You see 500 failed logins on one account followed by a success. What next?

Treat it as a likely compromise. Confirm the failed then successful logon pattern, check the source IP and account privilege, review post login activity, reset the account and kill sessions, block the IP and look for password spraying.

You have five alerts at once. How do you prioritise them?

Rank by asset criticality, impact and confidence rather than severity labels. Domain admin and server alerts first, then phishing, then single workstation malware, then low risk items. Communicate your order to your lead.

Which Windows event IDs do you check for account compromise?

4624 and 4625 for logons, 4672 for special privileges, 4688 for process creation, 4720 for account creation, 4728 and 4732 for privileged group changes, 4768 and 4769 for Kerberos, and 1102 for cleared audit logs.

How do you detect lateral movement in a network?

Look for unusual SMB, RDP and WinRM connections, network and remote desktop logons from odd sources, new services, PsExec or WMI use, and one account logging into many hosts. Baseline normal behaviour and map findings to MITRE ATT&CK.

A host sends thousands of DNS queries to random subdomains. What could it be?

It suggests DNS tunneling or malware using a domain generation algorithm. Check domain age, query volume and record types, identify the process, block the domain, isolate the host and hunt for other hosts.

A user logs in from India and then Germany 20 minutes later. What do you check?

Rule out VPNs and proxies, check device, user agent and MFA results, check IP reputation and confirm with the user. If unconfirmed, revoke sessions, reset the password and review mailbox rules.

A critical server stops sending logs to the SIEM for three hours. What do you do?

Treat silence as a detection gap. Check the forwarder, connectivity and server status, ask owners about maintenance, escalate if unexplained, review the last events before the silence and record the blind window.

A workstation uploads 5 GB to an unknown cloud domain at 2 am. What now?

Check proxy and firewall logs for destination, user and volume, confirm whether the service is approved, identify the process through EDR, isolate the host and block the domain if unauthorised, and escalate.

Users report renamed files and a ransom note. What is your immediate response?

Isolate affected hosts without powering them off, trigger the incident response plan, find patient zero and the entry point, confirm backups are safe, block IOCs, preserve evidence and use the designated communication channel.

SOC Analyst Interview Questions and Answers

Q: A user reports a suspicious email asking them to reset their password. What do you do as a SOC analyst?

Do not click anything. Get the original email with headers, check SPF, DKIM and DMARC, analyse URLs and attachments in a sandbox, search mail logs for other recipients, reset credentials if anyone clicked, then block and remove the email.

Q: Your EDR flags a suspicious PowerShell process on a finance laptop. What are your first moves?

Review the process tree, parent and command line, check hashes and domains, isolate the host through the EDR without wiping it, search the fleet for the same indicators and escalate with a clear summary.

Q: The same internal IP triggers a port scan alert every day. How do you handle it?

Verify the owner of the IP, confirm the authorised schedule, then tune the rule narrowly with documentation and a review date. Never disable a detection rule globally.

Q: When do you escalate to L2 and what goes in the handoff?

Escalate when an incident is confirmed or likely and beyond your playbook, or involves privileged accounts, several hosts or data loss. Include a summary, timeline, assets, IOCs, evidence and actions taken.

SOC Interview Prep

SOC analyst interview questions: 15 scenarios with answers

SOC interviews are mostly scenarios. The interviewer describes an alert and watches how you think. These are the 15 scenarios that come up again and again, with a model answer for each, so you can practise how to think instead of memorising lines.

By Techonquer | Updated 13 November 2026 | 12 min read

15 questions

Scenario based, with answers

5 groups

Triage to major incidents

L1 and L2

Entry to mid level SOC roles

Before you start

How to answer any SOC scenario question

Interviewers are not checking whether you remember a perfect script. They want to see a calm, repeatable way of thinking. Use the same five steps for every scenario and you will rarely get lost.

STEP 1

Understand

What happened, to whom, and how bad could it be

STEP 2

Verify

Is it real? Check logs and context before reacting

STEP 3

Contain

Stop the spread without destroying evidence

STEP 4

Escalate

Hand off clearly when it goes beyond your playbook

STEP 5

Document

Write down what you saw and what you did

Say it out loudPractise answering these questions aloud, not just reading them. A good answer starts with what you would check first, then what you would do.

Recommended program

Want to practise these scenarios with real tools?

Reading answers helps, but doing the work is what makes them stick. If you want a structured way to learn SOC skills hands on, take a look at the SOC Training program at Techonquer.

Explore the SOC Training program

Group 01Questions 1 to 3

Alert triage

The bread and butter of an L1 role. These test whether you have a clear, safe process for the most common alerts.

A user reports a suspicious email asking them to reset their password. What do you do?

Do not click anything. Ask the user to forward the email as an attachment so you keep the original headers
Check the sender, the reply to address and the SPF, DKIM and DMARC results in the headers
Pull out every URL and attachment and check them in a sandbox and against reputation sources such as VirusTotal and URLScan
Search the mail logs for the same sender, subject or URL to find everyone else who received it
If anyone clicked or opened it, check proxy and EDR logs for what happened next, reset their password and revoke their sessions
Block the sender and the URL, remove the email from all mailboxes, document it and give the user quick feedback

What they want to hearA repeatable process that scopes the whole campaign, not just the one email that was reported.

You see 500 failed logins on one account from one IP in five minutes, then a success. What next?

Treat a success after many failures as a likely compromise until you prove otherwise
Confirm the pattern in the logs: failed logons (4625) followed by a successful one (4624) from the same source
Check the source IP reputation and location, and whether the account is privileged
Review what the account did after logging in: new processes, mailbox rules, file access and other logins
Disable or reset the account, kill active sessions and block the IP
Check whether the same IP tried other accounts, which points to password spraying, and recommend MFA and a lockout policy

What they want to hearThe order: confirm, scope, contain, then improve the control.

Your EDR flags a suspicious PowerShell process on a finance laptop. What are your first moves?

Open the alert context: the process tree, the parent process and the full command line
Look for red flags: launched from Word or Outlook, encoded commands, download cradles and hidden windows
Check file hashes and any contacted domains against reputation sources
If it looks malicious, isolate the host through the EDR, but do not wipe it, because you need the evidence
Search the rest of the fleet for the same hash, command line or domain
Escalate to L2 or incident response with a clear summary

What they want to hearIsolate, do not wipe, and hunt across the fleet instead of fixing one machine.

Learn the skills

SOC Training program All courses

Group 02Questions 4 to 6

Tuning and judgement

These separate analysts who follow steps from analysts who make good decisions under pressure.

The same internal IP triggers a port scan alert every day. How do you handle it?

Do not just suppress it. First work out whether it is really benign
Identify the owner of the IP in the asset inventory. It is often an authorised vulnerability scanner
Confirm the schedule and approval with the team that runs it
If it is legitimate, tune the rule narrowly: that source IP and that time window, with a documented reason and a review date
If nobody owns it, treat it as suspicious and escalate
Never disable a detection rule globally to make the noise go away

What they want to hearTuning backed by evidence and documentation, not silencing alerts.

Five alerts arrive at once: malware on a workstation, a phishing report, a failed VPN login, an AV alert on a server, and a domain admin login at 3 am. How do you prioritise?

Rank by asset criticality, possible impact and confidence, not by the severity label alone
First: the odd hour domain admin login and the AV alert on the server. Both involve high value assets
Second: the phishing report, because it can spread to many users while you wait
Third: malware on a single workstation, then the failed VPN login
Tell your lead what you are doing first and why, and ask for help if two items are both urgent

What they want to hearRisk based thinking and clear communication.

When do you escalate to L2, and what goes in the handoff?

Escalate when an incident is confirmed or likely and goes beyond your playbook: privileged accounts, several hosts, data loss, or anything high impact you are unsure about
Do not sit on it hoping to be certain. A fast escalation with partial information beats a late perfect one
Include a one line summary, a timeline, affected users and assets, IOCs, links to evidence, what you already did and what you recommend next

What they want to hearNo ego about escalating, and a handoff someone can act on without asking you questions.

Group 03Questions 7 to 9

Detection skills

Technical questions dressed as scenarios. Name specific log sources and event IDs wherever you can.

Which Windows event IDs would you check for a suspected account compromise, and why?

4624 and 4625 successful and failed logons. Check the logon type: 3 is network, 10 is remote desktop
4672 special privileges assigned to a new logon, which flags admin level access
4688 process creation, especially with command line auditing turned on
4720 account created, and 4728 or 4732 member added to a privileged group
4768 and 4769 Kerberos ticket requests, useful for spotting abuse
1102 the audit log was cleared, a strong sign someone is covering their tracks

What they want to hearThe IDs and the reason each one matters, not a memorised list.

How would you detect an attacker moving laterally in the network?

Look for workstation to workstation connections over SMB, RDP and WinRM, which are rare in a healthy environment
Watch for network logons (type 3) and remote desktop logons (type 10) from unusual sources
New service creation (event 7045) and tools such as PsExec or remote WMI
One account logging in to many hosts in a short time, or access to admin shares
Baseline what normal looks like, and map findings to MITRE ATT&CK lateral movement techniques

What they want to hearYou know normal first, and you speak in ATT&CK terms.

A host sends thousands of DNS queries to long random looking subdomains. What could it be?

This pattern points to DNS tunneling for command and control or data exfiltration, or malware using a domain generation algorithm
Check the domain age and reputation, the volume of queries, the record types (TXT is common) and which process makes them
Block the domain at DNS or the proxy, and isolate the host if the process looks malicious
Hunt for other hosts that queried the same domain

What they want to hearYou name both possibilities and widen the hunt beyond one host.

Group 04Questions 10 to 12

Visibility and identity

Identity attacks and blind spots are where many real incidents hide.

Q10

A user logs in from India, then from Germany 20 minutes later. What do you check?

Rule out the boring explanations first: a VPN, a proxy or a mobile carrier gateway
Check the device, the user agent and whether MFA was passed on both logins
Check both IP addresses against reputation sources
Contact the user through a trusted channel to confirm
If they cannot confirm, revoke sessions, reset the password, and review mailbox rules and recent activity

What they want to hearVerify before panicking, but act if it cannot be confirmed.

Q11

A critical server has sent no logs to the SIEM for three hours. What do you do?

Treat silence as a detection gap, not as good news. Attackers sometimes disable logging first
Check the log forwarder or agent status, network connectivity and whether the server is up
Ask the system owners whether maintenance or a change explains it
If there is no explanation, escalate as potentially suspicious and review the last events before the silence
Restore logging, and record the blind window in the incident notes

What they want to hearYou understand that missing data is itself a signal.

Q12

A critical CVE is announced. What is your role as a SOC analyst?

Confirm whether you are actually exposed: check the asset inventory and vulnerability scanner for affected systems
Look for exploitation attempts in WAF, IDS and server logs, and search for published IOCs
Work with the vulnerability and patch teams on priority and timing
Suggest compensating controls until patching: a WAF rule, blocking the exposure, extra monitoring
Report what you found, even if the answer is nothing

What they want to hearYour job is detect and monitor, not patch, and you coordinate with the team that does.

Group 05Questions 13 to 15

Major incidents

High stakes scenarios. The right answer is almost always: contain, preserve evidence, escalate.

Q13

A workstation uploads 5 GB to an unknown cloud storage domain at 2 am. What now?

Pull the proxy and firewall logs: destination domain, user, device, volume and duration
Check whether the destination is an approved business service
Identify the responsible process through the EDR, since it could be backup software or malware
If it is unauthorised: isolate the host, block the domain and preserve the logs
Escalate to incident response, and work out what data it was using file access logs and DLP

What they want to hearFacts first, then containment, then escalation.

Q14

Several users report files renamed with a strange extension and a ransom note. What is your immediate response?

Contain first: isolate affected hosts from the network through the EDR or by disabling the switch port. Do not power them off yet, because memory can hold evidence
Trigger the incident response plan and escalate immediately
Find patient zero and the entry point, such as a phishing email or exposed RDP
Check that backups are offline and untouched
Block known IOCs, preserve evidence and use the designated communication channel. Payment decisions are never an L1 call

What they want to hearContain, escalate, and do not play hero.

Q15

An employee who just resigned is downloading a huge number of documents. What do you do?

Handle it quietly and carefully. This may be an insider risk, and confronting the person is not your job
Check DLP and proxy logs for volume, file types and destinations such as personal cloud storage or email
Compare it with the person's normal behaviour to separate real risk from routine work
Preserve evidence and escalate to your lead, HR and legal according to policy
Do not tip off the employee or discuss it with colleagues

What they want to hearDiscretion, process and evidence.

Learn the skills

SOC Training program All courses

Interview day

How to stand out in a SOC interview

Think out loud. Narrate what you would check and why. A silent correct answer scores lower than a clear reasoning process
Name real sources. SIEM, EDR, proxy, DNS, mail gateway and event IDs make you sound like someone who has done the work
Admit what you do not know. Say what you would look up or who you would ask. Bluffing is the fastest way to lose trust
Bring a home lab story. One alert you investigated in a lab, explained start to finish, beats a list of tools
Ask about the team. Shift pattern, tooling and how escalation works show that you think like an analyst

Avoid these

Mistakes that cost candidates the offer

Jumping straight to the fix before verifying that the alert is real
Wiping or rebooting a machine and destroying the evidence you needed
Disabling a noisy rule instead of tuning it with evidence
Never escalating, or escalating with no context in the handoff
Memorised answers that fall apart when the interviewer changes one detail

Ready to turn these answers into real skills?

Interviews reward people who have actually worked alerts. Start with the SOC Training program, or ask us where you should begin.

Explore the SOC Training program Ask on WhatsApp

Common questions

What do SOC analyst interviews usually include?

Usually a mix of fundamentals (networking, Windows and Linux, common attacks), scenario questions like the ones on this page, a look at the tools you have used, and sometimes a short practical task with logs or an alert.

Do I need a certification to get a SOC job?

Not always, but entry level hiring often uses certifications as a filter. Practical evidence such as a home lab, investigated alerts and a clear explanation of your process carries a lot of weight on top of them.

How should I prepare in two weeks?

Learn the five step approach on this page, practise each scenario aloud, review the key Windows event IDs, and walk through one alert you investigated in a lab from start to finish.

Should I memorise these answers?

No. Learn the reasoning behind them. Interviewers change details on purpose, and a memorised script breaks while a clear way of thinking adapts.

This page is educational interview preparation. Practise investigations only in labs and environments you are authorised to use.