A network alert says a laptop may be beaconing to a command-and-control server. How do you investigate?
What the interviewer wants to hear
- Check the destination: reputation, domain age, rarity in the environment
- Look at connection pattern: interval, jitter, sizes, timing
- Use EDR to find the process making connections
- Examine the process: parent, hash, path, persistence
- Contain if confirmed and scope other hosts
Model answer
First I look at the destination. I check its reputation in threat intel and VirusTotal, when the domain was registered, and how many other hosts in our environment talk to it. A rare, new domain is suspicious. Next I study the pattern in proxy or Zeek logs: regular intervals with small jitter, similar byte sizes, and activity at night when the user is away all point to beaconing. Then I pivot to EDR to find which process made the connections, and check its path, signature, hash, parent process and any persistence like scheduled tasks or run keys. If it looks malicious, I isolate the host, block the domain and IP, and search the SIEM for other hosts contacting the same infrastructure or running the same hash, before handing over for remediation.
Can you answer it under time pressure?
Take a timed medium round and get scored on every answer.
More medium Cybersecurity Analyst questions
- Walk me through how you triage a new SIEM or EDR alert.
- You have 2,000 open vulnerabilities from a scan. How do you decide what to fix first?
- What is MITRE ATT&CK and how do you use it in your work?
- You suspect a Microsoft 365 user account is compromised. How do you investigate and respond?
- Your SOC gets too many false positive alerts. How would you reduce alert fatigue without missing real attacks?
- How do you write an incident report that works for both technical teams and non-technical leaders?
- How do you use threat intelligence in day-to-day SOC work without drowning in indicator feeds?
- A critical vulnerability is being exploited in the wild, but the affected system cannot be patched for weeks. What do you do?
- EDR raises an alert for a suspicious PowerShell command on a user's laptop. Walk me through your investigation.