Cyber Security Engineer Interview Guide (3–8 Years Experience)

• Quantitative: Assigns explicit monetary values. Formula: ALE = SLE x ARO (Single Loss Expectancy x Annualized Rate of Occurrence).
• Qualitative: Categorizes risk subjective severity using a Risk Matrix (High/Medium/Low based on Probability vs Impact).

• Preventive: Blocks security incidents before execution (e.g., Firewall, MFA, Antivirus).
• Detective: Identifies and alerts on malicious activity in progress (e.g., SIEM, IDS, Log auditing).
• Corrective: Mitigates damage and restores systems post-incident (e.g., Backups, Patching, Endpoint Re-imaging).
• Compensating: Alternative control deployed when primary control is unfeasible (e.g., Network isolation for legacy OS).

• STRIDE: Categorizes threats into **S**poofing, **T**ampering, **R**epudiation, **I**nformation Disclosure, **D**enial of Service, and **E**levation of Privilege.
• PASTA: Risk-centric 7-step process aligning business objectives with technical threat analysis.

1. SYN: Client sends packet with SYN flag set and an initial sequence number (ISN).
2. SYN-ACK: Server responds acknowledging client ISN with ACK flag and sends its own SYN flag.
3. ACK: Client sends final ACK packet. Connection enters `ESTABLISHED` state. Firewalls monitor these flag states to track valid sessions.

• DNSSEC: Cryptographically signs DNS records with digital signatures to prevent DNS spoofing and cache poisoning.
• DoH (DNS over HTTPS): Encrypts DNS queries inside HTTPS traffic (Port 443) for user privacy.
• DoT (DNS over TLS): Encrypts DNS queries using dedicated TLS tunnels on Port 853.

• Site-to-Site VPN: Encrypted IPsec tunnel permanently connecting two physical network gateways/firewalls across public internet.
• Remote Access VPN: Encrypted tunnel established between individual remote endpoint devices (using SSL/TLS or IPsec client) and a central corporate VPN gateway.

• SSL/TLS VPN: Operates at Layer 7 over TCP Port 443; accessible via standard web browsers without client software installation; easy traversal through restrictive firewalls.
• IPsec VPN: Operates at Layer 3 (IP layer); requires dedicated client software; provides full network-level connectivity to target subnets.

• NGFW: Layer 3-7 network firewall filtering traffic based on IP addresses, ports, protocols, and application signatures across enterprise networks.
• WAF: Layer 7 specialized proxy specifically inspecting HTTP/HTTPS payloads to detect and block web application attacks (OWASP Top 10: SQLi, XSS, CSRF, File Inclusion).

• EDR: Focuses strictly on host-level telemetry (endpoints, workstations, servers).
• XDR: Correlates telemetry across multiple domains—endpoints, email, identity providers (AD/Entra), cloud workloads, and network firewalls—into a single incident view.

1. Review EDR alert details and map process execution tree (Parent/Child PID).
2. Inspect command-line arguments and encoded PowerShell payloads (`-EncodedCommand`).
3. Collect file SHA-256 hashes and query threat intelligence platforms (VirusTotal).
4. Analyze memory or disk artifacts using Live Response sessions.
5. Isolate host, terminate malicious process trees, and purge persistence mechanism.

• Password Hash Sync (PHS): Syncs hashed password hashes from on-prem AD to cloud Entra ID; simplest, highly resilient.
• Pass-Through Authentication (PTA): On-prem agent validates cloud login attempts against on-prem DCs in real time.
• Federation (ADFS): Redirects cloud auth to on-premises ADFS infrastructure.

• NTLM: Challenge-response protocol using MD4 password hashes; vulnerable to Relay attacks, Pass-the-Hash, and lacks mutual authentication.
• Kerberos: Ticket-based authentication using strong symmetric/asymmetric encryption, enforces mutual authentication, and relies on a trusted KDC.

1. Preparation: Tooling, training, and playbooks.
2. Detection & Analysis: Triaging alerts, analyzing log telemetry, and validating scope.
3. Containment: Isolating systems (Host Isolation / disabling accounts) to prevent spread.
4. Eradication: Removing malware, backdoors, and attacker persistence.
5. Recovery: Restoring systems to production safely.
6. Lessons Learned: Post-incident analysis and detection rule improvements.

• IOC (Forensic Artifact): Static evidence of past compromise (e.g., file hash, known bad IP).
• IOA (Behavioral Pattern): Dynamic execution behavior indicating an active attack sequence in progress (e.g., unprivileged process attempting to dump LSASS memory).

• Static Analysis: Inspecting malware binaries without execution (PE file headers, strings, imported DLL functions, YARA rules).
• Dynamic Analysis: Running malware inside an isolated sandbox VM (Cuckoo/ANY.RUN) to observe process creation, registry writes, and network C2 traffic.

1. Validate alert context and check for false positive indicators.
2. Pivot on key entities (User Account, Hostname, Source IP, Process Hash).
3. Expand timeline search window around alert timestamp (+/- 1 hour).
4. Correlate endpoint EDR logs with network firewall and identity sign-in logs.
5. Document investigation timeline and escalate if containment is required.

SecurityEvent
| where TimeGenerated > ago(24h)
| where EventID == 4625
| summarize FailedCount = count() by Account, IpAddress
| where FailedCount > 10
| project Account, IpAddress, FailedCount

index=windows sourcetype=WinEventLog:Security EventCode=4625 
| stats count by src_ip, TargetUserName 
| where count > 10 
| sort - count

• Type 1: Evaluates suitabilty of security control *design* at a specific point in time.
• Type 2: Evaluates operational *effectiveness* of security controls over an extended testing period (typically 6–12 months).

• Mean Time to Detect (MTTD) & Mean Time to Respond (MTTR).
• Patch Compliance % (SLA window performance).
• Phishing Simulation Failure Rate %.
• Open Vulnerability Backlog by CVSS severity.
• Microsoft Secure Score / Compliance Score progression.

1. Immediate Host Isolation: Execute mass host network isolation across all affected endpoints via EDR console (Defender/CrowdStrike/SentinelOne).
2. Isolate Network Subnets: Instruct network team to drop inter-VLAN routing for affected user subnets at core firewalls to block SMB lateral movement.
3. Revoke Credentials: Force domain-wide password resets for compromised accounts and invalidate active Kerberos/OAuth tokens.
4. Forensic Triage: Identify patient zero host, analyze memory/event logs for initial infection vector and persistence mechanisms.
5. Eradication & Recovery: Wipe infected devices, rebuild via Autopilot/PXE, and restore user files exclusively from clean backups.

1. Revoke Sessions & Password Reset: Immediately revoke active OAuth refresh tokens via PowerShell (`Revoke-MgUserSignOutSession`) and execute password reset.
2. Audit Mailbox Rules & Delegation: Inspect Exchange Online for hidden inbox rules (`Get-InboxRule`), forwarding addresses, or newly added delegate permissions created by the attacker.
3. Identity Hardening: Re-register MFA methods, enforce Fast ID Online (FIDO2) phishing-resistant security keys, and mark account as high risk in Entra ID Protection.
4. Purge Phishing Emails: Run a tenant-wide Compliance Search to locate and hard-delete the AiTM phishing email from all inboxes.

1. Analyze Sign-in Logs: Review Entra ID Sign-In logs: Check source IP addresses, ASN/ISP details, User Agent strings, and Device Compliance status for both sign-ins.
2. Check VPN / Proxy Status: Verify if the user is connected to a corporate egress proxy or VPN provider causing IP geolocation distortion.
3. MFA & Application Context: Check if the second sign-in successfully completed MFA or used an app-specific legacy token.
4. User Verification: Contact the user out-of-band to confirm location. If unconfirmed, treat as account compromise, revoke sessions, reset password, and isolate the account.

1. Trace Process Trees: Use EDR process trees to identify source parent process initiating WMI (`wmic.exe`) and `psexec.exe` execution across hosts.
2. Host Isolation: Isolate source and target host machines from network via EDR console.
3. Identify Compromised Credentials: Inspect Windows Event ID 4624 (Logon Type 3 / Network) on target servers to determine which privileged account was compromised to execute remote commands.
4. Block Attacker Artifacts: Add malicious file hashes and C2 IPs to EDR blocklists tenant-wide, revoke compromised account tokens, and rotate LAPS local admin passwords.

1. Extract Threat Indicators: Obtain raw email headers from reported sample, extract sender domain, source IP, subject line, and embedded URL/attachment hash.
2. Tenant-Wide Purge: Execute Microsoft Defender Automated Investigation & Remediation (AIR) or PowerShell `New-ComplianceSearch` and `New-ComplianceSearchAction -Purge -PurgeType SoftDelete` to remove the email from all 1,000 inboxes.
3. Block Indicators: Add URL to Safe Links blocklist, block sender domain/IP in Exchange Transport Rules and EOP tenant allow/block list.
4. Analyze Clicks: Query Defender for Office 365 Threat Explorer to identify users who clicked the link or submitted credentials; force password resets for impacted users.

1. Gather Telemetry Evidence: Inspect Defender for Endpoint USB file-write logs, Purview Insider Risk Management alerts, and Endpoint DLP incident records.
2. Preserve Forensic Artifacts: Create a forensic image of the user's workstation disk and preserve system event logs.
3. Account Suspension: Coordinate with HR and Legal to immediately revoke the developer's AD/Entra ID account, disable VPN access, and wipe corporate mobile profiles.
4. Legal & HR Handoff: Package timestamped forensic chain-of-custody reports documenting specific file paths copied to USB for legal enforcement.

1. Isolate Source Endpoint: Instantly execute network isolation on the host executing the attack via EDR console.
2. Disable Account & Revoke Tokens: Disable the compromised user account in Active Directory and reset session tokens.
3. Identify Targeted Service Accounts: Inspect Event ID 4769 (Kerberos Service Ticket Request) on Domain Controllers to identify which Service Principal Names (SPNs) were requested using weak RC4 encryption.
4. Rotate Managed Passwords: Force immediate complex password rotations for all targeted SPN service accounts and evaluate migrating service accounts to Group Managed Service Accounts (gMSA).

1. Identify Alert Noise Source: Query SIEM logs to filter high-volume alert rules and aggregate by source IP address.
2. Tune & Filter: Create temporary, approved exclusion rules in SIEM referencing the vulnerability scanner's static IP address and scheduled maintenance window.
3. Separate Critical Queues: Segregate P1/Critical alert queues (e.g., EDR host isolation triggers) from standard log noise to ensure real threats remain visible.
4. Process Governance: Mandate that vulnerability scanning teams register all scan schedules in advance within Change Management.

1. Command Structure: Establish dedicated Incident Command Bridge (Teams/Zoom call) and designate roles: Incident Commander (Lead), Technical Lead (Investigation), Communications Scribe, and Management Liaison.
2. Technical Execution: Assign discrete investigation tracks to specialists (e.g., EDR host isolation, Network firewall blocking, Identity token revocation) with strict 15-minute update intervals.
3. Stakeholder Communication: Issue clear, factual status summaries to executive leadership every 30-60 minutes detailing Impact, Containment Status, and Estimated Recovery Time, avoiding unverified speculation.

1. Emergency Vulnerability Triage: Assess organizational exposure using vulnerability management tools (Tenable/Qualys/MDE) to identify all affected internet-facing assets.
2. Emergency CAB Approval: Submit Emergency Change Request to Change Advisory Board (CAB) for immediate patching or applying vendor-recommended workaround rules.
3. Apply Mitigation / Patch: Deploy hotfix patch or apply temporary WAF signature blocking rules within 4 hours.
4. Threat Hunting: Search SIEM/firewall logs historically (past 30 days) for exploitation attempts using disclosed IOCs/signatures.
5. Post-Patch Rescan: Rescan assets to confirm 100% remediation and report status to CISO.

Key Production Query Examples:

1. Detect LSASS Memory Dumping via Process Telemetry:

DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where ProcessCommandLine has_any ("lsass", "dump", "procdump", "comsvcs.dll")
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName

2. Detect Successful Logons from Risky Anonymized VPN IPs:

SigninLogs
| where TimeGenerated > ago(24h)
| where ResultType == 0
| where NetworkLocationDetails contains "AnonymousVPN" or LocationDetails.country != "US"
| project TimeGenerated, UserPrincipalName, IPAddress, Location, AppDisplayName, ConditionalAccessStatus

3. Detect Encoded PowerShell Execution Chains:

DeviceProcessEvents
| where TimeGenerated > ago(24h)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any ("-enc", "-encodedcommand", "bypass", "nop")
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, ParentProcessFileName

• 50 Microsoft Defender Labs: Setting up ASR rules, configuring device isolation, custom indicator matching, and tuning AIR playbooks.
• 50 Sentinel Labs: Creating custom log connectors, building KQL detection rules, mapping alerts to MITRE ATT&CK, and executing Logic App playbooks.
• 30 Incident Response Labs: Simulating AiTM phishing containment, clearing rogue Exchange forwarding rules, and executing host isolation commands.
• 25 Threat Hunting Labs: Hunting for Kerberoasting attempts, analyzing SMB lateral movement, and detecting C2 DNS beaconing.
• 20 Malware Investigation Labs: Executing RAM dumps with WinPmem, parsing PE headers, and evaluating Volatility `malfind` outputs.
• 100 Security Interview Cheat Sheets: Port reference guides, Windows Event ID cheat sheets, and Linux permission matrixes.