SOC Analyst interview question

How would you detect DNS tunneling in an environment?

What interviewers are really testing

• Understanding why tunneling exists (exfil/C2)
• Statistical and behavioral detection ideas
• Practical tooling awareness

A strong answer framework

1. Flag abnormally long or high-entropy subdomain labels
2. Spikes in TXT/NULL queries or per-host query volume
3. Steady cadence to a single rare or newly-registered domain
4. Baseline first: normal clients query few domains frequently
5. Deploy entropy scoring, query-length thresholds, NXDOMAIN ratios

Follow-ups you should be ready for

• Which datasets or tools would you use?
• How do you cut false positives from CDNs?

More real SOC Analyst interview questions

• A domain controller is making outbound connections to an external IP on port 443. No maintenance is scheduled. How do you investigate?
• A user reports clicking a link in a phishing email. Walk me through your response.
• How would you write a Splunk search to detect multiple failed logins followed by a success?