These are the kinds of questions a junior (L1/L2) SOC analyst is actually asked, with short, honest answers. The best way to make these answers your own is to do the work: the free SOC Analyst course has you handle real logs, packet captures and Windows events in your browser.
Fundamentals
What is the difference between an event, an alert and an incident? An event is any logged activity; an alert is an event (or pattern) a rule flagged as suspicious; an incident is a confirmed security issue that needs response.
What does an L1 analyst do vs an L2? L1 monitors the queue, does first triage and escalates. L2 investigates deeper - correlation across sources, scoping, and containment guidance.
What is the difference between SIEM and EDR? A SIEM centralises and correlates logs from many sources; EDR focuses on endpoint process/behaviour telemetry and response.
Reading the evidence
How would you spot a successful SSH brute-force in auth.log? Many "Failed password" lines from one IP, then an "Accepted password" for an account from that same IP, often followed by a session. Practise it in the brute-force lab.
What Windows event ID is a failed logon? 4625 (and 4624 is a successful logon). Work a Windows logon case.
How do you find a web shell in access logs? Look for an unusual script being POSTed to repeatedly, odd user-agents, and requests that do not match normal browsing. Try the web shell hunt.
Process and frameworks
Walk me through triaging an alert. Understand what fired and why, gather context (who/what/when), pivot the indicator across your other logs, decide true vs false positive, and either close with a reason or escalate with a clear write-up.
What is MITRE ATT&CK and how do you use it? A catalogue of attacker tactics and techniques. You map observed behaviour to techniques so detection coverage and reports speak a common language. See mapping the kill chain.
What are the steps of incident response? Preparation, identification, containment, eradication, recovery and lessons learned.
How to stand out
Interviewers can tell who has only read about this and who has done it. Build real evidence to talk about by finishing the free SOC Analyst course - 12 labs on real logs, captures and events, ending with a written incident report you can describe in the interview.