Preparing for a Cybersecurity Analyst, SOC Analyst (L1/L2), or Ethical Hacker interview in 2026? Tech titans like Microsoft, IBM, Infosys, Wipro, and global MSSPs test candidates across networking fundamentals, SIEM alert triage, incident response lifecycles, and attack scenarios. Here are the top 50 curated interview questions with exact answers to help you crack your technical rounds with confidence.
Part 1: Networking & Security Architecture
Q1 What is the difference between Threat, Vulnerability, and Risk?
Answer: A Threat is an external attacker, malware, or natural disaster that has the potential to cause damage. A Vulnerability is a weakness or flaw in software, firmware, or human policy (e.g., unpatched Apache Log4j). Risk is the mathematical probability of a threat exploiting a vulnerability multiplied by the business impact: Risk = Threat × Vulnerability × Impact.
Q2 Explain the 7 Layers of the OSI Model and which layer firewalls operate on.
Answer: The 7 OSI layers are: 1. Physical, 2. Data Link (MAC, ARP), 3. Network (IP, Routers), 4. Transport (TCP, UDP), 5. Session, 6. Presentation (SSL/TLS), 7. Application (HTTP, DNS). Traditional packet-filtering firewalls operate at Layers 3 and 4, while Next-Generation Firewalls (NGFW) inspect up to Layer 7 (Application).
Q3 What happens during a TCP 3-Way Handshake?
Answer: 1. SYN: Client sends a SYN packet with initial sequence number ISN(c). 2. SYN-ACK: Server acknowledges with ACK = ISN(c)+1 and sends its own SYN = ISN(s). 3. ACK: Client acknowledges with ACK = ISN(s)+1. The connection is now established.
Q4 What is the difference between Symmetric and Asymmetric Encryption?
Answer: Symmetric encryption uses a single shared secret key for both encryption and decryption (e.g., AES-256). It is extremely fast and used for bulk data. Asymmetric encryption uses a mathematically linked key pair: a public key for encryption and a private key for decryption (e.g., RSA, ECC). It is slower and used for key exchange and digital signatures.
Q5 What is DNS Tunneling and how do you detect it?
Answer: DNS Tunneling encodes non-DNS protocol data (exfiltration or C2 commands) inside DNS queries (TXT, A, or AAAA records) to bypass firewalls. It is detected in SIEM/Zeek by monitoring for unusually high query volumes to single domains, high entropy (randomness) in subdomains, and large TXT record payload sizes.
Part 2: Cyber Attacks & Offensive Security
Q6 What is SQL Injection (SQLi) and how do you prevent it?
Answer: SQLi occurs when malicious SQL statements are inserted into input fields (e.g., ' OR '1'='1), executing unauthorized database queries. Prevention: 1. Use Parameterized Queries (Prepared Statements). 2. Use ORM frameworks. 3. Enforce Least Privilege on DB accounts. 4. Deploy Web Application Firewalls (WAF).
Q7 What is Cross-Site Scripting (XSS) and what are its 3 types?
Answer: XSS executes malicious JavaScript inside a victim's browser session. Types: 1. Stored XSS: Payload permanently saved in the database (e.g., comment box). 2. Reflected XSS: Payload reflected off the web server in URL query params. 3. DOM-based XSS: Attack occurs completely on client-side DOM processing.
Q8 What is Cross-Site Request Forgery (CSRF)?
Answer: CSRF tricks an authenticated user's browser into sending forged HTTP requests to a vulnerable application (e.g., transferring funds). Mitigated using unpredictable, cryptographically secure anti-CSRF tokens in forms and setting cookies to SameSite=Strict.
Q9 What is the difference between ARP Poisoning and IP Spoofing?
Answer: ARP Poisoning operates at Layer 2 inside a Local Area Network (LAN) by spoofing MAC addresses to execute Man-In-The-Middle (MITM). IP Spoofing operates at Layer 3 by altering the source IP header in packets to bypass IP-based filters or amplify DDoS attacks.
Q10 Explain the MITRE ATT&CK Framework.
Answer: MITRE ATT&CK is a globally accessible curated knowledge base of adversary tactics, techniques, and procedures (TTPs) based on real-world observations. It covers phases from Initial Access and Execution up to Command & Control and Exfiltration, allowing SOC teams to map detections against known adversary behaviors.
Part 3: SOC Operations, SIEM & Incident Triage
Q11 What are the phases of Incident Response according to NIST SP 800-61?
Answer: 1. Preparation (policies, playbooks, tools), 2. Detection & Analysis (SIEM alerts, IOC hunting), 3. Containment, Eradication & Recovery (isolating systems, wiping malware, restoring from immutable backup), 4. Post-Incident Activity (Lessons Learned and updating detection rules).
Q12 What is the difference between IDS and IPS?
Answer: An IDS (Intrusion Detection System) is passive/out-of-band; it monitors traffic and generates alerts without dropping packets. An IPS (Intrusion Prevention System) is inline with the network; it actively analyzes packets and can immediately drop malicious traffic or reset TCP sessions.
Q13 What is the difference between EDR and Antivirus?
Answer: Traditional Antivirus relies primarily on static signature matching of known malware hashes. EDR (Endpoint Detection and Response) continuously records endpoint telemetry (process execution, network connections, file modifications) and uses behavioral analytics and AI to detect unknown fileless malware, living-off-the-land binaries (LOLBins), and lateral movement.
Q14 How do you analyze a suspicious phishing email?
Answer: 1. Inspect email headers for SPF, DKIM, and DMARC alignment. 2. Verify Return-Path vs From address. 3. Extract and check sending IP against AbuseIPDB/VirusTotal. 4. Defang links (e.g., hxxps[://]example[.]com) and inspect redirect chains in an isolated sandbox. 5. Submit attachments to a detonation sandbox (e.g., Any.Run).
Q15 What is a Pass-the-Hash (PtH) attack and how is it defended against?
Answer: An attacker steals an NTLM password hash from memory (via tools like Mimikatz) and uses it directly to authenticate to remote Windows services without needing the plaintext password. Defenses: Credential Guard, disabling NTLM in favor of Kerberos, and restricting Domain Admin logins to Tier-0 management workstations.
Q16 What is Windows Event ID 4624 and 4625?
Answer: Event ID 4624 indicates a Successful Account Logon. Event ID 4625 indicates a Failed Account Logon. Multiple 4625 events in a short window followed by a 4624 event often signify a successful brute-force or password-spraying attack.
Q17 What is the difference between Port Scanning with SYN scan vs Full Connect scan in Nmap?
Answer: A SYN scan (-sS) is stealthy ("half-open"); it sends a SYN and waits for SYN-ACK, then immediately sends RST instead of ACK, avoiding full TCP connection logs. A Full Connect scan (-sT) completes the 3-way handshake via the OS socket API, making it louder and logged by target application servers.
Q18 What is Port 445 and what common attacks target it?
Answer: Port 445 is used by Server Message Block (SMB) for file sharing in Windows. Notable exploits targeting port 445 include EternalBlue (MS17-010), WannaCry ransomware, and SMB Relay attacks.
Q19 What is Zero Trust Architecture?
Answer: Zero Trust operates under the core principle: "Never trust, always verify." It eliminates the concept of an implicitly trusted internal corporate network. Every access request (identity, device health, location, and data sensitivity) is dynamically authenticated and authorized before granting least-privilege access.
Q20 Scenario: At 2:00 AM, you observe high outbound traffic from a database server to an unknown foreign IP. What are your immediate steps?
Answer: 1. Triage & Verify: Check the destination IP against threat intelligence (VirusTotal, AlienVault OTX) and confirm the protocol/port. 2. Isolate: Network-isolate the database server immediately or block the destination IP on the perimeter firewall to stop active data exfiltration. 3. Capture Volatile Memory: Collect memory dump and network connections (netstat) before rebooting. 4. Escalate: Notify Incident Commander and Security Lead. 5. Initiate Forensic Root-Cause Analysis.
Want all 50 questions with detailed code, Wireshark filters, and Splunk queries? Download our complete PDF preparation guide through our admission portal.