47.4 SOC Analyst Round – SIEM, Triage, MITRE

Q25. Explain SIEM architecture in simple terms.

(Theme: Accenture SOC — candidate-reported.) SIEM collects logs from many sources, normalises fields, stores them, runs correlation rules, and presents alerts for analysts. Core idea: central visibility + search + detection. Products differ (Splunk, Sentinel, Elastic, Wazuh lab stacks) but the workflow is ingest → detect → triage → escalate.

Q26. What is a true positive versus a false positive?

Frequently asked across MNC SOC interviews (candidate-reported). True positive: the alert correctly points to malicious or policy-violating activity. False positive: the rule fired but the activity is benign. I document close reasons and push noisy rules for tuning instead of blindly closing everything.

Q27. Walk through how you triage a phishing alert.

(Theme: Accenture SOC — candidate-reported; also general SOC guides.) I check alert metadata, headers, SPF/DKIM/DMARC alignment, URL/attachment reputation, whether the user clicked, proxy/DNS/EDR after the click, and isolate only if evidence supports. I notify the user and block indicators per playbook. I practise header reading on sample emails in my lab – never on a real client mailbox without permission.

Q28. Explain one true-positive scenario you can defend in interview.

(Theme: Accenture SOC — candidate-reported.) Example from OWN lab narrative: multiple 4625 failures on a service-style account from an unusual IP, then a 4624, plus a rare process tree. I would escalate, reset credentials per policy, and hunt lateral movement. I label it as lab-practised reasoning if I have not done production SOC yet.

Q29. What is MITRE ATT&CK at interview level?

(Theme: Accenture SOC — candidate-reported.) A knowledge base of adversary tactics (goals) and techniques (how). I use it to label detections – for example persistence or lateral movement – and to ask which log source would show that technique. I do not recite hundreds of IDs from memory; I show I can map one alert to a technique family.

Q30. Explain persistence in MITRE terms.

(Theme: Accenture SOC — candidate-reported.) Persistence means the attacker arranges to survive reboot or re-login – scheduled tasks, services, startup items, account creation, and similar. Blue looks for new autostart entries, unusual services, and account changes, then removes and hardens.

Q31. Explain lateral movement as a defender.

(Theme: Accenture SOC — candidate-reported.) After a foothold, attackers jump to other hosts using stolen credentials or remote admin tools. Indicators: unusual SMB/RDP/WinRM auth between workstations, sudden admin use on many hosts, odd service installations. Segmentation, LAPS-style local admin hygiene, and auth monitoring reduce blast radius.

Q32. Connection established from an external IP – investigate and mitigate?

(Theme: Accenture SOC — candidate-reported.) I identify process, user, destination/source reputation, port, volume, and whether data left. Contain by host isolation or firewall block per playbook, rotate credentials if needed, and hunt sibling hosts. I preserve logs before wiping.

Q33. How do you handle three critical alerts at once?

Frequently asked across MNC interviews (candidate-reported). I do a fast impact skim: crown-jewel or domain-controller-class assets first, active propagation next, then document so a teammate can take the others. I escalate early when scope exceeds my access.

Q34. What logs matter most in a typical incident?

Frequently asked (candidate-reported). Firewall, EDR/endpoint, authentication (AD/VPN), DNS, email gateway, web proxy, and critical server logs. Cloud adds CloudTrail / control-plane logs. I name why each matters, not a shopping list of twenty tools.

Q35. IDS versus IPS in one minute?

Frequently asked across MNC interviews (candidate-reported). IDS detects and alerts; IPS can block in line. Both need tuning. Blocking without understanding business traffic can cause outages – so change control matters.

Q36. What is alert fatigue and what do you do about it?

Frequently asked (candidate-reported). Too many low-value alerts train analysts to click Close. I document rationale, tune or exception noisy rules with detection engineering, and keep high-fidelity detections loud.