Top SOC Analyst Interview Questions for 2026

1. What is a Security Operations Center (SOC)?

Answer: A SOC is a centralized unit of people, processes, and technology that continuously monitors, detects, analyzes, and responds to cybersecurity incidents. It typically operates 24x7 and combines SIEM platforms, threat intelligence feeds, EDR tools, and trained analysts (L1, L2, L3) to protect an organization's digital assets.

2. What does a SOC Analyst do day-to-day?

Answer: A SOC Analyst monitors security alerts on the SIEM dashboard, triages incidents, performs initial investigation on suspicious logs, escalates true positives to L2 or incident response, documents findings in a ticketing system, tunes detection rules to reduce false positives, and contributes to threat intelligence reports.

3. Explain the CIA Triad.

Answer:

• Confidentiality – information is accessed only by authorized parties.
• Integrity – data remains accurate and unaltered by unauthorized actors.
• Availability – authorized users can access systems whenever required.

4. What is the difference between an event, an alert, and an incident?

Answer: An event is any observable occurrence in a system. An alert is an event flagged by a detection rule that needs review. An incident is a confirmed security violation with potential business impact that requires a coordinated response.

5. What are the levels of a SOC team?

Answer: L1 Analyst handles real-time monitoring and triage; L2 Analyst performs deeper investigation, correlation, and containment; L3 Analyst (or Threat Hunter) leads advanced hunting, malware analysis, and root cause analysis; SOC Manager owns process, KPIs, and escalations.

6. What is a true positive, false positive, false negative, and true negative?

Answer:

• True Positive – alert correctly identified a real threat.
• False Positive – alert fired but no real threat exists.
• False Negative – a real threat occurred but no alert fired.
• True Negative – no alert fired, no threat existed.

7. What is the difference between IDS and IPS?

Answer: IDS (Intrusion Detection System) passively monitors and alerts. IPS (Intrusion Prevention System) sits inline and can actively block malicious traffic in real time.

8. Explain the OSI model from a SOC perspective.

Answer: Each layer (Physical, Data Link, Network, Transport, Session, Presentation, Application) maps to specific attacks – ARP spoofing at L2, IP spoofing and DDoS at L3, port scans at L4, session hijacking at L5, SSL stripping at L6, and SQLi/XSS at L7. SOC analysts use this model to scope and classify incidents.

9. What is a kill chain?

Answer: Lockheed Martin's Cyber Kill Chain has seven phases: Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command & Control, and Actions on Objectives. SOC Analysts disrupt attacks by detecting and breaking the chain at the earliest possible phase.

10. Explain MITRE ATT&CK and how SOC Analysts use it.

Answer: MITRE ATT&CK is a curated knowledge base of real-world adversary tactics and techniques. SOC Analysts map alerts and incidents to ATT&CK IDs, build detection coverage gap analyses, prioritize threat hunts, and communicate adversary behavior consistently to stakeholders.

11. Difference between vulnerability, threat, and risk.

Answer: Vulnerability is a weakness, threat is an actor or event that can exploit it, and risk is the potential business impact when a threat exploits a vulnerability.

12. What is defense in depth?

Answer: Defense in depth is a layered security strategy that combines preventive, detective, and responsive controls across people, network, endpoint, application, and data layers so that the failure of any single control does not cause a breach.

13. What is the principle of least privilege?

Answer: Users, applications, and processes should only have the minimum permissions needed to perform their tasks. This reduces blast radius during compromise.

14. What is zero trust?

Answer: Zero trust assumes no implicit trust based on network location. Every access request is continuously authenticated, authorized, and encrypted using identity, device posture, and context.

15. What is the difference between vulnerability assessment and penetration testing?

Answer: Vulnerability assessment is a broad scan that lists known weaknesses. Penetration testing simulates a real attacker who chains vulnerabilities to demonstrate impact.

16. What is a SIEM?

Answer: A SIEM (Security Information and Event Management) platform collects, normalizes, correlates, and alerts on logs from across the enterprise – endpoints, firewalls, servers, applications, and cloud. Examples include Splunk, IBM QRadar, Microsoft Sentinel, ArcSight, LogRhythm, and Elastic SIEM.

17. Which SIEM tools have you worked on?

Answer: Mention the platforms you used in training and labs – e.g., Splunk Enterprise, QRadar Community Edition, Microsoft Sentinel, and the ELK stack. Briefly describe one rule or dashboard you built and one investigation you completed.

18. What is log correlation?

Answer: Log correlation links events from multiple sources (firewall, AD, endpoint, proxy) using shared fields like user, IP, or timestamp to detect patterns that single events would miss – for example, brute force followed by successful login.

19. What is SOAR and how is it different from SIEM?

Answer: SOAR (Security Orchestration, Automation, and Response) automates repeatable analyst tasks using playbooks, integrates with ticketing and threat intel, and accelerates response. SIEM detects; SOAR acts on the detection.

20. What is EDR and how does it complement SIEM?

Answer: EDR (Endpoint Detection and Response) continuously records process, file, and network activity on endpoints, enabling behavior-based detection, isolation, and forensic timelines. SIEM aggregates logs across the environment; EDR provides deep endpoint context.

21. What is XDR?

Answer: Extended Detection and Response unifies endpoint, network, identity, email, and cloud telemetry into a single detection and response platform, reducing context switching for analysts.

22. What are the standard log sources a SOC ingests?

Answer: Firewalls, proxies, IDS/IPS, Windows Security and Sysmon logs, Linux syslog, Active Directory, DNS, DHCP, EDR, antivirus, web servers, databases, VPN, cloud audit logs (CloudTrail, Azure Activity, GCP Audit), and SaaS apps.

23. What is normalization in SIEM?

Answer: Normalization converts heterogeneous log formats into a common schema (e.g., source_ip, user, action) so that correlation rules and searches work across all sources.

24. What is the difference between use case, rule, and playbook?

Answer: A use case describes the threat scenario to be detected. A rule is the SIEM logic that fires alerts for that use case. A playbook is the documented, often automated, response procedure.

25. Explain a Splunk SPL search you have used.

Answer: Example: index=wineventlog EventCode=4625 | stats count by user, src_ip | where count > 10. This identifies brute-force login attempts. Be ready to explain index, sourcetype, stats, eval, and lookup commands.

26. What is a parser in SIEM?

Answer: A parser extracts structured fields from raw log lines so the SIEM can index, search, and correlate them. Splunk uses props/transforms; QRadar uses DSM; Sentinel uses ASIM and ingestion-time transformations.

27. How do you reduce false positives?

Answer: Tune rules with allow lists for known-good behavior, use baselines and statistical thresholds, enrich alerts with asset criticality and identity context, suppress duplicates, and feed analyst feedback back into the rule.

28. What is threat intelligence integration in SIEM?

Answer: Threat intel feeds (commercial, open-source, ISAC) provide IOCs – IPs, hashes, domains – which the SIEM matches against logs in real time. Matches raise the severity of alerts and accelerate triage.

29. What is UEBA?

Answer: User and Entity Behavior Analytics builds behavioral baselines for users, hosts, and service accounts and detects anomalies such as impossible travel, privilege escalation, or data exfiltration.

30. What metrics do you track for SOC efficiency?

Answer: MTTD (Mean Time to Detect), MTTR (Mean Time to Respond), alerts per analyst per shift, false positive rate, escalation rate, dwell time, and SLA adherence.

31. What is threat hunting?

Answer: Threat hunting is the proactive search for adversaries already inside the environment that have evaded automated detections. Hunters form hypotheses based on TTPs and intel, query telemetry, and convert findings into new detections.

32. Explain a hypothesis-driven hunt.

Answer: Example hypothesis: 'An attacker is using LSASS memory dumping to steal credentials.' Hunt query: search Sysmon Event ID 10 for processes accessing lsass.exe with GrantedAccess values commonly associated with Mimikatz, then validate against known admin tools.

33. What are IOCs and IOAs?

Answer: IOCs (Indicators of Compromise) are forensic artifacts of a past or active attack – hashes, IPs, domains. IOAs (Indicators of Attack) describe attacker behavior – privilege escalation, lateral movement, persistence – regardless of specific tools.

34. What is lateral movement and how do you detect it?

Answer: Lateral movement is when an attacker moves from one host to another using stolen credentials, RDP, SMB, WMI, or PsExec. Detection signals include unusual remote service creation (4697/7045), uncommon admin logons (4624 type 3), and Kerberos anomalies.

35. What is privilege escalation?

Answer: Privilege escalation is gaining higher rights than originally granted – horizontal (peer accounts) or vertical (admin/root). Detect via abnormal use of runas, sudo, token manipulation, or sudden membership changes in privileged AD groups.

36. What is persistence and what artifacts indicate it?

Answer: Persistence ensures attacker access survives reboots. Common artifacts: new scheduled tasks, run keys, services, WMI subscriptions, BITS jobs, startup folder additions, and modified Group Policy preferences.

37. What is command and control (C2)?

Answer: C2 is the channel an implant uses to receive instructions – HTTP/S beaconing, DNS tunneling, ICMP, or domain fronting. Detect via beacon timing analysis, rare destinations, and high entropy DNS queries.

38. What is data exfiltration and how can SOC detect it?

Answer: Exfiltration is unauthorized data transfer out of the network. Look for unusual upload volumes, encrypted archives, cloud storage uploads from non-standard hosts, DNS tunneling, and email attachments to external personal domains.

39. What are living-off-the-land (LOLBins) attacks?

Answer: Adversaries abuse legitimate Windows binaries – PowerShell, WMIC, certutil, mshta, rundll32 – to evade signature-based detection. Defenders write behavior rules for suspicious parameter combinations.

40. How do you detect a brute-force attack?

Answer: Multiple authentication failures (4625, 4771) from a single source within a short window followed by a success, or a low-and-slow pattern across many accounts. Correlate with VPN, RDP, and SaaS logs.

41. How do you detect a phishing attack post-delivery?

Answer: Look for clicks on newly registered or recently observed domains in proxy logs, credential submission to suspicious URLs, anomalous OAuth consents, mailbox forwarding rules, and subsequent impossible-travel logins.

42. What is DNS tunneling?

Answer: DNS tunneling encodes data inside DNS queries/responses to bypass network controls. Detect by analyzing query length, entropy, frequency per host, and uncommon record types like TXT/NULL.

43. How do you investigate a suspicious PowerShell alert?

Answer: Pull the full command line and parent process, decode any base64 payload, check for AMSI bypass strings, search the host for related Sysmon events, and look at network connections initiated by the PowerShell session.

44. What is the difference between signature-based and behavior-based detection?

Answer: Signature-based detection matches known patterns (hashes, regex, YARA). Behavior-based detection looks at sequences of actions and statistical anomalies, which is essential for unknown malware and fileless attacks.

45. What is threat intelligence and what types exist?

Answer: Tactical intel = IOCs; Operational intel = TTPs of specific actors; Strategic intel = high-level trends used by leadership; Technical intel = exploit and tool details. SOCs consume all four to enrich detections and decisions.

46. What are the phases of incident response?

Answer:

• Preparation – build playbooks, tools, training.
• Identification – validate that an incident has occurred.
• Containment – short-term and long-term isolation.
• Eradication – remove malware, close exploited paths.
• Recovery – restore systems, monitor for recurrence.
• Lessons Learned – post-incident review and detection improvements.

47. What frameworks guide incident response?

Answer: NIST SP 800-61, SANS PICERL, ISO/IEC 27035, and the MITRE ATT&CK and D3FEND knowledge bases.

48. What is the difference between containment, eradication, and recovery?

Answer: Containment limits damage (network isolation, account disable). Eradication removes the root cause (malware, persistence). Recovery returns systems to normal operation with monitoring to ensure the threat is gone.

49. What is a runbook?

Answer: A runbook is a structured, step-by-step procedure for handling a specific alert type – inputs to gather, validation queries to run, containment actions, escalation criteria, and documentation requirements.

50. What is chain of custody and why does it matter?

Answer: Chain of custody is the documented handling of digital evidence from collection through analysis, storage, and disposal. It ensures evidence is admissible in legal or HR proceedings.

51. How would you respond to a confirmed ransomware infection?

Answer: Isolate impacted hosts from network, disable affected user accounts, preserve volatile evidence, identify the strain via hash and ransom note, contain blast radius across shares and backups, restore from clean backups, rotate credentials, and conduct lessons learned.

52. How do you handle an insider threat alert?

Answer: Quietly preserve evidence (mail, file access, USB, DLP), engage HR and Legal early, avoid tipping off the user, monitor on a heightened basis, and execute coordinated containment with management approval.

53. What is a tabletop exercise?

Answer: A tabletop is a discussion-based simulation where stakeholders walk through a scenario to test playbooks, communications, and decision authority – without touching production systems.

54. What is the difference between BCP and DR?

Answer: Business Continuity Planning ensures critical business functions continue during disruption. Disaster Recovery focuses specifically on restoring IT systems and data within RTO/RPO targets.

55. What artifacts do you collect from a Windows host during IR?

Answer: Memory image, MFT and USN journal, registry hives, Prefetch, Amcache, Shimcache, Sysmon and Security event logs, scheduled tasks, services, autoruns, browser history, and PowerShell history.

56. What is the difference between volatile and non-volatile data?

Answer: Volatile data (RAM, network connections, running processes) is lost on shutdown and must be collected first per RFC 3227. Non-volatile data (disk, logs, registry) persists.

57. How do you communicate during a major incident?

Answer: Use a dedicated war room, share factual updates on a regular cadence, separate technical comms from executive comms, and maintain a single source of truth (incident timeline) until closure.

58. What is dwell time and why is it important?

Answer: Dwell time is how long an attacker remains undetected in the environment. Reducing dwell time directly limits damage and is a key SOC KPI.

59. What is a post-incident review?

Answer: A blameless review held after closure to document the timeline, identify detection and response gaps, and assign actionable improvements to detection rules, playbooks, training, and architecture.

60. How do you stay calm during a high-pressure incident?

Answer: Trust the playbook, communicate clearly and frequently, scope the incident before acting broadly, and rely on the team's defined roles. Practice through tabletop drills builds confidence.

61. Walk me through what happens when a user opens a website.

Answer: DNS resolution, TCP three-way handshake, TLS handshake with certificate validation, HTTP request/response, content rendering. SOC analysts inspect each layer in proxy, DNS, and PCAP logs during investigations.

62. What is the TCP three-way handshake?

Answer: SYN from client, SYN-ACK from server, ACK from client. Anomalies like SYN floods or unusual flag combinations indicate scanning or DoS.

63. What ports and protocols should every SOC Analyst know?

Answer: 20/21 FTP, 22 SSH, 23 Telnet, 25 SMTP, 53 DNS, 80 HTTP, 110 POP3, 123 NTP, 143 IMAP, 161 SNMP, 389 LDAP, 443 HTTPS, 445 SMB, 465/587 SMTPS, 636 LDAPS, 3389 RDP.

64. What is the difference between TCP and UDP?

Answer: TCP is connection-oriented, reliable, ordered. UDP is connectionless, faster, with no delivery guarantees. Many evasion and exfiltration techniques abuse UDP-based protocols like DNS.

65. How do you analyze a PCAP file?

Answer: Open in Wireshark, filter by IP/port/protocol, follow TCP streams, extract files via 'Export Objects', inspect TLS SNI for destination domain, and look for plaintext credentials, beaconing, or unusual user agents.

66. What are common Windows event IDs you monitor?

Answer: 4624 successful logon, 4625 failed logon, 4634 logoff, 4672 admin logon, 4688 process creation, 4697 service install, 4720 user created, 4732 added to local group, 1102 audit log cleared, 5140/5145 share access.

67. What is Sysmon and why is it useful?

Answer: Sysmon is a free Microsoft tool that adds rich endpoint telemetry – process creation with hashes and command lines, network connections, file creation, registry changes, image loads, and DNS queries – critical for modern detections.

68. How do you detect ARP spoofing?

Answer: Look for duplicate IP-to-MAC mappings, sudden changes in ARP tables, gratuitous ARP storms, and use ARP monitoring tools or network access control to alert on inconsistencies.

69. What is a firewall rule review?

Answer: Periodic audit of rules to remove any-any allows, expired entries, unused rules, and overly broad source/destination scopes. SOC findings often drive these reviews.

70. What is netflow and how do SOCs use it?

Answer: NetFlow records summary metadata about network conversations (source, destination, ports, bytes, duration). SOCs use it for baselining, beacon detection, exfiltration analysis, and historical investigations.

71. Explain HTTP status codes relevant to security.

Answer: 401 Unauthorized and 403 Forbidden indicate access control; spikes of 404s suggest scanning; 500s after suspicious payloads can hint at exploitation attempts; 302 redirects to attacker domains indicate phishing or open redirect abuse.

72. What is a proxy and why does the SOC care about proxy logs?

Answer: A proxy mediates web traffic, applies category filtering, and breaks TLS for inspection. Proxy logs are the single most useful source for tracking C2, phishing clicks, and data exfiltration to web destinations.

73. What are the main categories of malware?

Answer: Virus, Worm, Trojan, Ransomware, Spyware, Adware, Rootkit, Bot, RAT, Wiper, and Fileless / LOLBin malware. Each has distinct behaviors that drive different detections and responses.

74. What is a rootkit and why is it dangerous?

Answer: A rootkit hides processes, files, and connections at OS or kernel level, often surviving reboots and resisting standard tools. Detection usually requires offline analysis or specialized memory forensics.

75. What is fileless malware?

Answer: Malware that runs primarily in memory without writing distinctive files to disk – often via PowerShell, WMI, or Office macros. Detection relies on behavior, command-line, and memory analysis.

76. What is the difference between static and dynamic malware analysis?

Answer: Static analysis examines a sample without executing it (strings, headers, imports, YARA, hashes). Dynamic analysis runs the sample in a sandbox to observe behavior – process tree, network, registry, and file changes.

77. Have you used any sandbox tools?

Answer: Examples: Any.Run, Hybrid Analysis, Joe Sandbox, Cuckoo, VMRay. Mention how you submitted a suspicious file, captured IOCs, and added them to detection rules and block lists.

78. What is YARA and how is it used?

Answer: YARA is a pattern-matching language used to write rules that identify malware families based on strings and binary patterns. SOCs use YARA in EDR, mail gateways, and threat intel platforms.

79. What are common malware persistence mechanisms?

Answer: Run keys, scheduled tasks, services, WMI event subscriptions, DLL search-order hijacking, COM hijacking, Office templates, and startup folder entries.

80. What is a hash and why is it important?

Answer: A hash (MD5, SHA-1, SHA-256) uniquely fingerprints a file. SOCs use hashes to share IOCs, look up reputation in VirusTotal, deduplicate samples, and block known-bad files via EDR.

81. How do you triage a suspicious email?

Answer: Check headers for SPF/DKIM/DMARC results, evaluate sender domain age and reputation, detonate attachments and URLs in a sandbox, search the mail gateway for similar messages, and quarantine across all recipients if malicious.

82. How would you respond to a malware alert from EDR?

Answer: Validate the detection, capture process tree and command lines, isolate the host via EDR, collect memory and disk artifacts, identify scope through hash and behavior search, eradicate persistence, and re-image if integrity is uncertain.

83. What are the key differences between on-prem and cloud SOC monitoring?

Answer: Cloud monitoring relies on API and audit logs (CloudTrail, Azure Activity, GCP Audit, M365 Unified Audit), focuses on identity and configuration, has shared responsibility boundaries, and requires ingestion of high-volume cloud-native telemetry.

84. What is the shared responsibility model?

Answer: The cloud provider secures the underlying infrastructure; the customer secures identity, data, configuration, applications, and access. The exact split depends on the service model (IaaS, PaaS, SaaS).

85. What are critical AWS log sources for a SOC?

Answer: CloudTrail (API audit), VPC Flow Logs (network), GuardDuty (threat detection), Config (resource changes), S3 access logs, ALB/NLB logs, WAF logs, and IAM Access Analyzer findings.

86. What are critical Azure log sources?

Answer: Microsoft Sentinel ingests Azure Activity, Entra ID Sign-in and Audit, Defender for Cloud, NSG Flow Logs, Storage analytics, Key Vault, and Microsoft 365 Defender alerts.

87. How do you detect a compromised cloud identity?

Answer: Look for impossible travel, MFA fatigue, anomalous OAuth consents, sudden mass downloads from OneDrive/SharePoint, new mailbox forwarding rules, role assignment changes, and access from unusual ASNs or anonymizers.

88. What is a misconfigured S3 bucket and why does it matter?

Answer: An S3 bucket open to the public can leak sensitive data. SOCs detect via Config, Access Analyzer, and CloudTrail PutBucketAcl/PublicAccessBlock changes, and respond by restricting policy and rotating exposed data.

89. What is CSPM?

Answer: Cloud Security Posture Management continuously evaluates cloud resources against benchmarks (CIS, NIST, ISO) and surfaces misconfigurations the SOC must triage.

90. What is CWPP?

Answer: Cloud Workload Protection Platforms protect VMs, containers, and serverless workloads with vulnerability management, runtime detection, and behavior-based prevention.

91. Scenario: Multiple failed logons from a single IP followed by success – what do you do?

Answer: Confirm the success, identify the user and host, validate whether the source IP is expected (VPN, corporate ASN), check for subsequent suspicious activity (privilege use, lateral movement), force password reset and MFA challenge, and create a ticket with timeline and IOCs.

92. Scenario: A user clicks a phishing link – walk me through your response.

Answer: Quarantine the email across all mailboxes, identify the destination domain and credential submission, force password reset, revoke active sessions and tokens, review sign-in logs for anomalous activity, search EDR for downloaded payloads, and educate the user.

93. Scenario: EDR alerts on PowerShell with a base64 command from Word.

Answer: Triage as likely macro-based delivery. Capture the parent-child process tree, decode the base64 to inspect the script, isolate the host, search the environment for similar parent-child patterns, capture the original Word document, and submit IOCs.

94. Scenario: A server suddenly communicates with an unusual external IP every 60 seconds.

Answer: Treat as suspected C2 beaconing. Pull netflow/proxy logs, identify the process making the connection, query reputation of the destination, isolate the host if confirmed malicious, and hunt for the same IOC across the fleet.

95. Scenario: An admin account is used at 3 AM from a country your company does not operate in.

Answer: High severity. Block the session, force credential reset and MFA re-enrollment, review all actions taken during the session, audit recent role changes, scan systems touched by the account, and engage the account owner via verified out-of-band channel.

96. Scenario: SIEM stops receiving logs from a critical firewall.

Answer: Validate at the SIEM (input status, parsing errors), then at the network (connectivity, syslog daemon, disk space on collector), open a P2/P3 ticket, and document MTTR. Missing logs are also a detection blind spot, so notify the IR lead.

97. Scenario: You are reviewing a noisy alert with 500 hits per day. What's your approach?

Answer: Sample diverse alerts, classify them, identify the dominant false-positive pattern, propose tuning (allow lists, thresholds, additional filters) backed by data, gain peer review, deploy in a test rule, and measure FP rate before promotion.

98. Scenario: A workstation is suspected of data exfiltration via DNS.

Answer: Pull DNS query logs for the host, look at long, high-entropy subdomains and uncommon record types, identify the process making queries via EDR, isolate the host, capture memory, and block the destination domain on DNS sinkhole.

99. Scenario: How would you handle a Severity 1 incident at 2 AM on a Sunday?

Answer: Activate the on-call rota, follow the major incident playbook, open the bridge, communicate to stakeholders on the agreed cadence, focus on containment first, document every action, and hand over cleanly to the day shift.

100. Scenario: You disagree with an L2 analyst about whether to escalate. What do you do?

Answer: Present the evidence calmly, refer to the documented escalation criteria, capture the disagreement in the ticket, and let the SOC lead make the call. Always err on the side of escalation when business impact is unclear.

Which SIEM should I learn first for a SOC Analyst interview?

Splunk has the largest enterprise footprint in India, so it's the safest first choice. Add Microsoft Sentinel because cloud-native SOC roles are growing fastest, and IBM QRadar for service provider interviews.

How important is MITRE ATT&CK in 2026 SOC interviews?

Very important. Almost every L2-and-above interview asks you to map a real or hypothetical alert to ATT&CK tactics and techniques and to discuss detection coverage gaps.

What programming or scripting do I need as a SOC Analyst?

Comfortable Python and PowerShell are enough at L1/L2 – for parsing logs, automating triage, and writing simple enrichments. Bash and KQL/SPL round out the toolkit at L3.

Are SOC Analyst jobs only night shifts?

Most enterprise SOCs run 24x7, so rotational shifts are common at L1 and L2. L3, hunting, and engineering roles usually move to business-hours coverage with on-call.

Which certifications carry the most weight for SOC interviews in 2026?

CompTIA Security+ and CySA+, Microsoft SC-200, EC-Council CSA, and Splunk Core Certified Power User are widely recognized. Pair any one with strong lab work and this question bank for the best results.

Can I crack a SOC Analyst interview as a fresher?

Yes. Freshers are hired into L1 SOC roles every month in Hyderabad. The winning formula is: solid fundamentals, one SIEM you can demo, ATT&CK fluency, 50+ rehearsed answers like the ones above, and disciplined mock interviews.