Splunk & SOC Analyst Interview Questions (with Answers)

Interviewers for Splunk and SOC roles usually check three things: whether you understand the fundamentals, whether you can apply them to a scenario, and whether you can explain your thinking clearly. Use these questions to test yourself, then practise answering them out loud.

Splunk fundamentals

What are the main components of a Splunk deployment?

Forwarders collect and send data, indexers parse and store it in indexes, and search heads let users run searches, dashboards and alerts. Larger deployments add a deployment server, cluster manager and license manager.

What is the difference between a universal forwarder and a heavy forwarder?

A universal forwarder is lightweight and mainly forwards raw data. A heavy forwarder is a full Splunk instance that can parse, filter and route data before sending it on.

What is an index and what is a sourcetype?

An index is where Splunk stores events. A sourcetype describes the format of the data (for example, a firewall log or Windows event log), which tells Splunk how to parse timestamps, line breaks and fields.

What is the difference between stats, eventstats and streamstats?

stats aggregates results into a summary table. eventstats calculates the same aggregates but adds them to each event without removing events. streamstats calculates running aggregates in the order events are processed.

How would you find the top source IPs with failed logins?

For example: index=security EventCode=4625 | stats count by src_ip | sort -count | head 10 — adjust the index, field names and event codes to your data.

SOC and SIEM

What does a SIEM do?

A SIEM collects logs from many sources, normalises them, correlates events, and raises alerts so analysts can detect and investigate security incidents from one place.

How do you triage an alert?

Read the alert logic, check the affected user and asset, look for related events before and after, compare against known benign activity, decide whether it is a true or false positive, and escalate or close with clear notes.

What is the difference between a false positive and a false negative?

A false positive is an alert on activity that is not actually malicious. A false negative is malicious activity that did not trigger an alert — usually the more dangerous of the two.

What are the phases of incident response?

A common model is preparation, identification, containment, eradication, recovery and lessons learned.

What is MITRE ATT&CK used for?

It is a knowledge base of attacker tactics and techniques. SOC teams use it to map detections, find coverage gaps and describe incidents in a common language.

Scenario practice

• You see 40 failed logins followed by one success for a service account. What do you check next?
• A user clicked a link in a suspicious email. What data would you look at, and in what order?
• An alert fires every night at 2 AM for the same host. How do you decide whether to tune it?

Talk through each scenario step by step: what you would search for, what result would change your decision, and how you would document it. Clear reasoning matters as much as the final answer.