SOC Analyst Tier-1 Interview Guide 2026: Questions and Answers

A SOC is a centralised security function that continuously monitors, detects, investigates and responds to cyber threats. It combines people, processes and technologies such as SIEM, EDR, identity security, email security and threat intelligence.

A Tier-1 analyst monitors alerts, performs initial validation and enrichment, identifies affected entities, checks for related activity, documents evidence and escalates cases that are malicious, high-impact, widespread or beyond Tier-1 authority.

An event is a recorded activity, such as a login. An alert is created when activity matches a detection rule or suspicious condition. An incident is a confirmed or suspected security situation that requires coordinated investigation and response. Multiple related alerts may form one incident.

A true positive means the detection is valid and the activity is malicious or violates policy. A false positive means the alert fired but the underlying activity does not match the intended threat. A benign positive means the rule correctly detected the behaviour, but it was authorised or expected.

Security Information and Event Management collects and analyses security logs from multiple systems. It helps analysts correlate activity, generate alerts, investigate incidents, search historical data, build dashboards and support reporting. Learn the fundamentals through SIEM Tools Explained for Beginners.

Important sources include authentication, endpoint or EDR, firewall, proxy, DNS, email, Active Directory, VPN, cloud, application and vulnerability logs. The best source depends on the alert. For a suspicious login, I would prioritise identity, VPN, endpoint and relevant application evidence.

I validate the rule, time, data source and triggering events. I then enrich the user, device, source and destination, examine activity before and after the alert, search for related indicators, determine scope, classify the result and document the evidence. If the alert is high-impact or unclear, I escalate it with context.

Severity represents the potential technical impact or seriousness of the activity. Priority determines how quickly the case should be handled after considering severity, asset criticality, active exploitation, business impact, user privilege, exposure and current scope.

An Indicator of Compromise is an observable artefact associated with malicious activity, such as a file hash, domain or IP address. An Indicator of Attack focuses more on attacker behaviour or intent, such as credential dumping or unusual process relationships. IOCs may change quickly, while behavioural detections can identify broader patterns.

The CIA triad represents confidentiality, integrity and availability. Confidentiality prevents unauthorised disclosure, integrity protects accuracy and trustworthiness, and availability ensures systems and data remain accessible when needed. Incident impact can be explained using these three objectives.

Common ports include 22 for SSH, 25 for SMTP, 53 for DNS, 80 for HTTP, 443 for HTTPS, 445 for SMB and 3389 for RDP. I would not judge activity using the port alone because applications can use non-standard ports. I would verify the process, direction, destination, protocol and business context.

The client sends SYN to request a connection. The server replies with SYN-ACK. The client responds with ACK, and the session is established. Many SYN packets without completed handshakes can have several causes, including scanning, filtering, packet loss or resource exhaustion, so I would investigate the traffic pattern and server evidence.

TCP is connection-oriented and provides ordered, reliable delivery. UDP is connectionless and has lower overhead but does not provide the same delivery guarantees. The security relevance depends on the protocol and application. DNS commonly uses UDP but can use TCP in specific situations.

DNS translates domain names into IP addresses and supports other record types. DNS logs can reveal newly observed domains, command-and-control infrastructure, suspicious subdomains, tunnelling patterns and connections that endpoint or proxy alerts reference. I would correlate DNS with process, proxy and threat-intelligence data.

Firewall logs mainly show network connections, source and destination addresses, ports, protocol and allow or deny decisions. Proxy logs provide application-layer web context such as URL, domain, method, response, user identity and category. Together they help explain both the connection and the web request.

I examine the display name, From, Reply-To and Return-Path, trace Received headers, check SPF, DKIM and DMARC alignment, analyse URLs and attachments safely, identify recipients and review whether anyone clicked, entered credentials or executed content. I then establish scope and follow the email and identity containment playbook. Use the detailed phishing email investigation guide.

SPF helps verify whether sending infrastructure is authorised for the envelope sender domain. DKIM verifies a cryptographic signature associated with the signing domain. DMARC evaluates alignment between the visible From domain and authenticated SPF or DKIM identifiers and applies the domain owner’s published policy. Passing all three does not guarantee that the content is safe.

The current DMARC specification is available from the RFC Editor.

I would determine whether the user only opened the page, entered credentials, downloaded a file or executed content. I would identify the device, account, time and destination, review proxy, DNS, endpoint and identity telemetry, search for other recipients, preserve evidence and follow the approved containment and escalation process.

Useful IDs include 4624 successful logon, 4625 failed logon, 4648 explicit credentials, 4672 special privileges, 4688 process creation, 4720 account creation, 4732 group membership change, 4740 account lockout, 4768 and 4769 Kerberos activity, and 1102 audit-log clearing. Event availability depends on audit configuration. Review the complete Windows Event ID guide.

I would validate the accounts, source, destination, timestamps and authentication method. I would check whether one account or many accounts were targeted, identify the successful session, compare the source with normal behaviour and examine activity after login. I would consider password guessing, user error, stale credentials and legitimate automation before deciding.

Malware is a broad category of malicious software. Ransomware is a type of malware or extortion activity designed to disrupt access, often by encrypting data, and may also involve data theft. A ransomware alert requires rapid validation, scoping, containment and escalation because spread can create severe operational impact.

Endpoint Detection and Response collects endpoint telemetry and supports detection, investigation and response. Analysts use it to review processes, parent-child relationships, files, users, persistence, network connections and response actions such as device isolation, subject to permissions and procedure.

A hash is a fixed-length value calculated from file content. It helps identify an exact file, search for internal prevalence and compare against approved threat intelligence. A matching hash can be strong evidence, but no match does not prove a file is safe because attackers can modify files and produce new hashes.

MITRE ATT&CK is a knowledge base of adversary tactics and techniques based on observed behaviour. SOC teams use it to describe attacker actions, map detections, identify visibility gaps and structure investigations. It should support reasoning rather than become a list of technique IDs memorised without context.

I would escalate when evidence indicates malicious activity, the case involves critical assets or privileged accounts, the scope is growing, containment requires higher authority, the alert may involve data loss or legal obligations, the playbook requires escalation, or the evidence remains uncertain after the Tier-1 investigation. The escalation should include evidence, scope, actions completed and clear next questions.