Top Cyber Security Interview Questions 2022

1. What happens when we type “Facebook.com” in our browser?

Your browser first translates a link like “www.facebook.com” into an IP address. To get it, your browser takes the caches and domains. Then, the website(facebook.com) is broken into pieces and sent to the browser as packets. Now, the browser reassembles it to send it back to you. The site’s server and the browser then try to make a connection using TCP/IP protocol. There’s a three-way handshake of SYN, SYNACK, ACK. 

The client sends half-open connection of SYN packets to facebook. Facebook responds with SYNACK packets and the client after receiving it, sends the ACK packet to make a connection.

In the process, the IP addresses are checked by firewall configurations. Now, the data is encrypted before exchanging across the internet. After that, the browser sends a HTTP request and facebook responds to it with the HTTP response code. This is then parsed and reassembled into a webpage. At last, the browser arranges the code together to show the page. 

2. What will you do if Malware in the host alert is detected?

First, disconnect the device from the internet to stop spreading the malware more to other devices. Then, restart it in safe mode. This will prevent the malware threatening operations from working. 

You can have a brief idea of what were the applications running while you were using the computer to get an idea of the software having malware. Now, you can use a malware scanner to remove the malware. Once detected its location, you can just go to the specified location and hit delete.

3. What is RCA?

Root cause analysis (RCA) is a process of problem-solving for identifying the root-cause problems. It is used to find the known problems for identify appropriate solutions. Problems in the root cause analysis may have multiple causes depending on the deficiencies in products, processes, and many more factors. Moreover, it can be performed with a lot of techniques, and methodologies to detect the root causes of any event. Root cause analysis can display where the systems or processes failed or caused an issue.

4. What kind of action should be taken when a system gets ransomware?

If your device is infected by ransomware, you have to gain control again of your device. The most importantly you can do to remove them is:

• Reboot windows OS to safe mode
• Install and run anti-malware software
• Scan the device to identify the ransomware program
• Restore the computer to its previous state

5. what are the different commands you used in Splunk?

You may hear the terms streaming, producing, transforming, orchestrating, and data processing used to describe the sorts of search instructions as you learn more about Splunk SPL. This article defines these terminologies and provides a list of commands that fit into each category

There are Six search commands basically:

• Distributable streaming
• Centralized streaming
• Transforming
• Generating
• Orchestrating
• Dataset processing

Such categorizations are not exclusive to the Splunk online app. Some commands can only be classified into one of these groups. The stats command is an example of a command that exclusively belongs in the transformers category. Some commands may fall into more than one category.

Real-Time Best Splunk Online Training by SIEM XPERT – Enroll Now!

6. Why do we use Firewall, IPS, and WAF?

● Firewall:-

A firewall is a system that uses IP addresses and port numbers to determine whether network traffic should be allowed or blocked.As a result, it corresponds to requirements such as denying access to a specific server or port on the network or limiting access to a single server.Firewalls are frequently installed at the intersections of LANs and WANs, as well as between LANs.

● WAF:-

The Web Application Firewall (WAF) is a hardware or software solution that acts as a barrier between external users and web applications. This means that the WAF examines all HTTP communication (request-response) before it reaches the web apps or users. The WAF uses a set of previously specified rules to monitor and analyze HTTP traffic, allowing it to detect malicious HTTP requests such as Cross-Site Scripting (XSS), SQL Injection, Dos, or DDoS assaults, cookie manipulation, and many others.

● IPS:-

The Intrusion Prevention System (IPS) is a more general-purpose protection device or software in the case of the Intrusion Prevention System (IPS). It protects against traffic from a wide range of protocols, including DNS, SMTP, TELNET, RDP, SSH, and FTP, to name a few.it is a system that protects communications on the network that appear to be harmful. WAF can’t defend the OS, network, or software because its capabilities are limited to web applications.

For example, IPS are more effective against DDoS and assaults involving specific software flaws.

7. The difference between ARP and RARP, what is the port number for these protocols?

• ARP is nothing but address resolution protocol and RARP is an abbreviation for Reverse Address Resolution Protocol.

• The basic major difference between ARP and RARP is that ARP when provided with the logical address of the receiver obtains the physical address of the receiver whereas RARP when provided with the physical address of the host, it obtains the logical address of the host from the server.

• The Address Resolution Protocol (ARP) is a network layer protocol used by many computers to map physical addresses, also known as a media access control (MAC) address, to the logical address of their owner. This protocol works in both directions and can be used to find out the Media Access Control (MAC) address of a host by sending an ARP request packet.

• The ARP maps the node’s IP address (32-bit logical address) to the MAC address/physical address (48-bit address). Whereas RARP maps the 48-bit address (MAC address/physical address) to the logical IP address (32-bit).

• In ARP, the ARP table is managed by host whereas, in RARP, RARP table is managed by the server 

• In ARP, the broadcast Mac address is used, whereas in RARP Ip address is used.
• In ARP, the ARP table required updation whereas, in RARP, the RARP table uses the configuration of the Ip address.

8. Ping Works on which layer and what is the protocol and port

 Does number ping work?

Ping command is a network tool used to determine whether an Ip address or host is accessible. After knowing this one can use the results to draw further conclusions. Therefore, pinging is usually the first line of defence when troubleshooting internet connections. it is just not only tests connectivity but also measures time and maintains accountability of all Internet Control Message Protocol (ICMP) packets.

The ping command uses the services of the Internet Control Message Protocol (ICMP), the latter being encapsulated in the IP header. Therefore, the ping utility operates basically on layer 3 (the Network layer) of the OSI model.

ICMP is widely known protocol used for the ping command. 

Ping command works on port no-8

9. What is the Range of IP?

 In the case of an IP Range, or subnet, this is a bundle of consecutive public IP addresses. The size of the IP range is determined by the subnet mask, which limits the sizes to:

• 4 Public IP Addresses (subnet /30)
• 8 Public IP Addresses (subnet /29)
• 16 Public IP Addresses (subnet /28)
• 32 Public IP Addresses (subnet /27)
• 64 Public IP Address (subnet /26)

Also, it is required to know that every range has 3 IP addresses that (by default) can not be used as public IP addresses. These are:

• The Network Address (the lowest IP address in the range)
• The Broadcast Address (the highest IP address in the range)
• The IP Address is configured as the gateway IP address.

What is IR life cycle and what defines the relationship with Mitre ATT&CK ? (In cyber security).

10. The incident response lifecycle

The incident response in the cyber security lifecycle consists of three stages: preparation, detection/analysis, and post-incident activity. During each phase, WAF technology plays a different role, increasing preparedness and enabling rapid data-driven responses that help improve your security posture.

1. The preparation Phase–  The Preparation phase encompasses the work that an organization does to get ready for incident response, such as establishing the appropriate tools and resources and training the team. This phase consists of work done to prevent incidents from occurring.

2. Detection and Analysis- According to NIST, accurately detecting and assessing incidents is often the most difficult part of incident response for many organizations.

3. Post-incident activity – The final phase of the incident response life-cycle is dedicated to applying lessons learned in previous phases. This is a three-step process that includes the following steps:

Examine incident logs to see if an attack uncovered any potential flaws in your security configuration.

To eliminate flaws, WAF rules are being tweaked and new policies are being implemented.

Testing the new rules while keeping false positives in mind.

11. Relationship with Mitre ATT&CK

The process used by SOC teams to develop correlation rules (the detection rules used to match specific system logs and events to adversary techniques) is fairly simple. The SOC develops detection rules that trigger alarms when certain conditions are met, based on a combination of architecture models (knowing precisely which systems they are protecting and how they behave under duress) and threat models relating to specific adversarial behaviours.

The same process, however, can be reversed and used in a proactive manner by incident response teams to aid in investigations and speed up the determination of how the attacker penetrated the network and moved to their final objectives

12. What are Ports?

A port is a logical location where network connections begin and end. Ports are software-based devices that are managed by the operating system of a computer. Each port corresponds to a specific process or service. Ports allow computers to easily distinguish between different types of traffic: emails, for example, go to a different port than webpages, even though both reach a computer via the same Internet connection.

Ports are standardized across all network-connected devices, with a unique number assigned to each port. The majority of ports are reserved for specific protocols; for example, all Hypertext Transfer Protocol (HTTP) messages are routed to port 80. While IP addresses allow messages to be sent to and from specific devices, port numbers allow specific services or applications within those devices to be targeted.

Read our next blog The complete guide of What is Log4j?