By Jackson Godwin . Cybersecurity Analyst & Penetration Tester

Whether you’re a student preparing for your first SOC analyst role or transitioning into security operations, interviewers at Tier 1 level are testing for one thing above all: can you explain fundamentals clearly and reason through a scenario. Use these questions to test yourself out loud, not just silently in your head — interviewers are listening for how you explain, not just what you know.

How to use this guide: Cover the answer, read the question, and say your answer out loud before checking it. If you can’t explain a concept simply, you don’t know it well enough yet — go back and review.

Section 1: Networking Fundamentals

Q1. What is a port, and why do computers use them?

A: A port is a numbered virtual endpoint that lets a device separate different types of network traffic. A single IP address can run many services at once — web, email, remote access — and ports let the operating system know which service should handle incoming data.

Q2. What’s the difference between TCP and UDP?

A: TCP is connection-oriented and reliable — it establishes a session, confirms delivery, and retransmits lost data, making it suitable for web browsing and email. UDP is connectionless and faster, with no delivery guarantee, which suits real-time traffic like streaming or VoIP where speed matters more than perfect reliability.

Q3. Name five common ports and their services.

A: Port 80 (HTTP), 443 (HTTPS), 22 (SSH), 25 (SMTP), and 53 (DNS) are a good baseline. I’d also mention 3389 (RDP) and 445 (SMB) since they show up often in Windows-environment investigations.

Q4. Walk me through the TCP three-way handshake.

A: The client sends a SYN packet to request a connection. The server responds with SYN-ACK, acknowledging the request and offering its own synchronization. The client replies with ACK, confirming receipt, and the connection is now established for data transfer.

Q5. Why does the three-way handshake matter for security?

A: It’s the basis of TCP connection tracking, and it’s also what SYN flood attacks abuse — an attacker sends many SYN packets without completing the handshake, leaving the server with a pile of half-open connections that exhaust its resources.

Q6. Explain the OSI model and why a SOC analyst needs to know it.

A: The OSI model breaks network communication into seven layers, from physical cabling up to the application layer users interact with. Knowing it helps you localize an attack — for example, ARP spoofing happens at Layer 2, IP spoofing at Layer 3, SYN floods at Layer 4, and SQL injection or XSS at Layer 7 — which tells you which logs and tools are relevant.

Q7. At which OSI layer does a WAF operate, and why does that matter?

A: A WAF operates at Layer 7, the application layer, because that’s where it can inspect the actual HTTP requests and payloads for attack patterns like SQL injection or XSS. A network firewall working at Layer 3/4 wouldn’t see that level of detail.

Section 2: Common Attacks

Q8. What is phishing, and what would you look for in the logs?

A: Phishing is a social engineering attack where a message impersonates a trusted source to trick a user into revealing credentials or installing malware. I’d check email logs for spoofed or lookalike sender domains, review URLs against threat intelligence feeds, and check proxy logs to see if any user actually visited the malicious link.

Q9. What’s the difference between a virus, a worm, and a trojan?

A: A virus attaches itself to a file and needs user action to spread. A worm spreads on its own across a network without needing a host file. A trojan disguises itself as legitimate software while hiding malicious functionality — it relies on the user trusting and running it.

Q10. Explain SQL injection with an example.

A: SQL injection happens when unsanitized user input is inserted directly into a database query. A classic example is entering ‘ OR 1=1 — into a login field, which can make the query always evaluate as true and bypass authentication entirely.

Q11. What’s the difference between stored and reflected XSS?

A: Stored XSS saves the malicious script on the server — for example in a comment field — so it runs for every visitor who loads that page. Reflected XSS isn’t saved anywhere; it’s embedded in a link and only executes for the person who clicks it, which makes it a common phishing companion.

Q12. How would you detect a brute-force attack in progress?

A: I’d look for a high volume of failed login attempts against the same account or from the same source IP in a short window, especially if attempts continue across many different usernames — a pattern that points to credential stuffing rather than a single user mistyping a password.

Q13. What is a DDoS attack, and how would a SOC respond?

A: A DDoS attack floods a target with traffic from many sources — often a botnet — until the service becomes unavailable. Response typically involves confirming the traffic spike, engaging the ISP or cloud provider’s anti-DDoS protections, applying rate-limiting or IP blocks, and following the incident response plan.

Q14. What is a man-in-the-middle attack?

A: It’s when an attacker secretly intercepts communication between two parties, often on unsecured public Wi-Fi, allowing them to read or alter data in transit. Strong TLS, certificate pinning, and monitoring for unexpected certificate changes all help defend against it.

Q15. How does ransomware typically get onto a network, and what are early warning signs?

A: Most ransomware arrives through phishing emails, exposed RDP, or an unpatched vulnerability. Early signs include mass file renaming, unusual spikes in CPU or disk activity, and unexpected processes encrypting files across shared drives.

Q16. What’s a zero-day, and why is it hard to detect?

A: A zero-day is a vulnerability that’s unknown to the vendor and has no patch yet, so signature-based tools can’t recognize an exploit against it. Detection depends more on behavioral analysis — noticing unusual activity — than on matching known indicators.

Section 3: Defensive Tools & Concepts

Q17. What does EDR do that traditional antivirus doesn’t?

A: Traditional antivirus mostly matches files against known malware signatures. EDR continuously monitors endpoint behavior, flags suspicious activity even without a known signature, can automatically isolate a compromised device, and gives analysts the visibility needed to investigate how an attack unfolded.

Q18. What’s the difference between IDS and IPS?

A: An IDS detects and alerts on suspicious activity but doesn’t take action itself — think of it as a camera. An IPS sits inline with traffic and can actively block or drop malicious packets in real time — closer to a guard who physically intervenes.

Q19. Explain the difference between a false positive and a false negative, and which is more dangerous.

A: A false positive flags something harmless as malicious, which wastes analyst time. A false negative misses something genuinely malicious, letting an attack go unnoticed — that’s the more dangerous outcome because the organization has no idea it’s compromised.

Q20. What’s the difference between a stateful and a stateless firewall?

A: A stateful firewall tracks the context of an entire connection and allows return traffic because it recognizes it as part of a session the user initiated. A stateless firewall evaluates every packet in isolation with no memory of prior traffic, which is faster but less accurate.

Q21. What is a WAF and what does it protect against?

A: A Web Application Firewall filters and monitors HTTP/HTTPS traffic to a web application, blocking attack patterns such as SQL injection, XSS, and malicious file uploads. It operates at the application layer, giving it visibility a network firewall doesn’t have.

Q22. What is NAC and how does it help security?

A: Network Access Control checks whether a device meets an organization’s security policy — updated antivirus, patched OS, approved configuration — before allowing it onto the network. Non-compliant devices can be quarantined or blocked until they’re remediated.

Q23. What does ‘system hardening’ mean in practice?

A: It’s the process of reducing a system’s attack surface by disabling unused services, applying patches promptly, removing default credentials, uninstalling unnecessary software, and enforcing strong password and configuration policies.

Section 4: Vulnerabilities, Investigation & Advanced Concepts

Q24. What’s the difference between a vulnerability and an exploit?

A: A vulnerability is a weakness in a system — like an outdated software version or a misconfiguration. An exploit is the actual technique or code an attacker uses to take advantage of that weakness. Not every vulnerability gets exploited, but every exploit relies on one existing.

Q25. What is an open mail relay, and why is it risky?

A: An open mail relay accepts and forwards email from anyone without verifying they’re authorized to use it. Spammers abuse this to send phishing or spam through your infrastructure, which can get your organization’s IP blacklisted and damage its email reputation.

Q26. How would you investigate a suspected SQL injection attempt?

A: I’d review web server and WAF logs for suspicious query patterns or SQL syntax in request parameters, check for unusual database error messages returned to the client, confirm whether the payload actually reached the database layer, and work with developers to verify input validation and parameterized queries are in place.

Q27. What is Command and Control (C2) traffic, and how might you spot it?

A: C2 traffic is communication between compromised malware on a host and an attacker’s remote server, used to issue commands or exfiltrate data. Indicators include beaconing at regular intervals, connections to newly registered or algorithm-generated domains, and traffic to known-bad IPs from threat intelligence feeds.

Q28. What does ‘persistence’ mean in the context of an attack, and name two techniques.

A: Persistence refers to techniques attackers use to maintain access to a compromised system even after a reboot or an attempted cleanup. Common techniques include adding malicious entries to startup locations (such as the Windows Registry) and creating scheduled tasks or cron jobs that re-launch malicious code.

Q29. What is Mimikatz, and why would a SOC analyst care about it?

A: Mimikatz is a tool that extracts credentials, password hashes, and Kerberos tickets from memory on Windows systems. It’s used legitimately in red team engagements but is also widely abused by attackers for privilege escalation and lateral movement, so its presence on an endpoint is a strong indicator of compromise.

Q30. Walk me through your general process when you receive a SIEM alert.

A: First I’d validate the alert isn’t a false positive by checking the raw log data. Then I’d gather context — source and destination IPs, user account, timestamps, and any related events — to understand scope. Based on severity, I’d contain the affected system if needed, escalate according to the incident response plan, and document findings including indicators of compromise for the final report.

Q31. Why is credential stuffing effective even against organizations with no breach of their own?

A: Because people commonly reuse passwords across services. If a user’s credentials leak from an unrelated site, attackers will try that same combination against other platforms, including your organization’s — which is exactly why MFA is such an effective mitigation regardless of password strength.

Final Tips Before Your Interview

Interviewers at the Tier 1 level are rarely looking for a perfect, memorized definition. They want to see that you understand how these concepts connect — how a vulnerability becomes an exploit, how a Layer 7 attack differs from a Layer 3 one, and how you’d actually respond under pressure. Practice explaining each answer above in your own words, out loud, until it feels natural rather than recited.

About the Author

Jackson Godwin

Cybersecurity Analyst & Penetration Tester

Jackson Godwin is a Cybersecurity Analyst, Penetration Tester, and Specialist in Cybersecurity Governance, VAPT, and Security Operations based in Abuja, Nigeria. He is the founder of TechTrain Academy, where he supports the development of African cybersecurity professionals through practical, job-focused training

info@jacksontechnology.com.ng