SOC analyst interview questions, and what a strong answer sounds like
I passed Security+ and finally have a SOC interview next week. I know every acronym on the exam, and I am terrified that the moment they hand me a real alert my mind will go blank.
Updated . Every figure links to its source at the end of the page.
Short answer
Entry-level SOC interviews test whether you can reason through an alert out loud and write down what you found. Expect networking and Windows log basics, the incident response process, one or two scenarios such as a reported phishing email or a burst of failed logons, and questions about shift work. ISC2 reports that 84 percent of cybersecurity hiring managers use skills-based assessments or tests for entry- and junior-level applicants, so practise doing the work, then explaining it.
A first SOC interview feels like a second exam, and it is a different kind of test. Security+ mostly asked you to pick the right answer from a list. The interviewer wants to hear you think: what you check first, what would change your mind, and when you would hand the problem to someone more senior. That is learnable in a week if you practise out loud. The questions below are grouped the way most SOC loops run: technical fundamentals, log analysis, incident response, scenarios, then behavioural. Each one says what the interviewer is listening for and how a strong answer is built. Do not memorise scripts. Interviewers ask follow-ups precisely to find out whether you have.
How an entry-level SOC interview is usually run
Most loops have three parts. A recruiter or HR screen checks that you can work the shift pattern and that your resume is true. A technical round, often with a Tier 2 analyst, runs through fundamentals and then hands you a scenario. A final round with the SOC manager is mostly behavioural: how you communicate, how you handle a mistake, whether you write things down.
The ISC2 2025 Cybersecurity Hiring Trends Report surveyed 929 hiring managers and found teamwork, problem-solving and analytical thinking ranked ahead of any single technical skill. That matches what the technical round actually scores: a clear method beats a long list of tool names.
If you are still deciding whether your certificate gets you into the room at all, the Security+ and no-experience question has its own post. This page assumes you have the interview and need to pass it. For where this first seat leads, from Tier 1 to detection engineering or incident response, see the cybersecurity career path.
Networking fundamentals
Which ports should a SOC analyst know, and why would you care about each one in an alert?
Tested: whether port numbers mean anything to you beyond flashcards. Give the port, then the reason it shows up in an investigation. SSH on 22 and RDP on 3389 are remote access, so either exposed to the internet is a finding. SMB on 445 leaving your network for the internet is almost never legitimate. DNS on 53 is worth watching for unusual volume or very long query names, which can indicate tunnelling. HTTP and HTTPS on 80 and 443 are a common channel for command-and-control traffic because it blends in with normal browsing. Kerberos on 88 and LDAP on 389 matter once you are looking at domain controllers.
Walk me through the TCP three-way handshake.
Tested: whether you can read a packet capture. The client sends SYN, the server answers SYN-ACK, the client completes with ACK. The strong answer then applies it: a host sending many SYNs to many ports and never completing the handshake looks like a scan, and a server receiving a flood of SYNs it cannot complete looks like a SYN flood. Mention RST as the abrupt close you see when a port is closed. Deeper routing and subnetting questions are more common in NOC loops, and the network engineer question set covers them.
What is the difference between an IDS and an IPS?
Tested: placement and trade-offs. An IDS watches a copy of traffic and raises alerts. An IPS sits inline and can drop or block traffic. The follow-up is usually "so why not run everything as an IPS?" Answer it: a false positive on an IPS blocks legitimate business traffic, and an inline device adds a point of failure. Suricata and Snort can run in either mode, which is a good detail to drop in if you have used one.
Security concepts, applied
Apply the CIA triad to an incident you might see on shift.
Tested: whether you can use a framework to judge impact. Do not define the three words and stop. Pick examples. A laptop with unencrypted customer data left on a train is a confidentiality problem. An attacker changing the bank details on a supplier invoice is an integrity problem. Ransomware is an availability problem first, and often a confidentiality problem as well when data is stolen before encryption. Finish by saying that the property affected feeds the severity you assign.
How do you use MITRE ATT&CK in day-to-day work?
Tested: practical use rather than recognition. ATT&CK is a knowledge base of adversary behaviour: tactics are the attacker's goal and techniques are how they reach it. In a SOC it is a shared vocabulary for tagging alerts, for example T1566 for phishing as initial access or T1110.003 for password spraying under credential access, and for asking which techniques you have no detection for. Current detail earns credit here: the Enterprise matrix now lists 15 tactics, including Stealth and Defense Impairment, so notes that still show Defense Evasion as one tactic predate the current version.
SIEM and log analysis
What does a SIEM do, and what can it not do?
Tested: whether you understand that a SIEM only knows what it is fed. It collects logs from many sources, normalises them, correlates events and fires alerts from rules. Name the sources: endpoint or EDR telemetry, Windows Security logs, firewall, proxy and DNS logs, identity provider sign-ins, email gateway. Then the limits: no log source, no detection; badly tuned rules bury real alerts. If you have written even one query in Splunk, Microsoft Sentinel or Elastic, describe it.
Which Windows event IDs do you know, and what pattern would worry you?
Tested: whether you have read a Security log. The core set:
- 4624: an account successfully logged on
- 4625: an account failed to log on
- 4720: a user account was created
- 4732: a member was added to a security-enabled local group, such as local Administrators
- 4740: a user account was locked out
- 4688: a new process was created (the command line only appears if that audit setting is enabled)
- 1102: the audit log was cleared
Then give a pattern. A run of 4625 events followed by a 4624 for the same account from the same source suggests a guessed password. A 4720 followed by a 4732 outside a change window suggests persistence. A 1102 on a server almost always deserves a question. Mention that the logon type field in 4624 separates RDP (RemoteInteractive) from network logons.
How do you handle a false positive?
Tested: judgement and discipline. Confirm it with evidence before you call it, and write down the evidence, because "looked fine" is not a closure note. Distinguish a false positive (the rule matched something it should not) from a benign true positive (the activity was real but authorised, like an admin running a scanner). Then propose a narrow tuning change, such as excluding one service account on one host, and say who approves it. The red flag interviewers listen for is a candidate who would quietly suppress a noisy rule.
Incident response process
What are the phases of incident response?
Tested: structure, and whether your reading is current. Most teams still talk in the four-phase life cycle from NIST SP 800-61 Revision 2: preparation; detection and analysis; containment, eradication and recovery; and post-incident activity. Say that, then show you know NIST replaced it. Revision 3, published in April 2025, supersedes the 2012 version and organises incident response around the six NIST Cybersecurity Framework 2.0 Functions: Govern, Identify and Protect cover preparation, while Detect, Respond and Recover cover the incident itself, with lessons learned feeding improvement throughout. Close by placing yourself: a Tier 1 analyst lives in detection and analysis and takes first containment steps a playbook allows.
When do you escalate, and what do you hand over?
Tested: whether you know your boundaries. Escalate when compromise is confirmed or likely, when a privileged account or several hosts are involved, when data may have left, or when the situation is outside the playbook. The handover is the part most candidates skip: a one-paragraph summary, a timeline, the indicators, what you have already done, and what you have not yet checked. Saying what you have not checked is what lets the next person trust the rest.
Scenario questions
An EDR alert fires: PowerShell with an encoded command on a finance workstation. Walk me through your triage.
Tested: method under pressure. A strong answer moves from scope to evidence to decision. Read the rule and the raw event. Identify host, user and time. Look at the process tree: PowerShell spawned by Word or Excel is far more worrying than PowerShell spawned by a management agent. Decode the command. Check network connections from the process and whether the same hash or domain appears on other hosts. Enrich indicators against threat intelligence. Decide: true positive, false positive or benign. If true, isolate the host if the playbook allows and escalate. Document as you go, with timestamps.
A user reports a suspicious email. What do you do?
Tested: phishing investigation end to end. Get the original message with full headers, because a screenshot or forward loses evidence. Check sender, Reply-To and Return-Path, and read the SPF, DKIM and DMARC results in the authentication headers. Detonate links and attachments in a sandbox, never on your own machine. Search mail logs for every other recipient. Then answer the question that decides severity: did anyone click, and did anyone enter credentials? Proxy, DNS and sign-in logs tell you. Response is purging the message, blocking the sender and URL, and resetting passwords and revoking sessions for anyone who entered credentials.
You see hundreds of failed logons across dozens of accounts from one IP, then one success. What now?
Tested: recognising password spraying and prioritising. Many accounts with few attempts each is spraying; many attempts against one account is brute force. The success is now the priority. Check whether the source IP is internal or external, whether MFA was satisfied, and what that session did after logon. Contain by disabling or resetting the account and revoking sessions, block the source, and escalate because a valid credential is in someone else's hands.
How would you handle commodity malware on one laptop compared with ransomware?
Tested: urgency and escalation. Commodity malware on one host follows the playbook: isolate, collect artefacts, confirm scope, reimage. Ransomware is a major incident from the first minute. Isolate affected hosts from the network immediately, escalate straight away, and avoid powering machines off unless your playbook says to, because memory holds evidence. Help identify the first infected host and whether backups are intact. Decisions about ransom, legal notice and public communication belong to leadership, and saying so is part of a good answer.
Behavioural questions
This role works nights and weekends on a rotation. How will you manage that?
Tested: whether you will last on the rota. Be honest about your situation and specific about how you have handled irregular hours before, whether in retail, hospitality, the military or caring for someone. If you have never worked nights, say what you will do about sleep and handover rather than claiming it will be easy.
Show me how you would write up a ticket.
Tested: documentation. Every alert you close becomes a record someone else relies on. Describe the structure: what triggered it, what you checked, what you found, what you concluded and what happens next, with times and evidence. Write for the analyst who picks it up in the middle of the night with no context.
Tell me about a time you made a mistake at work.
Tested: ownership. Pick a real mistake, say what you did when you noticed, and say what you changed so it could not recur. Interviewers hear a lot of answers where the mistake turns out to be someone else's. For the opening "tell me about yourself" answer, the career-changer version is covered here.
The home lab question, and how to have a good answer by next week
Tell me about your home lab.
Tested: whether you have done anything outside a course. The interviewer will ask what broke and what you learned from it, so a lab you built is worth more than a long list of platforms you subscribed to.
A lab that produces a good answer is small:
- Two virtual machines: one Windows client and one Linux or Windows server. Add a domain controller if you have the memory.
- Sysmon on the Windows machine, with Windows Security auditing turned on, including process creation with command line.
- Logs forwarded to a SIEM you can run at home, such as Wazuh or the Elastic stack.
- Atomic Red Team tests mapped to ATT&CK techniques, run one at a time, with a note of which ones your SIEM caught.
- A GitHub repository with one write-up per technique: what you ran, what fired, what did not, and the detection rule you wrote.
The resume line that comes out of it reads like work: "Built a Windows and Linux lab forwarding Sysmon and Security logs to Wazuh; wrote and tested detections for password spraying and encoded PowerShell." That line also answers "cybersecurity resume no experience" better than a skills cloud does. Formatting the certification itself is covered in how to list certifications on a resume.
What this does not fix
This page prepares you to answer questions well. It cannot create the job history many SOC postings quietly expect, and no amount of interview polish will move a resume that never reaches a human. If you are getting no interviews at all, the problem is upstream of everything here, and a help desk or NOC role is often the faster route into a SOC than a third certificate. The questions are typical of entry-level loops, but every team runs its own, and a managed security provider will test differently from an in-house team at a bank.
Exams that fit this path
- CompTIA Security+, if you need the baseline certificate most SOC Tier 1 postings name
- Certified in Cybersecurity (CC), if you are earlier on and want ISC2's entry-level credential first
- CompTIA CySA+, for the analyst-level exam to aim at once you have time on shift
Common questions
What questions are asked in a SOC analyst interview?
Expect four groups. Networking basics such as ports, the TCP handshake and IDS versus IPS. Log analysis, especially Windows event IDs like 4624 and 4625 and how a SIEM works. Incident response process and escalation. Then one or two scenarios, usually a phishing report or a suspicious process alert, where you talk through your triage. The final round is behavioural: shift work, documentation and how you handle mistakes. The scenarios carry the most weight because they show method rather than recall.
How do I prepare for a SOC analyst interview as a fresher?
Practise out loud, because the skill being tested is explaining your reasoning. Take each scenario on this page and talk through it in a few minutes, then have someone interrupt you with "what if the user says they did click?" Build a two-machine lab that sends logs to a SIEM and run a handful of ATT&CK techniques against it, so you have one real detection to describe. Read a raw Windows Security log at least once. Prepare a short, honest answer about night shifts. If the role names a certificate you do not hold yet, Security+ is the one Tier 1 postings ask for most often.
What are scenario-based SOC analyst interview questions?
They are questions where the interviewer describes an alert or report and asks what you would do. Common ones are a user reporting a phishing email, a burst of failed logons followed by a success, PowerShell launched by an Office application, and ransomware on a workstation. A strong answer moves in order: scope the alert, gather evidence, decide whether it is real, contain or escalate according to the playbook, and document. Say what you would check before what you would conclude.
Do I need CySA+ to get a SOC analyst job?
Not for a first role. CompTIA recommends about four years in a SOC analyst or vulnerability analyst role before CySA+, so it is a credential for the job after the first one. For Tier 1 roles, Security+ or ISC2's Certified in Cybersecurity is what postings usually name, and CySA+ is the step after a year or more on shift. If you hold Security+ already, a home lab and practised scenario answers will do more for your next interview than another exam booking.
How do I get an entry level cyber security job with no experience?
Most people do it through IT first. In ISC2's 2025 hiring survey, managers who filled cybersecurity roles from inside their organisation drew 85 percent from IT and 68 percent from technical support or help desk. BLS lists less than five years of related work experience as typical for information security analysts. A help desk or NOC job gives you tickets, logs and shift experience that map directly to SOC work. See jobs you can get with A+ and the help desk interview guide.
How much does a SOC analyst make?
BLS reports a median annual wage of $129,180 in May 2025 for information security analysts, and projects 21 percent employment growth from 2025 to 2035. That figure covers all analysts, including senior staff, and BLS does not publish a separate figure for Tier 1 SOC roles, so expect a first SOC offer to sit well below it. For certificate-by-certificate pay data, see the cybersecurity certification salary guide.
Sources
- 01Share of cybersecurity hiring managers using skills-based assessments or tests for entry- and junior-level applicants, and survey size 84 percent; 929 hiring managers surveyed in December 2024 in Canada, Germany, India, Japan, the UK and the US; margin of error plus or minus 3 percent at 95 percent confidence; among the 22 percent sourcing talent from other internal departments, 85 percent recruited from IT and 68 percent from technical support or help desk
ISC2 2025 Cybersecurity Hiring Trends Report checked 2026-10-25 - 02Information security analyst pay, size, outlook and entry requirements Median pay $129,180 per year (May 2025); 192,900 jobs in 2025; projected growth 21 percent 2025 to 2035; about 14,100 openings per year; typical entry-level education bachelor's degree; work experience in a related occupation less than 5 years
US Bureau of Labor Statistics, Occupational Outlook Handbook: Information Security Analysts checked 2026-10-25 - 03Current revision of NIST incident response guidance and the life cycle it replaced SP 800-61 Rev. 3 published April 2025, superseding SP 800-61 Rev. 2 (August 2012); previous four-phase model: Preparation; Detection and Analysis; Containment, Eradication and Recovery; Post-Incident Activity; new model based on the six CSF 2.0 Functions (Govern, Identify, Protect, Detect, Respond, Recover)
NIST, SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management (2025) checked 2026-10-25 - 04Windows Security event IDs and their meanings 4624 an account was successfully logged on; 4625 an account failed to log on; 4720 a user account was created; 4732 a member was added to a security-enabled local group; 4740 a user account was locked out; 4688 a new process has been created; 1102 the audit log was cleared
Microsoft Learn, Windows security auditing event reference (event 4624 page and linked event pages) checked 2026-10-25 - 05Number of MITRE ATT&CK Enterprise tactics and technique IDs used as examples 15 Enterprise tactics, including TA0005 Stealth and TA0112 Defense Impairment; T1566 Phishing (Initial Access); T1110.003 Password Spraying (Credential Access)
MITRE ATT&CK, Enterprise tactics page (2026) checked 2026-10-25 - 06Registered TCP port numbers for common services ssh 22, smtp 25, domain (DNS) 53, http 80, kerberos 88, ldap 389, https 443, microsoft-ds (SMB) 445, ms-wbt-server (RDP) 3389
IANA, Service Name and Transport Protocol Port Number Registry checked 2026-10-25 - 07CompTIA CySA+ V4 exam details and recommended experience Exam CS0-004, launched June 23, 2026; maximum 85 questions; 165 minutes; passing score 750 on a scale of 100 to 900; recommended experience about 4 years in a SOC analyst or vulnerability analyst role; V3 English exam retires December 22, 2026
CompTIA, CySA+ V4 certification page (2026) checked 2026-10-25
Keep going
I finally have a help desk interview on Thursday. I know the A+ material, but I freeze when someone says "walk me through it", and I am scared they will ask something I have never touched.
I passed both A+ exams last month. Every help desk posting says entry level and then asks for two years of experience, and I honestly cannot tell whether A+ was enough or whether I paid for the wrong thing.
I have a NOC interview next week and I keep picturing a senior engineer asking me to subnet on a whiteboard while I go blank, even though I passed CCNA a month ago.
I finally got an interview for a help desk job after years in retail, and I freeze at the very first question. I can explain DNS, but I cannot explain why someone who sold phones should be hired to fix them.
I passed Security+ three weeks ago and I still do not know where it goes on my resume. I have moved it from the top to the bottom and back again, and every version gets the same silence.
I passed Security+, I have sent more than a hundred applications, and I have not had one interview.
I think a robot is deleting my resume before a human ever sees it, and I want to know if a certification would stop that.