Walmart prep Campus Grad Cybersecurity

Start2,783 words, about 14 min

Master checklist

Source: JD walmart/JD_Campus Grad_Cybersecurity.pdf + Resume walmart/walmart-cybersecurity-intern.pdf + online research (Walmart Global Tech India loops 2024-2026, cybersecurity intern Qs, AI-security Qs)

0. Interview Loop To Expect

  • OA (90 min, HackerEarth/HackerRank): aptitude + CS MCQs + 2-3 DSA
  • Technical 1 (45-60 min): intro + CS fundamentals + 1-2 DSA live coding
  • Technical 2 (45-60 min): resume deep-dive + security domain scenarios + design
  • HR / Hiring Manager (20-30 min): STAR behavioral + Why Walmart + logistics

1. Networking (JD: TCP/IP, firewalls, VPNs, IDS/IPS)

  • OSI 7 layers + TCP/IP 4 layers, encapsulation, mnemonic
  • TCP 3-way handshake (SYN, SYN-ACK, ACK), sequence/ack numbers, 4-way teardown (FIN/RST)
  • TCP vs UDP - reliability, ordering, speed, use cases (video, DNS, email)
  • IP, IPv4 vs IPv6, subnetting, CIDR, NAT, private vs public IP
  • ARP - how it works, ARP spoofing / poisoning
  • DHCP, ICMP (ping/traceroute), how traceroute works
  • DNS - recursive vs authoritative, A/AAAA/CNAME/MX/TXT records, resolution flow
  • DNS attacks: spoofing, cache poisoning, tunneling (long random subdomains), exfil via DNS
  • DNS monitoring - why SOC cares, what to log
  • HTTP/HTTPS, methods, status codes, headers, cookies, sessions
  • TLS handshake (1.2 vs 1.3), certificates, CA, HSTS, cipher suites, weak ciphers / TLS 1.0/1.1
  • SSH - how it works, key auth vs password, sshd hardening
  • FTP, SMTP, SMB, RDP, LDAP - what they do + default ports
  • Top 30 ports memorize: 21 FTP, 22 SSH, 23 Telnet, 25 SMTP, 53 DNS, 67/68 DHCP, 69 TFTP, 80 HTTP, 110 POP3, 143 IMAP, 443 HTTPS, 445 SMB, 3306 MySQL, 5432 Postgres, 6379 Redis, 3389 RDP, 8080 alt-HTTP, 27017 Mongo
  • Firewall: stateless vs stateful, NGFW, WAF (what it adds: SQLi/XSS inspection at L7)
  • Firewall rule review: overly broad rules, shadowed rules, management ports open to users, missing log on deny
  • IDS vs IPS vs SIEM vs SOAR vs EDR - signature vs anomaly vs heuristic
  • VPN: IPsec vs SSL VPN, site-to-site vs remote access, tunneling concept
  • VLANs, network segmentation - purpose (limit lateral movement), how to prove it works (scan/flow logs per zone)
  • Zero Trust principles - never trust always verify, least privilege per request
  • Proxy vs reverse proxy, load balancer, NAT gateway
  • Attacks: MITM, SYN flood, DDoS L3/L4 vs L7, IP spoofing, replay attacks
  • Wireshark: display filters, follow TCP stream, spot cleartext creds, DNS tunneling, anomalous destinations
  • Nmap: -sS/-sT/-sU/-sV/-O/-A, NSE scripts, when to use each
  • tcpdump, netstat/ss, basic pcap reading task
  • Classic: "What happens when you type google.com in browser?" - full DNS > TCP > TLS > HTTP > render answer
  • Hub vs switch vs router

2. Cryptography, Authentication, Access Control (JD: basics)

  • Symmetric (AES, ChaCha20, DES/3DES) vs Asymmetric (RSA, ECC, DH) - speed, key sizes, use cases
  • RSA high-level math, Diffie-Hellman key exchange
  • Hashing (MD5, SHA-1, SHA-256) vs encryption - one-way, salting, rainbow tables, bcrypt/Argon2 for passwords
  • Digital signatures - how sign + verify works
  • PKI: CA, intermediate, chain of trust, trust store, cert expiry outages, revocation CRL/OCSP, auto-renewal
  • TLS/SSL: why SSL deprecated, TLS 1.2 vs 1.3 differences
  • Authentication factors, MFA/2FA, TOTP, biometrics, passwordless
  • Kerberos: TGT + service tickets, domain controller role, Kerberoasting / AS-REP roasting / golden ticket
  • OAuth2 flows, OpenID Connect, SAML high-level
  • JWT: header.payload.signature, attacks (alg=none, weak secret brute force, no expiry), how to secure
  • Sessions: session fixation, hijacking, secure/HttpOnly/SameSite cookies, timeout, rotation
  • Authorization: RBAC vs ABAC, least privilege, privileged access management (PAM), just-in-time access
  • Password storage: salt + pepper + slow hash, credential stuffing vs brute force vs dictionary
  • Non-repudiation, CIA triad (Confidentiality, Integrity, Availability) + AAA

3. Linux / Windows System Security (JD: familiarity)

  • Linux permissions: rwx, chmod/chown/chgrp, user/group/other, SUID/SGID/sticky bit, find SUID files
  • Users/groups, sudoers, disabling root login, SSH key auth
  • sshd_config hardening: PermitRootLogin no, PasswordAuthentication no, port change, allow-users
  • Systemd, cron, package updates, minimal install principle
  • Logs: /var/log/auth.log, syslog, auditd, how to grep for brute force
  • iptables/nftables basics, ufw
  • File integrity monitoring, fail2ban, EDR agents
  • "How would you secure a fresh server?" - update, remove unused services/ports, firewall, SSH keys, logging, backups, AV/EDR, CIS benchmark
  • CIS Benchmarks - what they are, hardening vs patching difference
  • Windows: AD, Group Policy, what weakens domain (WDigest, LLMNR, SMBv1, local admin sprawl)
  • Pass-the-Hash, Mimikatz high-level, LSA protection
  • Event Logs, Sysmon, PowerShell logging
  • Common commands: ps, lsof, netstat, ss, tcpdump, grep, awk, find, systemctl
  • Container isolation: namespaces, cgroups, seccomp, Docker escape risks (privileged, socket mount)

4. OWASP Top 10 + Web App Security (JD: knowledge of OWASP Top 10, Burp Suite)

  • OWASP Top 10 2021 - name all 10 with example + fix
  • A01 Broken Access Control: IDOR, path traversal, missing checks - prevention (deny by default, per-object checks)
  • A02 Cryptographic Failures: cleartext, weak hashing, missing TLS
  • A03 Injection: SQLi (error/union/blind/time-based), XSS (stored/reflected/DOM), command injection, SSTI, LDAP/XPath injection
  • SQLi prevention: parameterized queries / prepared statements / ORM (sqlc), least-priv DB user, WAF as layer only
  • XSS prevention: output encoding, CSP, HttpOnly, input validation
  • A04 Insecure Design: threat modeling, secure design patterns, rate limiting
  • A05 Misconfiguration: default creds, verbose errors, directory listing, unnecessary features
  • A06 Vulnerable Components: SBOM, dependency scanning (Dependabot, Snyk), Log4j lesson
  • A07 Auth Failures: brute force, credential stuffing, weak session, MFA bypass
  • A08 Integrity Failures: insecure deserialization, unsigned updates, CI/CD tampering
  • A09 Logging Failures: what to log (auth, access, input validation failures) + what NOT to log (passwords, PII)
  • A10 SSRF: what it is, cloud metadata 169.254.169.254, allow-list + egress filtering
  • CSRF: SameSite cookies, CSRF tokens
  • SOP, CORS (misconfig * + credentials), CSP directives, HSTS, X-Frame-Options / clickjacking
  • File upload vulns: extension bypass, MIME check, store outside webroot, scan
  • Rate limiting, account lockout, CAPTCHA tradeoffs
  • Secrets in code: env vars, vaults, git history scanning, pre-commit hooks
  • Burp Suite: proxy, repeater, intruder, sequencer, how to test login/search flow
  • API security: BOLA/IDOR, excessive data exposure, mass assignment, JWT issues (OWASP API Top 10 high-level)

5. Vulnerability Assessment, Pentesting, SOC, Incident Response, Threat Hunting (JD responsibilities)

  • VA vs pentest: automated scan (Nessus/OpenVAS) vs manual exploit chain
  • Pentest phases: recon, scanning/enumeration, exploitation, post-exploitation, reporting (PTES)
  • Recon: OSINT, subdomains, whois, Google dorks, Shodan
  • Scanning/enumeration: Nmap, gobuster/ffuf, Nikto, Nessus
  • Exploitation: Metasploit basics, manual PoC, privilege escalation (Linux/Windows)
  • CVSS scoring: base metrics, severity levels, how to prioritize
  • Cyber Kill Chain (recon > weaponize > deliver > exploit > install > C2 > actions) + MITRE ATT&CK tactics
  • SOC tiers L1/L2/L3, SOC workflow: alert > triage > investigate > contain/escalate > close
  • SIEM: Splunk (SPL search, correlation rules), ELK, Sentinel - log sources (firewall, endpoint, AD, cloud)
  • True positive vs false positive tuning, alert fatigue, risk-ranked queues
  • SOAR playbooks, automation of enrichment + containment
  • IR lifecycle (NIST/SANS): Prepare > Detect/Analyze > Contain > Eradicate > Recover > Lessons Learned
  • Containment: short-term (isolate host, block IP) vs long-term (patch, reset creds)
  • Evidence handling: chain of custody, disk/memory image, order of volatility
  • Threat hunting: hypothesis-driven, IOCs vs IOAs vs TTPs, threat intel feeds, Sigma rules
  • Malware analysis: static (strings, hashes, VT, PE headers) vs dynamic (sandbox, procmon, wireshark)
  • YARA rules high-level, hashes (MD5/SHA256) for intel
  • Forensics: Autopsy/ProDiscover basics, file carving, deleted recovery, timeline analysis
  • Reverse engineering: Ghidra/GDB basics, x86 registers/stack, buffer overflow high-level, strings + decompiler flow
  • Scenario: "PC slow + beaconing to unknown IP" - isolate, pcap, DNS/process tree, block C2, reimage, hunt laterally
  • Scenario: "Zero-day disclosed in prod library" - inventory, assess exposure, WAF/virtual patch, patch, monitor
  • Scenario: "Phishing mail clicked by employee" - reset creds, revoke sessions, check mailbox rules/forwarding, hunt
  • Scenario: "Ransomware alert at 2am" - isolate, preserve logs, escalate, no ransom without approval
  • Tools: Wireshark, Nmap, Burp, Splunk, Metasploit, Nessus, Autopsy - what each is used for

6. Security Engineering Design + Automation (JD: design security solution, automation scripts)

  • Design secure 3-tier web app: WAF/LB at edge > app in private subnet > DB isolated, tight SGs, bastion, central logging
  • Design monitoring for N hosts: agents > pipeline (Splunk/ELK) > detection rules > alerting > SOAR
  • Secure API design: auth, rate limiting, validation, audit logging, versioning
  • Secrets management: vault, rotation, no hardcode, env scoping
  • Shift-left: SAST/DAST in CI (GitHub Actions), dependency scan, coverage gates
  • Python scripting: log parser, port scanner, hash checker, phishing URL features, Splunk API calls
  • Libraries: requests, re, subprocess, socket, scapy, hashlib, argparse
  • Bash basics: grep/awk/sed, cron jobs for monitoring
  • Detection-as-code: Sigma rules, Splunk SPL, how finding becomes rule + test for FP
  • Retail-scale thinking (Walmart): cart/checkout what breaks if stock hits zero, inventory low-stock alerts, ETA/assignment, search ranking - plain explanations

7. Programming + DSA + CS Fundamentals (JD: Python/C/C++/Java, Walmart OA/tech rounds)

  • Python fluency: strings, dicts, lists, OOP, file handling, requests
  • C/C++/Java/Go basics: call by value vs reference, pointers (C), memory management
  • OOP: abstraction, encapsulation, inheritance, polymorphism + live code example (Shape/Rectangle/Square)
  • Virtual functions, static vs dynamic binding, pure virtual/abstract
  • DSA patterns: arrays/strings, hashing, two pointers, intervals merge, stack/queue, heap Top-K, BFS/DFS grid, trees, binary search, DP basics
  • Practice: implement stack using queues, merge free slots for N users, min distance between tree nodes, right-shift subarray queries
  • Time/space complexity, edge cases, narrate brute > optimize
  • OS: processes vs threads, paging + logical vs physical address, segmentation, page replacement FIFO/LRU, interrupts, deadlock, scheduling
  • DBMS: normalization 1NF/2NF/3NF/BCNF + functional dependency, SQL vs NoSQL, indexes, transactions ACID, JOINs
  • OOP + OS + CN + DBMS MCQs for OA
  • Secure coding: input validation, parameterized SQL, output encoding, auth checks, error handling without info leak
  • Git, Docker, CI (GitHub Actions), basic system design (load balancer, cache, queue)

8. AI/ML Basics for Security (JD: TensorFlow/PyTorch/Scikit-learn, classification/anomaly/pattern)

  • Supervised vs unsupervised vs RL - definitions + security examples (malware/phishing vs UEBA/clustering vs red-team agents)
  • Classification for security: malware benign vs malicious, phishing vs legit - need labeled data drawback
  • Anomaly detection: Isolation Forest, Autoencoders, clustering, UEBA - finds novel threats, harder to validate
  • Metrics for imbalanced data: precision, recall, F1, ROC-AUC - why accuracy lies (99.9% still floods SOC)
  • False positive economics: TP=0.99100=99, FP=0.01999900=9999, precision ~1% math
  • Overfitting/underfitting, bias-variance tradeoff in security models
  • Train/test drift, baseline poisoning (gradual ramp absorbs into baseline)
  • Feature engineering for logs: time windows, behavioral profiles, statistical aggregations
  • PyTorch/Scikit-learn basics: tensors, training loop, train/val split, XGBoost/Random Forest when to use
  • Model pipeline: ingest (Splunk/Elastic) > features > model (supervised + unsupervised + sequence LSTM/Transformer) > scored alerts + SHAP > analyst feedback retrain loop
  • Production tools: Splunk MLTK, Sentinel UEBA, Darktrace, Vectra - what they do

9. AI/ML Use Cases (JD: anomaly, phishing, malware, fraud)

  • Anomaly detection architecture: data sources, features, model choices, alert layer, feedback loop
  • Phishing detection: URL lexical features, NLP on body, header auth SPF/DKIM/DMARC, why AI phishing has no typos (detect urgency+authority+secrecy, verify out-of-band)
  • Malware classification: byte n-grams, API sequences, evasion via FGSM x_adv = x + eps*sign(grad)
  • Fraud detection: black-box probing across ranges, evasion via behavior shaping
  • "Anomalous != malicious" - need human + context, threshold tuning concept, z-score fails on zero variance
  • How to evaluate: reduce benign denominator to raise precision, stack signals, risk-rank

10. LLM / GenAI Security - Core Differentiator (maps to Siege project)

  • OWASP LLM Top 10 2025 memorize: LLM01 Prompt Injection, Sensitive Disclosure, Supply Chain, Data/Model Poisoning, Improper Output Handling, Excessive Agency, System Prompt Leakage, Vector/Embedding Weaknesses, Misinformation, Unbounded Consumption
  • Prompt injection: direct (ignore previous instructions) vs indirect (hidden in RAG docs/web/emails)
  • Why wordlist/blocklist never fixes injection: paraphrase, base64/leet/other languages, multi-turn split, semantic not lexical
  • Real defence layers: separate trusted instructions vs untrusted data, tag/quarantine RAG, least-privilege tools, output schema validation, human approval for high-impact, guardrails as layer only
  • RAG risks: doc poisoning, cross-tenant leakage (per-user scoping + row-level ACLs), vector DB poisoning, metadata prompt manipulation, cost exhaustion DoS, hallucinated attribution
  • RAG defence: provenance tracking, sanitise retrieved chunks, anomaly on retrieved vectors, per-role retrieval, output validation
  • Excessive agency: constrained tools + allow-list + human-in-loop removes blast radius
  • System prompt leakage: why it matters, how to probe, how to mitigate
  • Insecure plugin/tool design, overreliance, unbounded consumption (DoS via expensive inference)
  • Adversarial ML 4 families: evasion, poisoning, extraction, inversion/membership inference
  • MITRE ATLAS (14 tactics for ML) vs ATT&CK (classic IT) - when to cite which
  • Model extraction: systematic boundary probing from few accounts at high rate - defend via quotas, anomaly, coarse outputs, watermarking
  • Red-team methodology: recon (model type/context) > bypass (role-play, encoding, overflow) > extraction (system prompt/training/customer data) > tool abuse > reasoning drift (false premises, multi-turn) - document chain + severity + impact + fix
  • Automated jailbreaks: GCG (gradient suffix), PAIR (attacker LLM refines), TAP (tree+pruning) - 80%+ ASR, transferable, why one-time testing is obsolete
  • Tools: Garak (offensive scanner) vs NeMo Guardrails (runtime defence, Block not log-only) vs PyRIT (Microsoft red-team automation)
  • MLSecOps: data provenance, signed datasets, model signing, SBOM, notebook secret hygiene, pipeline stages as attack surface
  • MCP risks (2026 hot): tool poisoning via description/metadata, rogue server shadowing trusted tool, exfil via tool outputs - defences: pin/allow-list + sign servers, treat metadata as untrusted + alert on change, least-privilege per server, sandbox/isolate, human approval, log every invocation, OWASP MCP Top 10
  • Logging for LLM: prompt + retrieved context + tool calls/args/results + output + guardrail verdict + tenant/request ID (PII minimised) - alerts: injection hits, denied tool calls, system prompt reads, anomalous sequences, extraction rate spikes
  • IR for AI: Detect > Contain (kill session/revoke tool creds/throttle) > Eradicate (rotate keys, quarantine doc, rollback to signed model) > Recover > Lessons (regression probe)
  • Governance: NIST AI RMF (Govern, Map, Measure, Manage + GenAI Profile 600-1), EU AI Act tiers (unacceptable/high/limited/minimal), red-team before launch + continuous
  • Microsoft AI Red Team learnings: context harms (bias/manipulation) not just CIA, cross-disciplinary, iterative

11. Resume Defence - Be Ready To Whiteboard Every Bullet

  • Siege (QNU Labs, Go): 4 delivery channels, attack-graph executor for chained multi-turn, 19 technique catalog, MCP interception proxy, detection-rule drafts - demo flow + tradeoffs + what you'd rebuild
  • Cross-tenant session takeover fix: root cause (keying), (pool,uid) fix, fail-closed UID resolution, regression tests - explain IDOR analogy
  • Aidan observability: request logging, admin failed-run views, retention - how it cuts MTTR, PII in logs?
  • Xlancr Redis/FastAPI cache: 50% cost/latency cut, layers, invalidation, 70% coverage via Actions
  • PeerWatch P2P: full-mesh TCP, custom binary protocol (10 types), 512KB SHA-256 chunks - why TCP, NAT, integrity, how you'd secure/encrypt it
  • Coding platform: Judge0 sandbox isolation, Asynq queue, Gin, sqlc, 600+ users - abuse cases (fork bomb, crypto miner, SSRF), timeouts, resource limits
  • Gravitas payment: Redis Sorted Sets seat-hold, race condition fix, transaction leak on all paths (pool exhaustion), 3M visits / 50L INR / zero downtime, admin dashboards -95% tickets
  • CookOff portal: 5-member team, 15k evals, 200/min peak, <10s verdicts - auth, queue, hardest bug
  • CTF 2nd place: Ghidra/GDB challenges, exact techniques used, buffer overflow/static analysis story
  • Skills table: Go/Rust/TS/SQL, Flask/Django/NestJS, Postgres/Mongo/Redis/DuckDB, Docker/Linux/Actions - one-line depth per tool
  • Links live: GitHub demos, portfolio sophic.dev ready to screen-share
  • NIST CSF, ISO 27001, CIS Controls, PCI-DSS (Walmart payments), HIPAA/GDPR basics
  • Security+ / CEH / OSCP / AI-DS certs - what each covers (even if you don't hold them)
  • Recent: Log4j pattern, supply chain, ransomware, zero-day playbook, CVEs to cite
  • AI in SOC: UEBA/SOAR/LLM triage pros/cons
  • Walmart research: Fortune 1 retail tech, supply chain innovation, Global Tech India (Bengaluru/Chennai), recent tech blog posts
  • Walmart Career Roadmap Cybersecurity: intern vs campus FT expectations

13. Behavioral / HR (Walmart loves STAR + numbers)

  • Tell me about yourself (60-90 sec, InfoSec + AI security hook)
  • Hardest problem solved + why hard
  • Vulnerability found and remediated (use session takeover / race condition / leak)
  • Slipping deadline, disagreeing stakeholder, ambiguous request stories
  • Failure / what you'd do differently per project
  • Leadership, teamwork (5-member team, coordinator roles), ownership
  • Why Walmart? Why cybersecurity? Why AI security? Where do you learn news (labs, CTFs, blogs)?
  • Strength/weakness with proof, future plans, MS or not, relocation comfort
  • 2 smart questions to ask: SOC stack? How red-team findings ship to prod? Intern conversion?
  • STAR format + exact numbers/dates/outcomes - no vague answers
Saved in this browser only.
Next fileNetworking