Security Engineering

Incident Response & Forensics

8 practice questions. Free questions open a full answer guide; the rest unlock with Pro.

  • If you had to preserve evidence from a potentially compromised machine, what would you collect and in what order, and why? Junior level
  • A workload in an auto-scaling group looks compromised, but those instances get recycled in minutes. How do you collect forensic evidence before it disappears?Go Pro Senior level
  • Walk me through how you'd respond to an alert that one of your production cloud instances is compromised.Go Pro Mid level
  • When you have to collect forensic evidence from a compromised system, what makes the evidence sound enough to actually rely on later?Go Pro Mid level
  • Walk me through how you classify the severity of a suspected security incident and what that classification actually changes about your response.Go Pro Senior level
  • Imagine you're brought in after a breach and asked to reconstruct what the attacker did — but the logs only go back two weeks. What logging and telemetry should you have had in place before the incident?Go Pro Mid level
  • Walk me through the phases of responding to a security incident, like discovering an exposed credential or a compromised server.Go Pro Junior level
  • GuardDuty fires telling you one of our IAM access keys is being used from an unfamiliar IP outside our cloud. Walk me through how you scope the blast radius and what you contain, in what order.Go Pro Senior level
Want questions matched to your role? Paste a job title, job description, or CV for a personalized set, or go Pro to unlock the full bank.