20 scenario questions Indian SOC interviewers ask (and how to answer)

Definitions get you through the first technical round. Scenarios decide the offer. Below are twenty situational prompts that come up repeatedly in Indian L1 and L2 SOC interviews, with the shape of a strong answer — not a script to memorise, because interviewers can hear a memorised answer immediately.

The structure to use every time

1. Clarify — one question that narrows the problem.
2. Check — what you would look at, in priority order, and why.
3. Decide — benign, needs more data, or escalate.
4. Act — containment, documentation, communication.

Say this structure out loud as you go. Interviewers are scoring the process more than the verdict.

Phishing and email

1. A user forwards a suspicious email. What now? Preserve the original with headers. Check sender domain and authentication results (SPF, DKIM, DMARC). Detonate or reputation-check links and attachments in a safe environment. Search mail logs for other recipients. If malicious: purge from mailboxes, block the sender and URL, check whether anyone clicked or submitted credentials.

2. A user clicked the link and entered credentials. Priority? Reset the password and revoke active sessions and tokens immediately — session revocation is the step candidates forget. Then check sign-in logs for successful access, MFA prompts, mailbox rule creation and forwarding rules.

3. The email came from a legitimate internal address. Treat the sending account as potentially compromised, not the email as safe. Investigate that account''s sign-ins and mailbox rules.

4. How do you tell a phishing simulation from a real attack? Check with the security awareness owner and the known simulation infrastructure. Say that you would still document it.

Authentication and identity

5. Twenty failed logins, then one success. Determine whether it is one source or many, whether the source is expected for that user, whether MFA was satisfied, and what happened after the success. A success after a burst is treated as compromise until proven otherwise.

6. Impossible travel alert — Mumbai then Frankfurt in ten minutes. Check for VPN or corporate proxy egress first; this is the most common benign explanation. Then confirm device, MFA and subsequent activity.

7. A privileged account logs in outside working hours. Check the change calendar and on-call roster before escalating. Legitimate out-of-hours admin work is common; unexplained out-of-hours admin work is not.

8. A new account was created and added to a privileged group within minutes. Who created it, was there a ticket, was it via a normal provisioning path. Persistence is the concern.

Endpoint

9. Word spawns PowerShell. Classic macro-based execution chain. Look at the parent-child tree, the command line and any encoded content, network connections made afterwards, files written, and persistence created.

10. EDR flags a tool your admins actually use. Confirm the user, host and ticket. Tune with context rather than blanket-suppressing — say that explicitly.

11. A host beacons to an external IP every sixty seconds. Regular intervals suggest automation: could be legitimate telemetry or command and control. Check the process, the destination reputation, the JA3/TLS details available to you, and whether other hosts do the same.

12. Ransomware indicators on one endpoint. Isolate the host from the network but keep it powered on to preserve volatile evidence. Escalate immediately. Identify the account used, check for lateral movement and shadow-copy deletion, and confirm backup integrity.

Network

13. Large outbound transfer at 3 a.m. Identify source host, user, destination, protocol, and whether the volume is unusual for that host. Distinguish a backup job from exfiltration by checking the schedule and the destination.

14. Unusual DNS with long random subdomains. Consistent with DNS tunnelling or algorithm-generated domains. Check volume, the querying process, and whether the domain is newly registered.

15. An internal host scans other internal hosts. Check whether it is an approved vulnerability scanner before assuming lateral movement. If not, treat it as reconnaissance from a compromised host.

Judgement and process

16. You closed an alert as false positive and it turned out to be real. Say what you would do: reopen, escalate with a clear timeline, document why the original decision was made, and propose the detection or process change that prevents a repeat. Interviewers want honesty and correction, not defensiveness.

17. Your queue has forty alerts and one hour left in the shift. Prioritise by asset criticality and severity, handle anything indicating active compromise first, and hand over the rest with clear notes. Mention the handover explicitly.

18. L2 is unavailable and you believe it is a live incident. Follow the escalation matrix to the next contact, take any pre-authorised containment action, document everything with timestamps.

19. A senior manager asks you to whitelist something you think is unsafe. Explain the risk, offer a narrower alternative, and require the exception to go through the documented approval process. Never quietly comply and never simply refuse.

20. Nothing happens for three hours on a night shift. Threat hunting, tuning noisy rules, reading recent advisories, updating runbooks. This answer tells the interviewer whether you will grow.

How to practise these

Reading them is not practising them. Set a timer, pick five at random, and answer out loud in under two minutes each, using the four-step structure. Record yourself once — you will hear the filler immediately.

Next step

Take the free 5-question AI mock interview with SOC analyst as your target role. It asks scenario questions like these, listens to your spoken answer, and scores your reasoning so you know which of the twenty you still cannot deliver cleanly.