SOC Analyst Interview Questions & Answers

1. What is the role of a SOC Analyst?

Answer:
A SOC Analyst monitors, detects, analyzes, and responds to security incidents within an
organization. Their core responsibilities include triaging alerts, investigating anomalies,
performing threat hunting, escalating critical incidents, and improving detection
capabilities. They ensure threats are identified early and mitigated to protect the
organization’s systems and data.

2. What is the difference between an event, alert, and

incident?
Answer:

 Event: Any observable occurrence in a system or network. (e.g., user login)

 Alert: A notification generated by a tool (SIEM, EDR, etc.) indicating a potential
security issue.
 Incident: A confirmed security breach or policy violation that requires response.

3. What is a SIEM? Name some popular SIEM tools.

Answer:
A Security Information and Event Management (SIEM) system collects, correlates, and
analyzes logs from multiple sources to identify potential threats. It is the primary tool in
a SOC.

Examples:

 Splunk
 Microsoft Sentinel
 IBM QRadar
 Elastic SIEM
 ArcSight

4. How do you triage a security alert?

Answer:

1. Validate the alert – check if it’s a true positive or false positive.

2. Gather context – user, host, IP, geolocation, processes, recent activity.
3. Analyze indicators – check IOCs in threat intelligence feeds.
4. Assess severity – determine impact and likelihood.
5. Take action – isolate host, reset credentials, block IP, etc.
6. Document findings – evidence, steps taken, and escalation.

5. What is the MITRE ATT&CK framework?

Answer:
MITRE ATT&CK is a globally used framework outlining the techniques, tactics, and
procedures (TTPs) used by attackers. It helps SOC teams classify attacks, create
detections, and improve threat hunting.

6. Explain False Positive vs False Negative.

Answer:

 False Positive: A benign activity flagged as malicious.

 False Negative: A real threat that goes undetected—this is more dangerous.

7. What are Indicators of Compromise (IOCs)?

Answer:
IOCs are forensic artifacts that indicate malicious activity, such as:

 Malicious IPs/domains
 Hashes of malware files
 Suspicious registry changes
 Unusual outbound traffic

8. What is Threat Hunting?

Answer:
Threat hunting is a proactive process where analysts search for hidden threats in the
environment using hypotheses based on threat intelligence, attacker behavior, or
anomalies in logs.

9. What steps do you take when detecting malware on a

workstation?
Answer:

1. Isolate the system from the network.

2. Collect system information (processes, connections, autoruns).
3. Analyze suspicious files or processes.
4. Run EDR or antivirus scans.
5. Remove malware and patch vulnerabilities.
6. Review logs to determine spread or impact.
7. Document and escalate if needed.

10. Explain the difference between IDS and IPS.

Answer:IDS (Intrusion Detection System): Detects and alerts on malicious activity.

 IPS (Intrusion Prevention System): Detects and actively blocks malicious

activity.

11. What are common stages of the Cyber Kill Chain?

Answer:

1. Reconnaissance
2. Weaponization
3. Delivery
4. Exploitation
5. Installation
6. Command & Control
7. Actions on Objectives

12. Describe a time you handled a high-severity incident.

Answer (sample):
"I identified unusual outbound traffic to a suspicious IP flagged by the SIEM. I validated
it through threat intelligence and found it associated with C2 activity. I isolated the
endpoint, collected memory dumps, escalated to Tier 3 for forensic analysis, and assisted
in blocking the IP across the firewall. I created a detailed incident report and added new
detection rules to prevent reoccurrence."

13. What is lateral movement, and how do you detect it?

Answer:
Lateral movement is when attackers move inside a network after initial compromise.

Detection involves:

 Monitoring remote service usage (RDP, SMB)

 Alerting on credential dumping tools
 Reviewing unusual admin account activity
 Checking for abnormal login patterns across hosts

14. What tools does a SOC Analyst commonly use?

Answer:

 SIEM: Splunk, Sentinel

 EDR: CrowdStrike, Defender ATP, Carbon Black
 Network Monitoring: Wireshark, Zeek
 Threat Intel: VirusTotal, AlienVault OTX
 Forensics: Autopsy, FTK Imager

15. How do you stay updated on cybersecurity threats?

Answer:
Following threat intel blogs (Krebs, Cisco Talos), subscribing to feeds (MITRE, CISA),
staying active in cybersecurity communities, using OSINT tools, and participating in
training or labs (TryHackMe, HTB).
1. Scenario: Multiple failed logins followed by a successful
login
You see several failed login attempts to an admin account from a foreign IP, and then a
successful login. What do you do?

Answer:

1. Validate the alert:

o Check if the IP is known or malicious using VirusTotal/OTX.
o Confirm timestamp and geolocation anomalies.
2. Check user activity:
o Review recent login locations.
o Verify if the user is traveling.
o Check MFA logs.
3. Contain if suspicious:
o Force logout of the session.
o Reset account credentials.
o Block IP on the firewall.
4. Investigate deeper:
o Review access logs for privilege use.
o Check for lateral movement or unusual commands.
5. Escalate if needed and document everything.

Reasoning:
Failed logins → brute force attempt.
Successful login → potential account compromise.

2. Scenario: Endpoint shows PowerShell spawning from Word

Your EDR shows [Link] spawning a PowerShell script. What does this indicate?

Answer:
This is a classic sign of a macro-based malware attack.

Steps to take:

1. Analyze the PowerShell command (decode base64 if present).

2. Check parent-child process tree — confirm Word → PowerShell.
3. Quarantine the host to stop execution.
4. Search for IOCs:
o Dropped files
o Suspicious registry changes
o Scheduled tasks
5. Check email logs for the malicious attachment.
6. Block the sender domain if phishing is confirmed.

Reasoning:
Legitimate Word usage rarely triggers PowerShell.
This is typically malware delivery (Emotet, TrickBot, etc.)
3. Scenario: Outbound connection to a known C2 domain
Your SIEM flags a workstation communicating with a known malware command-and-
control server.

Answer:

1. Immediately isolate the host.

2. Pull network and EDR telemetry for:
o Processes contacting the domain
o Persistence mechanisms
o Suspicious executables
3. Check DNS logs to see if other devices resolved the domain.
4. Scan the host using EDR/AV.
5. Collect forensic artifacts (autoruns, network connections).
6. Block the domain and associated IPs.
7. Hunt for similar activity across the environment.

4. Scenario: User reports ransomware screen on their PC

What do you do first?

Answer:

1. Isolate the machine from the network (pull network cable).

2. Preserve volatile data (don’t reboot).
3. Check for encryption activity on file shares.
4. Identify ransomware family using ransom note & hashes.
5. Search for lateral movement:
o New admin accounts
o PSExec usage
o Shadow copy deletion
6. Escalate to IR team for full containment.

5. Scenario: Suspicious VPN login at 3 AM

User logs in from another country at 3 AM — not normal.

Answer:

1. Verify whether the user was awake/traveling.

2. Check MFA activity:
o If bypassed → compromised.
3. Review:
o What resources were accessed?
o Any privilege escalation?
4. Reset credentials and invalidate tokens.
5. Block the IP and scan the endpoint.
🔍 LOG-BASED SCENARIO QUESTIONS & ANSWERS
6. Log Scenario: You see this in your SIEM
Event ID: 4625
Reason: Unknown username or bad password
Account Name: admin
Source IP: [Link]
Attempts: 347

What is happening?

Answer:
This looks like a brute force attack on the admin account.

Steps to take:

1. Verify whether these attempts succeeded later.

2. Geo-check the IP – likely foreign/untrusted.
3. Block IP at firewall/WAF.
4. Review user lockout status.
5. Enable MFA if not enabled.
6. Search for similar events across other accounts.

7. Log Scenario: Lateral movement in Windows logs

Event ID: 4624 (Logon Type 3)
Account: user1
Source Workstation: PC-23
Target: DC-01

What does this indicate?

Answer:
Type 3 = network logon.
If a normal user account logs into a domain controller, it's highly suspicious.

Response:

1. Check if user1 has legitimate DC access.

2. Look for repeated attempts → brute force?
3. Check for tools like PsExec/WMIC.
4. Review processes launched by user1.

8. Log Scenario: Rare Scheduled Task Created

[Link] /Create /SC MINUTE /TN “Updater” /TR “C:\Users\Public\[Link]”
Answer:
This is likely persistence created by malware.

Steps:

 Investigate [Link] (hash, upload to VirusTotal).

 Inspect parent process.
 Remove scheduled task.
 Check for others created around the same timestamp.

9. Log Scenario: Suspicious DNS Requests

[Link]

Large number of randomized subdomains → DGA malware.

Answer:

1. Block the domain.

2. Check all hosts making similar queries.
3. Review outbound connections.
4. Isolate affected systems.

10. Log Scenario: Large outbound data transfer

Outbound: 4.2GB to IP 104.x.x.x
Protocol: HTTPS
Process: [Link]
User: finance_user

Answer:
Possible data exfiltration.

Steps:

1. Verify if this was a legitimate upload (OneDrive, Google Drive, etc.)

2. Check domain categorization.
3. Review recent user behavior.
4. If suspicious → isolate host and escalate.
🔥 FIREWALL LOG–BASED INTERVIEW QUESTIONS & ANSWERS

1. You see repeated firewall denies from one external IP to multiple internal ports. What does this
mean?
Answer:
This behavior usually indicates port scanning or reconnaissance.
An attacker is trying to find open ports or vulnerable services.
What I would do:
1. Check threat intel (OTX, VirusTotal) for the external IP.
2. Check if the denied attempts ever became allowed later.
3. Block the IP at the perimeter firewall (if malicious).
4. Look for scanning attempts on other hosts.
5. Enable rate-limiting or IDS signatures if needed.

2. Firewall log: What do you identify?

Action: Allow
SRC IP: [Link]
DST IP: [Link]
DST Port: 4444
Protocol: TCP
Bytes Sent: 30,204,002

Answer:
Port 4444 is commonly used for reverse shells / Meterpreter.
Suspicious Indicators:
 High data transfer
 Destination is external
 Unusual port for legitimate traffic
Conclusion: Possible data exfiltration or active remote connection.
Actions:
1. Immediately isolate the source workstation.
2. Check processes and active network connections.
3. Review EDR logs for suspicious binaries.
4. Block IP and port at the firewall.

3. Firewall alert shows inbound traffic to TCP port 3389 (RDP). What does this indicate?
Answer:
This usually indicates:
 Brute-force attempt
  RDP scanning
 Possible exploitation attempt
What to do:

 Ensure RDP is not open to the internet.

 Check login attempts in Windows logs (Event 4625, 4624).
 Implement VPN-only access or MFA.

4. The firewall log shows internal host communicating with a known malicious domain. What
next?
Answer:
This is likely malware beaconing.
Actions:
1. Quarantine the internal host.
2. Check if the domain exists in threat intel feeds.
3. Investigate the host using EDR.
4. Block the domain/IP on the firewall.
5. Search across SIEM for other hosts contacting the domain.

5. You notice a sudden spike in outbound connections to random IPs from one host.
Answer:
This suggests:

 Botnet activity
 Worm propagation
 Malware scanning
Steps:
1. Isolate the device.
2. Review processes, autoruns, network connections.
3. Check DNS logs for DGA behavior.
4. Run AV/EDR scans.
5. Identify if lateral movement occurred.

SPLUNK INTERVIEW QUESTIONS & ANSWERS

6. What is SPL (Search Processing Language) in Splunk?

Answer:
SPL is Splunk’s query language used for:
  searching
 filtering
 transforming
 correlating logs
 building dashboards and alerts
Example SPL:
index=firewall action=blocked src_ip!=10.* | stats count by src_ip

7. How do you check for failed logins in Splunk?

Answer:

index=windows EventCode=4625
| stats count by Account_Name, IpAddress

This returns all failed login attempts grouped by user and IP.

8. How do you detect brute-force attacks using Splunk?

SPL Query:

index=windows EventCode=4625
| stats count by IpAddress, Account_Name
| where count > 10

If one IP attempts many failed logins, it indicates brute force.

9. How do you track lateral movement using Splunk?

Use Windows logon types (3, 10):

index=windows (EventCode=4624 OR EventCode=4625)

Logon_Type=3 OR Logon_Type=10
| stats count dc(host) by Account_Name

 Logon Type 3 → network logon

 Logon Type 10 → RDP

Unusual lateral movement will stand out via rare hosts or accounts.

10. What is a Splunk Forwarder?

Answer:

 A universal forwarder (UF) collects and forwards logs from endpoints.

 A heavy forwarder (HF) can parse data before forwarding.
Forwarders send logs to Splunk indexers.
11. How do you create an alert in Splunk?
Steps:
1. Run SPL search.
2. Click Save As → Alert.
3. Set:
o Alert condition (e.g., results > 0)
o Trigger frequency
o Severity
o Notification method (email, Slack, webhook)

12. Splunk shows a high number of DNS queries for random subdomains. What does this mean?
Answer:
Likely DGA-based malware.
Example SPL:

index=dns
| regex query=".*[0-9a-z]{20,}.*"
| stats count by src_ip, query

13. Splunk dashboard shows spikes in outbound traffic. What could cause this?
Possible causes:
 Data exfiltration
 Misconfigured service
 Malware beaconing
 Backup jobs
What you do:
Investigate firewall logs, compare with normal patterns, check process tree on the source.

14. What is the difference between Index Time and Search Time?
Answer:
 Index time: When Splunk receives and stores data.
 Search time: When SPL queries apply transformations (e.g., eval, stats).
Index-time fields cannot be changed later.

15. What are notable events in Splunk ES?

Answer:
Notable events are high-priority alerts created by correlation searches in Splunk Enterprise
Security.
SOC analysts use them to triage, investigate, and escalate incidents.
Question 1: Firewall Basics and Default Action

Q: What is the fundamental security function of a firewall, and what is the

concept of the "Implicit Deny" rule?

A:

 Firewall Function: A firewall's fundamental job is to filter network

traffic based on a set of pre-defined rules (policy). It decides which
packets are allowed to enter or leave the network and which are
denied.
 Implicit Deny: This is the most important security concept in a
firewall. It is an unwritten rule at the very bottom of the rule list that
states: "If traffic does not explicitly match any prior ALLOW rule, then
it must be DENIED (blocked)." This ensures the network is closed by
default.

Question 2: Initial Triage and IoCs

Q: An alert comes in stating that an internal host ([Link]) attempted to

connect to an external IP ([Link]) on TCP port 80, and the connection was
ALLOWED. Your Threat Intelligence (TI) system flags the external IP as
malicious.

 A. What is the single most important action you, as an L1 Analyst,

should take right now?
 B. What are the two main Indicators of Compromise (IoCs) in this
alert?

A:

 A. Immediate Action: Since the connection was allowed and the IP is

malicious, you must immediately isolate the internal host ([Link])
from the network (using your EDR tool or by disabling its network port)
to prevent further communication or lateral movement.
 B. The IoCs:
1. The Destination IP Address ([Link]) because it matches the
TI blacklist.
2. The fact that the firewall log shows the connection was ALLOWED
(meaning the malicious connection succeeded).

Question 3: Common Protocol Ports

Q: When you see a high volume of traffic on certain ports, you need to know
what they are. What is the standard service associated with the following
common ports?

 A. UDP Port 53
 B. TCP Port 3389
  C. TCP Port 21

A:

 A. UDP Port 53: DNS (Domain Name System). Used to translate domain
names (like [Link]) into IP addresses.
 B. TCP Port 3389: RDP (Remote Desktop Protocol). Used for remote
access and control of Windows machines.
 C. TCP Port 21: FTP (File Transfer Protocol). Used for transferring files
between a client and server.

Question 4: Log Data vs. Packet Data

Q: Explain the difference between a Firewall Log and a Full Packet Capture
(PCAP), and state which one is larger in file size.

A:

 Firewall Log: This is a metadata summary (like a receipt). It records

details such as the time, source IP, destination IP, port, and the
firewall's action (ALLOW or DENY). It does not contain the actual data
being transferred.
 Full Packet Capture (PCAP): This is a complete recording of every
single bit of data (including the payload) sent during the
communication. It is a full copy of the conversation.
 File Size: The Full Packet Capture (PCAP) is vastly larger in file size
because it contains the entire message payload, while the firewall log
only contains header information.