You get credible evidence that an attacker has had access to a production server for a week. How do you lead the response?

What the interviewer is looking for

• This question tests detection & incident response. Describes investigation steps, containment, evidence preservation, communication and lessons learned in a calm order.
• Strong answers: Assembles a team, scopes before tipping off the attacker, preserves evidence, contains, rotates credentials, eradicates, recovers, involves legal and communications including regulatory notification deadlines, and reviews afterwards.
• Likely follow-up: How do you decide when it is safe to say the attacker is gone?

Another way it may be asked: You discover someone has been inside one of your servers for days. What do you do, and in what order?

A structure to follow: Answer, explain, example, limits

1. Step 1

   Answer

   Give your direct answer in the first sentence so the interviewer knows where you are going.

2. Step 2

   Explain

   Say how it works or why you would do it that way, in plain words before jargon.

3. Step 3

   Example

   Anchor it in something you have actually done or seen, with the detail that shows hands-on experience.

4. Step 4

   Limits

   Say when your approach would not be the right one. It shows judgement.

This is guidance on shape, not a script. Use your own real experience and facts; never invent details to fill a gap. See the STAR guide and answer frameworks.

Common slips

• Reciting a definition without showing you have applied it.
• Using terms you cannot explain if asked a level deeper.
• Claiming experience beyond what you can discuss in detail.

How to practise it

Say the answer in 90 seconds, then answer the follow-up as if it were a new question.

Related questions

• You notice a user account logging in from two countries an hour apart. What would you check, and what would you do?
• What is SQL injection, how does it happen, and how would you prevent it in a web application?
• Why is multi-factor authentication important, and which kinds of second factor are stronger than others?
• A scanner reports three thousand vulnerabilities across your systems. How do you decide what to fix first?
• Walk me through how you would threat model a new feature that lets users upload files to share with others.

Browse all questions