A production Linux server is suspected to be compromised and may lead to legal action. How do you collect evidence in a forensically sound way while limiting business impact?
What the interviewer wants to hear
- Plan with stakeholders; decide contain versus observe
- Follow order of volatility: memory and live state first
- Use trusted tools and write outputs to external storage
- Hash all evidence and keep chain of custody
- Snapshot or image disks, then rebuild rather than clean
Model answer
I first agree the plan with the system owner and legal, including whether to contain immediately or observe briefly, and how to keep the service running, for example by failing over to another node. Then I collect evidence by order of volatility. I capture memory using a trusted tool such as AVML or LiME, and record running processes, network connections, logged-in users and open files. Tools run from trusted media, and output goes to external storage, not the suspect disk. Next I take a disk image or a cloud volume snapshot, and copy key logs. Every item is hashed with SHA-256 and recorded in a chain of custody log with who, when and where. Analysis happens on copies. Finally the server is rebuilt from a known good image, not cleaned in place.
Can you answer it under time pressure?
Take a timed hard round and get scored on every answer.
More hard Cybersecurity Analyst questions
- Ransomware is spreading across your network on a Friday night. Walk me through how you would handle it.
- Design a threat hunt to find lateral movement in a Windows Active Directory environment.
- Your CISO wants to move to zero trust. What does that mean in practice and where would you start?
- A developer accidentally pushed AWS access keys to a public GitHub repository two hours ago. How do you respond?
- How would you build, test and maintain a new detection rule, for example for credential dumping from LSASS?
- Several employees fell for an adversary-in-the-middle phishing site that stole their session cookies despite MFA. How do you respond and harden the environment?
- You are building detection for a cloud-first company with a limited SIEM budget. Which log sources do you onboard first and why?
- HR tells you an engineer who just resigned may be taking source code and customer data. How do you investigate fairly and legally?
- How would you measure whether a SOC is effective? Which metrics would you use, and what are their pitfalls?