Scenario Based SOC Analyst Interview Questions and Answers | Part 1 | Security Analysts | SOC| Cyber

[sachin-trnc]

Finally started, Thanks for starting this session, It will help alot, please include Real time SIEM Scenario questions & answer with use cases, Thanks in Advance & Have a great year ahead 🙂

[a.r.bentley]

This is good information. it does leave out one critical part in the beginning: whether the employee took action on the email. If the employee simply opened the email, and realized it was spam/phishing/etc, they could simply just report it, mark it as spam/phishing, allow a cyber review of the email, and then delete once in the clear. If they do take action shes giving good steps to take.

[sachin-trnc]

Hi Mam,

Can you make videos on below mentioned Topic, as in whole youtube No one has done till now,

So i request to please make

"How to create use cases & How to Develop use cases with correlation Rules for All SIEM"

Thanks in Advance Have a Great year ahead.

[AI-InfoSec]

How to start career as SOC what are the basic tools and knowledge to have while appearing for SOC Analyst

[venkatachandrasrikanthredlam]

Excellent session and very informative

[maruthikumar]

thank you help a lot of information sharing.

[aejazinamdar]

Hello madam, this video is really awesome. I have a question. If email is opened then it is fine. If user has accessed any attachment or links then it should be necessary to isolate. Pls confirm

[claudiamanta]

Thank you. I am not an IT specialist, and all this is fascinating.

I have a question. If that employee (who actually paid attention to the IT security training) had not opened that suspicious email, do you need to take all those steps that are hugely disruptive? Can you not contain the suspicious email and analyse it?
I think it is more likely that you need to worry about the others in the organisation because the phishing attack might have been deployed at a larger scale and not all employees are as careful as the one who reported it. What would you do? Scan all network for that (and similar) email, isolate it, see on what devices it was open and quarantine those?

PS- I love your Eastern European accent (is it Romanian? Hungarian?).

Many thanks.

[iytfukh]

These questions are relevant for which level..? L1, L2 or

[priyadharshini]

Ma'am, If the user has not opened/accessed any contents of the email in the first question. Is it still necessary to perform the device isolation, disabling the user from AD.?

[Praneethreddy-egtk]

can I get the introduction for secuirty anaylst

[saiteja]

Its just like reading the text from chatgpt or google resources