Skip to main content
Courses
Interview Courses
Product Management
New
Ace product interviews from strategy cases to technical skills.
Forward Deployed
Beta
Prep for FDE loops at Anthropic, OpenAI, Palantir, and more.
Engineering Management
Review key leadership and people management skills.
Software Engineering
Learn essential strategies for coding problems and more.
System Design
Define architectures, interfaces, and databases in a time crunch.
Data Science
Execute statistical techniques and experimentation effectively.
Machine Learning
Review building, evaluating, and deploying AI/ML models.
Data Engineering
Design complex data models and ETL pipelines.
More Courses
Generative AI
Security Engineer
Data Analytics
Eng Behavioral
TPM
Solutions Architect
UX / Product Design
BizOps & Strategy
View all courses
Loops
Experiences
Questions
Top Questions
Product Management
Behavioral Questions
Coding Questions
System Design
SQL Questions
Machine Learning
Data Analytics
Data Engineering
Browse all questions
Practice
Coaching
Mock Interviews & Coaching
Practice with our team of senior tech coaches.
Resume Review
Get your resume reviewed by a senior tech recruiter.
Salary Negotiation
Increase your offer with our expert negotiators.
How Coaching Works
Learn how expert coaching can help you land the job.
Pricing
Job Referrals
Get job referrals to top tech companies.
Blog
Check out our blog on tech interviewing tips, strategies, and more.
Resources
Members-only articles, videos, and interviews.
Work with us
Help us grow the Exponent community.
Perks
Access exclusive member benefits.
For universities
Give your students tech interview prep.
For businesses
Improve your placement rates, outcomes, and more.
For recruiters
Post a job on Exponent's exclusive job board.
Affiliate program
Recommend us to others and earn commission.
Search or ask AI...
⌘K
Log in
Sign up
Sign up
Search or ask AI...
⌘K
Courses
Product Management
New
Ace product interviews from strategy cases to technical skills.
Forward Deployed
Beta
Prep for FDE loops at Anthropic, OpenAI, Palantir, and more.
Engineering Management
Review key leadership and people management skills.
Software Engineering
Learn essential strategies for coding problems and more.
System Design
Define architectures, interfaces, and databases in a time crunch.
Data Science
Execute statistical techniques and experimentation effectively.
Machine Learning
Review building, evaluating, and deploying AI/ML models.
Data Engineering
Design complex data models and ETL pipelines.
View all courses
Loops
Experiences
Questions
Product Management
Behavioral Questions
Coding Questions
System Design
SQL Questions
Machine Learning
Data Analytics
Data Engineering
Browse all questions
Practice
Coaching
Mock Interviews & Coaching
Practice with our team of senior tech coaches.
Resume Review
Get your resume reviewed by a senior tech recruiter.
Salary Negotiation
Increase your offer with our expert negotiators.
How Coaching Works
Learn how expert coaching can help you land the job.
Pricing
More
Job Referrals
Get job referrals to top tech companies.
Blog
Check out our blog on tech interviewing tips, strategies, and more.
Resources
Members-only articles, videos, and interviews.
Work with us
Help us grow the Exponent community.
Perks
Access exclusive member benefits.
For universities
Give your students tech interview prep.
For businesses
Improve your placement rates, outcomes, and more.
For recruiters
Post a job on Exponent's exclusive job board.
Affiliate program
Recommend us to others and earn commission.
Sign up
Log in
Technical Questions for Security Analysts
Overview
Introduction to Technical Questions
Rubric for Technical Questions
Using the OODA Framework
SIEM & Telemetry
How SIEM and Telemetry Are Tested
Telemetry Data Sources
Querying (KQL/SPL/Sigma Patterns)
Common SIEM Pitfalls
Networking and OS Fundamentals for Triage
How Networking & OS Fundamentals Are Tested
Packet Clues (Ports, Flags, and HTTP Artifacts)
Event IDs and Audit Trails (Windows, Linux, macOS)
Processes, Services, and Startup Persistence
Designing Threat Detection
How Detection Questions Are Tested
Detection Design
MITRE ATT&CK Framework
Endpoint, Cloud, and Identity Telemetry
EDR and Sysmon
Cloud Audit Logs
Identity and Access Clues
Scripting and Automation for Investigations
Security Scripting Questions
Log Parsing One‑Liners
Automating Enrichment and Triage
Using Generative AI for Triage and Investigation
(Optional) Digital Forensics Essentials
Evidence Handling and Triage Acquisition
Disk, Memory, and Browser Artifacts
Mock Interviews
Network Fundamentals, Incident Response
How to Triage a Situation
Threat Detection & Incident Response
Alerts and Investigations
Parsing Data, AI in Monitoring, Encryption
Automation and AI
Mock Interview: Design a Cyber Attack
Mock Interview: How Does the Internet Work?
Unlock full course
Technical Questions for Security Analysts
Overview
Introduction to Technical Questions
Rubric for Technical Questions
Using the OODA Framework
SIEM & Telemetry
How SIEM and Telemetry Are Tested
Telemetry Data Sources
Querying (KQL/SPL/Sigma Patterns)
Common SIEM Pitfalls
Networking and OS Fundamentals for Triage
How Networking & OS Fundamentals Are Tested
Packet Clues (Ports, Flags, and HTTP Artifacts)
Event IDs and Audit Trails (Windows, Linux, macOS)
Processes, Services, and Startup Persistence
Designing Threat Detection
How Detection Questions Are Tested
Detection Design
MITRE ATT&CK Framework
Endpoint, Cloud, and Identity Telemetry
EDR and Sysmon
Cloud Audit Logs
Identity and Access Clues
Scripting and Automation for Investigations
Security Scripting Questions
Log Parsing One‑Liners
Automating Enrichment and Triage
Using Generative AI for Triage and Investigation
(Optional) Digital Forensics Essentials
Evidence Handling and Triage Acquisition
Disk, Memory, and Browser Artifacts
Mock Interviews
Network Fundamentals, Incident Response
How to Triage a Situation
Threat Detection & Incident Response
Alerts and Investigations
Parsing Data, AI in Monitoring, Encryption
Automation and AI
Mock Interview: Design a Cyber Attack
Mock Interview: How Does the Internet Work?
Unlock full course
Courses
Technical Questions for Security Analysts
Mock Interviews
Parsing Data, AI in Monitoring, Encryption
Premium
Watch Harrison-Abel Berdan (Sr. security analyst) walk through parsing raw data, talk about using AI in monitoring, answer questions on encryption, and more.
Next Lesson
/courses/security-analyst-technical-questions/parsing-data-ai-in-monitoring-encryption