The panel reads you an alert: a Word document spawned PowerShell with a long base64-encoded command block. "Walk me through what you'd do." You know exactly why that's bad, parent-child process mismatch, encoding usually means someone's hiding the actual command, so you start talking. "That's definitely malicious, I'd block the source IP and isolate the host." The panel nods, waits, then asks: "Isolate which host? Is this the only one?" You didn't say. You went straight to the response before establishing what you were even responding to, and now you're reconstructing the scope out of order, live, in front of the people deciding whether to hire you.
That's the part candidates who know their tools still get wrong, and it isn't a knowledge gap. Everyone in that chair can tell you encoded PowerShell from Office is a red flag. What the panel is actually grading is whether you have a repeatable process you'd run at two in the morning on a real incident, not whether you recognized the indicator. Recognizing the indicator is the easy half.
The structure that answer is missing has four pieces, in order. Scope: is this one host or several, one user or a pattern across many, and how far back does the activity go. Context: is this expected here, a sysadmin's scheduled script, a known deployment tool, or does it have no legitimate reason to exist on this host's baseline. Decision: state plainly what would make you call this benign versus what makes you escalate right now, and for encoded PowerShell spawned from Word specifically, there usually isn't a benign version, so that's the moment to say so and move to escalation rather than kicking the decision down the road. Escalation: what you'd actually hand to L2, the process tree, exact timestamps, the affected host list, and the specific reason you believe it isn't benign, so the next person isn't repeating your first ten minutes of work.
Narrate an alert in that order, scope then context then decision then escalation, and the same technical instinct you already had lands as a process instead of a guess. That's the arc a SOC actually runs on, from a fresh L1 alert through to the kind of detection and escalation judgment L3 work assumes you already have, and it's the same arc the SOC Analyst Book Bundle is structured around across its three volumes, plus the free SOC Analyst Level 1 career path and the Wazuh Alert Triage lab if you want to run through real alerts before the interview does it for you: https://resources.codelivly.com/product/soc-analyst-the-complete-l1-l2-l3/
