Days done
0
Tasks done
0
Total tasks
0
0
days done
SOC analyst interview Q&A bank
Master These Before Every Interview
These are the most common SOC analyst interview questions. Practice answering out loud — not in your head.
Fundamentals
"What is the difference between IDS and IPS?"
IDS (Intrusion Detection System) monitors and alerts on suspicious traffic — passive, no blocking. IPS (Intrusion Prevention System) is inline and actively blocks threats in real time. IDS generates alerts; IPS generates blocks and alerts.
Fundamentals
"Explain the CIA triad with an example of each being compromised."
Confidentiality = data exposed to unauthorised parties (data breach). Integrity = data altered without authorisation (ransomware encrypts files, web defacement). Availability = systems made inaccessible (DDoS attack, ransomware locking files).
SOC Process
"Walk me through how you would investigate a phishing email alert."
1. Check email headers (Return-Path, Received, X-Originating-IP). 2. Analyse sender domain (SPF/DKIM/DMARC fail?). 3. Extract URLs — check in VirusTotal and URLScan.io without clicking. 4. Identify targeted user. 5. Check if user clicked/entered credentials. 6. Verdict + action: block sender, reset credentials if needed, notify user.
SOC Process
"What is a false positive and how do you reduce them?"
A false positive is an alert that triggers on legitimate activity — e.g. Nmap scan by the IT team triggering an IDS port scan rule. Reduce them by: tuning detection rules to exclude known-good sources, creating whitelists for trusted IPs/applications, adjusting alert thresholds, and correlating with asset context.
Networking
"What happens when you type a URL into your browser?"
DNS lookup for the domain → TCP 3-way handshake with server IP → TLS handshake (for HTTPS) → HTTP GET request sent → Server responds with HTML/CSS/JS → Browser renders the page. Each step produces observable network artefacts a SOC analyst can investigate.
Networking
"What does a port scan look like in Wireshark?"
SYN scan: many TCP packets with only the SYN flag set, to many different destination ports, from the same source IP in a short time window. Filter: tcp.flags.syn==1 && tcp.flags.ack==0. A legitimate connection would show SYN → SYN-ACK → ACK on the same port — port scans never complete the handshake.
Tools
"What SIEM tools have you used and what queries can you write?"
Splunk (SPL): index=* sourcetype="WinEventLog:Security" EventCode=4625 | stats count by src_ip | sort -count — top failed login IPs. Wazuh with custom detection rules for brute force and PowerShell execution. Elastic/KQL basics. I can write SPL queries for most common SOC use cases.
Tools
"What would you do if you found malware on an endpoint?"
1. Isolate the endpoint from the network immediately. 2. Preserve evidence — take memory dump, disk image if possible. 3. Identify the malware (hash → VirusTotal, strings analysis). 4. Check for lateral movement — did it spread? 5. Eradicate (reimage or clean). 6. Document IOCs, write report, update detection rules to catch it next time.
Behaviour
"Tell me about a time you investigated an alert — walk through your process."
Use your LetsDefend or BOTS investigation as the example. Structure: "I received a SIEM alert for [X]. My first step was [Y]. I found [Z] in the logs. I enriched the IP in VirusTotal which showed [result]. I concluded it was [verdict] because [evidence]. I recommended [action]." This structured answer shows real investigative thinking.
Behaviour
"Why do you want to work in cybersecurity?"
Don't say "it's a growing field" or "good salary." Say: "I spent 10 months building a home lab, analysing real malware samples, and investigating attack scenarios. I genuinely enjoy the detective work. [Specific example from your journey]. I want to do this professionally." Authentic enthusiasm beats rehearsed answers every time.
Advanced
"What is MITRE ATT&CK and how would you use it in a SOC?"
MITRE ATT&CK is a framework of adversary tactics, techniques, and procedures organised into 14 tactic columns. In a SOC: map alerts to ATT&CK techniques to understand what stage of an attack is occurring. Use ATT&CK Navigator to identify detection gaps. Write Sigma rules mapped to specific technique numbers for documentation and sharing.
Advanced
"What is the difference between symmetric and asymmetric encryption?"
Symmetric: same key encrypts and decrypts (AES). Fast, used for bulk data. Problem: how do you securely share the key? Asymmetric: public key encrypts, private key decrypts (RSA, ECC). Slow, used for key exchange. TLS uses asymmetric to exchange a symmetric session key — best of both worlds.
Salary guide 2026
Know Your Worth Before You Negotiate
Salary ranges vary by location, company size, and your specific skill set. Use these as negotiation anchors, not ceilings.
Negotiation tip: Never give a number first. When asked "what are your salary expectations?", respond with: "I'm looking for a market-rate salary for a SOC analyst with my skills and certifications. What is the budget range for this role?" Then negotiate from their number. Having BTL1 + Security+ + a strong GitHub portfolio justifies the higher end of any range.
🇮🇳 India tip: MSSP se start karein agar fresh hain — 1 year ka experience ke baad salary 50–80% badh sakti hai product companies ya banks mein. CTC negotiate karte waqt variable component aur joining bonus bhi dhyaan mein rakhein.
Job search tips that work
How to Actually Get Hired
Apply volume — 5 per day minimum
Job searching is a numbers game. 5 applications per day = 100 in a month. Even with a 3% response rate, that's 3 interviews. Most people apply 2–3 a week and wonder why they're not getting interviews.
Apply if you meet 60% of requirements
Job postings are wishlists. "5 years experience required" on a Tier 1 role means they want enthusiasm and will train. If you have the core skills (networking, SIEM, log analysis), apply. The worst that happens is silence.
LinkedIn is your #1 source
80% of cybersecurity jobs are filled through LinkedIn. Optimise your profile, post your write-ups, connect with hiring managers directly. A recruiter who finds YOU is far better than cold-applying into an ATS black hole.
Message hiring managers directly
"I applied for your SOC Analyst role and wanted to reach out directly. I've spent 10 months building [specific skill] in my home lab. Here's my GitHub: [link]. Happy to discuss." A 2-sentence LinkedIn message gets noticed. Cold applications do not.
GitHub open in every interview
When asked "tell me about a project", open your GitHub. Show, don't tell. "Here's the Splunk BOTS investigation report I wrote, and here's the Volatility memory forensics SOP." Live evidence beats any verbal claim.
India: target MSSPs first
TCS, Wipro, Infosys, HCL, Accenture Security, IBM India — all have large SOC operations and hire freshers with certs and demonstrated skills. Yes, the starting salary is lower, but you get enterprise-scale experience quickly. Move to product companies or banking after 12–18 months.
Keep studying while applying
Don't stop learning while job searching. Continue 1–2 hours of lab work per day during Phase 5. New LinkedIn posts show activity. New GitHub commits show momentum. This also means you're sharper in technical interviews.
Attend local security meetups
OWASP chapters, null meetups (India), BSides conferences, ISACA local events — these are where you meet hiring managers in person. Most jobs are filled through people, not portals. One introduction at a meetup is worth 50 cold applications.