All language subtitles for 2. Advanced Scenerio Based QuestionsAnswers

Hello everyone.

In this lecture we will discuss about advanced scenario based interview question.

So why this is the advance?

This is because in this interview, totally check your investigation part from your investigation part

to your skills, each and everything.

And they will get to know that whether you have worked on it or not.

So let me start I will give you some examples, but before that, let me show you that what exactly

the scenario is and for this particular lecture.

So the interviewer will give you a scenario and in in between they will stop you and they will change

the scenario.

INTERVIEWER will try to check your skill and he will get to know whether you have worked earlier on

it or not.

For this type of question, you should have proper knowledge, definitely.

And then only you can answer these these type of questions.

And for example, we have taken maybe, I think, four questions just to show you that just the demo

that how they can actually ask this type of question.

Let me start with the number one question.

So let's say I'm the interviewer and you are one of the candidates.

So you received one of the phishing email in your organization, then how you will investigate manually.

Now what will be your answer?

Definitely you will.

You will have to elaborate this answer.

You will say you will do URL analysis, domain analysis, attachments, right.

And you will check whether the email is spoofed or not.

You will check the sender domain, these kind of things.

You will check whether it's malicious or not.

Right.

And once you will set all these investigations, you will set all these steps, they will interrupt

you.

This is the what?

The barrier question now.

INTERVIEWER is stopping you?

Definitely.

Now the scenario is change, guys.

So let's say everything is clean.

Even the you are even the attachments, even even the email is not spoofed.

The sender domain is also, you know, showing the perfectly clean now but it's still the email is the

phishing one now question is that how you will confirm it?

So here is the answer.

See it might be happened, guys, that you are an attachment.

Everything is clean.

But somehow that URL is redirecting to some other pages.

Right.

And it might be a happen that that URL is asking for the.

Sending you a one on one of the page in which they are asking for the credential.

So this type of emails, this type of phishing email, generally used for the credential harvesting.

So this this could be your answer.

Now, again, there is a barrier question.

Let's suppose you enter the credential, right?

It is given giving an error.

Then what will be your next step?

Well, the.

See.

It can happen that you are just giving your credential and it is reloading again and again.

So at least three times this is the you can try at least three and more times.

If it is showing the same error, then you should check the the redirected URL of that URL actually,

then check for the reputation of those things.

And on those basis you will have to take the action.

You will have to consider whether it's a phishing email or not.

Right.

No, just it's a note so her interviewer can ask more questions, right?

Definitely.

So you should have the whole investigation.

You should have the knowledge of whole investigation for phishing emails.

Now we have the question second.

You might have seen the organization use major tech framework in their organization, but why do they

use it?

Though we have our antivirus EDR, SIEM and other tools out there to secure from suspicious suspicious

activities.

Right.

So what is the need of that tech in your organization?

So let's see the answer.

Okay.

So these type of tools, let's say antivirus ideas, can detect the suspicious activities.

There is no doubt but organization use attack framework framework just to map out the characteristics

and specific tools used in attack across the major tech frameworks.

And it helps the SOC team assesses the current effectiveness of the existing security measures and the

impact of the attack.

So basically, whatever the security we have in our organization, it actually checks all those measures

of whether this kind of let's see if there is some some technique different technique in the might attack.

So whether our SOC team or against the security measures are enough to face those issues or not.

Right.

Whether we we are blocking we are just denying those traffic or not.

So this is what just a framework.

Framework, just to check the you can see the existing security measures and that how it can be impact

on us.

Now attack allows defenders to assess whether they can defend against a specific ETB or you can say

apt.

Right.

And common behaviors across multiple threat actors.

Question thought we have when you move the NFC cards from one PC to another, PC, does the MAC address

get transferred as well?

Definitely, because the Mac address is in that and I see card actually.

So it is going to change.

But why?

It is going to change, as I said, because we are changing the NFC card and Mac address is already

encoded in that and I see card that that's the reason.

Now last question.

We have very important one.

Mainly, this is the most asked questions basically for the scenario based question.

So the question is, have you ever worked on any malware cases in your previous organization?

So definitely you might we have bugs.

So in my case, I worked on it.

I worked on many of the like like emotet ICD idea, ICD ID, many ransomware as well, a lot of phishing

emails as of now, I think maybe more than six or 7000 emails I have already investigated.

Okay.

Now, very question is that tell us how Emotet work.

So you have to tell each and every thing that how actually that malware.

Or maybe it depends on you that on which our case you have worked.

Right, so you have to elaborate it.

Now the next question will be, can you explain this malware in the form of cyber culture?

Now here, what does what does it mean?

It means what?

Actually, the interviewer wants you to just elaborate or you can say, explain the text of in the 70

stages of cyber kill chain and which stages like that, how or how it will be.

First part like recommends second part weaponization, delivery, exploitation, installation, command

and control, and then action on objectives.

So you have to just correlate your malware or whatever the attacks you have worked go to correlate with

these seven stages of cyber kill chain, for example, like Emotet.

Emotet generally comes through phishing email, right?

So in that sense, definitely I'm going to gather the information of the, you know, recipient means

the user where I have to send the email.

Correct.

Now, weaponization is that I will attach the file.

I will do each and everything, whatever I have to, you know, attach in the email body, the deliveries

that I will send that email to the user.

And exploitation is that once the user is going to click on that attachment, that is directly going

to install.

Once it will install, install, I will get the command and control.

And after that I can, you know, is to seal the data.

I can steal each and everything is still the password is still the confidential datas different different

things even.

You know, I can drop other malware too.

So this is how I correlate these things, right?

I hope this, these four questions are enough to just to tell you that how actually these advanced you

can say scenario based question as in the during the interview but why take care.