All language subtitles for 1. Roles & Responsibilities, SIEM Questions

In this video, we will talk about roles and responsibilities and same questions.

So whenever you are going for an interview, then definitely the interview interview is going to ask

the questions related to your roles and responsibilities.

And this is 100% chances, right?

So it's very rare cases that the interviewer is not going to ask the roles and responsibilities and

same questions.

Well, whatever, whatever I have seen and whatever my seniors, my juniors I have seen and collected

all those these data and I have seen the roles and responsibilities was the main you can say main question

that was included in all those 50 samples.

So let's meet.

Let me start with what is sim?

So you, you are already are already working on that same right.

What exactly it is security information and even management we can see this is this is this is using

for the real time analysis.

Right and security alert generated by application and network network hardware.

So that's what SIM and we seem you were using in your organization.

This is one of the question and what was the source is from where same collection the logs so sources

what what actually the interviewee is asking here that from where your sim were getting the logs so

definitely it was an idea such ideas maybe the routers, virtual machines servers was different different

places.

So but you should know your organization architecture that exactly from where your sim was collecting

the

sorry collecting the logs.

Right.

Now what is clearer is they both are same.

You can search on more on these things.

What is the architecture of these architecture?

Radar.

And definitely they will ask about these things so you can directly go these two links I have shared.

You can go and you can read these things.

What are the components of radar is Splunk.

So whatever they did, I don't know whether you are using Q Radar or Splunk, right?

So if you are using Q radar, maybe, let's say example, even data, dataflow data.

So just go for that components.

What actually the login analysis dashboard, there are a lot of things, components in that and Splunk

for Splunk, let's example, search hard for forwarder indexer.

You can go through this link and you will get a lot of data.

Now brief us about your carrier.

So.

Your career so far from where you have started.

So you have to start from your academics, right?

Right.

From the academics.

And.

And including your graduation.

Then after your first job.

Second job, and then what do you have to do you have done apart from your roles and responsibilities?

You can also mention these things in your career.

Please explain your roles and responsibilities to your previous organisation.

So directly is asking about the roles and responsibilities you can tell.

What?

What was the roles and responsibilities and what are the other parts you are doing apart from that?

Roles and responsibilities.

So you can mention those.

It will give a good you can say impression on the interviewer.

So have you underlined any sorry handle any big incident phishing email case in your career?

So let's say if you have investigated on any malware, if you investigate it on any big phishing email.

So you can mention those things here.

Right.

So let's say example candidate handle emotet malware campaigns, right?

So you will explain each and everything that how I detected, how he investigated step by step and how

and how he mitigated it.

Right.

Next question.

We have explained this incident in the form of cyber kill chain.

Okay.

We already have discussed this one.

Correct.

And in the cyber kill chain video, we have already discussed it.

What are the stages of incident management process?

So that is very simple.

You are doing this process in your daily routine.

That is incident identification, logging and categorization, incident notification and escalation

investigation, resolution, recovery, and then incident incident closer.

Next question, how you handle any alert.

So he's directly talking about that, the alert you are getting from SIM.

So please explain the process.

So you have to explain a whole process that how actually you handle and how actually you were working

on those incidents.

What is the event code for success and failure login.

So it's 46244, log in and 4625 is successful.

Log in 4462446254 fail along.

So you can you can check all all those event codes.

Maybe they will they will ask you different different codes regarding such as audit policy.

These are the things they can ask with certification you have done.

Let's say you if you have done the CE certification.

Right.

So you should know about the C is what exactly in that because they can ask any question.

Let's say they can ask you directly about the Wireshark.

They can ask about a map or different, different tools.

Okay, so what is the map?

So NPP stands for Network Maker Mapper, and we generally used it to scan a system and understand what

weakness exist that a hacker could potentially exploit through the NSA engine.

If you remember, we have used end map, right?

So as the program is open source and free, it is one of the most more common tool use for scanning

network for open ports and other weakness.

95th Question What is the difference between IOC and I?

We have discussed it.

Let's again discuss it.

So I see that is static, but I use that dynamic I which means indicator of attack so I, I can directly

say is for ADR and I use urgently for the malware whatever we are getting on daily routines.

Right.

The known signatures you can say.

What is the spear phishing?

So targeting a single person, targeting a single person in any organization or any anything else and

sending sending one of the phishing emails, doing the social engineering that is called spear phishing.

How you will do the analysis of phishing emails.

So take this course.

This is a free course, right?

And you can learn fishing email investigation from here.

This is totally free as of this video.

I'm making this video.

So as of now, it's free header analysis.

You can also learn from there.

Can you name support number.

So you should remember the important phone number such as 420 538944434 number 80.

Right.

So these are the basics.

But whatever the very on a daily basis, whatever you are, what number you are working on, you should

know those port numbers.

What is the LP?

We already have discussed it.

Right.

So I'm not discussing it.

The mag, SPF and the game.

Well, you can go through that free course.

You will get it.

But let me tell you some some some of the demo that what actually there are some small differences in

these t.

So Dmarc is domain based message authentication, reporting and confirmation is an email authentication

policy and reporting protocol basically dmarc and dmarc.

We have SPF and the DCMS.

So SPF, you know, SPF shows that the IP address, whatever, the domain, the IP addresses.

Related to that domain.

So it authenticated those things.

And Dkim having some domain keys identified, Mel.

It means.

It gives you can say it gives the integrity means that the content of the body is not changed.

So this is done by giving the email a digital signature.

So this is what DCMS do.

SPF means sender policy framework.

For more details, you can directly go jump to this free course and you can see there all those things.

How you will decide that on which alert you have to work first if there is 100.

Obviously, if if there is some some 100 alerts, there will be some some varieties like high critical,

medium low.

So obviously, I will choose a critical one, which is very critical for my network.

So I will choose that one and I will work on it firstly.

Why you want to leave your company.

That's a very you very big question always.

You will get this question always.

So you can tell I mean, you can think your answer your answer could be different from mine.

But what I what I just tell that I've learned a lot of things in my previous conversation.

I explore as much as I can.

So now I feel that I should move for a challenge and for a new responsibility so that I can grow more

and you can add more things, right?

So that so that it can give you a good impression to the interviewer.

What motivated you to come in this organization so you can say you have learned more things about that

organization and there is a learning, there is challenges and there is new responsibilities.

And that matches your profile.

So that's why these things motivated to come in that organization.

You can tell these things.

Do you have any questions to us?

Okay.

This is the last question.

Well, you can ask if you have any any such good question, then you must go with that.

But if you don't have, then I should suggest you don't ask any question if you don't have.

Right.

So that's it, guys.

We have this roles and responsibilities.

That was a very.

You know that the interview always asks these type of questions related to roles and responsibilities.

So these 105 questions is going to be a very is going to be very helpful for you.

As for our sample, we have taken 50 interviews sample.

And these were the repeated questions we were getting.