Home / Blog / Career and Certs
SOC Analyst Interview Prep: Technical Questions for Beginners
The networking, Windows log and alert triage questions that entry level SOC interviews often include, with simple ways to answer them clearly and what to study first.
A first interview for a SOC (Security Operations Centre) analyst role can feel like a test of everything you have ever read about cyber security. In practice, most entry level interviews come back to the same few areas: basic networking, common Windows logs and how you would handle an alert. This guide walks through those areas, shows simple ways to answer, and helps you decide what to study first.
Scenario: You have a one hour video interview for a junior SOC analyst job at a managed security provider. The job advert mentions a SIEM (Security Information and Event Management system, the tool that collects and searches logs), phishing triage and Windows. The interviewer says: "We will do some quick questions, then I will show you an alert and ask what you would do." You have one week to prepare.
What will they actually ask?
Interviewers for junior roles are rarely trying to catch you out. They want to see that you understand the basics, that you can think in a logical order and that you will ask for help when you need it. Most technical questions fall into a handful of groups.
A very common opening question is "What is the CIA triad?" It stands for Confidentiality (only the right people can see data), Integrity (data is not changed without permission) and Availability (systems and data are there when needed). Give the three words, a one line meaning for each and, if you can, a quick example: ransomware attacks availability, a leaked spreadsheet breaks confidentiality.
Get the networking basics solid
You do not need to be a network engineer, but you will see IP addresses and port numbers in almost every alert. An IP (Internet Protocol) address identifies a device on a network. A port is a numbered door on that device that a particular service listens on.
| Port | Protocol | Why a SOC cares |
|---|---|---|
| 22 | SSH (Secure Shell) | Remote login to Linux servers, a common brute force target. |
| 25 | SMTP (Simple Mail Transfer Protocol) | Sending email between mail servers. |
| 53 | DNS (Domain Name System) | Turns names into IP addresses. Attackers also hide traffic in it. |
| 80 and 443 | HTTP and HTTPS | Web traffic. 443 is encrypted, so you often only see the destination. |
| 445 | SMB (Server Message Block) | Windows file sharing. Often used to move between machines inside a network. |
| 3389 | RDP (Remote Desktop Protocol) | Remote desktop to Windows. Should not be open to the internet. |
Another favourite is "Explain the TCP three way handshake." TCP (Transmission Control Protocol) sets up a connection in three steps: the client sends SYN (synchronise), the server replies SYN-ACK (synchronise and acknowledge), and the client sends ACK. After that, data can flow. If you can add that a flood of SYN packets with no final ACK can be a denial of service attack, that is a nice bonus.
Tip: If you forget a port number, say so and explain how you would check it. "I think RDP is 3389, and I would confirm it in the documentation" is a much better answer than a confident wrong guess. SOC work rewards checking, not guessing.
Know the Windows events that come up most
Most organisations run Windows, so interviewers often ask about the Windows Security log. You do not need to memorise hundreds of event IDs. Learn this short list well, and be able to say what each one tells you.
| Event ID | Meaning | What you might look for |
|---|---|---|
| 4624 | Successful logon | Logons at odd hours or from unusual machines. |
| 4625 | Failed logon | Many failures in a short time, which can mean password guessing. |
| 4688 | New process created | Suspicious programs or command lines being run. |
| 4720 | User account created | New accounts nobody asked for. |
| 4732 | Member added to a local security group | Someone added to the local Administrators group. |
| 1102 | Security audit log cleared | Someone trying to hide what they did. |
Logon events also carry a logon type. Three are worth knowing: type 2 is someone at the keyboard, type 3 is a network logon such as opening a file share, and type 10 is a remote desktop logon. If an interviewer asks "How would you spot an RDP logon?", the answer is a 4624 event with logon type 10.
Note: A previous article on this site, the Windows logon events cheat sheet, goes deeper into logon types and failure codes. Read it after this one if you want more detail.
Talk through an alert out loud
Many interviews include a scenario: "A user reports a suspicious email. What do you do?" There is no single perfect answer. What the interviewer wants is a sensible order and clear reasons. Phishing is listed in MITRE ATT&CK (a public knowledge base of attacker techniques) as T1566, and it is one of the most common alerts junior analysts handle.
- 1Gather the factsWho received it, when, the sender address, the subject, any links or attachments.Collect
- 2Check safelyLook up the sender domain and link reputation without clicking. Check attachments with a sandbox if your team uses one.Analyse
- 3Find the impactDid anyone click or enter a password? Did others receive the same email?Scope
- 4Act and recordFollow the playbook: remove the email, block the sender, escalate if anyone clicked, and write up what you found.Respond
Say each step out loud, and say why. For example: "I would check whether anyone clicked the link, because if a password was entered, the account may need a reset and the case should go to a senior analyst." Mentioning escalation is a strength, not a weakness. Junior analysts are expected to know when to hand something on.
Watch out: Never say you would open a suspicious attachment or click a link on your normal computer "to see what happens". Interviewers listen for safe habits, and that answer suggests you could cause the incident you were meant to stop.
Be ready to read a simple query
Some interviews show you a short SIEM search and ask what it does. You are not expected to write complex queries from memory, but you should be able to read one slowly. Here is a typical example in Splunk's SPL (Search Processing Language).
index=wineventlog EventCode=4625
| stats count by Account_Name, Source_Network_Address
| where count > 10
| sort - count- Line 1 searches the Windows event log index for failed logons (Event ID 4625).
- Line 2 counts the failures for each account and source address.
- Line 3 keeps only combinations with more than 10 failures.
- Line 4 sorts them so the biggest count comes first.
A good answer finishes with what the result means: "This would show possible password guessing, and I would then check whether any of those accounts had a successful logon afterwards." The same idea in Microsoft Sentinel uses KQL (Kusto Query Language), which reads in a very similar top to bottom way.
SecurityEvent
| where EventID == 4625
| summarize Failures = count() by TargetAccount, IpAddress
| where Failures > 10Line by line: pick the Windows security events table, keep failed logons, count them for each account and IP address, then keep the ones above 10. If you can explain both versions, you show that you understand the idea, not just one tool.
Prepare for the questions about you
Technical questions are only half of the interview. The other half checks whether you would be a good teammate on a busy shift. Prepare short, honest answers to these:
- Why do you want to work in a SOC?
- Tell me about something you built or practised, such as a home lab, a capture the flag event or an online lab platform.
- Describe a time you solved a problem you had not seen before.
- How do you keep up with security news?
- How would you handle a shift where lots of alerts arrive at once?
For stories, use the STAR method: Situation, Task, Action, Result. It keeps your answer short and makes sure you finish with what happened. Talking about a home lab is especially useful, because it proves you have touched real logs. A previous article on this site explains how to build one with free tools.
Tip: Prepare two questions to ask them. "What does a typical shift look like?" and "How do new analysts get trained and escalate cases?" both show you are thinking about doing the job well.
Key takeaways
- Entry level SOC interviews focus on networking, Windows logs and how you handle an alert.
- Learn a short list of ports and event IDs well, rather than a long list badly.
- Answer scenario questions in a clear order and explain why you take each step.
- Read queries slowly, line by line, and finish with what the result means.
- Saying you would check, ask or escalate is a strength in a junior analyst.
Pick one section of this article each day for the next week and practise it out loud. By interview day, you will have rehearsed every common question at least once, and you will be able to show the interviewer how you think, which matters more than knowing every answer.
Written by Ben, Cybersecurity Student