Every SOC interview question list gives you the answer. Almost none tells you what the panel is marking while you give it — and that is what decides the round. An L1 interviewer in Hyderabad or Bengaluru is not checking whether you memorised the CIA triad. They are working out whether you would be safe on a live console at two in the morning.
So these thirty questions are grouped the way an Indian SOC technical round actually runs, in the order it runs, with a short answer for each and a line on what is being scored where that matters. The answers are deliberately brief. They are the shape of a good reply, not a script — a panel can hear a memorised paragraph from across the table.
What Are the Most Common SOC Analyst Interview Questions?
Most SOC analyst interviews open with the CIA triad, the difference between an event, an alert and an incident, and how you would triage a suspicious login alert. Indian L1 panels then move to network and log questions, one SIEM question, and one scenario walkthrough — usually around 30 questions across roughly five rounds.
Those first three are filters, not scoring questions. Everyone answers them. The interview is won or lost later, in the log-analysis questions where a specific number is expected, and in the scenario question where you have to think out loud without a safety net.
How this list was built
These questions are the ones that recur across published SOC interview guides and the mock interviews we run at the end of the AimNxt SOC Analyst L1 & L2 programme. No employer's actual interview script is reproduced here, and no company is named.
How Is an Indian SOC Analyst Interview Structured?
A typical Indian SOC analyst interview runs three stages: an HR screen, a 45 to 60 minute technical round, and a manager round. The technical round is where the 30 questions below live, and it usually moves in a fixed order — fundamentals, networking, log analysis, SIEM, then one scenario you must walk through aloud.
HR / recruiter screen
Ten to fifteen minutes. Notice period, location, shift willingness — SOC work is rotational, and saying you cannot do nights ends the process here. Certifications are checked as keywords, not tested.
Technical round
The real filter. Fundamentals, networking and logs, SIEM, then a scenario. Usually one analyst plus a team lead. This is where the questions below get asked.
Manager / fit round
How you handle being wrong, how you escalate, how you explain a finding to someone non-technical. Short, and more decisive than candidates expect.
If you are still deciding which tier to target, the difference in what each round demands is set out in our breakdown of SOC analyst L1 vs L2 vs L3 roles and skills. Everything below assumes you are interviewing for L1 or early L2.
Round 1: Security Fundamentals Questions (Q1–Q8)
Round one checks vocabulary: the CIA triad, the event-alert-incident distinction, hashing versus encryption, and defence in depth. These are pass or fail filters rather than scoring questions — an Indian L1 panel expects crisp two-sentence answers here, and saves its real time for the log and scenario rounds that follow.
Q1. What is the CIA triad?
Confidentiality, integrity and availability — the three properties every security control exists to protect. Name which one a given attack breaks: ransomware breaks availability first and confidentiality second.
Q2. What is the difference between an event, an alert and an incident?
An event is any activity a system logs. An alert is an event a detection rule flagged. An incident is an alert an analyst has confirmed as real and harmful. Only incidents get escalated.
Scored on: whether you understand that triage is the work in between, not a formality.Q3. What is the difference between a threat, a vulnerability and a risk?
A vulnerability is the weakness, a threat is what could exploit it, and risk is the likelihood and impact of that happening. Give one example rather than three definitions.
Q4. Hashing, encryption and encoding — what is the difference?
Hashing is one-way and protects integrity. Encryption is reversible with a key and protects confidentiality. Encoding is reversible without a key and is not a security control at all — Base64 is transport, not protection.
Q5. Symmetric versus asymmetric encryption?
Symmetric uses one shared key and is fast. Asymmetric uses a public and private key pair and is slower. TLS uses asymmetric to agree a symmetric session key, then switches — which is the answer that shows you understand why both exist.
Q6. What is defence in depth?
Layered controls, so no single failure exposes the asset: perimeter, segmentation, endpoint, identity and monitoring. The SOC is the layer that assumes every other layer will eventually fail.
Q7. What is Zero Trust?
Trust nothing by network location; verify every request against identity, device posture and least privilege. In SOC terms it produces far more authentication logs to monitor, not fewer alerts.
Q8. What is an advanced persistent threat?
A well-resourced attacker who gets in and stays quiet for months. You find one through patterns — regular beaconing, credential reuse, odd lateral movement — rather than through a single loud alert.
Round 2: Network and Log Analysis Questions (Q9–Q16)
Round two is where most freshers lose the interview: TCP versus UDP, the three-way handshake, IDS versus IPS, and which Windows Event ID records a failed logon. Answer with the number wherever one exists — Event ID 4625 for failed logons, 4624 for successful ones — because specifics are what separate candidates here.
Q9. Explain the TCP three-way handshake.
SYN, SYN-ACK, ACK. The useful follow-on: a flood of SYNs with no returning ACK is exactly what a SYN-flood denial-of-service looks like in a packet capture.
Q10. TCP versus UDP — and why does a SOC care?
TCP is connection-oriented, ordered and acknowledged. UDP is fire-and-forget. Attackers favour UDP for amplification attacks and DNS-based exfiltration precisely because there is no handshake to leave behind.
Q11. IDS versus IPS?
An IDS detects and alerts. An IPS sits inline and blocks. A false positive on an IPS breaks production traffic, which is why tuning discipline matters far more there than on an IDS.
Scored on: whether you mention the operational cost of blocking, not just the definition.Q12. Which ports and protocols should a SOC analyst know?
At minimum 22 SSH, 25 SMTP, 53 DNS, 80 and 443 HTTP and HTTPS, 445 SMB, 3389 RDP. Add that 445 and 3389 exposed to the internet are the two findings you see most often.
Q13. What is network segmentation and why does it help?
It limits blast radius. If the finance VLAN cannot reach the server VLAN, one compromised laptop stays one compromised laptop instead of becoming a domain-wide incident.
Q14. Where do you find failed logins on Windows and on Linux?
Windows Security log, Event ID 4625 for a failed logon and 4624 for a successful one. On Linux, /var/log/auth.log on Debian and Ubuntu, /var/log/secure on RHEL and CentOS.
Q15. What are Indicators of Compromise?
Artefacts showing a breach has already happened — a known-bad file hash, a command-and-control domain or IP, a suspicious registry run key, an unexpected scheduled task.
Q16. IOC versus IOA?
An Indicator of Compromise is evidence of what has already happened. An Indicator of Attack is behaviour showing an attack in progress, such as Word spawning PowerShell with an encoded command. IOAs catch what signature-based IOCs miss.
Round 3: SIEM and Tooling Questions (Q17–Q22)
Round three asks how a SIEM works, what a correlation rule is, and what you do with a rule that fires constantly. Name the platform you have genuinely used — Splunk, IBM QRadar or Microsoft Sentinel — and describe one query you wrote in it. Vague tool familiarity is the answer panels remember worst.
Q17. How does a SIEM work?
It ingests logs from many sources, normalises them into a common schema, correlates them against detection rules, and raises alerts for analysts. Ingest, parse, correlate, alert, investigate — in that order.
Q18. What is a correlation rule or use case?
Logic that turns several events into one meaningful alert. Ten failed logons followed by a success from a new country is credential stuffing — one alert worth reading, not eleven events worth ignoring.
Q19. What is log normalisation, and why does it matter?
Different vendors name the same field differently. Normalisation maps them onto one schema so a single query works across firewall, endpoint and identity logs instead of three separate ones.
Q20. What is EDR, and how is it different from antivirus?
Antivirus blocks files it recognises as bad. EDR records process, registry and network behaviour on the endpoint so you can reconstruct what actually happened and respond remotely, including isolating the host.
Q21. An alert fires 200 times a day and is always benign. What do you do?
Not suppress it quietly. Confirm the benign cause, tune the rule with a documented exception, and have it reviewed. Untuned noise is the mechanism by which a real alert eventually gets missed.
Scored on: whether you change the rule through a process, or just close the tickets faster.Q22. What is MITRE ATT&CK and how do you use it day to day?
A public catalogue of real adversary tactics and techniques, maintained by MITRE. In practice you map an alert to a technique ID, then check whether neighbouring techniques in that tactic also fired on the same host.
You can read 30 answers. You still have to say them out loud.
Sit in on a live SOC class at our KPHB, Kukatpally campus or online. 60 minutes with the instructor, no payment required.
Round 4: Scenario-Based SOC Interview Questions (Q23–Q28)
Scenario questions ask what you would do, in order, and are scored on your process rather than your conclusion. Say what you check first, what would change your mind, and when you escalate. A candidate who says "I would escalate to L2 with this evidence and this reasoning" outranks one who simply guesses the right verdict.
Q23. Walk me through the first ten minutes of an alert.
Read the alert and the rule that produced it. Establish user, host, time and source. Check whether it matches a known false positive. Pull the surrounding logs. Then decide: close, monitor or escalate — with the reason written down.
Scored on: having an order at all. Most candidates jump straight to a verdict.Q24. A user clicked a link in a phishing email. What now?
Contain first: isolate the host, reset the account and revoke its sessions, block the URL and the sender. Then investigate what ran after the click, and search the mail gateway for everyone else who received it.
Scored on: containment before investigation, and remembering the other recipients.Q25. Multiple failed logins, then one success from a new country.
Treat it as a probable account compromise. Check whether multi-factor authentication was actually satisfied, what the session did afterwards, and whether that source IP touched other accounts. Escalate before it turns into lateral movement.
Q26. How do you tell a false positive from a real detection?
By evidence, not instinct. Does the process, its parent, the user and the timing fit a known business pattern? If you cannot explain why it is benign, it is not a false positive yet — it is an unfinished investigation.
Q27. You see PowerShell running with an encoded command.
Decode it before judging it. Then check the parent process — Word or Outlook spawning PowerShell is far more suspicious than a management agent doing the same thing — and whether it opened any outbound connections.
Q28. A server beacons to an unknown IP every 60 seconds.
Traffic at a fixed interval is classic command-and-control. Check the destination's reputation, which process owns the connection, how long the pattern has run, and whether any other host does the same. Escalate with a timeline.
Round 5: Behavioural Questions Panels Actually Ask (Q29–Q30)
The last round tests whether you are safe to put on a live console: how you handle being wrong, and how you explain a technical finding to a non-technical manager. If you have no production experience, answer with a real example from your lab — an invented incident is easy for a panel to unpick with two follow-up questions.
Q29. Tell me about a time you got an investigation wrong.
Name what you missed, what followed from it, and the check you added afterwards. The panel is testing whether you raise your own mistakes early or quietly hope nobody notices.
Q30. Explain a security incident to a non-technical manager.
Lead with impact and with what you need from them, not with the technique. "An account was used from an unfamiliar location, I have locked it, and I need HR to confirm whether the user is travelling" is the right shape.
How Should You Practise SOC Interview Questions?
Practise out loud, one question at a time, instead of re-reading a list of answers. Reading a question bank builds recognition; a SOC interview tests recall under mild pressure. Ten minutes a day spoken aloud, on the eight questions you find hardest, beats an hour of silent reading before the interview.
SOC Interview Answer Drill
Answer out loud first. Then reveal the model answer and what the panel is scoring. Eight questions, one round each.
Loading the drill…
Say your answer aloud, then select Reveal.
A good answer
What the panel is scoring
The drill is practice material, not a prediction of any employer's questions. If you cannot answer four of these eight out loud in under a minute each, you are not ready to interview yet — and that is fixable in about a week.
How Do You Answer When You Have No SOC Experience?
Answer from your lab, and say plainly that it is a lab. "In my lab I ingested Windows Security logs into Splunk and wrote a rule for repeated 4625 events from one source" is a complete answer to "have you used a SIEM". Indian L1 roles are genuine fresher entry points, and panels expect lab evidence rather than production experience.
What they will not forgive is inflation. Claiming production QRadar experience you do not have survives about two follow-up questions, and the interview is effectively over at that point — not because you lacked the experience, but because you were willing to say something untrue about your own work.
The tooling worth having in that lab is covered in more detail in our guide to the SOC analyst tools and skills employers ask for, and the certification question — which one, and when — in our comparison of the main SOC analyst certifications for 2026.
What Makes Freshers Fail SOC Analyst Interviews?
The three commonest failures are reciting definitions with no example, claiming tool experience you cannot describe, and jumping to a verdict in a scenario question without stating your checks. All three are fixable in a week of spoken practice. None of them is about knowing more theory than you already know.
The recited definition
Textbook-perfect, example-free. Add one line of application to every definition — what it looks like in a log, or which attack breaks it.
The inflated tool claim
"I have worked on Splunk, QRadar and Sentinel" invites three follow-ups you cannot answer. One tool, described concretely, is stronger.
The instant verdict
"That is a false positive" with no checks behind it is the answer that worries a team lead most. State the checks, then the verdict.
The shift dodge
SOC work is rotational. Hedging on night shifts in the HR screen ends most processes before the technical round happens.
Pay expectations sit in the same category: know the market band before the HR screen rather than during it. We keep that data, with sources and dates, in our SOC analyst salary guide for India — treat every figure there as a market estimate that depends on experience, employer and interview performance, not as a guarantee.
How Does AimNxt's SOC Analyst Programme Prepare You for the Interview?
The AimNxt SOC Analyst L1 & L2 programme runs 10 modules, and the final one, Lab & Practical Exercises, includes mock interview preparation alongside live tool work in Nmap, Wireshark, Splunk and Seceon. The earlier modules supply the material the technical round tests, from Networking Concepts through to SIEM & EDR Architecture.
Networking Concepts
Answers Round 2: OSI and TCP/IP, the three-way handshake, IP addressing, key protocols and ports.
Intro to Cybersecurity
Answers Round 1: the CIA triad, SOC roles, threat actors, and cryptography including hashing and salting.
Cyber Attacks
DDoS, SQL injection, XSS and the OWASP Top 10 — the attack vocabulary scenario questions assume.
Authentication & Threats
Zero-Trust, AAA and defence in depth, which are three of the eight Round 1 questions above.
Frameworks & Analysis
MITRE ATT&CK, the Cyber Kill Chain, and the incident response life cycle used in Rounds 3 and 4.
Security Analysis
Static and dynamic malware analysis, plus phishing and URL analysis — directly behind Q24.
Log Analysis
Windows Event IDs, the event-alert-incident distinction, and IOCs: the core of Round 2.
SIEM & EDR Architecture
Hands-on time in a SIEM and an EDR, so Round 3 answers describe queries you actually wrote.
Security Teams & MISC Concepts
Red, blue and purple team roles, and vulnerability assessment basics — common Round 5 follow-ups.
Lab & Practical Exercises
Live attack simulation, a written exam, and mock interview preparation before you start applying.
To be precise about what that programme is and is not: AimNxt issues its own AimNxt certificate of completion, not a vendor certification — CompTIA, EC-Council and Cisco are the certification bodies for their exams, and AimNxt is an independent training provider that prepares you for them. The AimNxt Job Interview Guarantee programme runs through 110+ hiring partners and guarantees interview opportunities until you are placement-ready. It does not guarantee a job offer, a placement or any salary. If you are earlier in the journey than the interview, start with our roadmap for becoming a SOC analyst in India, or come and see a class at the SOC Analyst L1 & L2 course in Hyderabad first.
Frequently Asked Questions
Practise These Questions With a Trainer, Not a PDF
Ten structured modules from networking fundamentals to live attack investigation, hands-on time in a real SIEM, and mock interview preparation before you start applying.
SOC Analyst L1 & L2 Course at AimNxt
10 modules · Splunk, Wireshark, Nmap, Seceon · Mock interviews
Attend a free demo session before you commit. No payment required. Just 60 minutes with the instructor at our KPHB, Kukatpally campus or online.