Security Engineering
Incident Response & Forensics
8 practice questions. Free questions open a full answer guide; the rest unlock with Pro.
- If you had to preserve evidence from a potentially compromised machine, what would you collect and in what order, and why?
- A workload in an auto-scaling group looks compromised, but those instances get recycled in minutes. How do you collect forensic evidence before it disappears?Go Pro
- Walk me through how you'd respond to an alert that one of your production cloud instances is compromised.Go Pro
- When you have to collect forensic evidence from a compromised system, what makes the evidence sound enough to actually rely on later?Go Pro
- Walk me through how you classify the severity of a suspected security incident and what that classification actually changes about your response.Go Pro
- Imagine you're brought in after a breach and asked to reconstruct what the attacker did — but the logs only go back two weeks. What logging and telemetry should you have had in place before the incident?Go Pro
- Walk me through the phases of responding to a security incident, like discovering an exposed credential or a compromised server.Go Pro
- GuardDuty fires telling you one of our IAM access keys is being used from an unfamiliar IP outside our cloud. Walk me through how you scope the blast radius and what you contain, in what order.Go Pro
Want questions matched to your role? Paste a job title, job description, or CV for a personalized set, or go Pro to unlock the full bank.