1. What is a Security Operations Center (SOC)?
A SOC is a centralized team responsible for monitoring, detecting, analyzing, and
responding to cybersecurity incidents using a combination of technology solutions
and a strong set of processes.
2. What are the roles in a SOC team?
Common roles include SOC Analyst (Tier 1, 2, 3), Incident Responder, Threat Hunter,
SOC Manager, and Forensic Analyst.
3. What is the role of a Tier 1 SOC Analyst?
Tier 1 analysts monitor SIEM alerts, perform initial triage, and escalate incidents
to Tier 2 or 3 if necessary.
4. What is SIEM?
Security Information and Event Management (SIEM) is a system that aggregates and
analyzes log data to detect security threats in real time.
5. Name some SIEM tools.
Splunk, IBM QRadar, ArcSight, LogRhythm, and Elastic SIEM.
6. What is a false positive?
An alert triggered by normal activity that is mistakenly flagged as malicious.
7. What are Indicators of Compromise (IOCs)?
IOCs are pieces of forensic data such as IP addresses, file hashes, or domains that
indicate a potential breach.
8. Explain the incident response process.
The steps include Preparation, Identification, Containment, Eradication, Recovery,
and Lessons Learned.
9. What is threat hunting?
Threat hunting is a proactive search through networks to detect and isolate
advanced threats that evade existing security solutions.
10. What is phishing?
A cyber attack that tricks users into revealing sensitive information via deceptive
emails or messages.
11. What is a brute force attack?
An attempt to gain access to accounts by systematically trying all possible
passwords.
12. What is a firewall?
A firewall is a network security device that monitors and filters incoming and
outgoing network traffic based on security rules.
13. Difference between IDS and IPS?
IDS detects and alerts on potential threats; IPS detects and blocks them.
14. What is lateral movement?
When an attacker moves within a network after initial access to find sensitive data
or systems.
15. What is a DDoS attack?
A Distributed Denial of Service attack floods a network with traffic to disrupt
services.
16. How do you identify a compromised system?
Look for unusual logins, file changes, high CPU/network usage, and known IOCs.
17. What is a security baseline?
A set of minimum security standards and configurations for systems and networks.
18. What is log correlation?
The process of linking log entries from different sources to find patterns of
suspicious behavior.
19. What is MITRE ATT&CK?
A knowledge base of adversary tactics and techniques used to improve detection and
defense strategies.
20. What is malware?
Malicious software designed to damage or gain unauthorized access to systems.
21. What is an SSL certificate?
A digital certificate that provides authentication and enables encrypted
connections over HTTPS.
22. What are the common types of malware?
Viruses, worms, Trojans, ransomware, spyware, and adware.
23. How do you analyze a phishing email?
Check sender details, URLs, attachments, headers, and report to the security team.
24. What is endpoint detection and response (EDR)?
EDR is a set of tools focused on detecting, investigating, and responding to
threats on endpoints.
25. What is port scanning?
The process of sending packets to ports to discover open ports and services.
26. What is patch management?
Regularly applying updates to software to fix vulnerabilities and bugs.
27. What is a zero-day vulnerability?
A security flaw that is unknown to the vendor and has no patch available yet.
28. What is data exfiltration?
Unauthorized transfer of data from a system by an attacker.
29. What is a honeypot?
A decoy system set up to attract attackers and study their behavior.
30. What are security controls?
Measures used to reduce risk such as technical, administrative, and physical
controls.
31. What is the purpose of network segmentation?
To limit access and reduce the spread of attacks within a network.
32. What is CVE?
Common Vulnerabilities and Exposures – a list of publicly known cybersecurity
vulnerabilities.
33. How does a SOC handle insider threats?
By monitoring user behavior, restricting access, and investigating anomalies.
34. What is SIEM normalization?
Standardizing log data from different sources for easier analysis.
35. What is escalation in a SOC?
The process of forwarding unresolved or complex incidents to higher-tier analysts
or response teams.
36. What is risk assessment?
Evaluating and prioritizing risks based on their likelihood and impact.
37. What is phishing simulation?
A training method where employees are tested with fake phishing emails to improve
awareness.
38. What are logs collected in a SOC?
Firewall logs, system logs, antivirus logs, application logs, and authentication
logs.
39. What is sandboxing?
Running suspicious files in an isolated environment to observe behavior safely.
40. What are the key challenges in a SOC?
Alert fatigue, skills shortage, complex environments, and lack of visibility.
41. What is correlation rule tuning?
Adjusting SIEM rules to reduce false positives and improve alert relevance.
42. What is the difference between symmetric and asymmetric encryption?
Symmetric uses one key for encryption/decryption; asymmetric uses public and
private keys.
43. What is the difference between vulnerability scanning and penetration testing?
Scanning identifies known flaws; pen testing actively exploits vulnerabilities to
assess security.
44. What is the CIA triad?
Confidentiality, Integrity, and Availability – the core principles of information
security.
45. What is social engineering?
Manipulating individuals into revealing confidential information or performing
actions for attackers.
46. What is the use of Active Directory logs in a SOC?
To detect unauthorized access, privilege escalation, and suspicious user activity.
47. What is an SLA in incident response?
Service Level Agreement – defines response time expectations for incident handling.
48. What is chain of custody in forensics?
The documented process that maintains integrity of digital evidence from collection
to presentation.
49. What is EDR vs. antivirus?
EDR provides behavioral detection and response; antivirus uses signature-based
detection.
50. What is role-based access control (RBAC)?
Restricting access based on a user’s role within the organization.
