SOC Analyst Interview Questions and Answers for Freshers

MITRE ATT&CK framework categorizes DDoS attacks under Impact (T1498) and SQL injection attacks under Execution (T1210)

• MITRE ATT&CK framework categorizes DDoS attacks under Impact (T1498)

• Types of DDoS attacks include UDP flood, SYN flood, HTTP flood, etc.

• MITRE ATT&CK framework categorizes SQL injection attacks under Execution (T1210)

• Types of SQL injection attacks include Union-based, Error-based, Blind SQL injection, etc.

ArcSight is a security information and event management (SIEM) software that helps organizations detect and respond to security threats.

• ArcSight uses a hierarchical structure of components such as connectors, Logger, ESM, and Command Center.

• Connectors collect and normalize data from various sources.

• Logger stores and indexes the collected data for analysis.

• ESM (Enterprise Security Manager) correlates and analyzes the data to detect security incidents.

• Command Center provides a ...read more

I hold certifications such as CISSP, CEH, and CompTIA Security+.

• Certified Information Systems Security Professional (CISSP)

• Certified Ethical Hacker (CEH)

• CompTIA Security+

Phishing attacks are fraudulent attempts to obtain sensitive information such as usernames, passwords, and credit card details by disguising as a trustworthy entity.

• Phishing attacks often involve emails that appear to be from legitimate sources, asking recipients to click on a link or provide personal information.

• Common types of phishing attacks include spear phishing, whaling, and pharming.

• Phishing attacks can also be carried out through phone calls (vishing) or text message...read more

EDR (Endpoint Detection and Response) solution is a cybersecurity technology that continuously monitors and analyzes endpoint activities to detect and respond to threats.

• Continuous monitoring of endpoint activities

• Real-time detection of threats

• Immediate response to security incidents

• Behavioral analysis of endpoints

• Integration with SIEM for centralized monitoring

• Examples: CrowdStrike Falcon, Carbon Black, SentinelOne