SOC Analyst Interview Q&A

Q. Introduce Yourself? Answer: Hello Sir/Madam, My name is [Your Name], and I have completed my SOC Analyst internship where I worked in a 24x7 Security Operations Center environment. I have hands-on experience in monitoring and triaging alerts using SIEM (Splunk) and EDR (CrowdStrike). During my internship, I was responsible for investigating alerts from tools like Firewall (Palo Alto), Email Gateway (Proofpoint), Web Proxy (Zscaler), and WAF (Imperva). I handled real-time alerts, did triage, checked for false positives, and escalated true incidents as per the playbook. I also have experience in analyzing suspicious emails, checking IOCs using Recorded Future, and verifying file or network behavior using AnyRun and Wireshark. I used ServiceNow and OSTicket for incident tracking and documentation. I’m confident in reading logs, doing initial investigation, and working with senior team members to respond quickly to threats. I’m looking for a SOC Analyst role where I can continue learning, contribute to threat detection, and grow with the team. Q. What are your roles and responsibilities as a SOC Analyst? Answer: As a SOC Analyst intern, my main role was to monitor and respond to security alerts in real time. I worked on tools like Splunk SIEM to detect suspicious activity from different sources like Firewall, Proxy, EDR, Email Gateway, and WAF. My responsibilities included: • Triage of alerts – checking priority, source, and type of threat • Investigating alerts – verifying if it’s a real incident or false positive • Responding to incidents – escalating to senior analyst if required, based on SOC playbook • Analyzing email threats – checking headers, URLs, attachments using Proofpoint, VirusTotal, and AnyRun • Checking endpoint threats – using CrowdStrike EDR to see malicious processes, file paths, registry changes • Log analysis – reviewing logs from Firewall (Palo Alto), WAF (Imperva), Proxy (Zscaler) for IP/domain-based attacks • Threat intelligence – collecting IOCs from Recorded Future and matching with active alerts • Ticketing – updating incident status using ServiceNow and OSTicket I also helped in updating detection rules in Splunk and worked with my team to reduce false positives and improve alert quality. Q. What is TCP and UDP? Answer: TCP (Transmission Control Protocol) and UDP (User Datagram Protocol) are both Transport Layer (Layer 4) protocols in the OSI model. They help in sending data between two systems, but they work differently. TCP is connection-oriented – it checks if data is delivered correctly. It’s reliable but slower. Used in: HTTPS, SSH, RDP, FTP Example in SOC: If I see many failed TCP connections on port 22 (SSH), it may be a Brute-force attack. UDP is connectionless – it sends data fast but doesn’t check delivery. It’s faster, but less reliable. Used in: DNS, VoIP, SNMP Example in SOC: If I see thousands of UDP DNS requests, it may be a DNS tunneling or amplification attack. In alerts, I always check if the traffic is TCP or UDP to understand how the attacker is trying to connect. Q. What is the OSI Model? Answer: OSI Model means Open Systems Interconnection. It is a 7-layer model that helps us understand how data travels in a network. Each layer has its own function. In SOC, it helps me to analyze which layer the attack is happening. The 7 layers are: 1. 2. 3. 4. 5. 6. 7. Physical – cables, switches (real devices) Data Link – MAC address, ARP Network – IP address, routing (used in Firewall analysis) Transport – TCP/UDP ports (important for checking malicious ports) Session – connections between systems Presentation – data formats, encryption Application – user apps like browser, email (used in email analysis, web proxy alerts) In SOC, I mostly focus on Layer 3 to Layer 7 while analyzing logs. For example, if I see multiple TCP connections on port 3389, I know it’s related to Layer 4 – Transport, and it could be a Brute-force on RDP. So OSI Model helps to understand the attack path and log details clearly. Q. What is DHCP and How Does it Work? Answer: DHCP (Dynamic Host Configuration Protocol) is used to automatically assign IP addresses to devices in a network. It works on UDP port 67 (server) and port 68 (client). When a new device connects to the network, it sends a DHCP Discover The DHCP server replies with an Offer Device sends a Request Server sends an Acknowledgment (ACK) This is called DORA process – Discover, Offer, Request, Acknowledge. DHCP Starvation Attack: In this attack, the attacker sends many fake DHCP requests using spoofed MAC addresses. As a result, the DHCP server gives out all available IPs and runs out of free IPs, so real users can’t connect. This is used to cause a Denial of Service (DoS) on the network. SOC Example: One day, many systems failed to get IP addresses. In Firewall/EDR logs, we found thousands of DHCP requests from one machine. It was a DHCP Starvation attack using a tool like DHCPig. Q. What is DNS and How Does It Work? Answer: DNS (Domain Name System) is like the phonebook of the internet. It converts domain names like google.com into IP addresses like 142.250.195.14 so that systems can connect. When I open a website, my system sends a DNS query to a DNS server. The server replies with the IP address. This is a UDP-based service mostly on port 53. DNS Amplification Attack: This is a type of DDoS (Distributed Denial of Service) attack. Attacker sends a small DNS request using fake source IP (victim’s IP) to open DNS resolvers. The DNS server sends a large DNS response to the victim. This process is repeated using many servers, flooding the victim with huge traffic. It’s called “amplification” because the response is much bigger than the request. SOC Example: In Splunk, I saw high DNS traffic from one IP sending many queries per second – I used this SPL: index=main sourcetype="firewall_logs" dest_port=53 protocol=udp | stats count by srcIP | where count > 1000. This helped identify a possible DNS amplification attack. Common protocols and associated port numbers? Answer: Below are some common network protocols and their default port numbers, which I often see in SOC while analyzing logs. Protocol HTTP HTTPS Port Use in SOC 80 Web traffic (check for malware download, phishing) 443 Encrypted web traffic (check for SSL abuse) DNS 53 Domain name resolution (used in DNS tunneling attacks) FTP 21 File transfer (can be used for data exfiltration) SFTP/SSH 22 Secure file transfer / remote login (check brute force) Telnet 23 Remote login (insecure – detect unauthorized access) RDP 3389 Windows Remote Desktop (RDP brute-force attacks) SMTP POP3 IMAP Syslog Kerberos LDAP 25 110 143 514 88 389 SMB 445 File sharing in Windows (used in ransomware spread) SNMP MySQL Sending emails (used in email spoofing, spam) Email receiving (insecure) Email receiving (secure version: 993) Device log forwarding to SIEM Windows authentication (check for ticket abuse) Directory service (used in AD) 161 Network monitoring (check for enumeration) 3306 Database (check for SQL attacks) Q.What is Cryptography? What are its Types? Answer: Cryptography is a technique used to conver the paintext data into Cyber-Text data to protect data for transferring from one system to another system securely. It is mainly used in data confidentiality, integrity, and secure communication encryption and decryption operation. Types of Cryptography: 1. Symmetric Encryption: Same key is used to encrypt and decrypt the data Fast and used in internal systems