Google Detection Engineering & Incident Response interview questions

Three words every SOC uses and many candidates blur. The answer that scores defines each by what it obliges you to do, and names the decision that turns an alert into an incident.

The process tree tells most of the story in five minutes. Interviewers want an order of questions, the evidence for each, and a clear point at which you contain rather than keep looking.

Anyone can write a query that matches an attack. The interview is about everything else: the data source you trust, the benign activity that looks the same, how you proved it fires, and what the analyst does when it does.

Detections are production code that pages people. Treating them that way means version control, tests that prove they fire, review, staged rollout and metrics that decide which ones live.

A green heatmap is the easiest thing in security to fake. Interviewers want ATT&CK used to plan and test, with coverage that means 'proven to fire on the variants we expect', not 'a rule exists'.

Process creation with full command line and parentage answers more questions than any other event. The rest of the answer is about the next five sources, how sensors collect them, and what attackers do to blind them.

Inbound is blocked, so the compromised host calls out. That single design choice tells defenders where to look: unusual parents spawning shells with network connections, and regular outbound traffic to places nobody else visits.

The miner is the symptom. The incident is how it got there and what else the attacker could reach. Interviewers watch whether you stop at killing the process or follow the entry point and the credentials.

Encryption is the last stage of a ransomware attack, not the first. The strong answer contains spread fast, protects backups and identity systems, and knows that recovery depends on choices made months earlier.

Collect the things that disappear first, change as little as possible, write down everything you did, and know which artefact answers which question. That is most of practical forensics.

The group change is one event; the question is the chain behind it. The strong answer treats tier 0 as compromised until proven otherwise and works backwards from who made the change and with what credentials.

Resetting the password is step four, not step one. Attackers keep access through sessions, app consents and mailbox rules, and the money moves faster than the investigation.

Candidates still recite 'preparation, detection, containment, eradication, recovery, lessons learned'. Revision 3 moved incident response into the Cybersecurity Framework's functions, and interviewers notice who has kept up.

Analysts closing ten thousand alerts a week will miss the one that matters. The fix is not more analysts; it is fewer, better alerts and automation for the rest, measured by outcomes rather than throughput.

Sorting by CVSS score sends teams after thousands of 'criticals' nobody will ever exploit. The answer weighs whether exploitation is happening, whether the asset is reachable, and what it would cost you.

A hunt is a testable hypothesis about an attacker your detections missed. Without one, it is just browsing logs. The output that justifies it is usually a new detection, not a captured attacker.

Hash lookups catch yesterday's file. A good rule targets what the family cannot easily change, and gets tested against a corpus of clean files before anyone trusts it.

A logging pipeline is a distributed system with a threat model: attackers want it blind, analysts want it fast, finance wants it cheap. The staff answer designs for all three and for the day the queue backs up.

The first half is a Counter. The follow-up, an infinite stream and a memory cap, is the actual question: interviewers want a heavy-hitters algorithm and an honest statement of what it guarantees.

The review is where an incident pays for itself, or gets wasted. Interviewers want a factual timeline, contributing factors rather than a culprit, and actions with owners that someone checks.

Malware is just software that does what its operator wants on your machine. Every stage leaves evidence, and every stage has a control that can stop it.

Getting in once is not enough for an attacker. Persistence is where they must leave a mark on the system, which makes it one of the best places to catch them.

Crypto miners steal your compute. LLMjackers steal your model quota and resell it, and the first alert is often the bill.

The Arup case cost about US$25 million because everyone on the call looked and sounded right. The control that works does not involve spotting the fake at all.

Deciding what to fix is half the job. The other half is getting a fix onto 20,000 machines without breaking them, and proving it landed. Few candidates can describe that half.

The patch is the easy part. The hard parts are finding every copy, deciding what to do where you cannot patch tonight, and checking whether someone used it before you knew.

A credential that nobody legitimate ever uses produces an alert with almost no false positives. The craft is in placing it where an intruder looks and making sure it grants nothing.

Importing hashes and IP addresses from a report feels productive and changes almost nothing. The answer climbs from indicators to behaviours and ends with a test that proves the change.

EDR sees so much because it runs with so much privilege. On 19 July 2024 that privilege turned one bad content file into millions of crashed Windows machines. The answer covers both halves.

Having backups is not the control; having backups an attacker with admin rights cannot delete, and restoring from them on schedule, is. The scored answer designs for both.

Infostealers turned stolen passwords and cookies into a commodity with sellers, buyers and price lists. The scored answer follows the supply chain and cuts it at the points you control.

Headlines promised self-writing AI malware. The reports show something narrower and more useful to defenders: malware with a dependency on someone else's API. The scored answer separates hype from evidence and turns that dependency into detections.

Follow a known event through connector delivery, normalization and rule evaluation. Distinguish source changes, missing identity fields and late events from a real reduction in suspicious activity.

Design response automation when a remote action may have succeeded despite a lost reply. Preserve target identity, approval scope and audit evidence while reconciling the result.

A negative historical search needs a corpus, time range and validated rule. Explain what it rules out, what remains unknown and which local observations would change the incident assessment.

Use CERT-In’s public advisory to build an evidence-led defense review. Separate the reported campaign from a synthetic response exercise and avoid inventing CVEs, restricted indicators or attribution.

A dashboard shows improvement while authenticated assessment coverage shrinks. Reconcile inventory, collection and repair evidence before reporting risk reduction.