What’s your day-to-day in a SOC?
Triage alerts, enrich and investigate, escalate incidents, contain/eradicate threats, coordinate recovery, tune detections, and document lessons learned.
How do you triage an alert from the SIEM?
Validate authenticity, check severity/context (asset, user, impact), enrich with threat intel, inspect logs/EDR, determine scope, and escalate per runbook.
What’s the first thing you do when an incident is reported?
Confirm and classify the incident, isolate affected assets if needed, gather evidence, and follow the incident response playbook for containment.
Explain the NIST incident response phases.
Prepare → Detect & Analyze → Contain → Eradicate → Recover → Post-Incident Activities / Lessons Learned.
How do you use MITRE ATT&CK in investigations?
Map observed behaviors to TTPs to understand attacker intent, prioritize detections, inform response actions and build detection coverage.
What’s the Cyber Kill Chain?
Reconnaissance → Weaponization → Delivery → Exploitation → Installation → Command & Control → Actions on Objective. Use to disrupt attacker stages.
How would you respond to an EDR alert showing PowerShell spawned from Word?
Quarantine host, capture memory/process dump, collect logs, check parent/child processes, look for persistence, isolate network, and remediate based on findings.
What log sources are essential for triage?
Endpoint (EDR), network (firewall, proxy), authentication (AD/Azure AD), application logs, cloud audit logs, email gateway, and SIEM correlation logs.
How do you reduce false positives in a SIEM?
Tune rules (thresholds), add context (asset criticality, baselines), implement allowlists, use suppression windows, and validate with historical data.
What’s the difference between detection and prevention?
Prevention blocks threats proactively (firewall, DLP, email filtering); detection finds adversary activity that bypassed prevention (SIEM, EDR).
Describe containment vs eradication.
Containment limits impact (isolate systems); eradication removes threat artifacts and root cause (remove malware, close vulnerabilities).
How do you prioritize alerts?
Use risk factors: asset criticality, scope, impact, exploitability, confidence, and business context—then prioritize response.
What’s a playbook and why use one?
A playbook is a documented response process for specific incident types to ensure consistent, rapid, and auditable actions.
Give an example of a simple SIEM query for failed logins.
index=auth sourcetype=linux_secure “Failed password” | stats count by src_ip, user (Splunk-style).
How do you preserve evidence for forensics?
Isolate system, collect and image disk/memory, capture logs, record chain of custody, avoid altering evidence, and document actions.
What is DLP and typical controls?
Data Loss Prevention detects/prevents exfiltration (endpoint agents, email/Gateway DLP, CASB, content discovery and classification).
Explain SPF, DKIM, and DMARC.
SPF: sender IP authorization. DKIM: cryptographic signature. DMARC: policy and reporting for SPF/DKIM failures.
How would you handle a phishing email reported by a user?
Quarantine message, analyze headers/links/attachments, search for other recipients, block URLs/IOCs, notify impacted users, and log the incident.
What’s MTTR and why does it matter?
Mean Time To Respond/Recover — measures SOC effectiveness; lower MTTR reduces impact and risk.
How do you use threat intelligence in triage?
Enrich IOCs with sources (VT, AbuseIPDB, OTX), check reputation, prioritize based on matching TTPs, and feed SIEM rules.
What are common indicators of exfiltration?
Abnormal outbound traffic, large transfers to unknown IPs, unusual cloud storage usage, and spikes in data access.
How do you handle an attacker with valid credentials?
Revoke sessions, reset credentials, investigate origin, search for lateral movement, check MFA, and perform forensic analysis.
Describe Zero Trust principles.
Never trust implicitly, verify every request, least privilege access, microsegmentation, continuous authentication and device trust.
What is device trust?
Ensuring only managed, healthy devices meeting policy (patching, posture) can access resources.
