SOC Analyst Case Study Questions: Six Scenarios With a Method, Evidence and Model Answers

Key takeaways

• Use one method for every case: validate, scope, collect evidence, contain, eradicate, recover, report.
• Name the exact data you would check, such as firewall, proxy, DNS, EDR and authentication logs.
• Say what you would escalate and to whom. Knowing when to escalate is part of the job.
• Contain early if harm is ongoing, but preserve evidence before you wipe or rebuild.
• All log lines below are illustrative and use documentation IP ranges, not real incidents.

How do you answer a SOC case study question?

Use the same frame each time. It keeps you calm and shows the interviewer a repeatable process, which follows the incident handling stages in NIST SP 800-61.

1. Validate. Is this a true positive? Check the alert logic and the raw event.
2. Scope. Which hosts, users and accounts? When did it start?
3. Collect evidence. Logs, memory, process list, network captures. Note times in UTC.
4. Contain. Isolate the host or disable the account, in a way that keeps evidence.
5. Eradicate and recover. Remove the cause, patch, restore from known-good, monitor.
6. Report and learn. Timeline, root cause, detections to add.

Case 1: Unusual outbound traffic from a server

Question: An alert shows a file server sending a large volume of data to an external address at 02:10. What do you do?

Model answer: Check the firewall or proxy log for the destination, port, volume and duration. Compare it with the server's normal pattern. Look up the destination in threat intelligence and passive DNS. On the host, list processes with network connections and check recently created scheduled tasks or services. If the data transfer is ongoing, isolate the server from the network but keep it powered on so memory can be captured. Escalate to the incident lead if sensitive data is involved.

2026-03-04T02:10:41Z fw01 ALLOW tcp 10.10.5.20:51844 -> 203.0.113.50:443 bytes_out=2.4GB duration=1180s

What to say about this line: the volume is far above a normal baseline for this host, the destination is unfamiliar and the time is out of hours. It is enough to investigate, not enough to conclude.

Case 2: Suspected phishing email

Question: Several staff report the same email with an invoice link. What are your steps?

Model answer: Pull the message headers and check the sender, reply-to and authentication results (SPF, DKIM, DMARC). Extract the URL and attachment hashes and check them in a sandbox or by reputation. Search the mail gateway for every recipient and delete or quarantine the message. Check proxy and DNS logs for who clicked and, for those users, check sign-in logs and endpoint alerts. Reset credentials for anyone who entered a password. Then block the domain and update awareness material. Read our scenario-based interview questions for more cases.

Case 3: Many failed logins

Question: The IDS flags many failed logins against one account.

Mar 4 03:12:07 srv01 sshd[2211]: Failed password for admin from 198.51.100.7 port 40122 ssh2
Mar 4 03:12:09 srv01 sshd[2213]: Failed password for admin from 198.51.100.7 port 40124 ssh2
Mar 4 03:12:12 srv01 sshd[2215]: Accepted password for admin from 198.51.100.7 port 40126 ssh2

Model answer: The key detail is the last line: a success after repeated failures from the same source. Treat the account as compromised. Disable it, review what it did after 03:12:12, check for new keys, users and cron entries, block the source, and look for the same source against other hosts. Then enforce key-based login or multi-factor authentication and rate limiting.

Case 4: Ransomware on one workstation

Question: EDR reports files being renamed with a new extension on one laptop.

Model answer: Isolate the laptop through EDR right away, since speed matters here. Identify the process and the initial access, often an email attachment or a remote access tool. Check whether it touched file shares and whether the same indicators appear elsewhere. Do not pay or negotiate. Hand over to the incident lead, preserve evidence and restore from tested backups. In India, serious incidents have to be reported to CERT-In within the time in its directions, so check the current text on CERT-In.

Case 5: Impossible travel sign-in

Question: A user signs in from Pune and, twenty minutes later, from a distant country.

Model answer: Check whether a VPN or proxy explains it. Review the sign-in details: device, user agent, multi-factor result and whether the session token was reused. If it is not explained, revoke sessions, reset the password, force multi-factor re-registration and review mailbox rules and recent file access.

Case 6: Suspicious PowerShell

Question: EDR shows powershell.exe -enc... started by a Word document.

Model answer: A Office app spawning an encoded PowerShell command is high risk. Decode the string, record the commands and any URLs it contacts, find the document and the delivery email, isolate the host and hunt for the same parent-child process pattern elsewhere. Map it to MITRE ATT&CK techniques in your report.

What are the common mistakes in interviews?

• Reaching for containment or a rebuild before saying how you would preserve evidence.
• Naming tools without saying what you would look for in them.
• Skipping scope. One infected host is rarely the whole story.
• Never mentioning escalation, communication or documentation.

For technical questions, see our SOC analyst technical interview questions, and for more case formats the cyber security case study questions.

Next steps

Next steps: to train for a SOC role, see our Certified SOC Analyst course, and practise with our SOC analyst technical interview questions.

Related reading

• Types of Security Logs | A Complete Guide for Cybersecurity Monitoring in 2026
• [2026] Top 50 SOC Analyst Interview Questions and Answers
• Common SOC Analyst Interview Questions 2026