Principles of Information Security: Security Analyst Interview Questions and Scenarios

Security Analyst Interview Questions and Scenarios

Security Analyst Interview Questions & Scenarios: Exam-Ready Study Guide

What This Is

This guide prepares you for security analyst interviews by breaking down real-world scenarios, technical questions, and behavioral assessments used to evaluate candidates. Security analysts detect, investigate, and respond to cyber threats—making this knowledge critical for roles in SOCs (Security Operations Centers), incident response, and threat hunting. Example: In the 2023 MOVEit Transfer breach, attackers exploited a zero-day SQL injection flaw, exfiltrating PII from thousands of organizations. A security analyst’s ability to triage alerts, analyze logs, and recommend mitigations could have reduced the blast radius.

Key Terms & Concepts

• SOC (Security Operations Center): A centralized team that monitors, detects, and responds to cybersecurity incidents (24/7 in mature orgs). Tools: SIEM (Splunk, IBM QRadar), EDR (CrowdStrike, SentinelOne), SOAR (Palo Alto XSOAR).
• Incident Response (IR): A structured approach to handling security breaches (NIST SP 800-61). Phases: Preparation → Detection/Analysis → Containment → Eradication → Recovery → Lessons Learned.
• Threat Intelligence: Evidence-based knowledge about adversaries (MITRE ATT&CK, AlienVault OTX). Used to prioritize alerts and hunt for threats.
• False Positive vs. False Negative:
• False Positive: Alert triggered on benign activity (e.g., a user downloading a file flagged as malware).
• False Negative: Malicious activity missed by security tools (e.g., a zero-day exploit bypassing AV).
• Playbook: A step-by-step guide for responding to specific threats (e.g., ransomware, phishing). Aligns with NIST CSF (Identify, Protect, Detect, Respond, Recover).
• TTPs (Tactics, Techniques, and Procedures): How attackers operate (e.g., Tactic: Initial Access → Technique: Phishing → Procedure: Malicious Excel macro).
• IOCs (Indicators of Compromise): Artifacts left by attackers (e.g., IP addresses, hashes, domain names). Shared via STIX/TAXII (structured threat intelligence formats).
• Log Sources: Critical data for investigations:
• Firewall logs (blocked connections),
• Windows Event Logs (Event ID 4624 = successful login),
• Proxy logs (user web activity),
• Endpoint logs (process execution, file modifications).
• Chain of Custody: Legal documentation proving evidence integrity (critical for forensics). Example: Seizing a compromised laptop → hashing files → storing in a tamper-evident bag.
• Risk Assessment: Quantifying risk using ALE (Annualized Loss Expectancy) = SLE (Single Loss Expectancy) × ARO (Annualized Rate of Occurrence). Example: A ransomware attack costs $100K (SLE) and happens twice a year (ARO) → ALE = $200K.
• Zero Trust: "Never trust, always verify" security model (NIST SP 800-207). Components: MFA, least privilege, micro-segmentation, continuous authentication.
• MITRE ATT&CK: A knowledge base of adversary TTPs (e.g., T1059: Command-Line Interface for lateral movement). Used for threat hunting and red teaming.

Step-by-Step / Process Flow

1. Handling a Phishing Alert (SOC Analyst Workflow)

1. Triage the Alert:
2. Check the SIEM dashboard (e.g., Splunk) for the phishing email alert.
3. Verify IOCs: Sender domain, attachment hash, URLs (use VirusTotal, URLScan.io).
4. Isolate the Affected System:
5. If the email was opened, quarantine the endpoint (EDR tool like CrowdStrike).
6. Block the sender domain/IP at the email gateway (e.g., Proofpoint, Mimecast).
7. Analyze the Payload:
8. If a malicious attachment was executed, check process logs (e.g., powershell.exe spawning cmd.exe).
9. Look for C2 (Command & Control) traffic (e.g., unusual outbound connections to port 443).
10. Contain the Threat:
11. Kill malicious processes (EDR tool).
12. Reset user credentials (if compromised).
13. Patch vulnerable systems (if exploit was used).
14. Document & Escalate:
15. Update the incident ticket (ServiceNow, Jira).
16. Escalate to Tier 2/3 if lateral movement is detected.
17. Post-Incident Review:
18. Update playbooks (e.g., add new phishing IOCs).
19. Conduct user training (e.g., simulated phishing tests).

2. Investigating a Brute-Force Attack

1. Detect the Attack:
2. SIEM alert: Multiple failed login attempts (Event ID 4625 in Windows).
3. Check geolocation of IPs (e.g., Tor exit nodes, known malicious IPs).
4. Determine Scope:
5. Was the attack targeted (e.g., admin accounts) or random (e.g., common usernames like "admin")?
6. Check VPN logs (if remote access was used).
7. Mitigate:
8. Block the attacking IP (firewall rule).
9. Enforce account lockout (e.g., 5 failed attempts → 30-minute lockout).
10. Enable MFA (if not already in place).
11. Hunt for Persistence:
12. Check for new user accounts (Event ID 4720).
13. Look for scheduled tasks (schtasks /query).
14. Report:
15. Notify management (if PII was accessed).
16. Update threat intelligence feeds (e.g., add IP to blocklist).

Common Mistakes

Certification Exam Tips

CISSP

• Management vs. Technical: CISSP leans toward governance, risk, and compliance (GRC). Example: A question about incident response will focus on policies, roles, and legal considerations, not how to run netstat.
• CIA Triad Priority: Know which pillar is most important for a given scenario. Example:
• Banking system → Integrity (transactions must not be altered).
• Hospital EHR → Availability (life-critical systems must be online).
• Risk Management Formulas: Memorize ALE = SLE × ARO and Risk = Threat × Vulnerability × Impact.

Security+

• Port Numbers: Know common ports (e.g., 22: SSH, 443: HTTPS, 3389: RDP) and their risks (e.g., RDP exposed to the internet = brute-force attacks).
• Encryption vs. Hashing:
• Encryption = Reversible (AES, RSA).
• Hashing = Irreversible (SHA-256, MD5 ⚠️ broken).
• Social Engineering Tactics: Phishing, vishing, tailgating, and pretexting (e.g., "Hi, I’m from IT—can you reset your password for me?").

CEH (Certified Ethical Hacker)

• Attack Phases: Know the 5 phases of hacking (Reconnaissance → Scanning → Gaining Access → Maintaining Access → Covering Tracks).
• Tools: Be familiar with Kali Linux tools (e.g., Nmap for scanning, Metasploit for exploitation, Wireshark for packet analysis).
• OWASP Top 10: Memorize the 2021 list (e.g., A01: Broken Access Control, A03: Injection).

Quick Check Questions

1. Scenario:

A security analyst receives an alert about multiple failed login attempts from a single IP address targeting an admin account. The analyst blocks the IP at the firewall. What is the next best step? - A) Close the ticket—threat mitigated.
- B) Check VPN logs to see if the IP is from a remote employee.
- C) Reset the admin account password.
- D) Run a vulnerability scan on the targeted server.

Correct Answer: B
Explanation: The analyst should verify if the IP is legitimate (e.g., a remote employee with a misconfigured VPN) before taking further action. Blocking an IP without investigation could disrupt business operations.

2. Scenario:

During an incident response, a security analyst finds a suspicious process (svchost.exe) running from C:\Temp instead of C:\Windows\System32. What is the most likely explanation? - A) A legitimate Windows update.
- B) A malware masquerading as a system process.
- C) A misconfigured application.
- D) A false positive from the EDR tool.

Correct Answer: B
Explanation: svchost.exe should only run from System32. Running from C:\Temp is a red flag for malware (e.g., TrickBot, Emotet).

3. Scenario:

A company’s S3 bucket is misconfigured, exposing customer PII (Personally Identifiable Information). What NIST CSF function does this incident fall under? - A) Identify - B) Protect - C) Detect - D) Respond

Correct Answer: B (Protect)
Explanation: The Protect function includes access controls, encryption, and secure configurations (e.g., S3 bucket policies). The misconfiguration is a failure of protection controls.

Last-Minute Cram Sheet

1. CIA Triad: Confidentiality, Integrity, Availability.
2. SIEM Tools: Splunk, IBM QRadar, Microsoft Sentinel.
3. EDR Tools: CrowdStrike, SentinelOne, Carbon Black.
4. NIST IR Phases: Preparation → Detection → Containment → Eradication → Recovery → Lessons Learned.
5. MITRE ATT&CK: Framework for adversary TTPs (e.g., T1078: Valid Accounts).
6. OWASP Top 10 (2021): A01: Broken Access Control, A03: Injection.
7. Ports to Know:
8. 22 (SSH), 23 (Telnet ⚠️ insecure), 80 (HTTP), 443 (HTTPS), 3389 (RDP).
9. Risk Formula: ALE = SLE × ARO (Annualized Loss Expectancy = Single Loss Expectancy × Annualized Rate of Occurrence).
10. Zero Trust Principles: Never trust, always verify; least privilege; micro-segmentation.
11. False Positive vs. False Negative:
    • False Positive = Benign activity flagged as malicious.
    • False Negative = Malicious activity missed by security tools. ⚠️ More dangerous!