SOC ANALYST

L1 & L2 INTERVIEW PREPARATION GUIDE

From Zero to Interview-Ready

Covering: Networking Basics • Security Concepts • SIEM & Tools

Incident Response • Threat Intelligence • Malware Analysis
Top Interview Questions with Answers • Scenario-Based Questions

What is a SOC?
A Security Operations Center (SOC) is a team of security professionals
who monitor, detect, investigate, and respond to cyber threats 24/7.

Prepared for Interview Success

Version 1.0 • 2025
SOC Analyst L1 & L2 Interview Preparation Guide

Table of Contents

Section Topic
1 Understanding the SOC Analyst Role
2 Networking Fundamentals (Must-Know Basics)
3 Operating System Basics
4 Core Security Concepts
5 Security Tools Every SOC Analyst Must Know
6 SIEM – The Heart of a SOC
7 Incident Response (IR) Process
8 Threat Intelligence & Threat Hunting
9 Malware Analysis Basics
10 Common Attack Types You Must Know
11 Log Analysis Skills
12 SOC L1 Interview Q&A (50+ Questions)
13 SOC L2 Interview Q&A (Advanced Questions)
14 Scenario-Based Interview Questions
15 Certifications Roadmap
16 30-Day Study Plan
17 Quick Reference Cheat Sheet

Page 2
SOC Analyst L1 & L2 Interview Preparation Guide

Section 1: Understanding the SOC Analyst Role

Before your interview, you must clearly understand what a SOC does and what your job will look
like day-to-day. Interviewers always ask this.

1.1 What Does a SOC Do?

A SOC (Security Operations Center) is like a 24/7 security control room for IT systems.

It monitors networks and systems for suspicious activity, investigates alerts, and responds

to security incidents before they cause serious damage.

The three main jobs in a SOC are:

• Monitor: Watch logs, alerts, and dashboards for anything unusual
• Detect: Find real threats among thousands of alerts (separating false alarms from real
ones)
• Respond: Take action to stop or contain the threat

1.2 L1 vs L2 vs L3 – The Tier System

Tier Who Are They? What Do They Do?
L1 (Tier 1) First Responders Monitor SIEM, triage alerts, do initial
investigation, escalate if needed. Handle
high volume of alerts.
L2 (Tier 2) Incident Handlers Deep dive into escalated alerts, do
forensics, contain incidents, write detailed
reports.
L3 (Tier 3) Threat Hunters / Senior Analysts Proactively hunt threats, build detection
rules, handle APT (Advanced Persistent
Threat) cases.

1.3 A Typical Day for an L1 Analyst

1. Log in and review the SIEM dashboard for overnight alerts
2. Triage alerts – decide which are false positives vs real threats
3. Investigate suspicious alerts using logs, packet data, threat intel feeds
4. Escalate high-severity incidents to L2
5. Document findings in a ticketing system (like ServiceNow or Jira)
6. Handoff to next shift with clear notes

Page 3
SOC Analyst L1 & L2 Interview Preparation Guide

1.4 Key Soft Skills Interviewers Look For

• Attention to detail: You will look at thousands of alerts. Missing one can be costly.
• Communication: You must clearly explain technical findings to non-technical
managers.
• Calm under pressure: During a live incident, panic is the enemy.
• Curiosity: The best analysts always ask 'why' and dig deeper.

Page 4
SOC Analyst L1 & L2 Interview Preparation Guide

Section 2: Networking Fundamentals (Must-Know Basics)

Networking is the #1 topic in SOC interviews. You CANNOT skip this section.

Every security event happens over a network, so you must understand how data travels.

2.1 The OSI Model – 7 Layers

Think of OSI as a 7-floor building. Data travels up and down this building when it moves across
networks.

Layer # Layer Name Simple Explanation + Example

7 – Application Application Layer What the user sees. Example: HTTP (web browsing),
SMTP (email), FTP (file transfer)
6 – Presentation Presentation Layer Translates data. Handles encryption (SSL/TLS),
compression, encoding.
5 – Session Session Layer Manages connections/sessions between computers.
Login sessions.
4 – Transport Transport Layer Ensures data delivery. TCP (reliable, checks
delivery) vs UDP (fast, no checks)
3 – Network Network Layer Routing and IP addressing. IP packets travel here.
Routers work here.
2 – Data Link Data Link Layer MAC addresses, switches work here. Frames are
used instead of packets.
1 – Physical Physical Layer Actual cables, Wi-Fi signals, network cards. Raw bits
(0s and 1s).

Memory tip for OSI layers (top to bottom): All People Seem To Need Data Processing

(Application, Presentation, Session, Transport, Network, Data Link, Physical)

2.2 TCP vs UDP – Very Important!

TCP (Transmission UDP (User Datagram Protocol)
Control Protocol)
Reliable – guarantees Unreliable – no guarantee
delivery
3-Way Handshake (SYN, No handshake, just sends data
SYN-ACK, ACK)

Page 5
SOC Analyst L1 & L2 Interview Preparation Guide

Slower but accurate Faster but can lose packets

Used for: HTTP, HTTPS, Used for: DNS, VoIP, video streaming, gaming
SSH, FTP, Email
Attacker can exploit Used in DNS amplification DDoS attacks
handshake (SYN flood)

2.3 Key Ports Every SOC Analyst Must Memorize

Port Protocol/Service Used For
Number
21 FTP File Transfer Protocol – transferring files
22 SSH Secure Shell – remote login (encrypted)
23 Telnet Remote login (NOT encrypted – dangerous!)
25 SMTP Sending emails
53 DNS Domain name resolution (converts names to IPs)
80 HTTP Web traffic (NOT encrypted)
110 POP3 Receiving emails
143 IMAP Email access
443 HTTPS Secure web traffic (encrypted with SSL/TLS)
445 SMB File sharing in Windows – often exploited!
3389 RDP Remote Desktop Protocol – common attack target
1433 MSSQL Microsoft SQL Server
3306 MySQL MySQL database
8080 HTTP Alt Alternate HTTP port – often used by proxies/web apps

2.4 IP Addressing Basics

• IPv4: 32-bit address like [Link]. Has about 4 billion addresses.
• IPv6: 128-bit address like 2001:db8::1. Trillions of addresses available.
• Private IP ranges: [Link]/8, [Link]/12, [Link]/16 (used inside companies)
• Public IP: Globally routable IP visible to internet
• Loopback: [Link] always refers to 'yourself' (localhost)

2.5 DNS – How It Works

DNS = Domain Name System. It is the internet's phone book.

When you type [Link], DNS converts that to an IP like [Link]

Page 6
SOC Analyst L1 & L2 Interview Preparation Guide

so your computer can connect. Without DNS, you would need to memorize IP addresses!

DNS Record Types (important for SOC work):

Record Type What It Does
A Record Maps hostname to IPv4 address
AAAA Record Maps hostname to IPv6 address
MX Record Mail exchange – where emails go
CNAME Record Alias for another domain name
TXT Record Text info – used for SPF, DKIM (email security)
PTR Record Reverse lookup – IP to hostname

2.6 Subnetting Basics (Simplified)

Subnetting divides a large network into smaller ones for better management and security.
• CIDR notation: /24 means 256 addresses (e.g., [Link]/24)
• Subnet mask: [Link] = /24. Tells you which part is network vs host.
• Why it matters in SOC: You need to know if an IP is internal or external, and which
subnet was affected.

Page 7
SOC Analyst L1 & L2 Interview Preparation Guide

Section 3: Operating System Basics

3.1 Windows – Key SOC Knowledge

• Event Logs: Windows logs everything. Key log locations: Event Viewer > Windows Logs
◦ Security Log: Login attempts, privilege use, account changes
◦ System Log: OS errors, service start/stop
◦ Application Log: App-specific errors and info

3.2 Critical Windows Event IDs (Memorize These!)

Event ID What It Means Why It Matters
4624 Successful Login Normal, but look for unusual times or locations
4625 Failed Login Multiple fails = brute force attack!
4648 Logon with explicit credentials Could be credential theft or lateral movement
(runas)
4672 Admin privileges assigned Admin logon – always monitor
4688 New process created Malware often creates new processes
4698 Scheduled task created Attackers create tasks for persistence
4720 User account created Unauthorized account creation = red flag
4732 User added to admin group Privilege escalation alert!
4776 NTLM auth attempt Could be credential cracking attempt
7045 New service installed Malware often installs as a service

3.3 Linux – Key SOC Knowledge

• Important log files:
◦ /var/log/[Link] – Authentication logs (logins, sudo use)
◦ /var/log/syslog – General system messages
◦ /var/log/messages – General system activity
◦ /var/log/apache2/[Link] – Web server access logs
◦ /var/log/apache2/[Link] – Web server errors

• Useful Linux commands for SOC work:

Command What It Does
netstat -an Shows all active network connections and listening ports
ps aux Lists all running processes

Page 8
SOC Analyst L1 & L2 Interview Preparation Guide

last Shows who last logged in and when

cat /etc/passwd Lists all user accounts
find / -name '*.sh' Searches for shell scripts (look for suspicious ones)
grep -r 'error' /var/log/ Searches logs for 'error' keyword
tail -f /var/log/[Link] Watch auth log in real-time
who Shows currently logged in users
lsof -i Lists open files and their network connections

Page 9
SOC Analyst L1 & L2 Interview Preparation Guide

Section 4: Core Security Concepts

4.1 CIA Triad – The Foundation of Security

Every security decision is based on the CIA Triad. You WILL be asked this in interviews.

C = Confidentiality: Only authorized people can see the data (e.g., encryption)

I = Integrity: Data has not been changed or tampered with (e.g., hashing)

A = Availability: Systems and data are accessible when needed (e.g., backups, uptime)

4.2 Authentication vs Authorization vs Accounting

Concept Simple Definition Example
Authentication Proving who you are Entering your password to login
(AuthN)
Authorization (AuthZ) What you are allowed to do Your account can only read files,
not delete
Accounting (Audit) Tracking what you did Logs showing you accessed File
X at 3pm

4.3 Encryption Basics

• Symmetric encryption: Same key for encrypt and decrypt. Fast. Examples: AES, DES.
Risk: key must be shared securely.
• Asymmetric encryption: Two keys – public key (encrypt) and private key (decrypt).
Examples: RSA. Used in SSL/TLS.
• Hashing: One-way function. Converts data to fixed string. Cannot reverse. Examples:
MD5, SHA-256. Used to verify file integrity.
• TLS/SSL: Encrypts web traffic (HTTPS). Protects data in transit between browser and
server.

4.4 Firewall Types

Firewall Type How It Works
Packet Filter Firewall Checks source/destination IP and port. Basic. Doesn't inspect content.
Stateful Firewall Tracks connection state. Knows if traffic is part of existing session.

Page 10
SOC Analyst L1 & L2 Interview Preparation Guide

Application Firewall (WAF) Inspects actual content (HTTP traffic). Blocks SQLi, XSS attacks.
Next-Gen Firewall (NGFW) All of the above + IPS, deep packet inspection, app control, user
identity.

4.5 IDS vs IPS

IDS (Intrusion Detection IPS (Intrusion Prevention System)
System)
Only DETECTS and DETECTS and also BLOCKS threats automatically
ALERTS on threats
Passive – does not stop Active – can drop malicious packets
attacks
Lower risk of blocking Can cause false positives blocking good traffic
legitimate traffic
Placed in monitoring Placed inline in network traffic path
position
Example: Snort (in IDS Example: Snort (in IPS mode), Suricata
mode)

4.6 VPN, DMZ, and Zero Trust

• VPN (Virtual Private Network): Creates encrypted tunnel over internet. Used for
remote work. Masks internal network from internet.
• DMZ (Demilitarized Zone): A network segment between internal network and internet.
Web servers, mail servers placed here. If hacked, attacker doesn't immediately reach
internal systems.
• Zero Trust: Trust nobody by default – verify every user and device every time. Even
internal users must authenticate. Based on principle of 'never trust, always verify.'

Page 11
SOC Analyst L1 & L2 Interview Preparation Guide

Section 5: Security Tools Every SOC Analyst Must Know

5.1 Tool Categories Overview

Category Tools Purpose
SIEM Splunk, IBM QRadar, Microsoft Collect, correlate, alert on logs
Sentinel, Elastic SIEM
Network Analysis Wireshark, tcpdump, Zeek (Bro) Capture and analyze network traffic
Endpoint Detection CrowdStrike, Carbon Black, Detect threats on computers/servers
SentinelOne, Microsoft Defender
Threat Intelligence VirusTotal, AbuseIPDB, Shodan, Research IPs, domains, malware
MISP, ThreatConnect hashes
Vulnerability Nessus, Qualys, OpenVAS Find security weaknesses
Scanning
Log Management Graylog, ELK Stack, Fluentd Centralize and search logs
Incident Response TheHive, MISP, Cortex Manage IR cases and automate
enrichment
Ticketing ServiceNow, Jira, Remedy Track and manage security incidents

5.2 Wireshark – Network Traffic Analysis

Wireshark captures network packets and lets you see exactly what data is flowing. It's the #1
network forensics tool.
• Key filters you must know:
Wireshark Filter What It Shows
http All HTTP traffic
[Link] == [Link] Traffic to/from specific IP
[Link] == 443 HTTPS traffic
dns All DNS queries
[Link] == 1 SYN packets (look for SYN flood)
[Link] == HTTP POST requests (form submissions, data uploads)
POST
!(arp or dns or icmp) Filter out common noise to focus on interesting traffic

5.3 Nmap – Network Scanning

Nmap is used to discover hosts and services on a network. Attackers and defenders both use it.

Page 12
SOC Analyst L1 & L2 Interview Preparation Guide

Nmap Command What It Does

nmap [Link] Basic port scan of one IP
nmap -sS [Link] Stealth SYN scan (doesn't complete handshake)
nmap -sV [Link] Detect service versions
nmap -O [Link] OS detection
nmap -A [Link]/24 Aggressive scan of entire subnet
nmap -p 80,443 [Link] Scan specific ports only

Page 13
SOC Analyst L1 & L2 Interview Preparation Guide

Section 6: SIEM – The Heart of a SOC

SIEM = Security Information and Event Management

It is the central platform where all logs and alerts come together.

As a SOC analyst, you will spend most of your day inside a SIEM.

6.1 How SIEM Works

7. Data Sources send logs: firewalls, servers, endpoints, cloud, applications
8. SIEM collects and normalizes all logs into a common format
9. Correlation Engine applies rules to find patterns (e.g., 5 failed logins then success)
10. Alerts are generated when rules match
11. SOC Analyst investigates the alert
12. If real threat: escalate / respond. If false positive: tune the rule.

6.2 Splunk – Most Common SIEM in Interviews

Splunk is the most asked-about SIEM in interviews. Learn these SPL (Splunk Processing
Language) basics:
SPL Query What It Does
index=* | head 100 Show last 100 events across all indexes
index=windows Show all failed logins
EventCode=4625
index=windows Count failed logins per IP address
EventCode=4625 | stats
count by src_ip
index=web | search Show all 404 (not found) web errors
status=404
| timechart count by Graph event counts over time
EventCode
| table _time, src_ip, user, Show specific fields in a clean table
action
earliest=-24h Look at last 24 hours only

6.3 SIEM Use Cases (Detection Rules)

These are common SIEM detection rules you should know about:

Page 14
SOC Analyst L1 & L2 Interview Preparation Guide

• Brute Force Detection: More than 5 failed logins (Event 4625) within 5 minutes from
same IP
• Impossible Travel: User logs in from India at 10am and USA at 10:05am – physically
impossible!
• Off-Hours Login: Admin account logs in at 3am on a weekend
• New Admin Account: Event 4720 (account created) followed by 4732 (added to admin
group)
• Malware Communication: Endpoint connecting to known malicious IP or domain
• Data Exfiltration: Large outbound transfer to external IP, especially after hours

Page 15
SOC Analyst L1 & L2 Interview Preparation Guide

Section 7: Incident Response (IR) Process

Incident Response is the structured approach to handling security breaches.

This is a MAJOR topic in both L1 and L2 interviews. Know every step!

7.1 The 6 Phases of Incident Response (NIST Framework)

Phase Name What You Do
1 Preparation Build IR plan, set up tools, train team, define roles BEFORE an
incident happens
2 Identification Detect and confirm the incident. Determine scope. Answer: Is this
real? What happened?
3 Containment Stop the spread. Isolate affected systems. Short-term (disconnect)
and long-term (patch).
4 Eradication Remove the root cause. Delete malware, close vulnerabilities, reset
credentials.
5 Recovery Restore systems to normal operation. Monitor carefully for
recurrence.
6 Lessons Learned Conduct post-mortem. Document what happened, what worked,
what to improve.

7.2 Incident Severity Levels

Severity Description Example
P1 – Critical Major business impact. Ransomware spreading across network
Immediate response.
P2 – High Significant risk. Response Confirmed malware on single endpoint
within 1-4 hours.
P3 – Medium Moderate risk. Response Phishing email reported, no compromise yet
within 24 hours.
P4 – Low Minor risk. Response within 72 Policy violation, no malware involved
hours.

7.3 Chain of Custody

When handling evidence in a security incident, you must maintain Chain of Custody:
• What it means: Documenting who collected evidence, when, how it was stored, and
who has accessed it.

Page 16
SOC Analyst L1 & L2 Interview Preparation Guide

• Why it matters: Without proper chain of custody, digital evidence may not be admissible
in court.
• Key rule: Never work on original evidence. Always create a forensic copy (image) first.

7.4 Containment Strategies

• Network Isolation: Disconnect infected machine from network (but keep it powered on
for memory analysis)
• Account Suspension: Disable compromised user accounts immediately
• Firewall Rule: Block malicious IP at firewall level
• DNS Sinkhole: Redirect malicious domain to internal server to cut off C2
communication
• Null Route: Drop all traffic to/from malicious IP at router level

Page 17
SOC Analyst L1 & L2 Interview Preparation Guide

Section 8: Threat Intelligence & Threat Hunting

8.1 What is Threat Intelligence?

Threat Intelligence (TI) is information about existing or emerging threats. It helps you
understand who is attacking, how, and why.

TI Type Description
Strategic TI High-level: trends, attacker groups, business impact. For management.
Tactical TI TTPs (Tactics, Techniques, Procedures) of attackers. For security
team.
Operational TI Real-time: active campaigns, IOCs. For SOC analysts.
Technical TI Specific IOCs: malware hashes, IPs, domains, URLs. For tools.

8.2 IOCs – Indicators of Compromise

IOCs are evidence that a system has been compromised. When you find these, it means BAD
things happened.

Types of IOCs:

- IP addresses: Known malicious IPs (check on AbuseIPDB, VirusTotal)

- Domain names: Malicious or C2 domains

- File hashes: MD5/SHA256 of malware files (check on VirusTotal)

- URLs: Malicious links used in phishing

- Email addresses: Source of phishing emails

- Registry keys: Malware often modifies Windows registry

- Mutex names: Unique strings created by malware to avoid running twice

8.3 MITRE ATT&CK Framework

MITRE ATT&CK is a knowledge base of real attacker tactics and techniques. Every SOC
analyst must know this!
ATT&CK Tactic Simple Meaning

Page 18
SOC Analyst L1 & L2 Interview Preparation Guide

Initial Access How attacker got in (phishing, exploit, stolen creds)

Execution Running malicious code on the target
Persistence How attacker stays in after reboot (registry, scheduled task)
Privilege Escalation Getting higher permissions (admin, root)
Defense Evasion Avoiding detection (disable antivirus, use LOLBins)
Credential Access Stealing passwords (Mimikatz, keylogger)
Discovery Learning about the network/systems (nmap, queries)
Lateral Movement Moving to other systems (Pass-the-Hash, RDP)
Collection Gathering data to steal (documents, emails)
Command & Control (C2) Communicating with attacker's server
Exfiltration Sending stolen data out
Impact Final goal: encrypt (ransomware), delete, disrupt

8.4 Pyramid of Pain

Created by David Bianco, this shows how hard it is for attackers to change different IOC types:
Level (Pain for IOC Type Example
Attacker)
Very Easy (Low Pain) Hash Values Attacker just recompiles malware to change
hash
Easy IP Addresses Attacker moves to different server
Moderate Domain Names Costs money but easy to register new
domain
Hard Network Artifacts URL patterns, User-Agent strings
Harder Host Artifacts Registry keys, file paths used
Very Hard (High Pain) Tools If you detect their tools, they must build new
ones
Maximum Pain TTPs Changing attack behavior requires
retraining the whole team

Page 19
SOC Analyst L1 & L2 Interview Preparation Guide

Section 9: Malware Analysis Basics

9.1 Types of Malware

Malware Type What It Does Example
Virus Attaches to legitimate files and spreads ILOVEYOU worm
when files are executed
Worm Self-replicates and spreads WannaCry
automatically without user action
Trojan Disguised as legitimate software but Banking trojans
hides malicious code
Ransomware Encrypts victim files, demands payment REvil, LockBit
for decryption key
Spyware Secretly monitors user activity, steals Keyloggers
credentials
Rootkit Hides deep in OS, very hard to detect Kernel-level rootkits
Botnet/RAT Remote Access Trojan – gives attacker njRAT, AsyncRAT
full control of system
Cryptominer Uses your CPU to mine cryptocurrency XMRig
for attacker
Fileless Malware Runs entirely in memory, leaves no files PowerShell attacks
on disk

9.2 Static vs Dynamic Analysis

Static Analysis Dynamic Analysis
Examine malware Run malware in a safe sandbox and observe behavior
WITHOUT running it
Look at: file hash, strings, Watch: file changes, registry changes, network calls
imports, headers
Tools: strings, PEiD, Tools: Cuckoo Sandbox, [Link], Hybrid Analysis
pestudio, VirusTotal
Safe – no risk of infection Done in isolated VM – risk of escape if VM not secured
Faster but may miss Reveals true behavior but slower
packed malware

Page 20
SOC Analyst L1 & L2 Interview Preparation Guide

9.3 Key Malware Behaviors to Look For

• C2 Communication: Malware phones home to attacker server. Look for unusual
outbound connections, especially on common ports like 80, 443 to hide in web traffic.
• Registry Persistence: HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Run – malware adds entry here to survive reboot.
• Process Injection: Malware injects itself into legitimate processes ([Link],
[Link]) to hide.
• Lateral Movement: After infection, malware tries to spread to other machines using
stolen credentials.
• LOLBins (Living off the Land): Using built-in Windows tools for malicious purposes.
Example: PowerShell, certutil, msiexec.

Page 21
SOC Analyst L1 & L2 Interview Preparation Guide

Section 10: Common Attack Types You Must Know

10.1 Attack Type Quick Reference

Attack Simple Explanation How to Detect
Phishing Fake email tricks user into clicking Email gateway alerts, user reports,
link or giving credentials suspicious login from new location
Spear Phishing Targeted phishing – customized for Similar to phishing but harder to detect –
specific person/company check sender domain closely
SQL Injection Attacker inserts SQL code into web WAF alerts, error messages in web logs,
(SQLi) form to access database unusual DB queries
Cross-Site Injects malicious script into web WAF alerts, <script> tags in web logs,
Scripting (XSS) page viewed by others user reports
Man-in-the-Middle Attacker intercepts communication ARP spoofing detection, SSL cert
(MitM) between two parties warnings, Wireshark anomalies
Brute Force Trying many passwords until one Multiple failed logins (Event 4625),
works lockout events
DDoS Flood a server with traffic to make it Traffic spike, bandwidth saturation,
unavailable service unavailable
Pass-the-Hash Steal password hash and use it Event ID 4648, unusual lateral
directly without knowing password movement patterns
Kerberoasting Steal Kerberos tickets and crack Unusual service ticket requests, TGS
them offline to get service account events
passwords
Buffer Overflow Send more data than buffer can hold Application crashes, unusual process
– overwrite memory to run code behavior

10.2 Phishing – Deep Dive (Most Common Attack)

Phishing is involved in over 90% of data breaches. Know this topic cold.

Types: Email phishing, Spear phishing (targeted), Whaling (targeting executives),

Vishing (voice/phone), Smishing (SMS), Quishing (QR code phishing)

Email phishing indicators:

- Sender domain doesn't match company (support@[Link] vs [Link])

Page 22
SOC Analyst L1 & L2 Interview Preparation Guide

- Urgency language ('Your account will be deleted in 24 hours!')

- Suspicious links (hover to check real URL)

- Unexpected attachments (.exe, .docm, .xlsm files)

- Poor grammar/spelling (though modern AI phishing is well-written)

Page 23
SOC Analyst L1 & L2 Interview Preparation Guide

Section 11: Log Analysis Skills

11.1 Types of Logs You Will Analyze

Log Type What It Contains
Windows Event Logs Logins, process creation, account changes, services, scheduled tasks
Web Server Logs IP address, timestamp, URL requested, HTTP method, response code,
(Apache/IIS/Nginx) User-Agent
Firewall Logs Source IP, destination IP, port, protocol, action (allow/deny)
DNS Logs Domain queries, response, client IP – great for finding C2 domains
DHCP Logs IP assignments – helps map IP to hostname/MAC at specific time
Authentication Logs VPN logins, Active Directory logons, cloud logins
Proxy Logs All web requests from users – see what websites were visited
Email Logs Sender, recipient, subject, attachments, delivery status

11.2 Reading Web Server Logs

Example Apache log line:
[Link] - - [15/Jun/2024:14:23:01 +0000] "GET /[Link]?id=1' OR 1=1-- HTTP/1.1" 200
1234

Breaking it down:

[Link] = Client IP address

15/Jun/2024 = Date and time

GET = HTTP method

/[Link] = Page being accessed

?id=1' OR 1=1-- = THIS IS A SQL INJECTION ATTEMPT!

200 = HTTP status code (success – could mean it worked!)

1234 = Response size in bytes

Page 24
SOC Analyst L1 & L2 Interview Preparation Guide

11.3 HTTP Status Codes – Quick Reference

Code Range Meaning SOC Significance
200-299 Success Normal – but check for data exfiltration (large 200
responses)
301/302 Redirect Could be phishing redirect chains
400 Bad Request Could indicate scanning or fuzzing
401/403 Unauthorized/Forbidden Access attempts on restricted areas
404 Not Found Many 404s = directory scanning/enumeration
500 Server Error Could indicate successful exploit or
misconfiguration
503 Service Unavailable Could indicate DDoS attack in progress

Page 25
SOC Analyst L1 & L2 Interview Preparation Guide

Section 12: SOC L1 Interview Questions & Answers

These are the most commonly asked questions for SOC L1 roles.

Study these answers carefully. Tailor them to your own experience where possible.

12.1 Basic Concept Questions

Q: What is the difference between a threat, vulnerability, and risk?

Vulnerability = A weakness (e.g., unpatched software)

Threat = Something that can exploit that weakness (e.g., a hacker, malware)
Risk = The probability and impact if the threat exploits the vulnerability
Formula: Risk = Threat x Vulnerability x Impact
Example: Unpatched Windows server (vulnerability) exposed to internet, targeted by ransomware
group (threat) = HIGH risk

Q: What is the difference between IDS and IPS?

IDS (Intrusion Detection System) – MONITORS and ALERTS on suspicious activity. It is passive.
IPS (Intrusion Prevention System) – MONITORS and also BLOCKS threats automatically. It is
active.
Key point: IDS tells you someone is trying to break in. IPS tells you AND tries to stop them.
Example: Snort can operate as both IDS and IPS depending on configuration.

Q: Explain the TCP 3-Way Handshake.

Step 1 – SYN: Client sends SYN (synchronize) packet to server saying 'I want to connect'
Step 2 – SYN-ACK: Server responds with SYN-ACK saying 'OK, I acknowledge your request'
Step 3 – ACK: Client sends ACK (acknowledge) and connection is established
SOC relevance: A SYN flood attack sends thousands of SYNs without completing the
handshake, exhausting server resources (DDoS).

Q: What is a false positive in security alerting?

A false positive is when the SIEM or security tool generates an alert for something that is NOT
actually malicious.
Example: Your DLP tool alerts every time someone emails an Excel file, but it's legitimate
business use.
Why it matters: Too many false positives causes 'alert fatigue' – analysts stop caring and miss

Page 26
SOC Analyst L1 & L2 Interview Preparation Guide

real threats.
Your job as L1: Investigate each alert to determine if it's a true positive (real threat) or false
positive (benign activity).

Q: What is the CIA triad?

CIA stands for Confidentiality, Integrity, and Availability – the three pillars of information security.
Confidentiality: Ensuring only authorized users can access data (encryption, access controls)
Integrity: Ensuring data is not modified without authorization (hashing, digital signatures)
Availability: Ensuring systems and data are accessible when needed (redundancy, backups)
Every security control can be tied back to one or more of these three principles.

Q: What ports does HTTP and HTTPS use?

HTTP uses port 80 – unencrypted web traffic

HTTPS uses port 443 – encrypted web traffic (using SSL/TLS)
HTTPS encrypts the communication between browser and server using SSL/TLS certificates.
From a SOC perspective: Traffic on port 80 can be intercepted and read. HTTPS should be used
for all sensitive data.

Q: What is DNS and why is it important to security?

DNS (Domain Name System) translates human-readable domain names ([Link]) into IP
addresses.
Security importance:
- DNS can be used for C2 (command and control) – malware uses DNS to communicate with
attackers
- DNS tunneling: Attackers hide data inside DNS queries to exfiltrate data
- Malicious domains can be detected in DNS logs
- DNS sinkholes can block malware communication by redirecting malicious domains internally

Q: What is a SIEM and how does it help SOC analysts?

SIEM = Security Information and Event Management

It collects logs from all systems (firewalls, servers, endpoints, cloud), correlates them, and
generates alerts.
How it helps: Instead of checking 100 different log files manually, everything is in one place.
You can write correlation rules like: 'If more than 5 failed logins happen in 2 minutes from same
IP, create alert.'
Popular SIEMs: Splunk, IBM QRadar, Microsoft Sentinel, Elastic SIEM

Q: What steps do you take when you receive a security alert?

Page 27
SOC Analyst L1 & L2 Interview Preparation Guide

Step 1 – Acknowledge the alert and record the time

Step 2 – Gather information: What triggered the alert? What system? What user?
Step 3 – Check context: Is this normal behavior for this user/system? Check baseline.
Step 4 – Look for correlated events: Are there other alerts related to this?
Step 5 – Determine if it's a true positive or false positive
Step 6 – If true positive: Escalate to L2 with full documentation
Step 7 – If false positive: Document why and consider tuning the rule

Q: What is social engineering?

Social engineering is manipulating people (not systems) to give up confidential information or

perform actions.
Examples: Phishing (fake emails), Vishing (fake phone calls), Pretexting (fake identity to gain
trust),
Baiting (leaving infected USB drives), Tailgating (following someone through secure door).
Why it's hard to defend: Technology can be patched. Humans make mistakes when pressured or
tricked.
Defense: Security awareness training, strict verification procedures, never giving info over phone.

Q: What is the difference between symmetric and asymmetric encryption?

Symmetric encryption: Same key is used for both encryption and decryption.
- Fast, used for encrypting large data. Examples: AES-256, DES
- Problem: How do you securely share the key with the other party?
Asymmetric encryption: Uses two keys – a public key (anyone can see) and private key (kept
secret).
- Message encrypted with public key can only be decrypted with private key.
- Examples: RSA, Elliptic Curve. Used in HTTPS, SSH.
- Slower but solves the key sharing problem.
In practice: HTTPS uses asymmetric encryption to securely exchange a symmetric key, then
uses symmetric for the data.

Page 28
SOC Analyst L1 & L2 Interview Preparation Guide

12.2 More L1 Questions – Quick Format

Question Key Points in Your Answer

What is a DMZ? Network zone between internet and internal network. Hosts public-
facing servers. Provides buffer – if hacked, internal network is
protected.
What is ARP spoofing? Attacker sends fake ARP replies to link their MAC to legitimate IP.
Enables Man-in-the-Middle attacks on local network.
What is a zero-day Attack exploiting a vulnerability that is unknown to the vendor. No patch
exploit? exists yet. Very dangerous.
What is OSINT? Open Source Intelligence – gathering information from publicly
available sources (LinkedIn, Shodan, DNS records, WHOIS).
What is port scanning? Probing a host to see which ports are open (i.e., what services are
running). Nmap is the most common tool.
What is NAT? Network Address Translation – converts private IPs to public IP for
internet communication. Hides internal network structure.
What is a honeypot? Decoy system designed to attract attackers. When they interact with it,
you learn about their techniques and can detect them.
What is PKI? Public Key Infrastructure – system that manages digital certificates.
Uses CA (Certificate Authority) to verify identity.
Difference between HTTP GET – requests data, parameters visible in URL. POST – sends data in
GET and POST? request body, not visible in URL. Both can be malicious.
What is OWASP Top 10? OWASP = Open Web Application Security Project. Top 10 = most
critical web vulnerabilities. Key ones: SQLi, XSS, Broken Auth, IDOR.

Page 29
SOC Analyst L1 & L2 Interview Preparation Guide

Section 13: SOC L2 Interview Questions & Answers

L2 questions require deeper technical knowledge and analytical thinking.

You should also show knowledge of tools, frameworks, and real investigation experience.

13.1 Advanced Technical Questions

Q: Explain the Cyber Kill Chain and how it helps in threat detection.

The Cyber Kill Chain (by Lockheed Martin) describes the 7 stages of a cyber attack:
1. Reconnaissance – Attacker gathers info (OSINT, port scanning)
2. Weaponization – Creates exploit + payload (malware + document)
3. Delivery – Sends payload to victim (phishing email, infected USB)
4. Exploitation – Exploit fires and executes code on victim system
5. Installation – Malware installs (persistence mechanism)
6. Command & Control (C2) – Infected system contacts attacker server
7. Actions on Objectives – Attacker achieves goal (data theft, ransomware)
How it helps: If you detect at stage 3 (Delivery), you stop the attack early. Each stage has
different detection opportunities.

Q: How would you investigate a potential ransomware incident?

Step 1 – ISOLATE affected machines immediately from network (but do NOT power off –
memory evidence!)
Step 2 – Identify the ransomware variant by checking ransom note and file extension (use ID
Ransomware tool)
Step 3 – Check SIEM for initial infection vector – phishing email? RDP brute force? Vulnerable
service?
Step 4 – Determine blast radius – which systems are affected? Check file shares.
Step 5 – Check for data exfiltration before encryption (many ransomware groups steal data first)
Step 6 – Preserve evidence – take memory dumps, disk images of affected systems
Step 7 – Check backups – are they intact and not encrypted?
Step 8 – Begin eradication – remove malware, patch the entry point
Step 9 – Restore from clean backups. Monitor for re-infection.
Step 10 – Report and write post-mortem

Q: What is Pass-the-Hash and how would you detect it?

Pass-the-Hash (PtH): After stealing a password HASH (not the actual password), an attacker can
use that hash to authenticate to Windows systems – no need to know the real password.

Page 30
SOC Analyst L1 & L2 Interview Preparation Guide

How: Attacker uses tools like Mimikatz to extract hashes from memory (LSASS process).
Detection indicators:
- Event ID 4648 (explicit credential logon) from unusual source
- NTLM authentication (Event ID 4776) from accounts that normally use Kerberos
- Lateral movement from a machine to many others in short time
- Mimikatz execution – look for Event 4688 with suspicious process names
Prevention: Credential Guard (Windows), privileged access workstations, disable NTLM where
possible.

Q: Explain how you would investigate a phishing email that was reported by a user.

Step 1 – Collect the email as an .eml file (full headers preserved)

Step 2 – Analyze headers: Check true sending server (Received headers), SPF/DKIM pass/fail
Step 3 – Check sender domain: Is it real? Registered recently? Similar to legitimate domain
(homoglyph)?
Step 4 – Analyze links: Hover over links. Use [Link] to check the URL safely.
Step 5 – Analyze attachments: Upload hash to VirusTotal. Use sandbox ([Link]) to detonate.
Step 6 – Search SIEM: Did anyone else receive this email? Did anyone click the link?
Step 7 – Check proxy logs: Any connections to the malicious domain from internal hosts?
Step 8 – If compromise found: Escalate to full IR process.
Step 9 – Block: Add domain/IP/sender to email gateway blocklist.
Step 10 – Notify: Inform affected users, consider company-wide phishing alert.

Q: What is lateral movement and how do attackers do it?

Lateral movement is when an attacker moves from one compromised system to other systems
within the network.
Goal: Reach higher-value targets (domain controller, database servers, executive machines).
Common techniques:
- Pass-the-Hash/Pass-the-Ticket: Use stolen credentials
- RDP (Remote Desktop): Use stolen creds to RDP to other machines (Event 4648, 4624 Type
10)
- SMB shares: Access shared folders, drop malware
- WMI/PowerShell remoting: Execute commands remotely
- PsExec: Run programs on remote systems
Detection: Look for unusual RDP connections, login anomalies, service creation on multiple hosts
in quick succession.

Q: What is the MITRE ATT&CK framework and how do you use it in SOC work?

MITRE ATT&CK is a knowledge base of real-world attacker tactics (why), techniques (how), and
procedures (specific steps).
Organized into Tactics (columns) > Techniques > Sub-techniques.
How SOC analysts use it:
- Map detected behaviors to ATT&CK IDs (e.g., T1059 = Command-Line Interface abuse)

Page 31
SOC Analyst L1 & L2 Interview Preparation Guide

- Identify gaps in detection coverage using ATT&CK Navigator

- Communicate findings consistently (everyone understands T1078 = Valid Accounts)
- Threat hunting – pick a technique and look for it proactively
- Build SIEM detection rules aligned to ATT&CK techniques

Q: What is SOAR and how does it benefit a SOC?

SOAR = Security Orchestration, Automation, and Response

It automates repetitive SOC tasks and orchestrates multiple security tools together.
Example workflow: Phishing email reported > SOAR automatically extracts IOCs > checks
VirusTotal
> blocks IP in firewall > disables user account > creates ticket > notifies analyst.
Benefits:
- Faster response time (seconds vs minutes/hours)
- Reduces analyst workload (handles L1 triage automatically)
- Consistent response process every time
- Allows analysts to focus on complex, high-value work
Popular platforms: Palo Alto XSOAR, Splunk SOAR, IBM Resilient, TheHive + Cortex.

Page 32
SOC Analyst L1 & L2 Interview Preparation Guide

13.2 L2 Quick Questions

Question Key Answer Points
What is a Golden Ticket Forging a Kerberos TGT using the KRBTGT hash (stolen via DCSync).
attack? Gives attacker unlimited access to any resource. Very serious. Detect
via Event 4769 anomalies.
What is DCSync attack? Impersonating a domain controller to request AD replication and
retrieve all password hashes. Mimikatz can do this. Detect: unusual
replication requests from non-DC machines.
What is DNS tunneling? Hiding data inside DNS queries to bypass firewall/DLP. Data is
encoded in subdomain labels. Detect via high DNS query volume, long
domain names, unusual query types.
What is a watering hole Infecting a website that the target regularly visits. When they visit the
attack? site, malware is delivered. Very stealthy.
Explain living-off-the-land Using built-in OS tools for malicious purposes to evade detection.
(LOLBins) Examples: PowerShell, certutil, msiexec, regsvr32, rundll32.
What is memory Analyzing RAM of a running or recently powered-off system. Can
forensics? reveal: running processes, network connections, decrypted data,
password hashes. Tools: Volatility, Rekall.
What is threat hunting? Proactively searching for threats that have bypassed automated
detection. Not reactive. Uses hypothesis: 'I think attackers may be
using LOLBins – let me look.'
What is CVE? Common Vulnerabilities and Exposures – standardized IDs for known
vulnerabilities. CVE-2021-44228 = Log4Shell. Use to communicate and
track specific vulnerabilities.

Page 33
SOC Analyst L1 & L2 Interview Preparation Guide

Section 14: Scenario-Based Interview Questions

Scenario questions test how you THINK and ACT under real conditions.

Use the STAR method: Situation > Task > Action > Result

Show structured thinking, not just knowledge. Talk through your thought process out loud.

Scenario 1: Unusual Outbound Traffic

SCENARIO: Your SIEM alerts that a workstation is making outbound connections to an unknown
IP

in Russia on port 443 at 2am, transferring 500MB of data. The workstation belongs to the HR
manager.

What do you do?

13. Immediate action: Don't panic. Document the alert time and details.
14. Isolate: Immediately isolate the workstation from the network (but keep it on for
forensics).
15. Investigate the IP: Look up the IP in VirusTotal, AbuseIPDB, Shodan. Is it known
malicious?
16. Check DNS logs: What domain does this IP resolve to? Legitimate or suspicious?
17. Check endpoint: What process was making the connection? (Netstat, EDR telemetry)
Was it a legitimate app?
18. Check email logs: Did the HR manager receive any suspicious emails recently?
19. DLP check: What data was transferred? HR files? Personal data?
20. Escalate: This looks like a data breach. Escalate to L2/CISO immediately with full
report.
21. Preserve evidence: Take memory dump and disk image before any remediation.

Scenario 2: Multiple Failed Login Alerts

SCENARIO: You see 200 failed login attempts (Event 4625) in the last 10 minutes

for the account '[Link]' from IP [Link]. Then 1 successful login.

What happened and what do you do?

This is a textbook brute force attack that likely succeeded.

22. Identify: This is a Credential Brute Force attack, followed by successful compromise.

Page 34
SOC Analyst L1 & L2 Interview Preparation Guide

23. Disable account: Immediately disable [Link]'s account to prevent further access.
24. Investigate the source IP: [Link] – check in threat intel feeds. Is it a known
VPN/TOR/attack IP?
25. What happened after login: Check Event 4624 (successful login). What did they do?
Any new processes, file access, privilege escalation?
26. Check for persistence: Did they create any new accounts (Event 4720)? Add to admin
group (4732)? Create scheduled tasks?
27. Password reset: Force password reset for all potentially affected accounts.
28. Block IP: Add source IP to firewall block list.
29. Scope: Was only this account targeted, or were others also hit? Check for same source
IP attacking other accounts.

Scenario 3: User Reports Encrypted Files

SCENARIO: A user calls saying all their files now have '.locked' extension and there's

a ransom note on the desktop. What is your immediate response?

30. STOP: Tell the user to STOP using the computer immediately. Do not try to fix it
themselves.
31. Isolate NOW: Disconnect from network immediately (unplug ethernet, disable WiFi).
Ransomware spreads fast over SMB shares.
32. Preserve: Do NOT power off the machine. Keep it running – memory may contain
encryption keys.
33. Identify variant: Take a photo of the ransom note. Use ID Ransomware website to
identify the family.
34. Scope it: Check SIEM and file servers – are other machines affected? Is the network
share encrypted?
35. Find Patient Zero: When did this start? Check Event logs for initial execution. How did it
get in?
36. Escalate: This is a P1 Critical incident. Escalate to L2, CISO, IT Management now.
37. Backups: Check backup status. Are they clean? Were they encrypted too?

Scenario 4: Tell Me About a Time You Investigated an Alert

This is asked to test your actual experience. Even if you have limited experience,

you can reference lab work, CTF challenges, or describe a hypothetical using the correct
process.

Sample answer structure:

• Situation: "During my internship / home lab / CTF, I received an alert for..."
• Task: "My role was to investigate whether this was a true positive and determine the
scope."

Page 35
SOC Analyst L1 & L2 Interview Preparation Guide

• Action: "I started by checking the SIEM for context, then looked up the IP in VirusTotal,
then checked endpoint logs for related activity..."
• Result: "I determined it was [false positive / true positive]. I documented my findings and
[escalated / closed the ticket]."

Page 36
SOC Analyst L1 & L2 Interview Preparation Guide

Section 15: Certifications Roadmap

Certifications signal competency to employers. Here is the recommended path:

Level Certification Why You Need It

Beginner (Start CompTIA Security+ Industry baseline. Covers all fundamental
Here) SOC concepts. Almost always required for
SOC roles.
Beginner CompTIA Network+ Deep networking knowledge. Highly
recommended before Security+.
Beginner Free Google Cybersecurity Accessible, free with aid. Good intro to SOC,
Certificate (Coursera) SIEM, Python.
Intermediate CompTIA CySA+ Focused on threat detection and analysis.
L1/L2 (Cybersecurity Analyst) Perfect for SOC roles.
Intermediate CEH (Certified Ethical Hacker) Understanding attacker mindset. Helps with
threat hunting.
SIEM Specific Splunk Core User + Power Hands-on Splunk skills. Very valued in
User interviews.
Advanced GCIH (GIAC Incident Handler) Deep incident response expertise. Gold
standard for L2+.
Advanced GCFE / GCFA (GIAC Digital forensics skills for L2/L3 roles.
Forensics)
Advanced OSCP (Offensive Security) Penetration testing certification. Helps L3
threat hunters.

Free resources to build practical skills:

- TryHackMe ([Link]) – SOC Level 1 and 2 learning paths

- Hack The Box ([Link]) – Practical attack and defense labs

- Blue Team Labs Online ([Link]) – SOC-focused exercises

- SANS Cyber Aces – Free intro to OS, networking, security

- LetsDefend ([Link]) – SOC simulation platform

Page 37
SOC Analyst L1 & L2 Interview Preparation Guide

Section 16: 30-Day Study Plan

This plan takes you from basics to interview-ready in 30 days.

Study 2-3 hours per day. Mix reading with hands-on practice.

Week Focus Area What to Do

Week 1 (Days Foundations Study OSI model, TCP/IP, ports, DNS, firewall basics.
1-7) Watch Professor Messer Security+ videos. Complete
TryHackMe Pre-Security Path.
Week 2 (Days Security Core Concepts Study CIA triad, encryption, authentication, IDS/IPS,
8-14) incident response phases. Read NIST SP 800-61.
Practice Splunk queries on Splunk Boss of the SOC.
Week 3 (Days Tools & Hands-On Install and practice Wireshark, Nmap, Splunk free trial.
15-21) Complete TryHackMe SOC Level 1 path. Practice
reading Windows event logs. Try LetsDefend alert
investigations.
Week 4 (Days Interview Prep Review all Q&A sections in this guide. Practice
22-30) explaining answers out loud. Do 2 mock interviews.
Research target companies' security tools. Prepare 3
scenario answers using STAR method.

Daily Study Template

Time Block Activity
30 minutes Review previous day's notes / flashcards
60 minutes Study new concept from this guide
60 minutes Hands-on practice (TryHackMe / LetsDefend / Splunk lab)
30 minutes Practice explaining 3 interview questions out loud

Page 38
SOC Analyst L1 & L2 Interview Preparation Guide

Section 17: Quick Reference Cheat Sheet

Port Numbers Quick Reference

Port Service Note
20/21 FTP File transfer (21=control, 20=data)
22 SSH Secure remote access
23 Telnet Insecure remote access – avoid!
25 SMTP Send email
53 DNS Name resolution – monitor for tunneling
80 HTTP Web traffic – unencrypted
110 POP3 Receive email
143 IMAP Email access
443 HTTPS Secure web traffic
445 SMB Windows file sharing – often exploited
3389 RDP Remote desktop – common attack target
1433 MSSQL SQL Server database

Critical Windows Event IDs

Event ID Meaning Alert Level
4624 Successful logon Low – but check for anomalies
4625 Failed logon Medium – many = brute force
4648 Logon with alternate High
credentials
4672 Admin logon Medium – monitor always
4688 Process created Medium – watch for malware
4698/4702 Scheduled task High
created/modified
4720 User account created High
4732 User added to group Critical
7045 New service installed Critical

Page 39
SOC Analyst L1 & L2 Interview Preparation Guide

Acronyms Reference
Acronym Stands For One-Line Definition
APT Advanced Persistent Threat Sophisticated, long-term attack by organized group
C2/C&C Command and Control Attacker's server that controls malware
CVE Common Vulnerabilities and Unique ID for known vulnerabilities
Exposures
EDR Endpoint Detection and Advanced endpoint security and monitoring
Response
IOC Indicator of Compromise Evidence of security breach
LOLBin Living off the Land Binary Using built-in OS tools maliciously
OSINT Open Source Intelligence Intel from public sources
SOC Security Operations Center Team that monitors and responds to threats
TTP Tactics, Techniques, How attackers operate (MITRE ATT&CK)
Procedures
UEBA User Entity Behavior Detects anomalies in user/system behavior
Analytics

Interview Day Tips

• Structure your answers: Use STAR (Situation, Task, Action, Result) for scenario
questions.
• Think out loud: For technical questions, talk through your reasoning – they want to see
how you think.
• Say 'I don't know' correctly: If you don't know, say: 'I haven't encountered that specific
scenario, but I would approach it by...'
• Ask clarifying questions: For scenarios, ask clarifying questions – this shows
analytical thinking.
• Know your resume: Be ready to discuss anything you've listed. Have specific
examples.
• Show curiosity: Mention labs, CTFs, home projects – it shows genuine passion for
security.

Good luck with your interviews! Stay curious, keep learning, and you've got this.

Page 40