A critical vulnerability is being exploited in the wild, but the affected system cannot be patched for weeks. What do you do?
What the interviewer wants to hear
- Confirm exposure and affected assets
- Apply vendor mitigations or workarounds
- Compensating controls: isolate, restrict access, WAF or IPS rules
- Increase monitoring and hunt for signs of past exploitation
- Document risk acceptance with an owner and deadline
Model answer
First I confirm exposure: which assets have the vulnerable version, whether they are internet-facing, and what data they hold. If it is in the CISA KEV catalog or has public exploits, I treat it as urgent. Then I apply any vendor workaround, such as disabling the affected feature. Next come compensating controls: restrict network access to only required sources, put it behind a VPN, add WAF or IPS signatures for the exploit, and remove unnecessary accounts. Because it has been exploited elsewhere, I also hunt for signs that we were already hit, using published IOCs and behaviour like new processes or web shells. I raise monitoring on that system, and record a time-bound risk acceptance with a named owner until the patch is applied.
Can you answer it under time pressure?
Take a timed medium round and get scored on every answer.
More medium Cybersecurity Analyst questions
- Walk me through how you triage a new SIEM or EDR alert.
- You have 2,000 open vulnerabilities from a scan. How do you decide what to fix first?
- What is MITRE ATT&CK and how do you use it in your work?
- You suspect a Microsoft 365 user account is compromised. How do you investigate and respond?
- Your SOC gets too many false positive alerts. How would you reduce alert fatigue without missing real attacks?
- How do you write an incident report that works for both technical teams and non-technical leaders?
- A network alert says a laptop may be beaconing to a command-and-control server. How do you investigate?
- How do you use threat intelligence in day-to-day SOC work without drowning in indicator feeds?
- EDR raises an alert for a suspicious PowerShell command on a user's laptop. Walk me through your investigation.