Several employees fell for an adversary-in-the-middle phishing site that stole their session cookies despite MFA. How do you respond and harden the environment?

What the interviewer wants to hear

• Identify affected users from sign-in logs, proxy and email data
• Revoke sessions and tokens, reset passwords, check MFA methods
• Look for post-compromise actions: inbox rules, BEC, OAuth apps, data access
• Block the phishing infrastructure and purge emails
• Harden with phishing-resistant MFA and device-bound Conditional Access

Model answer

First I scope it. I find who received the email, who clicked through proxy logs, and whose sign-ins came from the attacker's infrastructure, looking for unfamiliar IPs and devices soon after the click. For each affected user I revoke all sessions and refresh tokens, reset the password, and remove any MFA methods the attacker registered. Then I hunt for post-compromise activity: new inbox forwarding rules, emails sent for invoice fraud, OAuth app consents, file downloads from SharePoint, and further internal phishing. I purge the emails from all mailboxes and block the domains. To harden, I would move high-risk users to FIDO2 or passkeys, require compliant or managed devices through Conditional Access, enable token protection where supported, and add detections for sign-ins that do not match the user's device.

More hard Cybersecurity Analyst questions

• Ransomware is spreading across your network on a Friday night. Walk me through how you would handle it.
• Design a threat hunt to find lateral movement in a Windows Active Directory environment.
• Your CISO wants to move to zero trust. What does that mean in practice and where would you start?
• A developer accidentally pushed AWS access keys to a public GitHub repository two hours ago. How do you respond?
• How would you build, test and maintain a new detection rule, for example for credential dumping from LSASS?
• You are building detection for a cloud-first company with a limited SIEM budget. Which log sources do you onboard first and why?
• HR tells you an engineer who just resigned may be taking source code and customer data. How do you investigate fairly and legally?
• A production Linux server is suspected to be compromised and may lead to legal action. How do you collect evidence in a forensically sound way while limiting business impact?
• How would you measure whether a SOC is effective? Which metrics would you use, and what are their pitfalls?