Ransomware is spreading across your network on a Friday night. Walk me through how you would handle it.

What the interviewer wants to hear

• Activate the incident response plan and assemble the team
• Contain fast: isolate hosts, disable accounts, block C2, protect backups
• Preserve evidence and scope the attack, including data theft
• Eradicate persistence and the initial access path
• Recover from clean backups in priority order and communicate
• Lessons learned and legal or regulatory reporting

Model answer

I would activate the incident response plan, open an incident channel and bring in the IR lead, IT, management and legal early. Containment comes first: use EDR to isolate affected hosts, disable compromised and privileged accounts, block command and control indicators, and if needed segment or disconnect network zones. I would quickly protect backups by taking them offline. I keep systems powered on where possible to preserve memory and logs. Next I scope: find patient zero, the initial access path such as an exposed VPN or phishing, the accounts used, and check for data exfiltration, since most groups also steal data. Eradication means removing persistence, resetting credentials including the krbtgt account twice, and patching the entry point. Recovery is from clean, tested backups in business priority order, with monitoring. Throughout, I keep timed notes. Afterwards we hold a lessons learned review and meet legal reporting duties, such as CERT-In reporting within six hours in India.

More hard Cybersecurity Analyst questions

• Design a threat hunt to find lateral movement in a Windows Active Directory environment.
• Your CISO wants to move to zero trust. What does that mean in practice and where would you start?
• A developer accidentally pushed AWS access keys to a public GitHub repository two hours ago. How do you respond?
• How would you build, test and maintain a new detection rule, for example for credential dumping from LSASS?
• Several employees fell for an adversary-in-the-middle phishing site that stole their session cookies despite MFA. How do you respond and harden the environment?
• You are building detection for a cloud-first company with a limited SIEM budget. Which log sources do you onboard first and why?
• HR tells you an engineer who just resigned may be taking source code and customer data. How do you investigate fairly and legally?
• A production Linux server is suspected to be compromised and may lead to legal action. How do you collect evidence in a forensically sound way while limiting business impact?
• How would you measure whether a SOC is effective? Which metrics would you use, and what are their pitfalls?