Cybersecurity analyst interviews rarely reward memorised definitions. Hiring managers want to know how you think when an alert fires at 3 a.m. and the evidence is incomplete: what you check first, what you rule out, when you escalate and how you write it up. The questions below are grouped in the order an analyst meets problems on shift, from triage to post-incident review. Each one is annotated with why it is asked, what a strong answer covers and the answer that quietly loses points.
Sample answers are illustrative. Use them to see the shape of a good answer, then rebuild them from your own lab work, studies or job experience.
Part 1: Triage questions
1. “An alert says a user account had 40 failed logins in five minutes. Walk me through what you do.”
Why they ask: this is the classic opener. It tests method, not knowledge.
A strong answer covers:
- Scope first: one account or many? One source or many? A single source hitting many accounts suggests password spraying; many sources hitting one account suggests something else.
- Outcome: was there a successful login after the failures? That changes the priority completely.
- Context: is the account a service account, an admin, a dormant user? Is the source internal, a known VPN range or an unfamiliar country?
- Action: lock or reset if there is a success you cannot explain, contact the user through a separate channel, and escalate according to the runbook.
Loses points: jumping straight to “block the IP” without checking whether a login succeeded.
2. “Read this log entry and tell me what you see.”
Many interviews include a short log extract. On Windows, you may be shown failed-logon events. Here is an illustrative, simplified example:
EventID: 4625
Account Name: svc_backup
Logon Type: 3
Status: 0xC000006A
Source Network Address: 10.20.4.17
Process Name: -What a strong answer says: Microsoft’s documentation states that event 4625 “is logged for any logon failure”. Logon type 3 is a network logon. Status 0xC000006A means a bad password for an account that exists; 0xC0000064 would mean a bad or misspelled user name, which Microsoft says can be “a sign of a user enumeration attack” when it appears several times in a row. Because this is a service account, Microsoft recommends monitoring all 4625 events for service accounts, since they “should not be locked out”. So the next steps are: has the password recently changed, is a scheduled task using stale credentials, and is 10.20.4.17 a server that should be using this account at all?
Loses points: treating every failed logon as an attack. Services running with stale or wrong credentials are a common, harmless cause of failed logons, and saying so shows real experience.
3. “How do you tell a false positive from a true positive?”
Strong answer: explain that you look for corroboration from a second source (endpoint, proxy, email gateway, identity logs), compare the activity with the asset’s normal behaviour, and record why you closed it so the rule can be tuned. Mention that a closed false positive with no notes is a future problem.
4. “You have twelve open alerts and one hour. How do you prioritise?”
Strong answer: severity is a start, not the answer. Weigh asset value (a domain controller over a test laptop), evidence of success (a completed action over an attempt), and spread (many hosts over one). Say you would flag to your lead if you cannot reach the critical ones in time.
Part 2: Investigation and frameworks
5. “How do you use MITRE ATT&CK in your work?”
Why they ask: ATT&CK is the shared vocabulary of most security teams. They want to know whether you use it or just name it.
A strong answer covers: mapping an alert to a technique to understand what the attacker was probably trying to achieve, then checking which adjacent tactics you can see evidence for. As of November 2026 (ATT&CK v20), the Enterprise matrix lists 15 tactics, from Reconnaissance and Resource Development through Initial Access, Execution and Persistence to Exfiltration and Impact. Give one concrete example, such as Command and Scripting Interpreter (T1059), whose sub-techniques include PowerShell (T1059.001).
Loses points: reciting the tactic list without saying how it changes what you investigate. Also check the current matrix before your interview: ATT&CK is revised, and its newer versions include tactics such as Stealth and Defense Impairment that older study notes will not mention.
6. “A user reports a suspicious email. What do you check?”
Strong answer, in order: sender and reply-to addresses, authentication results in the headers, links (expanded safely, not clicked), attachments (hashes, sandbox if available), whether others received it, whether anyone clicked or entered credentials, then containment such as removing the message from mailboxes and blocking indicators. Finish with: tell the reporter what happened, because people who report phishing should hear back.
7. “What is the difference between an indicator of compromise and an indicator of attack?”
Strong answer: an indicator of compromise is evidence that something bad has already happened, such as a known malicious file hash or domain. An indicator of attack describes behaviour in progress, such as an Office application spawning a script interpreter. Hashes and IP addresses change easily; behaviour is harder for an attacker to change, so behaviour-based detection tends to last longer.
8. “Which web application risks should an analyst understand, even without being a developer?”
Strong answer: reference the OWASP Top 10, and use the current edition. The 2025 list opens with A01 Broken Access Control, A02 Security Misconfiguration and A03 Software Supply Chain Failures, and ends with A09 Security Logging and Alerting Failures and A10 Mishandling of Exceptional Conditions. Then make it practical: what you would look for in web server or WAF logs for injection attempts, and why logging failures (A09) directly affect your ability to investigate.
Part 3: Incident response
9. “Walk me through how you would handle a confirmed ransomware detection on one laptop.”
A strong answer covers:
- Isolate the host from the network, preferably through the endpoint tool so you keep remote access for forensics. Do not power it off without considering what you lose from memory.
- Scope: same hash, same user, same lateral movement on other hosts? Check file shares the user can write to.
- Escalate to the incident lead and follow the incident response plan; ransomware usually involves management, legal and communications quickly.
- Preserve evidence and keep a timeline from the first alert.
- Recovery from known-good backups only after the entry point is understood.
Loses points: trying to handle a likely organisation-wide incident alone.
10. “Which incident response framework do you follow?”
Strong answer: name it and show you know it has moved on. NIST published SP 800-61 Revision 3 in April 2025, superseding Revision 2 from 2012. The new version is written as a Community Profile of the NIST Cybersecurity Framework 2.0, aiming to help organisations “reduce the number and impact of incidents” and improve detection, response and recovery. Explaining that change (incident response treated as part of overall risk management, not a separate lifecycle) signals you keep up to date. If your organisation uses another model, say how its phases map onto your day-to-day work.
11. “What goes into a good incident report?”
Strong answer: a timeline with timestamps and time zone, what was affected, how it was detected, what was done and by whom, what evidence was preserved, the root cause if known, and concrete recommendations. Two audiences: a technical section for engineers and a short summary for managers.
Part 4: Technical foundations
Expect quick-fire checks. Short, accurate answers are fine, with one example each.
| Question | What a good short answer includes |
|---|---|
| Explain the TCP three-way handshake. | SYN, SYN-ACK, ACK; why a flood of SYNs without ACKs is a problem. |
| Symmetric vs asymmetric encryption? | One shared key vs a key pair; how TLS uses both. |
| Hashing vs encryption? | Hashing is one-way and used for integrity and password storage; encryption is reversible with a key. |
| What does DNS tunnelling look like in logs? | Long, high-entropy subdomains, unusual query volume to one domain, many TXT records. |
| What is lateral movement? | Moving from the first compromised host to others, for example through remote services and stolen credentials. |
| What is least privilege? | Giving accounts only the access they need; why service accounts are a common weak point. |
Part 5: Behavioural questions with a security twist
12. “Tell me about a time you found something nobody had asked you to look for.”
Why they ask: good analysts are curious. Use a real example from work, a home lab or a capture-the-flag exercise.
13. “Tell me about a time you had to explain a technical risk to a non-technical person.”
Strong answer: show you translated risk into business impact (downtime, data exposure, cost) and gave them a clear decision to make.
14. “What would you do if a senior manager asked you to allowlist something you thought was unsafe?”
Strong answer: explain the risk in writing, propose a safer alternative, and escalate through the proper channel if they insist. Do not quietly comply, and do not quietly refuse.
15. “How do you stay current?”
Strong answer: name two or three specific sources you actually read, such as vendor advisories, national CERT alerts or framework release notes, and one thing you learned recently. Vague answers (“I read blogs”) are common and forgettable.
Questions to ask in a cybersecurity analyst interview
- “What does a normal shift look like, and how many alerts does an analyst handle?”
- “Which SIEM and endpoint tools do you use, and who tunes the detection rules?”
- “How is on-call handled, and how often?”
- “What happened in your last significant incident, and what changed afterwards?”
- “How do analysts move into threat hunting, engineering or incident response roles here?”
Preparing in the week before
- Rehearse questions 1, 2, 6 and 9 out loud. They are the scenario types that test method most directly.
- Re-read the current versions of the frameworks you plan to mention. Interviewers notice outdated references.
- Prepare one investigation story in detail: what you saw, what you checked, what you concluded, what you would do differently.
- Make sure your CV lists the tools and log sources you have actually used. Use the cybersecurity analyst resume builder to structure it, and run it through the ATS resume score checker against the job advert.
If you are still deciding on certifications or a route into the field, our separate guide on becoming a cybersecurity analyst covers that; this article assumes you already have an interview.
FAQ
Will there be a practical test?
Often. Common formats are a log-reading exercise, a simulated alert queue, a phishing email to analyse or a short written incident summary.
What if I don’t know an answer?
Say so, then explain how you would find out. A clear method for finding answers is a strength in an analyst.
How technical are entry-level interviews?
Expect networking, operating system and log basics plus scenario questions. A clear, careful method matters more than deep tool knowledge.
Should I mention home lab or CTF experience?
Yes, especially early in your career. Describe what you built or solved, what went wrong and what you learned.
Sources
- Event 4625(F): An account failed to log on, Microsoft Learn
- Enterprise Matrix, MITRE ATT&CK
- OWASP Top 10:2025, OWASP Foundation
- SP 800-61 Rev. 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management, NIST Computer Security Resource Center