Top 50 SOC Analyst Interview Questions and Answers (With Triage Scenarios)

Key takeaways

• Interviewers test how you triage and reason, not only definitions.
• Know your fundamentals: CIA triad, SIEM vs SOAR, IDS vs IPS, false positives, ATT&CK.
• Learn key Windows event IDs, Linux auth logs and common ports.
• Practise walking through scenarios aloud: check, decide, escalate, document.
• Back every answer with something you have done in a home lab.

How should you prepare for a SOC analyst interview?

Interviewers want to see how you think, not whether you can recite definitions. Below are 50 questions grouped by topic, with answers written to be spoken in your own words. Where a question asks "what do you do", walk through your steps in order and say what you would check at each step. If you do not know something, say how you would find out.

Three habits that help: practise on a home lab (a SIEM such as Splunk or Elastic with sample logs), keep a short list of three investigations you have done, and learn to explain an alert out loud in under a minute.

Role and fundamentals

1. What does a SOC analyst do?

Monitors alerts from security tools, decides which are real, investigates them, escalates or contains incidents and documents what happened. Tier 1 triages, Tier 2 investigates in depth, and Tier 3 hunts threats and improves detections.

2. What is the difference between an event, an alert and an incident?

An event is any observable occurrence, such as a login. An alert is an event or pattern a rule flagged. An incident is a confirmed or likely security violation that needs a response.

3. What is the CIA triad?

Confidentiality (only authorised people read data), Integrity (data is not altered improperly) and Availability (systems and data are usable when needed). Most incidents can be described by which of the three they harm.

4. What is a SIEM and why is it used?

A SIEM collects logs from many sources, normalises them, correlates events and raises alerts. It gives analysts one place to search and investigate. Examples include Splunk, Microsoft Sentinel and Elastic Security.

5. What is the difference between a SIEM and a SOAR?

SIEM detects and investigates by collecting and correlating logs. SOAR automates the response, for example enriching an IP, opening a ticket or blocking an address through playbooks.

6. What is the difference between IDS and IPS?

An IDS detects suspicious traffic and alerts. An IPS sits inline and can also block it. An IPS can cause outages if rules are wrong, so tuning matters.

7. What is the difference between a vulnerability, a threat and a risk?

A vulnerability is a weakness, a threat is something that can exploit it, and risk is the likelihood and impact of that happening.

8. What is a false positive and a false negative?

A false positive is a harmless activity flagged as malicious. A false negative is a real attack that goes undetected. Too many false positives cause alert fatigue; false negatives are the more dangerous.

9. What is MITRE ATT&CK and how do SOCs use it?

It is a public knowledge base of attacker tactics and techniques. SOCs map detections to techniques, find coverage gaps and describe incidents in a common language.

10. What is the cyber kill chain?

A model of attack stages: reconnaissance, weaponisation, delivery, exploitation, installation, command and control, and actions on objectives. Defenders try to break the chain as early as possible.

Networking and logs

11. Explain the TCP three-way handshake.

The client sends SYN, the server replies SYN-ACK and the client sends ACK. A flood of SYNs without final ACKs can indicate a SYN flood or a scan.

12. Which ports and protocols should a SOC analyst know?

Common ones are 22 SSH, 23 Telnet, 25 SMTP, 53 DNS, 80 HTTP, 443 HTTPS, 445 SMB, 3389 RDP and 3306 MySQL. Unexpected use of these, such as RDP from the internet, is worth investigating.

13. What is DNS tunnelling?

Data is hidden inside DNS queries and responses to reach an attacker's server. Signs include very long or random-looking subdomains, high query volume to one domain and unusual TXT records.

14. What is the difference between a firewall and a WAF?

A network firewall filters by IP, port and protocol. A web application firewall inspects HTTP traffic to block attacks such as SQL injection and cross-site scripting.

15. Which Windows event IDs are important?

4624 successful logon, 4625 failed logon, 4672 special privileges assigned, 4688 process creation, 4720 account created, 4768 and 4769 Kerberos tickets, and 1102 audit log cleared. Always read them with context.

16. Where do you look for Linux authentication logs?

Usually /var/log/auth.log on Debian-family systems and /var/log/secure on Red Hat family systems, or the journal with journalctl.

17. What is a proxy log useful for?

It shows which users and hosts requested which URLs, with response codes and bytes. It helps find malware downloads, command-and-control beaconing and data exfiltration.

18. What is beaconing?

Malware contacting its controller at regular intervals. Regular timing, small packets and a rare destination are the clues, even when the traffic is encrypted.

19. How do you tell whether traffic is encrypted malware or normal HTTPS?

You cannot from payload alone. Use metadata: destination reputation, certificate details, JA3 or similar fingerprints, timing patterns, volume, and endpoint telemetry showing which process made the connection.

20. What is a packet capture used for in a SOC?

Pcaps give the full detail of network conversations for deep investigation. Analysts open them in Wireshark to follow streams, extract files and confirm what an alert actually saw.

Alert triage and investigation

21. How do you triage an alert?

Read the rule and why it fired, check the asset and user, look for related activity, enrich indicators with threat intelligence, decide true or false positive, then escalate, contain or close with notes.

22. A user reports a suspicious email. What do you do?

Collect the original message with headers, check sender, links and attachments in a safe sandbox, search the mail system for other recipients, block indicators, and reset credentials if anyone clicked or entered details.

23. What is in an email header that helps an investigation?

The Received chain, Return-Path, SPF, DKIM and DMARC results, the originating IP and Message-ID. A mismatch between From and Return-Path is a common sign of spoofing.

24. You see many failed logons followed by one success. What does it suggest?

Brute force or password spraying that succeeded. Check source IPs, the account, what the account did after the success, and whether MFA was in place. Reset the credential if confirmed.

25. How do you investigate a suspected malware infection on a laptop?

Isolate the host through the EDR, collect process and network data, identify the file hash and parent process, check the hash against threat intelligence, look for persistence and lateral movement, then remediate or reimage.

26. What is lateral movement and how is it detected?

Attackers moving from one system to another using stolen credentials or remote tools. Look for unusual SMB, RDP or WinRM connections, new admin logons across hosts and tools such as PsExec.

27. What is privilege escalation?

Gaining higher rights than originally obtained. Detections include new members in admin groups, unusual use of sudo or token manipulation, and exploitation of local vulnerabilities.

28. What indicators suggest data exfiltration?

Large outbound transfers, uploads to personal cloud services, archives created just before transfers, traffic at odd hours and DNS or ICMP patterns carrying data.

29. What is an IOC and how is it different from a TTP?

An indicator of compromise is a specific artefact such as a hash or IP address. A TTP describes behaviour, such as credential dumping. IOCs expire quickly; behaviour-based detections last longer.

30. How do you decide the severity of an incident?

Consider the asset value, data sensitivity, scope, confirmed attacker activity and business impact. Follow your organisation's severity matrix and escalate when unsure.

Incident response

31. What are the phases of incident response?

Preparation, detection and analysis, containment, eradication and recovery, and post-incident activity. These follow the widely used NIST incident handling guidance.

32. What is the difference between containment and eradication?

Containment stops the spread, for example by isolating a host. Eradication removes the cause, such as malware, backdoors and compromised accounts.

33. What is the order of volatility?

Collect the most short-lived evidence first: memory and running processes, then network state, then disk, then logs and backups. Capture memory before shutting down a suspect machine when policy allows.

34. Why is chain of custody important?

It documents who handled evidence and when, so it stays admissible and trustworthy. Record hashes, times, tools and people.

35. What do you do during a ransomware incident?

Isolate affected hosts, preserve evidence, identify the strain and entry point, protect backups, notify leadership and legal, and restore from clean backups. Decisions about payment belong to management and legal advisers.

36. When must incidents be reported in India?

CERT-In directions require certain cyber incidents to be reported within a stated time window. Check the current text on the CERT-In website and your legal team's procedure.

37. What goes into a post-incident review?

A timeline, root cause, what worked, what failed, detection gaps, and tracked actions with owners. The aim is learning, not blame.

38. How do you handle a suspected insider threat?

Handle it quietly and by the book: preserve logs and evidence, involve HR and legal early, limit who knows, and avoid confronting the person. Look for unusual access, large downloads and activity outside normal hours.

39. What do you tell management during an incident?

Give a short, factual update: what happened, what is affected, what you have done, what you need and when the next update comes. Separate confirmed facts from assumptions.

40. What is a playbook and a runbook?

A playbook describes the decision flow for a scenario such as phishing. A runbook gives the exact operational steps for a task. Both make responses consistent.

Tools and detection engineering

41. What is EDR and how does it differ from antivirus?

EDR records endpoint activity, detects behaviour and lets analysts investigate and respond remotely. Traditional antivirus mostly matches known malicious files.

42. How would you write a detection for brute force logons?

Count failed logons per account or source in a time window, set a threshold based on normal behaviour, exclude known scanners, and alert on a success after many failures.

43. What is threat hunting?

Proactively searching for signs of compromise that alerts missed, usually starting from a hypothesis based on threat intelligence or an ATT&CK technique.

44. What is the difference between hashing and encryption?

Hashing is one-way and verifies integrity, while encryption is reversible with a key and protects confidentiality. File hashes identify known malware.

45. What is sandboxing?

Running a suspicious file in an isolated environment to observe its behaviour safely. Some malware detects sandboxes and stays quiet.

46. What is a honeypot?

A decoy system designed to attract attackers so defenders can study their methods and receive early warning. Any interaction is suspicious by definition.

47. What is Zero Trust?

A model that assumes no user or device is trusted by default. Every request is verified using identity, device health and context, and access is kept to the minimum.

48. How do you reduce alert fatigue?

Tune noisy rules, add context and enrichment, automate repetitive checks, group related alerts and review which detections never lead to action.

49. Which metrics show whether a SOC is working?

Mean time to detect and respond, false positive rate, alert volume per analyst, detection coverage against ATT&CK and the proportion of incidents found by internal detection.

50. Why do you want to work in a SOC?

Give an honest answer: you like investigating puzzles, working shifts as a team and learning how attacks work. Tie it to something you have practised, such as a lab or a capture-the-flag you completed.

Practice triage scenarios

These are practice prompts, not real cases. Answer each aloud: what do you check first, what would make it a true positive, and who do you tell?

1. An alert shows a finance user logged in from two countries within ten minutes.
2. Your EDR shows winword.exe starting powershell.exe with an encoded command.
3. A server that normally sends little traffic uploads several gigabytes at 3 am.
4. Multiple hosts query the same newly registered domain every 60 seconds.
5. An admin account is added to the Domain Admins group outside a change window.

Common mistakes in SOC interviews

• Naming tools without explaining what they showed you.
• Skipping documentation and escalation, which are half the job.
• Claiming every alert is an attack instead of showing judgement about false positives.
• Describing offensive steps against live systems; always say you work within authorisation.

Next steps

To build practical skills for the role, see our Certified SOC Analyst course. For more questions, read SOC analyst technical interview questions and SOC analyst skills and qualifications.

Related reading

• What Are the Six Phases of Incident Response in Cybersecurity? Step-by-Step Guide for 2026