Expert · Careers and certifications · topic 43 of 43 · 35 min
Interviews, CVs and honest salary expectations
Explanation
What interviewers look for
For entry roles, interviewers do not expect you to know everything. They check three things: do you have solid basics, can you think through a problem calmly, and can you explain clearly? Honest "I do not know, but here is how I would find out" beats a confident wrong answer.
Questions you should be ready for
| Question | What a good answer covers |
|---|---|
| What is the CIA triad? | Confidentiality, integrity, availability, with one example each |
| Explain the TCP three-way handshake. | SYN, SYN-ACK, ACK; how scans and SYN floods show up |
| Which ports are 22, 53, 443, 445 and 3389? | SSH, DNS, HTTPS, SMB, RDP, and why 445 and 3389 should not face the internet |
| What do Event IDs 4624 and 4625 mean? | Successful and failed logon; logon types 2, 3 and 10 |
| Hashing versus encryption? | Hashing is one-way (integrity, passwords with salt); encryption is two-way with a key (confidentiality) |
| What is a SIEM? Which have you used? | Collect, normalise, correlate, alert; name the one in your lab |
| Walk me through how you would handle a reported phishing email. | Headers, SPF/DKIM/DMARC, links and attachments safely, who else received it, purge, block, reset clickers |
| What are the phases of incident response? | NIST: preparation; detection and analysis; containment, eradication and recovery; post-incident activity |
| True positive vs false positive? | Definitions plus how you would tune a noisy rule |
| What is MITRE ATT&CK? | Tactics as goals, techniques as methods, an example ID |
| What do you do if you do not know the answer at 3 am? | Follow the playbook, escalate with evidence, never guess silently |
Scenario answers: think aloud
For scenario questions, structure matters more than the perfect answer. Say what you would check first and why, what evidence would change your mind, and when you would escalate. For behaviour questions ("tell me about a time you…"), use STAR: Situation, Task, Action, Result.
Q: You see 500 failed logons (4625) for many users from one internal IP, then one success.
A: First, I identify the source IP: which machine and owner. Second, I check the logon type
and Sub Status: many "user does not exist" suggests spraying. Third, I look at the account
that succeeded: what did it do next (4672, 4720, 4732, new processes)? If it looks malicious,
I escalate as high severity with the evidence and recommend isolating the source machine
and disabling the account, following the playbook.Your CV
- One page for freshers. Plain format that applicant tracking systems can read.
- A skills line with real tools you have used (Wireshark, Wazuh, Sysmon, Python, KQL basics).
- Projects section with links to your write-ups and GitHub.
- Certifications with the exact name and exam code where relevant (for example "CompTIA Security+ (SY0-701)").
- No exaggeration: anything on your CV can become an interview question.
Honest salary expectations in India
Salaries vary a lot by city (Bengaluru, Hyderabad, Pune, NCR and Mumbai usually pay more), company type (product companies and GCCs usually pay more than smaller service firms), shift allowances, and your skills. Rough ranges, as a guide only:
| Role and experience | Typical annual CTC (approximate) |
|---|---|
| SOC analyst L1, fresher | ₹3–8 LPA (many offers around ₹4–6 LPA) |
| SOC L2 / incident responder, 2–5 years | ₹7–18 LPA |
| Security engineer / cloud security, 3–6 years | ₹12–30 LPA |
| Senior roles, architects, managers | Higher, very wide range |
LPA means lakh per annum. CTC (cost to company) includes items you do not receive monthly in hand, such as provident fund contributions and variable pay. Ask for the in-hand amount and shift allowance in writing.
Avoiding job scams
- No genuine employer asks you to pay for an interview, training, a laptop or a "security deposit".
- Check the company domain of the recruiter's email and look up the company independently.
- Be careful with "work from home, earn ₹50,000 a week" offers; many are task scams.
Common mistakes
- Memorising definitions without examples.
- Saying "I would just block the IP" without checking evidence or impact.
- Talking down about previous employers or teammates.
- Not preparing questions for the interviewer (ask about shifts, training, and what L1 analysts do in a typical week).
Need help?
Stuck on a word or an idea? Search this course, or every course, and jump straight to the explanation or a worked question.
Try:
Watch the lesson
Interviews, CVs and honest salary expectations · 1/7
Interviews test basics, calm thinking, and clear explanation.
Prefer a video by a teacher? Find free videos on “SOC analyst interview questions and answers for freshers” on YouTube ↗
In real life: Two candidates, one question
Asked "How would you handle a reported phishing email?", candidate A says "I would block it." Candidate B explains: get the original with headers, check SPF/DKIM/DMARC, examine links in a sandbox, search who else received or clicked it, purge it, block the domain, reset any entered passwords, and close with a note. Both are freshers; B gets the offer at ₹5.2 LPA plus night-shift allowance, because B showed a process.
Practice (0/3 done)
In an interview you do not know an answer. What is best?
Write your answers (5–8 lines each) to: "Explain the CIA triad with examples", "What is the difference between 4624 and 4625?", and "Walk me through a phishing investigation". Then say them aloud and time yourself (2 minutes each).
Write a one-page CV for a SOC L1 role using only true information: summary, skills, projects (with links to your lab write-ups), certifications (exact names), education.
Quick quiz
Read more (free)
Related help
Before this, learn
This topic builds on these. If something here feels new, open them first.
Related topics
- Certifications: what, when and whyCareers and certifications · same module
- Career paths in cyber securityCareers and certifications · same module
- DevOps careers and interviews in IndiaDevOps: Git, Docker, Kubernetes and CI/CD · GitOps, platform engineering and DevOps careers
- Cloud roles, salaries and interviews in IndiaCloud Computing (AWS, Azure, Google Cloud) · Certifications and cloud careers
- Careers, salaries in India and your next stepsLinux and Red Hat (RHCSA to RHCE) · Certifications and career
- Networking careers in India and beyondComputer Networking (CCNA level) · Troubleshooting and the CCNA exam
Questions people ask about this
Open a question to see the answer and why. The first ones are this topic's own quiz, so try the quiz above before you peek.
What does STAR stand for in behavioural interviews?
Answer: Situation, Task, Action, Result
STAR structures a story about something you did.
What is a realistic fresher SOC L1 salary range in India?
Answer: Roughly ₹3–8 LPA, varying by city and company
Most fresher SOC offers fall in this broad range.
CTC means…
Answer: Cost to company, which includes items not paid monthly in hand
Ask for the in-hand figure separately.
A recruiter asks for a ₹15,000 "laptop deposit" before the offer letter. What is it most likely?
Answer: A job scam
Genuine employers do not take money from candidates.
Which answer to "an alert shows 500 failed logons then a success" is strongest?
Answer: Identify the source, check logon types and status codes, check what the successful account did, escalate with evidence
A structured, evidence-based process is what interviewers want.
In an interview, you are asked about a tool you have never used. What is the best response?Related
Answer: Say you have not used it, and explain how you would learn it or what similar tool you know
Honesty plus a clear learning approach builds trust; guessing is easy to spot.
Which is an honest salary range for freshers in cloud support or associate roles in India?Related
Answer: About ₹3.5–7 LPA, varying by city, company and skills
Fresher pay commonly falls in this range; product companies and some GCCs pay more, and it varies widely.
Which statement about salaries is most honest?Related
Answer: Pay ranges vary widely by city, company type, skills and interviews
Ranges are guides, not promises.
Which is an honest typical range for a fresher NOC L1 engineer in India?Related
Answer: About ₹2.5–5 LPA
Fresher NOC salaries are usually modest, around ₹2.5–5 LPA, and vary by city and company.
Pass the quiz (60% or more) or mark this topic as done when you are ready.
Your progress is saved on this device only.
Next steps
- This is the last topic of “Careers and certifications”. The module exam comes next.
- Module 10 exam: Careers and certifications · 11 questions · 15 min, without help. 4 topics of this module still to finish first.
- 43 topics left in the course before the final exam.