SHABAN RAZAcybersecurity expert

[ careers ]

SOC Analyst Interview Questions and Answers: 30 Questions to Prepare For

30 real SOC analyst interview questions with model answers on networking, logs, SIEM, incident response and scenarios, from a hiring cybersecurity manager.

By / / 4 min read

As a cybersecurity manager, I interview SOC analyst candidates regularly. Most fail not because they lack certifications, but because they cannot explain fundamentals clearly or reason through a scenario. These are the kinds of questions I ask, with what a strong answer includes. Use them to prepare, not to memorise.

Networking and fundamentals

  1. What happens when you type a URL into a browser? DNS resolution, TCP handshake, TLS negotiation, HTTP request and response. Bonus points for mentioning where security controls sit along the way.
  2. TCP vs UDP? Connection-oriented and reliable vs connectionless and fast; give examples such as HTTPS over TCP and DNS mostly over UDP.
  3. What are ports 22, 53, 80, 443, 445 and 3389? SSH, DNS, HTTP, HTTPS, SMB, RDP. Explain why exposed 445 and 3389 are dangerous.
  4. Explain the CIA triad. Confidentiality, integrity, availability, with an attack example for each.
  5. Symmetric vs asymmetric encryption? Shared key vs public/private key pair, and how TLS uses both.
  6. Hashing vs encryption? One-way vs reversible; why passwords are hashed, not encrypted.

Logs, SIEM and detection

  1. What is a SIEM and how does it work? Collection, normalisation, correlation, alerting, retention. See my SIEM guide.
  2. Which Windows event IDs do you know? 4624 (successful logon), 4625 (failed logon), 4672 (special privileges assigned), 4688 (process creation), 4720 (user account created), 4732 (member added to a security-enabled local group).
  3. What is a false positive, and how do you handle one? Benign activity that triggers an alert; investigate, document and tune the rule without blinding it.
  4. What is the difference between an event, an alert and an incident?
  5. What is MITRE ATT&CK? A knowledge base of attacker tactics and techniques. See my ATT&CK guide.
  6. What is an indicator of compromise vs an indicator of attack? Evidence that a compromise happened vs signs of attacker behaviour in progress.

Threats and attacks

  1. How would you identify a phishing email? Headers, sender domain, SPF/DKIM/DMARC results, links, attachments, urgency. See my phishing guide.
  2. Explain brute force vs password spraying. Many passwords against one account vs one password against many accounts.
  3. What is lateral movement? Moving from one compromised system to others, for example with stolen credentials and remote execution tools.
  4. How does ransomware typically unfold? Initial access, privilege escalation, lateral movement, exfiltration, backup destruction, encryption.
  5. What is SQL injection? Untrusted input executed as part of a database query; prevented with parameterised queries.
  6. What is a C2 beacon and how might you spot one? Regular outbound connections at fixed intervals to rare domains.

Incident response

  1. Name the phases of incident response. Preparation, identification, containment, eradication, recovery, lessons learned.
  2. Why not simply power off an infected machine? Memory evidence is lost; isolate it from the network instead.
  3. What is the first thing you do when you confirm an incident? Follow the playbook, escalate, and contain according to severity, documenting everything.
  4. How do you prioritise multiple alerts? Asset criticality, severity, confidence and potential for spread.

Scenario questions

  1. A user reports they entered their password on a fake login page. What do you do? Reset the password, revoke sessions, check sign-in logs, inbox rules and MFA changes, search for the same email in other mailboxes and block the domain.
  2. You see 500 failed logins followed by one success from a foreign country. Treat as likely compromise: disable or reset the account, revoke sessions, investigate what the account accessed.
  3. An endpoint shows PowerShell downloading a file from an unknown domain. Examine the command line and parent process, check the domain reputation, isolate the host if malicious and scope other affected hosts.
  4. A server is suddenly sending large volumes of data to a cloud storage provider at night. Possible exfiltration: confirm with the owner, block if unauthorised, preserve evidence and escalate.

About you

  1. Walk me through a lab or CTF challenge you solved. This is where hands-on candidates stand out.
  2. How do you keep up with threats? Name specific sources you actually read.
  3. Tell me about a mistake you made and what you learned.
  4. Why do you want to work in a SOC?

Final tips

Say "I don't know, but here is how I would find out" rather than guessing. Think out loud in scenarios. Build a home lab with a free SIEM and write about it; it gives you real stories to tell. My cybersecurity career roadmap for Pakistan explains how to build those skills.

References and further reading

  1. Microsoft: Audit logon events (Event 4624)
  2. MITRE ATT&CK
  3. Microsoft Certified: Security Operations Analyst Associate (SC-200)
  4. Wazuh documentation

Frequently asked questions

What questions are asked in a SOC analyst interview?

Expect networking fundamentals, common ports, Windows event IDs, SIEM concepts, attack types such as phishing and lateral movement, incident response phases, and scenario questions about investigating suspicious activity.

What are important Windows event IDs for SOC analysts?

Commonly asked IDs include 4624 (successful logon), 4625 (failed logon), 4672 (special privileges assigned), 4688 (process creation), 4720 (user account created) and 4732 (member added to a security-enabled local group).

How do I prepare for a SOC analyst interview?

Strengthen networking and operating system fundamentals, practise log analysis in a home lab with a free SIEM, study MITRE ATT&CK, and prepare to explain hands-on labs or CTF challenges you have solved.

Related articles