Guides

50 SOC Analyst Interview Questions and Answers

By Ravindra Bagale, Cyber Security trainer · LinkedIn · Published: 29 September 2026 · Last updated: 30 September 2026

This pack is 50 SOC analyst interview Q&As for L1/L2 hiring in India IT services, product companies and US remote SOC teams: triage, tickets, phishing, EDR/SIEM, IR handoffs, metrics and ethics. Speak process and evidence — not malware cookbooks.

Questions 1–50

Q1. What does an L1 SOC analyst do day to day? (Beginner)

L1 monitors the alert queue, triages by severity and asset value, follows playbooks, closes clear false positives, escalates true positives needing depth, and writes clear ticket notes. Soft skills: calm communication and clarifying questions. Tools vary; process consistency matters more.

Q2. L1 vs L2 vs L3 — difference? (Beginner)

L1: initial triage and playbook actions. L2: deeper investigation, correlation across tools, containment within policy. L3/IR or detection engineering: complex incidents, hunting, rule writing. Titles vary — describe responsibilities, not ego.

Q3. Walk me through your alert triage process. (Beginner)

Prioritise by severity, crown jewel and age; validate telemetry; check maintenance windows; enrich user/host/IP; decide TP/FP/benign-TP; contain if needed; document timeline. Never close critical alerts without a recorded reason.

Q4. What makes a good ticket note? (Beginner)

Who/what/when/where, evidence links, decision, actions and follow-ups. Write so the next shift continues without a call. Avoid pasting passwords or full PAN/Aadhaar into tickets.

Q5. False positive handling? (Beginner)

Confirm with context, document why it is FP, request tuning if recurring, and avoid alert fatigue by feeding detection engineering. Do not disable high-value rules casually. Track FP rates as a team metric.

Q6. What is MTTD / MTTR? (Intermediate)

MTTD is time from compromise to detection; MTTR is time to contain or recover (definitions vary by org). Leadership uses trends, not vanity. Better telemetry and playbooks lower both.

Q7. How do you handle a phishing alert? (Beginner)

Preserve the message, check if anyone clicked, read headers and auth results at a high level, inspect URLs/attachments in approved safe tools, decide phish/spam/legit, contain, and educate the reporter. Deep malware RE is usually L2+.

Q8. User clicked a phishing link — first actions? (Beginner)

Reset password, revoke sessions/tokens, check MFA changes, scan endpoint with EDR, search the mail gateway for campaign siblings, and update the IR ticket. Communicate without blame. Preserve evidence before reimaging if policy requires.

Q9. What logs for identity attacks? (Intermediate)

IdP sign-in logs, MFA challenges, impossible-travel themes, privileged role changes, failed-then-success bursts, and new API tokens. Correlate with email and EDR. In cloud, use CloudTrail or Entra sign-in equivalents.

Q10. EDR alert: suspicious PowerShell — how investigate? (Intermediate)

Check parent process, user context, command-line summary from EDR without pasting malware recipes, signed vs unsigned, network connections, and whether it matches admin tooling. Contain per playbook; escalate if unclear. Lab only on your VMs.

Q11. When do you isolate a host? (Beginner)

When confidence of compromise is high and lateral movement or ransomware risk outweighs downtime — per playbook. Prefer EDR network isolation when possible. Document who approved and when.

Q12. What is a playbook / runbook? (Beginner)

Step-by-step guidance for a scenario such as phishing, ransomware suspicion or lost laptop. Playbooks reduce panic across shifts. Good ones include decision points, contacts and evidence notes.

Q13. SIEM use cases you should know? (Beginner)

Failed-logon spikes, new admin creation, malware correlated with egress, geo-impossible sign-ins, sensitive file anomalies and cloud root/owner logins. Quality beats quantity of rules.

Q14. How do you prioritise a full queue? (Beginner)

Crown-jewel and ransomware-class alerts first, then lateral-movement signs, then aged mediums. Agree SLAs with the lead. Communicate backlog risk upward rather than silently skipping.

Q15. What is enrichment? (Beginner)

Adding context: asset owner, geolocation, threat-intel reputation, department, past tickets. Use approved intel sources only; do not scrape random sites from a SOC workstation carelessly.

Q16. Threat intel — how use IOCs safely? (Intermediate)

Match indicators against your telemetry with proper tooling; expire stale IOCs; prefer TTPs over raw IPs alone. Never test malware samples on production. Document confidence levels.

Q17. Describe the IR lifecycle as a SOC analyst. (Beginner)

Preparation, detect/analyse, contain, eradicate, recover, lessons. Analysts often live in detect/contain with handoffs to IR for major incidents.

Q18. How do you avoid destroying evidence? (Beginner)

Do not casually reimage before required capture; note times with a labelled timezone (IST for India teams); keep chain-of-custody for serious cases; export alert artefacts.

Q19. Shift handover best practice? (Beginner)

Summarise open P1/P2, waiting customer actions, fragile detections and tool outages. Verbal plus ticket update. Never leave a half-contained incident undocumented.

Q20. Metrics that matter vs vanity? (Intermediate)

Useful: MTTD/MTTR trends, percent of alerts with quality notes, tuned FP reduction, critical-asset coverage. Vanity: raw closes without quality. Be honest about noise.

Q21. How do you work with IT / helpdesk? (Beginner)

Clear asks: which host, what change, when. Share impact. Partnership gets faster containment than security elitism. Escalate jointly for VIP users.

Q22. Cloud alerts vs on-prem — difference? (Intermediate)

Cloud adds identity-heavy APIs and provider logs. On-prem emphasises AD, endpoints and network sensors. Hybrid needs correlation across both with least-privilege query access.

Q23. What is alert fatigue and how reduce it? (Beginner)

Too many low-value alerts train analysts to ignore everything. Reduce via tuning, suppressions with expiry, baselining and audited auto-close of known-benign patterns. Never silence ransomware-class signals for green dashboards.

Q24. Explain true positive benign. (Intermediate)

The detection fired correctly on allowed behaviour — for example an admin scanner or approved red team. Document the exception and allow-list carefully so real attacks are not hidden.

Q25. How do you handle VIP accounts? (Beginner)

Heightened playbooks: dual control, careful communication, privacy and faster escalation. Do not gossip. Same technical checks, higher process care.

Q26. Ransomware early signs in SOC? (Intermediate)

Mass file-rename alerts from EDR, backup deletion attempts, sudden encryption-process trees, unusual internal SMB scanning — thematic only. Isolate, preserve, invoke IR; restore from clean backups when possible. Paying is not the first impulse.

Q27. What is a tabletop exercise? (Beginner)

A discussion drill walking a scenario through roles without live malware. Improves playbooks and contacts. Strong interview story if you facilitated or documented gaps.

Q28. SOAR — what is it? (Intermediate)

Security Orchestration, Automation and Response connects tools to automate repetitive steps with human approval for risky actions. Start with read-only enrichment automations.

Q29. How do you validate a detection rule? (Intermediate)

Test in a lab with benign events you own, measure FP on sample windows, peer review, and document intent (ATT&CK mapping helps). Never validate by attacking third parties.

Q30. ATT&CK — how does SOC use it? (Beginner)

A common language for behaviours to map detections and gaps — not an attack tutorial. Say which techniques you cover and which crown-jewel paths lack telemetry.

Q31. Windows Event IDs worth knowing? (Intermediate)

Often cited: 4624/4625 logon success/fail, 4688 process create if audited, 4720 user created, 1102 audit log cleared. Sysmon adds richer command lines when deployed. Know what your org collects.

Q32. Linux auth logs — basics? (Beginner)

auth.log or secure for SSH, sudo and user changes depending on distro. Centralise via syslog/agent. Watch repeated failures then success, and unexpected authorised_keys changes on critical servers — within authorised scope.

Q33. How do you treat PII in investigations? (Beginner)

Minimise collection, mask in tickets, store evidence in restricted systems, follow retention. India and US companies care about privacy rules — escalate legal questions.

Q34. Communication during a major incident? (Beginner)

Single source of truth, factual updates, avoid speculation, separate technical bridge from exec summary. Practise status cadence when the IR lead requests it.

Q35. Hunting vs alert response? (Intermediate)

Alert response reacts to fired rules. Hunting is hypothesis-driven search through telemetry you may query. Both need documentation. Juniors start with guided hunts.

Q36. Vendor / MSSP collaboration tips? (Beginner)

Share crisp context, timezones, asset criticality and what you ruled out. Hold SLAs; keep ownership of crown jewels. Do not outsource thinking entirely.

Q37. How do you learn a new SIEM quickly? (Beginner)

Learn source onboarding, search syntax basics, saved detections, case workflow and timezone display. Rebuild three common queries from lab or prior work. Read the detection catalog.

Q38. Describe escalation with STAR. (Beginner)

Situation (alert), Task (decide), Action (enrich and contain steps), Result (stopped spread or tuned rule). Keep it defensive and honest; label lab stories as lab.

Q39. Containment vs eradication? (Beginner)

Containment stops the bleeding (isolate host, disable account). Eradication removes cause (malware, persistence, fix). Recovery brings services back safely. Premature recovery re-infects.

Q40. Password spray vs brute force — detection idea? (Intermediate)

Brute force: many failures on one account. Spray: few attempts across many accounts. Detect with population thresholds and geo/ASN anomalies. Defence: MFA, smart lockout, bans.

Q41. How do you handle tool outages in SOC? (Beginner)

Declare degraded mode, increase manual checks on crown jewels, notify stakeholders, use secondary paths if any, document blind spots. Never pretend coverage you lack.

Q42. Ethics: curious browsing of employee mail? (Beginner)

Only access data needed for the case under policy and approval. Curiosity is not authorisation. Violations can end careers and break law.

Q43. Soft skills India/US SOCs hire for? (Beginner)

Clear English notes, calm under pressure, ownership, asking for help early, and respect across timezones. Discuss night-shift readiness honestly for follow-the-sun models.

Q44. How do you keep skills sharp ethically? (Beginner)

Home lab VMs you own, range platforms with rules, cert study, writing detections — not scanning the internet. Isolation design impresses more than illegal trophies.

Q45. Explain chain of custody briefly. (Intermediate)

Document who handled evidence, when, and what changed so findings stay credible for HR/legal. Hash images when forensics requires; keep originals read-only when possible.

Q46. Runbook for lost laptop? (Beginner)

Remote lock/wipe via MDM if available, revoke tokens/VPN, rotate credentials used on the device, check last locations per policy, ticket the asset ID. Disk encryption coaching matters.

Q47. Dashboard green — still worried? (Intermediate)

Yes — silence can mean missing telemetry. Validate collectors, critical sources and detection coverage. Healthy scepticism is a SOC virtue.

Q48. How do you document a detection gap? (Beginner)

State the technique or scenario, missing logs, business risk, proposed control and owner. Put it in the backlog with priority — not only in chat.

Q49. Career path from L1? (Beginner)

Strong L1 to L2, detection engineering, IR, cloud security or GRC. Build writing plus one deep tool skill. Portfolio: lab notes and detections, not pirate exploits.

Q50. Final interview tip for SOC roles? (Beginner)

Speak process: triage → evidence → decision → contain → document → improve detection. Name ethics and authorisation. Panels at services and product firms reward structured calm answers.

Related guides on this site

• What is a SOC
• SIEM for SOC analysts
• Phishing like a SOC analyst
• Python for SOC