SOC Analyst interview question

A workstation is encrypting files and beaconing outbound. Walk me through your ransomware response.

What interviewers are really testing

• Containment before curiosity - isolate first
• Evidence preservation and scope assessment
• Recovery realism: backups, verification, lessons

A strong answer framework

1. Isolate the host from the network (keep power on to preserve memory)
2. Confirm scope: other hosts, file shares, backup infrastructure
3. Identify entry vector: phishing, RDP, vulnerable service
4. Preserve evidence: memory and disk images, relevant logs
5. Eradicate: reimage, rotate credentials, patch the entry vector
6. Verify backups offline before recovery; involve IR, legal, comms

Follow-ups you should be ready for

• Do you pay the ransom? Who decides?
• How do you verify backups are clean?
• What changes if a server is hit instead of a workstation?

More real SOC Analyst interview questions

• A domain controller is making outbound connections to an external IP on port 443. No maintenance is scheduled. How do you investigate?
• A user reports clicking a link in a phishing email. Walk me through your response.
• How would you write a Splunk search to detect multiple failed logins followed by a success?