TCS Senior Security Analyst Interview Questions and Answers

I have held roles such as Security Analyst, Incident Responder, and Security Engineer.

• Security Analyst: Conducted security assessments and implemented security measures.

• Incident Responder: Responded to security incidents and conducted forensic investigations.

• Security Engineer: Designed and implemented security solutions to protect systems and data.

Ransomware attacks encrypt files and demand payment for decryption.

• Encrypts files and demands payment for decryption

• May use social engineering tactics to trick victims into downloading malware

• May spread through phishing emails, malicious websites, or infected software

• Examples include WannaCry, Petya, and Locky

The port number of SMB is 445.

• SMB stands for Server Message Block.

• SMB is a protocol used for file sharing and printer sharing.

• Port 445 is used for direct TCP/IP connection without NetBIOS.

• Port 139 is also used for SMB over NetBIOS.

SMB relay attack is a type of attack where an attacker intercepts and relays SMB traffic to gain unauthorized access to a target system.

• The attacker intercepts SMB traffic between two systems and relays it to gain access to the target system.

• The attack can be carried out using tools like Responder or Metasploit.

• The attack can be prevented by disabling SMBv1, using SMB signing, and implementing network segmentation.

• An e...read more

EDR stands for Endpoint Detection and Response, a security solution that monitors and responds to endpoint threats.

• EDR solutions provide real-time visibility into endpoint activity and behavior.

• They use advanced analytics and machine learning to detect and respond to threats.

• EDR solutions can also provide forensic analysis to investigate incidents and identify root causes.

• Examples of EDR solutions include Carbon Black,...read more

EDR stands for Endpoint Detection and Response. It is a security solution that monitors and responds to endpoint threats.

• EDR solutions use agents installed on endpoints to collect data and send it to a central server for analysis.

• They use behavioral analysis and machine learning to detect and respond to threats in real-time.

• EDR solutions can also provide forensic data to investigate incidents and improve security postu...read more

Main event IDs to monitor as an SOC analyst

• Event ID 4624 - Successful account logon

• Event ID 4625 - Failed account logon

• Event ID 4768 - Kerberos authentication ticket request

• Event ID 4769 - Kerberos service ticket request

• Event ID 5140 - Network share access

• Event ID 5156 - Firewall rule added

• Event ID 7035 - Service control manager event

• Event ID 7045 - Service installation

• Event ID 800 - Windows update installation