SOC Analyst interview question

A user reports clicking a link in a phishing email. Walk me through your response.

What interviewers are really testing

• Calm, ordered containment
• Evidence collection and blast-radius assessment
• Blame-free user communication

A strong answer framework

1. Isolate the affected host
2. Collect URL, email headers, downloaded files
3. Check proxy/DNS logs for connections and exfiltration
4. Reset credentials and revoke active sessions
5. Scan for persistence (scheduled tasks, startup items)
6. Document and feed the awareness program

Follow-ups you should be ready for

• What changes if credentials were entered?
• How do you block the domain org-wide?
• Do you reimage the machine?

More real SOC Analyst interview questions

• A domain controller is making outbound connections to an external IP on port 443. No maintenance is scheduled. How do you investigate?
• How would you write a Splunk search to detect multiple failed logins followed by a success?
• How do you decide whether an alert is a true positive or a false positive?