SOC interviews test three things: whether you understand the basics (networking, logs, attacks), whether you can think through an alert calmly, and whether you can explain your reasoning. Below are questions that come up again and again for SOC L1 and L2 roles, with short answers you can build on in your own words.
Networking Basics
1. What is the difference between TCP and UDP?
TCP is connection-oriented: it uses a three-way handshake (SYN, SYN-ACK, ACK), guarantees delivery and order. UDP is connectionless and faster but does not guarantee delivery – used for DNS queries, streaming and VoIP.
2. Name common ports you should know.
FTP 21, SSH 22, Telnet 23, SMTP 25, DNS 53, HTTP 80, POP3 110, IMAP 143, HTTPS 443, SMB 445, RDP 3389. Unexpected traffic on these ports is often the first sign of trouble.
3. What happens when you type a URL into a browser?
DNS resolves the name to an IP address, the browser opens a TCP connection (and a TLS handshake for HTTPS), sends an HTTP request, and the server responds. Each step creates logs a SOC can use.
Security Concepts
4. What is the CIA triad?
Confidentiality (only authorised people see data), Integrity (data is not changed without authorisation) and Availability (systems are up when needed). Every incident affects at least one of them.
5. What is the difference between a vulnerability, a threat and a risk?
A vulnerability is a weakness, a threat is something that could exploit it, and risk is the likelihood and impact of that happening.
6. What is a false positive and a false negative?
A false positive is an alert on harmless activity; a false negative is a real attack that raised no alert. False negatives are more dangerous; too many false positives cause alert fatigue.
SIEM and Logs
7. What is a SIEM and why does a SOC use it?
A SIEM (Security Information and Event Management) collects logs from many sources, correlates them and raises alerts. Examples include Splunk, Microsoft Sentinel, IBM QRadar and the Elastic (ELK) stack.
8. Which Windows Event IDs do you check most?
4624 successful logon, 4625 failed logon, 4672 special privileges assigned, 4688 new process created, 4720 user account created, 4732 user added to a security group, and 1102 audit log cleared.
9. How would you detect a brute-force attack?
Look for many failed logins (4625) for one account or from one IP in a short time, followed by a success (4624). Check the source IP's reputation and location, then lock the account or block the IP according to the playbook.
Incident Response
10. What are the phases of incident response?
Under NIST guidance: Preparation; Detection and Analysis; Containment, Eradication and Recovery; and Post-Incident Activity (lessons learned).
11. A user reports a suspicious email. What do you do?
Check the headers (sender, reply-to, SPF/DKIM/DMARC results), analyse links and attachments in a sandbox, search for the same email in other mailboxes, remove it, block the sender or domain, and check whether anyone clicked or entered credentials – reset those passwords if so.
12. You see malware on one laptop. What are your first steps?
Isolate the device from the network using EDR, preserve evidence, identify the malware and how it arrived, check other devices for the same indicators, then remove it and restore the device. Escalate according to severity.
L2 Questions: Going Deeper
13. What is MITRE ATT&CK and how do you use it?
A knowledge base of attacker tactics and techniques. SOCs map alerts and detections to it to understand where an attacker is in the attack chain and to find gaps in detection coverage.
14. How would you detect lateral movement?
Look for unusual remote logons (type 3 or 10), new admin share access, remote service creation, PsExec or WMI use, and one account logging into many machines in a short time.
15. What is an IOC versus an IOA?
Indicators of Compromise (IOCs) are evidence of a past attack – hashes, IPs, domains. Indicators of Attack (IOAs) describe behaviour in progress – like a document opening PowerShell. IOAs catch new attacks that IOCs miss.
16. How do you reduce false positives without missing attacks?
Tune rules with context (known admin tools, service accounts, maintenance windows), use allow-lists carefully, combine several signals instead of one, and review tuned rules regularly.
AI in the SOC
17. How can AI help a SOC analyst – and what are the risks?
AI can summarise alerts, write SIEM queries, enrich indicators and draft reports. The risks are wrong answers stated confidently and sensitive data being shared with the wrong tools – so analysts must verify AI output and follow data rules. Read more in our article on AI in the SOC.
Scenario and HR Questions
- Walk me through how you would investigate an alert from start to finish.
- Tell me about a lab or CTF you solved and what you learned.
- How do you stay updated on new threats?
- How would you handle a high-severity alert at 3 AM when your lead is unavailable?
- Why do you want to work in a SOC rather than in pentesting?
Prepare with Hands-On SOC Training
The best interview answers come from real practice. Our SOC Analyst Foundations course gives you hands-on SIEM labs with Splunk and ELK, plus mock interviews and placement support – offline in Hyderabad or live online. Also see our guide to an ATS-proof cybersecurity resume.