47. Interview Questions Asked in MNC Interviews
47.3 Linux, Logs and Windows Event IDs
sudo yum, sudo service, /var/log/secure, Event ID 4624/4625 – Blue daily bread. Dhyan rakho.
Q17. How do you install and check a web service on Amazon Linux in this course style?
Frequently asked across MNC interviews when Linux comes up (candidate-reported). I use sudo yum install httpd -y or nginx, then sudo service httpd start, and sudo service httpd status. For boot I may use sudo systemctl enable httpd. I avoid mixing dnf into Amazon Linux examples in this course.
Q18. Where do you look for failed SSH logins on Amazon Linux?
I check /var/log/secure with sudo grep -i failed /var/log/secure | tail. Spikes mean brute force. Controls: key-only SSH, security group allow-list, fail2ban, no password auth for root.
Q19. What Windows Event ID indicates a successful logon?
(Theme: Accenture SOC — candidate-reported.) Event ID 4624 is a successful logon. I still ask: logon type, account, source IP, time, and whether it fits the user’s baseline. Success is not automatically benign.
Q20. What does Event ID 4625 tell you?
Frequently asked across MNC SOC interviews (candidate-reported). 4625 is a failed logon. Many 4625s then a 4624 from the same source can mean brute force eventually succeeded. I correlate count, source, account (especially service accounts), and hour of day.
Q21. How do you list listening ports on Linux in an interview?
I use ss -tulnp and compare to a baseline. Unexpected listeners are investigation triggers. On Raja-Rani’s lab EC2 I expect sshd and the web service – not a random reverse-shell port.
Q22. Why is chmod 777 on a web root a bad answer to "make it work"?
World-writable web root invites defacement or webshell drop after a foothold. Correct ownership and 755/644 patterns matter. Interviewers listen for least privilege, not "permission denied fixes".
Q23. How do you restart a service safely after a config change?
Config test first (sudo nginx -t or sudo apachectl configtest), then sudo service nginx reload or restart. Blind restart without test can take production down.
Q24. Observed ping.exe on a Windows host – how do you investigate at L1 level?
(Theme: Accenture SOC — candidate-reported.) I treat it as a signal, not a verdict. Ping can be admin troubleshooting or reconnaissance. I check parent process, user context, destination IPs, frequency, EDR/SIEM related alerts, and whether the same host shows scanning or lateral auth. I escalate with facts, not panic.
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Brutes SSH / sprays passwords | fail2ban; key-only SSH; 4625→4624 correlation; MFA |
| Uses living-off-the-land tools like ping for recon | Parent-process + destination analysis; baseline rare admin tools |
Ravindra Bagale's Tip
Event ID number rattling = incomplete. Interviewer vicharato: logon type, source IP, service account ka? 4624 success pan suspicious asu shakte. Think aloud. He lakshat theva.
Lab
On OWN Amazon Linux: generate a few failed SSH attempts from Kali host-only only against your VM, then sudo grep -i failed /var/log/secure | tail -20. Screenshot for portfolio. On a Windows lab VM you own, open Event Viewer and find a 4624 – note logon type (no domain attack).