Cybersecurity and SOC Interview Questions 2026: Freshers to 10 Years, OWASP, Networking, Incident Response and Scenarios

How to use this guide

This guide covers cybersecurity for SOC analysts, security engineers and application security roles. It explains the concepts and the reasoning that interviewers test. The guide is for defensive learning and interview preparation. Practise techniques only in labs you own or are authorised to use.

The answers follow widely used references, such as the OWASP Top 10 and the MITRE ATT&CK framework. Product names and features change, so check current documentation for exact settings.

What the interview pattern usually looks like

SOC roles test triage reasoning heavily. Application security roles test OWASP topics and secure code review. Security engineering roles test architecture and cloud controls.

Level 1: Security fundamentals

Q1. What is the CIA triad?

Confidentiality, integrity and availability. Confidentiality keeps data private. Integrity keeps data accurate and unaltered. Availability keeps systems and data accessible when needed. Many scenario answers start by asking which of the three is at risk.

Q2. What is the difference between a vulnerability, a threat and a risk?

A vulnerability is a weakness. A threat is an actor or event that could exploit it. Risk is the likelihood and impact of that exploitation. Patching reduces vulnerability, and controls reduce risk.

Q3. What is defence in depth?

Layering several controls, so one failure does not lead to a breach. Examples: network segmentation, endpoint protection, least privilege, logging, and user training.

Q4. What is the principle of least privilege?

Each user, process and service gets only the access it needs for its task. It limits the damage from a compromised account.

Q5. What is the difference between a virus, a worm, a trojan and ransomware?

A virus attaches to a file and spreads when the file runs. A worm spreads on its own across networks. A trojan looks legitimate but hides malicious behaviour. Ransomware encrypts data and demands payment. Many modern attacks combine these.

Q6. What is phishing, and what is spear phishing?

Phishing is a deceptive message that tricks a person into revealing credentials or running a file. Spear phishing targets a specific person, using details that make the message believable.

Q7. What is social engineering?

Manipulating people rather than systems. Pretexting, baiting and tailgating are examples. Training and verification steps reduce the risk.

Level 2: Networking and common attacks

Q8. What is the difference between a stateful and a stateless firewall?

A stateless firewall checks each packet alone. A stateful firewall tracks connections and allows return traffic for an approved session. Most modern firewalls are stateful.

Q9. What is a DMZ?

A network segment for public-facing servers, separated from the internal network by firewalls. A compromised public server should not give direct access to internal systems.

Q10. What is a port scan, and how do you detect one?

A scan probes many ports to find open services. Detect it by many connection attempts from one source to many ports or hosts in a short time, shown in firewall or IDS logs.

Q11. What is a man-in-the-middle attack?

An attacker secretly relays and may alter communication between two parties. Defences include TLS with certificate validation, HSTS on web applications, and not accepting untrusted certificates.

Q12. What is ARP spoofing?

The attacker sends fake ARP replies so traffic for another host goes to the attacker. Defences include dynamic ARP inspection on managed switches and monitoring for duplicate MAC addresses.

Q13. What is DNS poisoning, and what is DNS tunnelling?

DNS poisoning inserts false records into a resolver's cache, sending users to wrong addresses. DNS tunnelling hides data in DNS queries to move it out of a network. Watch for unusually long or frequent DNS queries.

Q14. What is a denial-of-service attack, and how do you respond?

It floods a service so legitimate users cannot use it. Responses include rate limiting, upstream scrubbing from the provider, autoscaling where it helps, and a runbook that names who to call.

Q15. What is lateral movement?

An attacker moves from a compromised host to others in the network, often by stealing credentials. Detect it through unusual logons, new admin tools, and access to systems the user has never used.

Level 3: Web application security (OWASP)

The OWASP Top 10 is a common topic in application security rounds. Know each category, an example, and a fix.

Q16. What is SQL injection, and how do you prevent it?

User input changes the SQL statement. Prevent it with parameterised queries or prepared statements, input validation, and limited database rights. Show the vulnerable pattern and the fixed one in the interview.

Q17. What is cross-site scripting?

Attacker script runs in a victim's browser through the page. Types: stored, reflected and DOM-based. Prevent with output encoding for the context, input validation, and a Content Security Policy.

Q18. What is cross-site request forgery?

A logged-in user's browser sends an unwanted request from another site. Defences: anti-CSRF tokens checked on the server, SameSite cookies, and requiring re-authentication for sensitive actions.

Q19. What is insecure direct object reference, and how do you fix it?

Changing an ID in a URL gives access to another user's record, because the server does not check ownership. Fix by checking authorisation on each object access, not only on login.

Q20. What is server-side request forgery?

The attacker makes the server request an internal or cloud metadata address. Prevent with an allow-list of destinations, blocking internal address ranges, and using instance metadata protections.

Q21. What is a security misconfiguration, and give examples.

Default passwords, open cloud storage, debug pages on in production, verbose error messages, and unnecessary services. Fix with hardening baselines and regular configuration review.

Q22. Explain insecure deserialisation.

Untrusted data is turned into objects, which can run code or change logic. Prevent by not deserialising untrusted input with dangerous formats, using signed data, and limiting types.

Q23. What is a secure cookie?

A cookie with Secure (sent only over HTTPS), HttpOnly (not readable by JavaScript) and SameSite set. These reduce theft and cross-site misuse.

Level 4: Authentication and cryptography

Q24. What is the difference between authentication and authorisation?

Authentication proves who the user is. Authorisation decides what they can do. A logged-in user can still be unauthorised for a record.

Q25. What is multi-factor authentication, and which factors exist?

Something you know (password), something you have (phone or security key), and something you are (biometrics). Combining two different types is stronger than two passwords.

Q26. How should passwords be stored?

Hashed with a slow, salted algorithm such as bcrypt, scrypt or argon2. Never encrypted with a key the app can read, and never stored in plain text or with fast hashes.

Q27. What is the difference between hashing and encryption?

Hashing is one-way and produces a fixed-size digest, used for integrity and passwords. Encryption is reversible with a key, used for confidentiality. Symmetric encryption uses one key. Asymmetric uses a public and private pair.

Q28. What is TLS, and what does the certificate prove?

TLS encrypts the connection and authenticates the server. The certificate binds a public key to a domain name and is signed by a trusted certificate authority. The browser checks the chain and the name.

Q29. What is a JSON Web Token, and what is a common risk?

A signed token with claims. Risks: accepting unsigned tokens, using a weak secret, trusting the algorithm field from the token, and not checking expiry. Verify the signature with a fixed algorithm and keep lifetimes short.

Q30. What is a salt?

A random value added to a password before hashing, so the same password does not give the same hash, and precomputed tables do not work.

Level 5: SOC operations and SIEM

Q31. What is a SIEM, and what does it do?

A security information and event management system collects logs from many sources, normalises them, correlates events, raises alerts and supports search. Examples include Splunk, Microsoft Sentinel and Elastic-based tools.

Q32. What is the difference between an event and an alert?

An event is a single log record, such as a login. An alert is a detection rule's output, raised when events match a pattern. Many events feed one alert.

Q33. What is a false positive, and why does it matter?

An alert that is not a real threat. Too many false positives cause alert fatigue, and real threats are missed. Tune rules and document why each is closed.

Q34. How do you triage an alert?

1. Read the rule name and what it means.
2. Check the asset: its owner, its criticality and whether it is expected.
3. Check the user and the source: is the activity usual for this person?
4. Pull related events in a time window: before, during and after.
5. Check threat intelligence for the IP, domain or file hash.
6. Decide: benign, suspicious or confirmed. Escalate with the evidence.
7. Document the steps and the decision.

Q35. What do you check in Windows logs for a suspicious logon?

Event IDs include 4624 for successful logon and 4625 for failed logon, with logon type. A lot of 4625 followed by 4624 can mean password guessing. Check the account, source IP, time and whether it was an interactive or network logon.

Q36. What is a brute-force attack, and how do you detect one?

Repeated login attempts with many passwords. Detect with many failures for one account or from one source in a short time, followed by a success. Respond by locking or challenging the account and blocking the source.

Q37. What is a log retention policy, and why is it important?

It defines how long logs are kept and where. Investigations and compliance need logs for weeks or months. Logs must be protected from tampering and time-synchronised with NTP.

Q38. What is MITRE ATT&CK?

A knowledge base of adversary tactics and techniques, such as initial access, persistence and lateral movement. SOC teams use it to map detections and find gaps in coverage.

Level 6: Incident response

Q39. What are the phases of incident response?

Preparation, identification, containment, eradication, recovery and lessons learned. The NIST framework lists these phases in a similar order.

Q40. How do you contain a compromised endpoint?

Isolate it from the network with the endpoint tool, keep it powered on for memory evidence where policy allows, collect volatile data, block known malicious indicators, and reset affected credentials. Do not wipe the machine before evidence is collected.

Q41. What is chain of custody?

A record of who handled evidence, when, and what was done. It keeps evidence usable for an investigation or legal action.

Q42. What is a post-incident review?

A blameless review after the incident, covering the timeline, detection gaps, the response quality and the actions to prevent a repeat. Track the actions to completion.

Q43. How do you respond to a suspected data exposure?

Confirm what data and which people are affected. Contain the access path. Preserve evidence. Notify the internal legal, privacy and management owners according to the policy and the law that applies. Prepare the facts before any external statement.

Level 7: Frameworks, cloud and architecture

Q44. What is zero trust?

An approach where no user or device is trusted by default, even inside the network. Every access is verified by identity, device health and context, and access is limited.

Q45. What are the main cloud security controls?

Identity controls: least privilege roles and MFA. Network controls: private subnets and restricted security groups. Data controls: encryption at rest and in transit, and private storage. Logging: audit trails enabled and sent to a central place. Configuration checks: continuous posture scanning.

Q46. What is vulnerability management?

A cycle of finding assets, scanning for vulnerabilities, prioritising by risk and exposure, patching or mitigating, and verifying. Use a severity score, but also the exposure of the asset and whether exploit code exists.

Q47. How does a penetration test differ from a vulnerability scan?

A scan automatically finds known weaknesses. A penetration test is a manual, goal-driven assessment that tries to chain weaknesses. Both need written authorisation and a defined scope.

Q48. What is secure software development lifecycle?

Security built into each stage: threat modelling at design, secure coding standards, code review, static and dynamic testing, dependency scanning, and monitoring in production.

Scenario questions asked in SOC rounds

S1. An alert shows a user logging in from two countries within an hour. What do you do?

Check whether the user travels, whether a VPN or cloud service explains the location, and whether the login succeeded. Check the device and the activity after login. If there is no explanation, reset the password, revoke sessions, require MFA, and escalate to the incident process.

S2. A user reports an email asking for credentials. How do you respond?

Ask the user not to click or enter anything. Collect the message as an attachment with full headers. Check the sender domain, links and any attachments in a sandbox. Search the mail system for the same message across users. Block the sender and the domain, reset credentials for anyone who clicked or entered details, and document it.

S3. An endpoint shows a process that encrypts files quickly. What do you do?

Treat it as ransomware until proven otherwise. Isolate the host from the network immediately. Identify the process, parent process and the user. Check other hosts for the same indicators. Protect backups by isolating them. Engage the incident response lead.

S4. A web server shows many requests with long strings in the URL.

Check the request pattern against signatures for SQL injection and path traversal. Review the application's error logs, and check whether any request returned data unexpectedly. Add a web application firewall rule as a temporary measure, and fix the code path.

S5. A developer committed an API key to a public repository. What do you do?

Revoke and rotate the key first. Check the logs for use of the key since the commit. Remove the secret from the history if the platform needs it, and do not rely on deleting the file alone. Add secret scanning to the pipeline.

How to answer 'explain a project'

Describe the environment and its risks, then your part: the controls you set up, the detections you wrote, the incidents you handled, or the vulnerabilities you fixed. Give the result in plain terms, such as fewer false positives or a closed finding, only if it is true for your work.

Common mistakes

• Jumping to a conclusion from one alert. Gather context from the asset, the user and the time window first.
• Wiping a machine before collecting evidence.
• Telling people to ignore an alert without a reason. Document why.
• Mixing up authentication and authorisation.
• Hashing passwords with a fast hash. Use a slow, salted algorithm.
• Testing systems you are not authorised to test. Always confirm written scope.

A four-week preparation plan

Frequently asked questions

Which certifications help most? Entry-level certifications on networking and security fundamentals help the first screening. Practical labs and triage skill matter more in the interview.

Do I need to know a SIEM product? Learn the concepts first. Hands-on time with one product, such as a free trial or a home lab, helps.

What is a realistic first role? A SOC analyst level 1, an IT support role with a security focus, or a vulnerability management analyst role. Each builds the base for later roles.