47.7 OWASP / Web / Email Auth (SPF DKIM DMARC)

Q53. What OWASP Top 10 themes should you be ready for?

(Theme: TCS HackQuest Season 9 — GeeksforGeeks candidate-reported.) I can explain injection, broken access control / IDOR, XSS, security misconfiguration, and SSRF at defender level, with fixes: prepared statements, authZ checks, output encoding + CSP, harden defaults, allow-lists for URLs. Labs only on OWN DVWA/Juice Shop.

Q54. How do you talk about Burp Suite in an MNC interview?

(Theme: TCS HackQuest — candidate-reported.) Burp is an intercepting proxy for web testing. I use it on OWN lab apps to see requests and prove issues, then I show the fix. I never proxy a production site without written authorisation.

Q55. Why mention Wireshark?

(Theme: TCS HackQuest — candidate-reported.) Wireshark captures and analyses packets. I use it in labs to see cleartext versus TLS, and to understand protocols. In SOC I may review PCAP from a sensor – still within authorised scope.

Q56. Explain SPF, DKIM, and DMARC.

(Theme: Accenture SOC — candidate-reported; Deloitte AmbitionBox snippet — candidate-reported.) SPF lists which servers may send mail for a domain. DKIM cryptographically signs messages. DMARC tells receivers what to do on alignment failures (monitor/quarantine/reject) and can request reports. Together they reduce spoofing – they do not replace user awareness.

Q57. User clicked a phishing URL – where do you look?

(Theme: Accenture SOC — candidate-reported.) Email gateway / headers, URL rewrite logs, proxy/DNS for the destination, EDR for process tree after click, identity logs for MFA fatigue or new sessions, and mail-box rules for persistence. In Microsoft Defender-style portals I look for URL click / Safe Links style telemetry when that stack is in use – product UI varies.

Q58. Authentication versus authorisation?

(Theme: common TCS-style cyber rounds — GeeksforGeeks candidate-reported themes nearby; frequently asked across MNCs.) Authentication proves identity. Authorisation decides what that identity may do. IDOR is often an authorisation failure after a valid login.

Q59. Social engineering – definition for MNC rounds?

(Theme: TechGig / Wipro; TCS Smart Hiring — candidate-reported.) Manipulating people into revealing secrets or taking unsafe actions. Defence: awareness, phishing simulations (authorised), verify-out-of-band for payment changes, and technical email controls.

Q60. Phases of a penetration test – how do you answer ethically?

(Theme: TCS Smart Hiring — candidate-reported.) High-level: scoping/rules of engagement, recon, scanning, exploitation (only in scope), post-exploitation awareness, reporting, and remediation support. I stress written permission and that in this course offensive labs stay on host-only targets I own.