47.2 Networking and Protocols (MNC rounds)

Q7. What is the CIA triad and why is it important?

(Theme: TechGig article on Wipro cybersecurity interviews — candidate-reported.) CIA means Confidentiality, Integrity, and Availability. Confidentiality keeps data away from unauthorised eyes. Integrity keeps data accurate and untampered. Availability keeps systems usable when needed. In SOC language I map alerts to which pillar is hit – ransomware mainly hits availability; credential theft hits confidentiality.

Q8. What is a firewall and how does it protect a network?

(Theme: TechGig / Wipro — candidate-reported; also TCS Smart Hiring experience on GeeksforGeeks — candidate-reported.) A firewall enforces allow/deny rules between trust zones – for example internet versus internal VPC. It is not magic by itself. I combine it with host hardening, least privilege, and logging. On Sahyadri’s lab EC2 I show security group least privilege as a cloud firewall pattern.

Q9. What is a DDoS attack and how can it be mitigated?

(Theme: TechGig / Wipro — candidate-reported; also Accenture SOC themes via public LinkedIn candidate post — candidate-reported.) DDoS floods a target so legitimate users lose availability. Mitigation ideas: rate limiting, traffic filtering, Anycast/CDN or cloud DDoS protection services, and having an incident playbook. I do not claim I ran a DDoS; I explain defender options.

Q10. Explain TCP versus UDP for a SOC round.

(Theme: Accenture SOC Analyst themes — candidate-reported LinkedIn post by Vinod Kumar.) TCP is connection-oriented with reliability features; UDP is connectionless and lighter. HTTPS and SSH use TCP. DNS often uses UDP for queries. Defenders care because flood and scan patterns look different on each. I read firewall and DNS logs with that lens.

Q11. Which ports should you know cold?

(Theme: Deloitte Cyber Security Analyst themes on AmbitionBox — candidate-reported snippet; also general SOC lists.) At least: 22 SSH, 80/443 HTTP/HTTPS, 53 DNS, 25/587 mail, 445 SMB, 3389 RDP, 3306 MySQL, 389/636 LDAP. UDP example: DNS 53. For each I can say risk if exposed to 0.0.0.0/0.

Q12. What is the Cyber Kill Chain at interview level?

(Theme: Accenture SOC — candidate-reported.) A high-level attacker path model: recon, weaponise, deliver, exploit, install, command-and-control, actions on objectives. I use it to structure detection – where would we see phishing delivery versus lateral movement – not as a rigid law. I also mention MITRE ATT&CK for technique detail.

Q13. OSI model – where does FTP fit, and what do interviewers want?

(Theme: Accenture SOC — candidate-reported.) They want placement sense. FTP is an application-layer protocol for file transfer; it rides on TCP. Cleartext FTP is risky; SFTP/FTPS are safer patterns. I map controls to layers without pedantic fights.

Q14. Explain threat versus vulnerability versus risk.

(Theme: TCS Smart Hiring — GeeksforGeeks candidate-reported.) A vulnerability (असुरक्षा) is a weakness. A threat is an actor or event that might exploit it. Risk is roughly likelihood times impact in context. An unpatched CVE on an air-gapped lab VM is different risk from the same CVE on a public login.

Q15. What is traceroute used for?

(Theme: TechGig common cybersecurity questions — frequently asked across interviews, candidate-reported.) Traceroute shows the hop path packets take toward a destination. In troubleshooting I use it to see where traffic stops. In security I remember that path info can leak topology – so I do not expose internal traces carelessly.

Q16. What is a honeypot in one interview minute?

(Theme: TechGig / Wipro — candidate-reported.) A honeypot is a decoy system meant to attract attackers so defenders can study tactics and gather intel. It must be isolated so it cannot become a pivot into real Sahyadri production. I treat it as a detection research tool, not a toy on the real LAN.