Cybersecurity Analyst interview questions

They represent an adversary goal, a way to achieve it, a more specific variant, and a concrete implementation respectively.

• A tactic states the adversary's objective, such as Credential Access or Persistence.
• A technique describes a general behavior used toward that objective, while a sub-technique narrows the behavior to a distinct method.
• A procedure is the observed or documented way a particular actor or tool implements a technique or sub-technique.
• Analysts should map evidence at the most specific defensible level without treating a tool name or isolated indicator as a technique by itself.

Map collected telemetry to ATT&CK data components first, then map validated analytics to the behaviors they can actually detect.

• A source such as endpoint process telemetry supports a component like Process Creation only when the relevant fields, hosts, and time periods are collected.
• A detection can map to a technique or sub-technique when its logic observes that behavior, not merely because the log source could contain related evidence.
• Collection gaps, disabled audit settings, parsing loss, retention, blind host populations, and evasion all reduce effective visibility.
• An ATT&CK heat map therefore documents scoped detection hypotheses and tests, not proof that every implementation of a colored technique is covered.

They target different credential stores and require different access paths, so their evidence and defenses are not interchangeable.

• LSASS memory dumping targets material associated with active logons on a Windows host and normally requires local administrative or SYSTEM-level capability.
• SAM extraction targets local account password hashes in the SAM and SYSTEM registry hives and generally requires privileged local or offline access.
• DCSync requests domain credential data through Active Directory replication protocols and requires replication rights, but it does not require reading LSASS on a domain controller.
• Defenses should distinguish LSASS protected-process settings and Credential Guard, registry and backup protections, and strict control and monitoring of directory replication privileges.

Kerberoasting attacks service ticket material for an SPN account, while AS-REP roasting attacks reply material for an account with Kerberos preauthentication disabled.

• Kerberoasting can usually be performed by any authenticated domain user who requests a service ticket for a registered SPN and cracks the encrypted ticket portion offline.
• AS-REP roasting requires a known account configured not to require preauthentication, after which an attacker can request crackable AS-REP material without that account's password.
• Both attacks succeed primarily against weak account passwords, but their directory configuration prerequisites and Kerberos message types differ.
• Long managed service account passwords reduce Kerberoasting risk, while enforcing preauthentication removes the AS-REP roasting condition.

Living-off-the-land binaries are legitimate system tools whose normal capabilities can be repurposed for malicious execution, transfer, or discovery.

• Examples include PowerShell, rundll32, regsvr32, mshta, and certutil, all of which also have valid administrative or application uses.
• A static allowlist based only on name, path, hash, or signature trusts the executable but cannot decide whether its arguments and surrounding activity are legitimate.
• Copies, alternate paths, unusual parent processes, encoded commands, remote content, and rare destinations provide context that a binary-only decision misses.
• Effective control combines constrained application policies with command-line, process ancestry, user, network, and frequency-based detection.

These mechanisms differ in required privilege, trigger, execution context, durability, and the telemetry they leave.

• A new or modified service can start at boot and run as SYSTEM, but creating one remotely or locally normally requires administrative control and produces service creation or modification events.
• A scheduled task supports time-based, event-based, or logon triggers and can run under another security context only when the creator has the necessary rights.
• An HKCU Run key starts code at that user's logon with user privileges, while an HKLM Run key affects more users and normally requires administrative rights.
• Defenders should restrict creation rights and baseline service, task, and autorun changes through their native Windows and endpoint telemetry.

They expose different remote administration paths, but all become lateral movement channels when credentials are poorly protected and authorization is too broad.

• SMB provides file and administrative share access, while PsExec typically uses SMB to copy a binary and Service Control Manager RPC to create and start a temporary remote service.
• RDP provides an interactive desktop session and leaves remote logon and session artifacts distinct from command-only administration.
• WinRM exposes WS-Management for remote PowerShell or command execution over HTTP or HTTPS and can be constrained with Just Enough Administration.
• Network segmentation, host firewalls, MFA on supported remote administration paths or gateways, unique local admin passwords, restricted admin groups, and credential protection reduce usable paths and privilege reuse.

HTTPS hides payload content but still exposes endpoint, TLS, timing, volume, and process context that can support command-and-control detection.

• Network sensors can observe destination IP, port, connection duration, byte directionality, packet sizes, and beacon timing even without decryption.
• Depending on the TLS version and use of Encrypted Client Hello, analysts may also see SNI, certificate metadata, client fingerprints, and protocol negotiation details.
• Endpoint and proxy telemetry can link a connection to its initiating process, command line, user, URL category, and destination reputation.
• No single feature proves command and control, so rules should combine signals and baseline legitimate browsers, update agents, and APIs.

Exfiltration often separates collection and preparation from transmission so the attacker can optimize volume, timing, and the chosen egress path.

• Staging consolidates selected files in a temporary location, while compression can reduce transfer size and file count but does not by itself encrypt the contents.
• HTTPS or cloud storage can blend with normal web traffic and support large transfers, whereas DNS offers lower bandwidth but may pass networks with weak resolver controls.
• Channel choice depends on data volume, available tools, authentication, protocol restrictions, destination trust, and the acceptable noise level.
• File and archive telemetry, DLP, proxy or CASB logs, egress filtering, resolver enforcement, and transfer-volume baselines address different parts of the sequence.

The Cyber Kill Chain is a high-level attack lifecycle, while ATT&CK is a detailed knowledge base of adversary behaviors that are not constrained to one linear sequence.

• The Kill Chain orders activity across reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives.
• Its phase model helps communicate campaign progression and identify where broad preventive or disruptive controls can break a chain.
• ATT&CK organizes tactics, techniques, and sub-techniques for threat modeling, detection engineering, emulation, and visibility-gap analysis.
• Teams can use the Kill Chain for an executive lifecycle view and ATT&CK for technical mapping, while recognizing that neither framework proves detection coverage.

Static and dynamic analysis provide different evidence, so a sound assessment combines both.

• Static analysis inspects file metadata, strings, imports, resources, and code without executing the sample.
• Dynamic analysis records processes, file and registry activity, memory operations, and network traffic on the code paths reached in a controlled environment.
• Packing, encoded data, and dynamic API resolution can hide static evidence, while trigger conditions, anti-analysis checks, and dormant branches can hide runtime behavior.
• Corroborating code-level artifacts with observed effects raises confidence, but neither source proves that every capability was exercised.

PE structures provide an initial map of likely capabilities and execution flow, but they remain supporting evidence.

• Imports suggest APIs the code may call for networking, persistence, process access, or cryptography, although delayed or dynamic resolution can leave the table sparse.
• Section names, raw and virtual sizes, entropy, and permissions can reveal embedded data, executable payloads, or unusual writable and executable regions.
• AddressOfEntryPoint identifies the nominal entry after loader setup and may lead to normal initialization or an unpacking stub, while TLS callbacks can execute before it.
• Header inconsistencies, an entry point outside a plausible code section, and sparse imports are useful in combination but do not prove maliciousness.

Packing or obfuscation should be treated as a hypothesis supported by several consistent artifacts.

• High entropy can come from compression, encryption, media, installers, or signed application bundles, so it is not conclusive by itself.
• Supporting static clues include few imports centered on loader APIs, encoded strings, indirect control flow, unusual section sizes or permissions, and an entry point in a suspicious section or unpacking stub.
• Runtime clues include code written or decompressed into memory, write-to-execute protection changes, late API resolution, and control transfer into a new executable region.
• Comparing the on-disk image with its in-memory layout and recovered imports is stronger than relying on a signature, section name, or compiler metadata alone.

Cryptographic hashes establish exact byte identity, while fuzzy hashes estimate similarity between nonidentical files.

• SHA-256 is suitable for exact deduplication and integrity checks because even a one-byte change produces an unrelated digest.
• Methods such as ssdeep and TLSH can help cluster near-duplicates that retain enough byte-level structure after minor edits or appended data.
• Recompilation, packing, encryption, major reordering, and very small inputs can sharply reduce or invalidate fuzzy-hash comparisons.
• Scores are algorithm-specific, are not probabilities, and should be combined with code, configuration, imports, and protocol evidence before claiming a relationship.

No observed activity means only that the tested conditions and reached code paths did not expose malicious behavior.

• The sample may require arguments, a parent document, user interaction, elevated privileges, a specific locale or date, or a reachable command server.
• Sleep delays, low-uptime checks, VM artifacts, hardware sizing, process checks, human-input checks, and timing tests can suppress execution in a sandbox.
• Run duration, network emulation, operating-system build, dependencies, privileges, and input coverage define what the result can support.
• Static clues, memory state, and controlled runs with different triggers can distinguish missing coverage from functionality that is genuinely absent.

Detection should model process injection as correlated cross-process memory and execution events rather than a match on one API.

• Major families include remote-thread DLL or shellcode injection, APC injection or thread-context hijacking, process hollowing or image replacement, and shared-section or manual PE mapping.
• Capture source and target identities, process-handle rights, remote allocation or writes, section mapping, memory-protection transitions, and image-load events.
• Capture remote thread creation, APC queuing when available, thread-context changes, and execution starting in private or otherwise unbacked executable memory.
• For hollowing, correlate suspended process creation with unmapping or overwriting the original image, replacement memory, context changes, and resume execution.

Describe demonstrated capabilities first and state family attribution separately with an explicit confidence level.

• Classify evidence-backed activity such as credential access, persistence, discovery, collection, command-and-control, or destructive actions.
• Separate observed execution from statically reachable or merely suspected functionality, since an import, string, or dormant routine does not prove use.
• Require independent family discriminators such as distinctive code, a stable configuration schema, protocol quirks, cryptographic constants, or validated code lineage.
• Treat infrastructure as supporting evidence because it can be shared or reused, and use a generic label such as unknown loader when family evidence is weak.

In a full certificate-authenticated TLS 1.3 1-RTT handshake, the server proves its identity while ephemeral (EC)DHE and HKDF produce traffic keys.

• ClientHello offers versions, cipher suites, groups, signature algorithms, and a key share; ServerHello selects parameters and returns a key share, enabling both sides to derive handshake keys.
• Under those keys, the server sends EncryptedExtensions, its certificate chain, a CertificateVerify signature over the transcript, and a Finished MAC based on the handshake secret.
• The client validates the chain, hostname, validity, permitted key usage, and applicable revocation policy, verifies CertificateVerify and Finished, then sends its own Finished.
• HKDF derives separate handshake and application traffic secrets, while the certificate private key authenticates the transcript rather than encrypting application data.

A secure policy supports TLS 1.3 and retains only hardened TLS 1.2 where client compatibility still requires it.

• Disable SSLv2, SSLv3, TLS 1.0, and TLS 1.1, then inventory clients before tightening the remaining TLS 1.2 configuration.
• Reject static RSA, DH, or ECDH key exchange, RC4, 3DES, and legacy CBC suites; for TLS 1.2 require ECDHE with AES-GCM or ChaCha20-Poly1305.
• TLS 1.3 authenticates negotiation in the transcript and places downgrade markers in ServerHello.random, while intentional TLS 1.2 fallback clients should use TLS_FALLBACK_SCSV instead of arbitrary retries.
• Ephemeral DHE prevents later certificate-key compromise from decrypting recorded sessions, but TLS 1.3 0-RTT should be disabled where replay resistance or forward secrecy for early data is required.

DNS tunneling is suggested by correlated naming and traffic anomalies, while DoH moves much of local network visibility to endpoints and resolvers.

• Useful signals include long or high-entropy labels, a high unique-subdomain ratio, regular beaconing, unusual query-to-response sizes, rare record types, and low cache reuse.
• Thresholds must account for CDNs, telemetry, security products, and service discovery because legitimate systems can produce high volume or label diversity.
• DoH authenticates and encrypts only the client-to-resolver hop, so the resolver still sees queries while passive local sensors usually see only the HTTPS connection.
• Managed environments can require approved DoH resolvers and recover context from endpoint, browser, proxy, and resolver telemetry instead of blocking encrypted DNS indiscriminately.