Lion Cipher Lab
Interview scenario: "You're handed a suspicious login alert — walk me through it"
- SOC Analyst / Blue Team
- Intermediate
- ~40 min
- Free · no account required
Why it matters
The single most common live exercise in a SOC-analyst interview is "here's an alert, walk me through it." It isn't testing whether you memorized a tool — it's testing whether you can reason under uncertainty and explain that reasoning clearly. An impossible-travel login is the classic prompt because it is genuinely ambiguous: it is very often a benign VPN or a business trip, and occasionally a real account takeover. Learning to work it out loud — first check, why, what confirms, what clears, when you escalate — is a skill you will use on your first shift and in every interview to get there.
What you'll learn
- Alert triage reasoning
- Impossible-travel / valid-accounts analysis
- Confirm-vs-clear thinking
- Escalation judgment
- Explaining a decision out loud (interview communication)
Steps in this lab
- The prompt — what the interviewer actually just handed you
- Step 1 — state the facts, and separate them from the guesses
- Step 2 — name the technique, and both hypotheses, in ATT&CK terms
- Step 3 — what you check FIRST, and why that order
- Step 4 — what would CONFIRM it vs what would CLEAR it
- Step 5 — when you escalate, and how you decide
- Step 6 — deliver it: write the structured triage narrative (the deliverable)