SOC Analyst interview question

A domain controller is making outbound connections to an external IP on port 443. No maintenance is scheduled. How do you investigate?

What interviewers are really testing

• Structured triage: validate, enrich, scope, contain
• Knowing DCs should never initiate outbound traffic
• Escalation judgment and evidence preservation

A strong answer framework

1. Validate: confirm source host, process, user context via EDR/Sysmon
2. Enrich the destination IP with threat intel and DNS logs
3. Scope: new services, scheduled tasks, odd logons, other hosts hitting the IP
4. Contain: block destination, isolate DC, preserve memory and logs
5. Eradicate: remove persistence, reset creds (KRBTGT if touched), rebuild if needed
6. Document the timeline and recommend: no direct internet access from DCs

Follow-ups you should be ready for

• Which logs would you pull first?
• What if the IP resolves to a legitimate cloud provider?
• When exactly do you escalate to IR?

More real SOC Analyst interview questions

• A user reports clicking a link in a phishing email. Walk me through your response.
• How would you write a Splunk search to detect multiple failed logins followed by a success?
• How do you decide whether an alert is a true positive or a false positive?