Start with the SANS Institute's severity levels - critical (active data exfiltration), high (confirmed malware), medium (suspicious activity), low (false positives). Emphasize you'd consider:

• Business impact (are crown jewels at risk?)
• Current threat landscape (is this part of an ongoing campaign?)
• Asset criticality (is it a public-facing server vs a test machine?)

Bonus points: Mention tools like Splunk ES or IBM QRadar for automated prioritization.

This is a trap question - the number varies wildly. Instead say:

"In mature SOCs with good tuning, maybe 10-15 quality alerts per 8-hour shift. But I focus on quality of investigation over quantity - better to thoroughly analyze five critical alerts than skim fifty."

"TCP is your certified mail - connection-oriented with delivery confirmation (SYN/ACK), perfect for web traffic. UDP is your postcard - connectionless fire-and-forget, great for VoIP or streaming where speed beats reliability."

Then pivot to security: "That's why UDP is attacker-favorite for DDoS - no handshake means easier spoofing."

"Drop is stealthier (no response to attacker) but deny creates logs that help us track recon attempts. In reality, the danger is misconfigured rules - like allowing ANY:ANY during an outage that never gets fixed."

Show your kill chain understanding:

1. Check Windows Event ID 4624 for unusual logon types (especially Type 3 network logons)
2. Correlate with 4672 (special privileges assigned) and 4648 (explicit credential use)
3. Hunt for lateral movement patterns in firewall/proxy logs
4. Verify if LSASS memory dumping tools like Mimikatz were executed

"I'd immediately isolate compromised systems and force password resets."