Cyber Security (SOC) Interview Questions and Answers

Describe the OSI seven-layer model, from the application interface and presentation translation to session management, transport end-to-end delivery, network routing, data link frame handling, and physical bit transmission.

Explain how a TCP three-way handshake establishes a connection between a client and server using SYN and ACK packets with an initial sequence number, enabling data transfer.

Explore the tcp header fields—source and destination ports, sequence and acknowledgement numbers, window size—and control flags (syn, ack, fin, rst, urg, psh) used to manage connections.

Explain the IP header fields in the network layer, including version, time to live, protocol, header checksum, and source and destination IP addresses.

Compare tcp and udp: tcp is connection oriented with a three-way handshake and reliable delivery; udp is connectionless and lacks guarantees, with dns and voip typically using udp.

Explain how ip addresses function as logical identifiers and classify them into class a, b, c, d, e ranges, including 127.0.0.0 loopback, multicasting, and private ranges 10/8, 172.16–172.31, and 192.168/16.

Explain how the dynamic host configuration protocol (dhcp) assigns IP addresses and network settings, including the subnet mask and default gateway, through discovery, offer, request, and acknowledgment.

Explain how a DNS server translates domain names into IP addresses, using a recursive resolver that queries root, TLD, and authoritative servers, caches results, and uses port 53.

A firewall monitors and controls traffic between internal networks and the internet using predefined security rules, and stateful inspection tracks connections to allow only established traffic.

Contrast traditional firewalls, which filter at layer 3/4 by IP and port with no deep packet inspection, with next-generation firewalls that add layer 7, application control, and intrusion prevention.

Compare firewall deny versus drop behavior, showing how deny sends a rejection while drop silently discards traffic, and distinguish IDS from IPS in monitoring, detecting, and blocking threats.

Explain the difference between firewall and IPS, noting firewall operates at layer 3–4 on perimeter, while IPS inspects layer 2 payloads to detect signatures and behavior-based analysis and block threats.

Understand how a proxy server acts as an intermediary between a client and a web server, and learn the forward, reverse, and transparent proxy types and their roles.

Learn key protocols and port numbers, including ftp 20/21, ssh 22, telnet 23, http 80, https 443, imap 143, smtp 25, dns 53, dhcp 67/68, and snmp 161/162.

Explore windows and linux commands for network diagnosis, including ping, traceroute, nslookup, netstat, arp, ip config, and remote access via ssh and telnet.

Learn linux commands, including ls for listing files, df for disk usage, chmod for permissions, find for searching, cat for viewing, grep for pattern search, and ps for process status.

Explore the CIA triad: confidentiality, integrity, and availability, and learn how encryption, hashing, checksums, and digital signatures protect data and ensure 24/7 availability.

Learn how encryption converts plain text to cipher text, how decryption restores it with a key, and how symmetric and asymmetric methods differ, including Advanced Encryption Standard, Des, and Blowfish.

Explore how hashing converts plaintext into a fixed-length hash value to preserve data integrity and detect tampering, using MD5, SHA-1, SHA-2, SHA-3, and SHA-256.

Encryption uses symmetric or asymmetric keys to convert plaintext to ciphertext and is reversible; encoding formats data for storage or transmission and hashing provides a non-reversible fixed hash for integrity.

Identify hacker types by intent, from white hat penetration testers to black hat attackers exploiting vulnerabilities. Explore gray hat bug bounty hunters, hacktivists, script kiddies, and state-sponsored hackers.

Identify threats, vulnerabilities, and risk, with examples like malware and phishing, and explain zero-day attacks, exploits, and payloads that enable unauthorized access.

Differentiate events, alerts, and incidents by defining events as normal logged activities, alerts as suspicious or anomalous detections, and incidents as confirmed security breaches requiring immediate remediation.

Explain true positives, false positives, true negatives, and false negatives in security operations, using examples from intrusion prevention system, firewall, and endpoint security to distinguish genuine threats from benign activity.

Define indicators of compromise and indicators of attack, and identify forensic data such as IPs, domains, and hashes, plus signs of ongoing attack like system slowness.

Data leakage means unauthorized transmission of organization data to external recipients, including accidental leakage and insider threats; bots automate tasks, and botnets enable DDoS and crypto mining.

Understand how http response codes from 1xx to 5xx signal processing, success, redirection, or failure. Identify client side versus server side issues using 4xx and 5xx codes for troubleshooting.

Explain the differences between ssl and tls, why tls replaces ssl due to vulnerabilities, and note tls versions 1.0–1.3 with 1.2/1.3 in use, explicit negotiation, and encrypted alert messages.

Explore file-based malware delivered via document or PDF attachments and how endpoint security scans prevent downloads, versus fileless malware that uses PowerShell and living off the land techniques.

Explain how CVE uniquely identifies vulnerabilities and how CVSS scores their severity from none to critical, including zero day vulnerabilities, using 0, 4-7, 7-9, and 9-10 ranges.

Explain dos and ddos attacks, how a botnet floods a target to disrupt services, and how defenders use firewalls, ids/ips, load balancers, and anti-ddos solutions.

Explain how the pass the hash attack steals a user password hash to authenticate to targeted systems, and discuss mitigations like TLS, credential guard, and limiting administrative privileges.

Explore how a man-in-the-middle attack intercepts and can manipulate communications between two parties, and learn protections like SSL/TLS, certificate verification, and strong passwords.

Explain spoofing and its types, including IP spoofing and DNS spoofing, where attackers impersonate systems by masking source addresses and triggering a denial of service.

Explain the password spray attack and how to mitigate it across multiple user accounts. Mitigate with strong password policies, multi-factor authentication, and monitoring for suspicious login activity.

Identify credential stuffing attacks using leaked credentials from breaches and the dark web, and discuss mitigations. Explain rainbow table attacks on password hashes and how salting thwarts them.

Examine dictionary based attacks, where attackers use common or default passwords to gain access, and apply mitigations like login attempt limits, lockouts, monitoring unusual activity, and multi-factor authentication.

Explain the OWASP top ten web application security risks and how the list updates with evolving threats, including injection, broken authentication, security misconfiguration, insecure communication, and server side request forgery.

Describe security misconfigurations, including default credentials, weak passwords, unpatched software, and insecure configurations, and outline mitigations such as regular patches, strong passwords, restricting exposed ports, and least-privileged access.

Understand how SQL injection exploits vulnerable websites via input fields to access and modify databases. Learn mitigations like input validation and sanitization, least privilege, WAFs, and regular security testing.

Explain cross-site scripting (XSS) and its mitigation, including reflected, stored, and DOM-based attacks, and defenses like input validation, content security policy, regular updates, and the use of a WAF.

Explain server-side request forgery and how attackers manipulate vulnerable servers to access internal resources and sensitive information. Implement mitigations such as input validation, whitelisting, monitoring, network segmentation, authentication, and updates.

Analyze major cyber attacks like SolarWinds and WannaCry, from sunburst supply chain intrusion to EternalBlue exploitation, and learn patching, vulnerability management, and staying updated via threat intel and podcasts.

Explore how Microsoft's active directory centralizes authentication and authorization to manage users and computers, with domain services, group policies, and DNS for access control, monitored by the security operations center.

Kerberos is a network authentication protocol that enables secure client–server access via a key distribution center, authentication server, and ticket granting server, issuing TGTs and service tickets.

Identify the common fields in Windows event logs, including event ID, date and time, source, level, user, computer name, description, and audit category.

Identify crucial windows event IDs for security investigations, alerts, and hunting, including 4624, 4625, 4634, 4720, 4726, 4740, 4798, 7034, and 1102.

Monitor authentication attempts and policy changes using Windows security event logs. These logs provide auditing and alerts, real-time detection, response, and forensic analysis to identify and block unauthorized access.

Identify the ten Windows logon types, including interactive, console, network, batch, service, proxy, cleartext credentials, new credentials, remote interactive, and remote desktop or assistance.

Explain the difference between user accounts and service accounts in Windows; user accounts log in with personal profiles, while service accounts run background system services.

Learn to interpret login failure error codes tied to Windows event IDs (A4625) to identify causes like account lockout, password expiry, wrong credentials, or logon hour restrictions.

Explore how the Windows registry operates as a centralized database storing user preferences and system settings, and learn why monitoring it is crucial for detecting anomalies and security incidents.

Explore how Windows PowerShell logging enhances security monitoring by tracking command line activity, detecting malicious scripts and privilege escalations, and integrating logs for centralized incident response.

Explore malware and its common types, such as virus, worm, trojan, ransomware, adware, spyware, and rootkit, and how they damage systems and steal sensitive information.

Viruses attach to files and spread when users run infected programs; worms self-replicate across networks without user action; trojans masquerade as software to steal data or create back doors.

learn what malware analysis is and why it matters, then compare static code-level analysis with dynamic behavior analysis to understand how malware operates and how to defend systems.

Perform static malware analysis by examining a sample without execution, collect metadata and hashes, analyze headers and strings, and unpack obfuscated code to reveal indicators.

Conduct dynamic malware analysis in an isolated sandbox to observe behavior and capture file system, registry, and network activity with tools like Sysmon and Wireshark.

Explore the key tools for malware analysis, including B studio, Ida Pro, Process Explorer, procmon, proc dot, Wireshark, Red shirt, and other sysinternals tools in a sandbox.

Explore phishing as a cyber attack that tricks users into revealing sensitive information, covering spear phishing, vishing, veiling, smishing, and email phishing with real-world examples.

Identify phishing signs such as urgency, odd language, unusual requests, and spelling errors, plus inconsistencies in web addresses; hover links and never share credentials.

Learn how SPF authenticates authorized sending servers, how DKIM uses digital signatures to preserve email integrity, and how DMARC enforces policies to prevent phishing.

Learn proven measures to counter phishing, including employee phishing awareness training, email security solutions, endpoint monitoring, simulated phishing tests, and least-privilege access controls.

Learn how the SOC collects network, server, application, security, and audit logs from across infrastructure, including cloud platforms such as AWS, GCP, and Azure, to monitor activity and detect threats.

Analyze firewall logs by examining source IP address, destination IP address, source port, destination port, protocol, timestamp, event type, action taken, and bytes transferred.

Explain the key fields analyzed in IPS logs, such as timestamp, event type, source and destination IPs and ports, signature ID and name, severity, action, and attack method and target.

Explain key EDR fields, including timestamp, event type, process name and id, user, IPs, file name and path, hash, action taken, threat type and name, detection method, and severity.

Identify important fields in email gateway logs, including timestamp, sender, recipient, message ID, status codes, subject, message size, and review SMTP logs and SPF/dMarc in headers from Proofpoint and Mimecast.

Analyze proxy logs by examining time stamp, client IP, requested URL, destination IP, user agent, http status codes, bytes transferred, content type, referrer, category, and action taken.

Explain the key AWS logs used for security analysis, including CloudTrail, VPC flow logs, AWS Config, CloudWatch, and GuardDuty, and how SIEMs receive alerts for anomalies and threats.

Collect Azure activity logs for auditing, Azure Defender for Cloud for security events, Azure Network Watcher and Application Gateway logs for network and web traffic insights; Sentinel logs when available.

Identify the Google Cloud logs collected for analysis—audit, VPC flow, firewall, storage, and DNS logs—and learn how to ingest them into on-prem SIEM solutions.

Identify and understand the logging levels used by network devices, from emergency to debugging, and recognize their impact on system usability, alerting, and troubleshooting.

Explore the concept of TTP in cybersecurity, detailing tactics, techniques, and procedures within the MITRE framework. Learn how initial access and phishing drive unauthorized access and data theft.

Learn the MITRE ATT&CK framework as a catalog of attacker tactics and techniques to identify, detect, and respond to cyber threats.

Explain the MITRE framework's TTPs and phases, including reconnaissance, resource development, initial access, execution, persistence, privilege escalation, defense evasion, and credential access.

Explore the MITRE framework TTP phases—from discovery and lateral movement to collection and exfiltration—covering Conti's command and control and ransomware impact.

Explain how a formal incident response plan and security controls enable defense, guiding the incident lifecycle from preparation and identification to containment, investigation, remediation, recovery, and lessons learned.

Attackers gain initial access through spear phishing, unpatched vulnerabilities, and stolen credentials. A finance employee encounters a malicious budget spreadsheet that delivers a payload, enabling privilege escalation and lateral movement.

Attackers execute malicious code on compromised systems using PowerShell and macros in document files delivered via phishing emails. They download payloads and establish a foothold, evading traditional endpoint security.

Explain how attackers establish persistence on a compromised system by using a scheduled task, registry modifications, and backdoors to maintain long-term access and evade detection.

Exploit vulnerabilities or misconfigurations after initial access to escalate privileges, expand control across the network, and use tools or techniques like pass-the-ticket and Kerberos to gain higher permissions.

Explore how attackers bypass security defenses by using code obfuscation, encryption, and disabling tools, including fileless malware and PowerShell-based attacks that run in memory.

Phishing demonstrates how attackers obtain credentials by sending trusted-looking emails that lead to a fake login page, where users unknowingly enter their username and password for capture.

Attackers conduct post-exploitation discovery to map a target environment through network scanning, Active Directory checks, and public information sources, identifying open ports, configurations, and credentials to enable lateral movement.