For initial access i talked about drive by downloads/watering hole techniques and methods to mitigate and detect it. After a while the other interviewer asks me - tell me a way an attacker from the outside would get into an organization?? well, drive by downloads is one such technique. I also mentioned valid accounts and spear phishing. Also when i mentioned drive-by downloads the interviewer mentioned that this technique is after an attacker has access to the system (LOL *BANGS MY HEAD TO THE WALL*). This technique is USED for initial compromise. How are these people even security professionals?
Threat Analyst Interview Questions
480 threat analyst interview questions shared by candidates
Asked about privilege access .. when trying to explain from attacker perspective they cut me off to say in a large environment an attacker would use user accounts with lower privileges to admin accounts and then establish lateral movement - which is just one vector? I guess that is all he knew?
VLAN-related questions from CCNA Security. What is VLAN double-tagging and VLAN hopping?
If you do not find evidence of a threat during a threat hunt, does that mean the hypothesis is wrong/bad?
What have you worked on.
A lot of scenario based questions. Also questions about email security e.g DNS, DKIM, SPF, DMARC etc.
Where do you see yourself in 5 years?
General questions about bad actor usage of social media, product features etc., and more technical questions about data mining/ analysis. Questions were too technical which is not quite possible for someone from outside the company to answer. It is not possible to know what resources the company has, what is the research and data mining capacity in the team. You have to presume things, which I think they didn't like. My specialisation in the field was not tested at all.
What are the latest cybercrime and dark web marketplace trends in Southeast Asia?
They asked was how I would approach specific case scenarios. The task wasn’t about getting a "right" answer, but about showing how I would analyse a threat or how I would handle an incident.
Viewing 281 - 290 interview questions