should not.
• Path traversal: attempts to access files outside intended directories.
• Command injection: untrusted input reaches system command execution.
16. Cloud Security Basics
Understand the shared responsibility model, IAM, MFA, security groups/firewalls, logging, encryption, backups, public
vs private resources, least privilege and secure storage permissions. For AWS, know basic concepts such as EC2, S3,
IAM, VPC, CloudTrail and security groups.
17. Essential Tools to Practice
Wireshark, Nmap, Linux terminal, Windows Event Viewer/PowerShell, a SIEM such as Splunk or Elastic, an EDR
concept/tool, vulnerability scanners, and safe lab platforms. Practice only on systems you own or are explicitly
authorized to test.
18. Job-Ready Mini Projects
1) Home SOC Lab: collect Windows/Linux logs into a SIEM, create 5 detection rules and investigate sample alerts.
2) Wireshark Investigation: analyze a provided PCAP and write a short incident report with IPs, ports, DNS activity
and conclusion.
3) Vulnerability Report: scan a legal lab target, prioritize findings and document remediation steps.
4) Phishing Analysis: inspect a safe sample email and identify sender, links, headers, indicators and recommended
response.
19. Interview Questions — Quick Answers
Q1. What is CIA triad? Confidentiality, Integrity and Availability.
Q2. What is a firewall? A security control that filters network traffic according to rules.
Q3. IDS vs IPS? IDS mainly detects and alerts; IPS can detect and block.
Q4. What is SIEM? A platform that centralizes and correlates security/event logs to support detection and
investigation.
Q5. What is phishing? A social-engineering attack that uses deceptive communication to steal information or cause
unsafe actions.
Q6. What is malware? Software designed to perform malicious or unauthorized actions.
Q7. What is a vulnerability? A weakness that could be exploited.
Q8. What is an IOC? Evidence or an observable indicator associated with compromise, such as a malicious hash,
domain or IP.
Q9. What would you do after a high-severity alert? Validate it, gather context, determine scope and severity,
contain if required, escalate according to procedure, document evidence and continue monitoring.
Q10. Why are logs important? They provide evidence of events and help detect, investigate and reconstruct
incidents.
Q11. TCP vs UDP? TCP provides reliable, ordered delivery; UDP is connectionless and generally lower overhead.
Q12. What is least privilege? Give only the minimum access needed to perform a task.
Q13. Encryption vs hashing? Encryption is reversible with the appropriate key; hashing is designed as a one-way
transformation.
Q14. What is MFA? Authentication using two or more different factor types, such as password + authenticator app.
Q15. What is incident response? A structured process for detecting, containing, removing and recovering from
security incidents.
20. 30-Day Job Preparation Plan
Period Focus
Days 1–5 Networking: OSI, TCP/IP, IP addressing, DNS, DHCP, ARP, TCP/UDP, common ports.
Days 6–10 Security basics: CIA, AAA, threats, malware, phishing, authentication, access control,
cryptography.
Days 11–15 Linux + Windows: commands, processes, permissions, services, Event Viewer, PowerShell and
networking.
Days 16–20 SOC skills: SIEM, logs, alert triage, IOC/IOA, incident response and basic threat hunting.
Days 21–25 Wireshark + vulnerability management + web security + cloud security basics.
Days 26–30 Complete 2–3 projects, prepare resume, practice 50 interview questions and explain every
project aloud.
21. Resume Skills to Target
Networking (TCP/IP, DNS, DHCP, ARP) • Linux • Windows • SIEM • Log Analysis • Incident Response • Wireshark •
Vulnerability Management • IAM • Firewalls • IDS/IPS • Basic Python • Cloud Security basics • Security fundamentals.
22. Final Job Checklist
You should be able to: explain CIA triad; identify common attacks; explain common ports; troubleshoot basic network
issues; read Windows/Linux logs; analyze a simple PCAP; explain SIEM and alert triage; identify IOCs; describe
incident response; explain vulnerability vs threat vs risk; use basic Linux commands; describe IAM/least privilege; and
present at least two practical security projects.
Important: Use cybersecurity tools only in authorized labs, your own systems, or environments where you have
explicit permission. Do not test real organizations without authorization.
This guide is designed as a foundation. For a Junior Cybersecurity Analyst/SOC role, combine it with hands-on
labs and a small portfolio.