title	SecOps and Threat Detection
category	SecOps and Threat Detection
tags	devops secops index

SecOps and Threat Detection

Security operations for engineers: SOC workflow, SIEM and normalisation, detection engineering, MITRE ATT&CK coverage, threat hunting, and security incident response.

14 questions · 🟢 Beginner: 2 · 🟡 Intermediate: 7 · 🔴 Advanced: 5

Questions

#	Question	Difficulty
169	What does a Security Operations Center (SOC) do?	🟢 Beginner
170	What is a SIEM and how do you make one useful?	🟡 Intermediate
171	What is detection engineering?	🔴 Advanced
172	What is the MITRE ATT&CK framework?	🟡 Intermediate
173	What is threat hunting?	🔴 Advanced
174	How do you run a security incident response?	🟡 Intermediate
175	What is EDR and how does it differ from antivirus?	🟢 Beginner
176	What is SOAR and what should you automate first?	🟡 Intermediate
712	What is the Role of Security Orchestration, Automation, and Response (SOAR) in SecOps?	🟡 Intermediate
713	How Do You Design and Execute Threat Modeling for Cloud-Native Infrastructure?	🔴 Advanced
714	How Do You Implement Automated Credential and API Key Exposure Detection?	🟡 Intermediate
715	What is Endpoint Detection and Response (EDR) and How Does It Integrate into SecOps?	🟡 Intermediate
716	How Do You Detect and Respond to Lateral Movement Within Kubernetes Clusters?	🔴 Advanced
717	What is Honeytoken or Honeypot Deception and How Is It Applied in Production Environments?	🔴 Advanced

What interviewers probe here

• Detecting behaviour rather than artifacts, and validating the detection.
• Preserving evidence before containment during a security incident.
• Which telemetry you would onboard first, and why identity logs come top.

---

⬅ Back to all topics