Citadel SOC Analyst Test

Please complete the following assessment to the best of your ability. Some questions are designed to evaluate your analytical thinking in addition to your technical knowledge.

All answers must be written in English.

The use of AI tools (ChatGPT, Claude, Copilot, etc) is not permitted during this assessment.

Recommended time: about 90–120 minutes. A 2-hour countdown starts when you leave this page. When time runs out, the assessment is submitted automatically.

Candidate Details Required

First Name

Name must be in English letters only

Last Name

Name must be in English letters only

Date

Question 1 – Log Ranking Drag & Drop

Task: Below are four logs collected from the organization's systems. Rank the logs from the most suspicious to the least suspicious, and explain the reasoning behind your ranking for each log.

*You may use the reputation website AbuseIPDB to check the reputation of the IP addresses included in the logs. AbuseIPDB ↗

Question 2 – Phishing Analysis Investigate

Scenario: An employee reported receiving the following email and almost entered their credentials. Review both parts carefully:

1. The email message itself
2. The web page that the link in the email leads to (interactive simulation below)

⚠ Simulated Phishing Email (for analysis only)

From: Microsoft Account Team <account-security@rnicrosoft-support.com>

To: you@citadel.co.il

Action Required: Unusual sign-in activity detected on your account

Tue, 6 Jul 2026 09:14:22 +0000

Dear User,

We detected unusual sign-in activity on your Microsoft account from a new location or device.

Location: Frankfurt, Germany
Device: Windows PC
Time: July 6, 2026, 09:08 UTC

If this was you, you can safely ignore this message. If you do not recognize this activity, please verify your identity immediately to prevent unauthorized access.

Verify Account

For your security, verification must be completed within 24 hours. Failure to verify your account may result in temporary restrictions to your Microsoft services.

Thank you,
Microsoft Account Security Team

⚠ Simulated Login Page (linked from the email) — interactive

🔒 login.rnicrosoftonline.com/common/oauth2/v2.0/authorize?client_id=d3590ed6-52b3-4102-aeff-aad2292ab01c&response_type=code&redirect_uri=https%3A%2F%2Fportal.office.com

Microsoft

Sign in

to continue to Microsoft 365

Enter a valid email address, phone number, or Skype name.

No account? Create one!

Enter password

U you@citadel.co.il

Please enter the password for your Microsoft account.

Verifying your account...

Additional verification required

We need to confirm it's you before restoring full access.

Your account has been temporarily restricted due to unusual activity. Please re-enter your password to unlock it.

Create account

to access Microsoft 365 services

Use a phone number instead

By proceeding, you agree to our Terms of service and Privacy & cookies statement.

Create password

Enter the password you would like to use with your account.

I agree to share my account credentials with trusted Microsoft security partners for account protection purposes.

Microsoft reserves the right to review account activity. Account recovery may require payment verification via third-party billing partners.
© 2019 Microsoft Corporation. All rights reserved.

Analysis Questions

Is this a phishing email or a legitimate email?

Phishing Legitimate

If this is phishing — list all findings that indicate it is phishing:

If this is legitimate — explain why:

Question 3 – SIEM Investigation Cita-SIEM

Task: Investigate the following security alerts using the simulated SIEM interface below. Two separate cases are available. Examine both thoroughly before writing your notes.

How to use Cita-SIEM — Read this first

A SIEM (Security Information and Event Management) system collects security logs from many sources and raises Offenses (alerts) when suspicious activity is detected. You do not need prior SIEM experience — follow the steps below.

Choose a Case

At the top of the SIEM panel you will see two buttons: Case 1 — Impossible Travel and Case 2 — Privileged Group. Click a button to load that offense, then investigate both cases.

Summary (Overview) tab

This is the main offense page. It shows:

Magnitude bar — how serious the system rates this offense
Severity / Relevance / Credibility — scoring values (higher = more concerning)
Description — what triggered the alert
Source / Destination IPs, Network, Times — where and when it happened
Offense Source Summary — details about the user or host involved

Events tab

Lists every individual log event linked to this offense (logins, group changes, etc.). Click any row to open a popup with the Raw Log — the original unparsed event text. This is often where the most important technical details are found.

User Info tab

Shows the profile of the user account involved (department, privileges, MFA status, normal country, etc.). In some cases you will also see an Actor section — the account that performed the action.

IP Info tab

Reputation and geolocation data for the IP addresses seen in the offense (country, ISP, hosting vs residential, previous activity). Use this to judge whether an IP looks unusual.

Timeline tab

A simplified chronological view of the key events. Useful to quickly understand the sequence of activity.

Tip: Good analysts look at all tabs, open the raw logs, and compare what is “normal” for the user versus what actually happened. Do not rely on a single field.

Case 1 – Impossible Travel

What happened in this incident?

Which finding in your investigation raises your level of suspicion the most, and why?

Is the available information sufficient to determine that the account was compromised? Explain.

If you could perform only one additional check before contacting the customer — what would you check and why?

Note one finding that may look suspicious at first glance, but by itself does not prove malicious activity. Explain why.

Case 2 – Added to System Admins

What happened in this incident?

Which finding in your investigation had the most significant impact on your initial assessment of the incident, and why?

Is there information in the user details that affects your level of suspicion? If so, which information and why?

⏳

Submitting your assessment…

Please wait while your answers are being sent.