Skip to main content

How Networking & OS Fundamentals Are Tested

Premium

Network activity is the backbone of almost every intrusion. Without understanding how connections are made, authenticated, and maintained, you can’t reliably identify malicious traffic or exfiltration.

Thus, network fundamentals are core to every SOC interview. Even if you specialize in SIEM or endpoint analysis, your ability to interpret packet data and explain common protocols will be tested. Interviewers use these questions to see whether you can reason about what’s happening on the wire when alerts fire.

SOC interviews often use basic TCP/IP, DNS, and HTTP questions to test how you think about:

  • Communication flow (client, server, ports).
  • Normal versus suspicious behavior.
  • Evidence you’d gather from packet captures or logs.
Protocol areaExample questionWhat it tests
TCP/IP“What’s the difference between TCP and UDP?”Your ability to explain reliability and connection setup
DNS“Why might an attacker use DNS for command and control?”Understanding of tunneling and protocol abuse
HTTP“How could you tell if a download request was suspicious?”Awareness of methods, headers, and patterns

TCP/IP

TCP is connection-oriented and reliable. Attacks often exploit open ports or manipulate connection states.

UDP is faster and connectionless. Used in DNS and streaming, but harder to monitor for anomalies.

Common Indicators:

  • Unexpected open ports.
  • Frequent SYN packets without completion (possible scans).
  • Internal systems initiating unusual outbound connections.

DNS

DNS is a frequent attacker channel because it’s often unmonitored and rarely blocked.

ObservationPossible meaning
Long, random subdomainsPossible data exfiltration or tunneling
High frequency of lookups to new domainsMalware beaconing
Domains created recentlyPotential staging or phishing
Queries for uncommon record types (TXT, NULL)Command and control signaling

When answering DNS questions, explain both what you’d look for and why it matters operationally.

HTTP

HTTP traffic provides context for downloads, uploads, and API calls.

Key indicatorInvestigation clue
GET requests for executable filesFile delivery or drive-by download
POST requests with large payloadsData exfiltration or C2 beaconing
Suspicious user-agentsNonstandard tools or scripts
HTTP over nonstandard portsEvasion or misconfiguration

Interviewers appreciate concise reasoning. Instead of listing every header, describe how you’d decide if traffic is normal or risky.

Putting it all together

In practice, security analysts correlate these signals. For example:

  1. TCP connection spike to an unknown IP.
  2. DNS queries for random subdomains.
  3. HTTP POST requests to that IP.

Explaining this chain demonstrates that you can move from raw telemetry to attack narrative.

Next Lesson