SOC Analyst interview question

How do you detect C2 beaconing in proxy or firewall logs?

What interviewers are really testing

• Interval-regularity analysis thinking
• Volume and domain-reputation signals
• Practical query ideas

A strong answer framework

1. Periodic callbacks: consistent intervals with small jitter
2. Small, consistent payload sizes; low-volume heartbeats
3. Rare, newly-registered, or low-prevalence destinations
4. Cluster by host+destination; compute interval deviation
5. Correlate with DNS and process creation before escalating

Follow-ups you should be ready for

• What interval patterns do real beacons use?
• How do you separate beacons from SaaS polling?

More real SOC Analyst interview questions

• A domain controller is making outbound connections to an external IP on port 443. No maintenance is scheduled. How do you investigate?
• A user reports clicking a link in a phishing email. Walk me through your response.
• How would you write a Splunk search to detect multiple failed logins followed by a success?