You suspect a Microsoft 365 user account is compromised. How do you investigate and respond?
What the interviewer wants to hear
- Review sign-in logs for unusual location, device or impossible travel
- Check for MFA changes, new inbox rules and OAuth app consents
- Contain: revoke sessions, reset password, re-register MFA
- Scope what the attacker accessed or sent
- Look for the initial cause, such as phishing or token theft
Model answer
I start with Entra ID sign-in logs: new countries, unusual IPs, unknown devices, impossible travel, or legacy protocols. Then I check audit logs for signs of persistence, such as new MFA methods, new inbox forwarding or delete rules, and consent to unfamiliar OAuth apps. If it looks real, I contain quickly: disable the account or reset the password, revoke all sessions and refresh tokens, remove the attacker MFA method and malicious rules or apps. Because modern phishing kits steal session tokens, a password reset alone is not enough. Then I scope the damage using the unified audit log: which emails and files were read, downloaded or sent, and whether the account sent phishing internally. Finally I find the root cause, such as an adversary-in-the-middle phishing email, and recommend phishing-resistant MFA like passkeys.
Can you answer it under time pressure?
Take a timed medium round and get scored on every answer.
More medium Cybersecurity Analyst questions
- Walk me through how you triage a new SIEM or EDR alert.
- You have 2,000 open vulnerabilities from a scan. How do you decide what to fix first?
- What is MITRE ATT&CK and how do you use it in your work?
- Your SOC gets too many false positive alerts. How would you reduce alert fatigue without missing real attacks?
- How do you write an incident report that works for both technical teams and non-technical leaders?
- A network alert says a laptop may be beaconing to a command-and-control server. How do you investigate?
- How do you use threat intelligence in day-to-day SOC work without drowning in indicator feeds?
- A critical vulnerability is being exploited in the wild, but the affected system cannot be patched for weeks. What do you do?
- EDR raises an alert for a suspicious PowerShell command on a user's laptop. Walk me through your investigation.