Post Incident Analysis and Improvement Questions

Covers the end to end process of investigating incidents and converting findings into durable program improvements. Candidates should be able to describe how to run structured post incident reviews and root cause analyses that probe beyond the immediate failure to uncover underlying system, process, human, and governance causes. Topics include evidence collection, timeline reconstruction, causal analysis techniques, identification and prioritization of corrective actions, remediation tracking and verification, validating effectiveness of fixes, communicating lessons learned across teams, and using incident data to inform risk assessments and policy or process changes. Emphasis should be placed on practical examples of preventing recurrence, balancing near term containment with long term fixes, and building a blameless culture that supports continuous improvement.

MediumTechnical

60 practiced

Describe a verification plan to ensure corrective actions from a PIR are effective over time. Include short-term verification such as tests and targeted scans, medium-term monitoring such as alerts and metrics, and long-term validation such as audits or red team exercises. Explain how you would document re-verification scheduling and who should sign off on effectiveness.

Sample Answer

**Summary / Objective** I would create a time-phased verification plan that proves corrective actions from the PIR are implemented, effective, and persistent: short-term tests, medium-term monitoring, long-term validation, plus clear documentation and sign-off.

**Short-term (0–30 days) — Tests & Targeted Scans**- Run targeted vulnerability scans and configuration checks against remediated assets.- Execute unit/functional tests for changed controls (e.g., MFA, firewall rules).- Perform controlled exploit attempts in a lab or isolated window (with approvals).- Deliverables: test cases, scan reports, remediation evidence.

**Medium-term (30–90 days) — Monitoring & Metrics**- Instrument SIEM/IDS rules to monitor related indicators of compromise.- Create dashboards: alert rate, failed auth trends, patch compliance, anomalous traffic.- Define thresholds and alerting for regression; schedule weekly reviews.- Deliverables: dashboards, weekly summary, incident correlation notes.

**Long-term (90+ days) — Audits & Red Team**- Schedule internal audit and a red-team/third-party pen test focused on the control area.- Conduct process audits to ensure policy and training sustained changes.- Use findings to close the loop back into PIR lifecycle.

**Re-verification Scheduling & Documentation**- Maintain a Verification Log (change, owner, dates, evidence, next re-check date).- Re-check cadence: critical issues = 30/60/90 days; medium = 90/180; low = annual.- Automate reminders via ticketing (change control) and link evidence to PIR item.

**Sign-off & Governance**- Technical sign-off: remediation owner or system owner verifies implementation.- Security sign-off: Information Security Analyst certifies monitoring and tests passed.- Risk/Business sign-off: Risk owner or business unit manager confirms residual risk accepted.- Final sign-off archived in PIR record; any exceptions require documented compensating controls and executive approval.

This plan ensures layered verification, measurable metrics, and accountable sign-offs to prove corrective actions remain effective.

MediumTechnical

75 practiced

Coding exercise in Python: Implement a function merge_logs(log_lines) that normalizes timestamps from mixed formats and returns events sorted by UTC timestamp. Input lines may contain ISO8601 timestamps like 2023-10-11T12:34:56Z, syslog-style timestamps like Oct 11 12:34:57, or YYYY/MM/DD HH:MM:SS. Assume syslog entries use the current year when year is missing. Skip malformed lines but log them. Example lines: 2023-10-11T12:34:56Z host1 sshd[123]: Failed password; Oct 11 12:34:57 host2 kernel: network connection; 2023/10/11 12:34:58 host3 app: user=alice action=upload file=report.pdf. You may use only Python standard library.

Sample Answer

**Approach**- Parse each line attempting three timestamp formats (ISO8601 Z, syslog without year, and YYYY/MM/DD). Convert to UTC-aware datetime, collect valid events, skip and log malformed lines to stderr. Finally sort by timestamp.

**Code**

python

import sys
from datetime import datetime, timezone
import re

def merge_logs(log_lines):
    parsed = []
    bad = []
    now_year = datetime.now().year
    iso_re = re.compile(r'^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}Z')
    ymd_re = re.compile(r'^\d{4}/\d{2}/\d{2} \d{2}:\d{2}:\d{2}')
    syslog_re = re.compile(r'^[A-Z][a-z]{2} +\d{1,2} \d{2}:\d{2}:\d{2}')
    for line in log_lines:
        line = line.rstrip('\n')
        try:
            if iso_re.match(line):
                ts = line.split(' ',1)[0]
                dt = datetime.strptime(ts, '%Y-%m-%dT%H:%M:%SZ').replace(tzinfo=timezone.utc)
            elif ymd_re.match(line):
                ts = line.split(' ',2)[:2]
                ts = ' '.join(ts)
                dt = datetime.strptime(ts, '%Y/%m/%d %H:%M:%S').replace(tzinfo=timezone.utc)
            elif syslog_re.match(line):
                ts = line[:15]
                dt = datetime.strptime(f"{now_year} {ts}", '%Y %b %d %H:%M:%S').replace(tzinfo=timezone.utc)
            else:
                raise ValueError("no timestamp")
            parsed.append((dt, line))
        except Exception as e:
            bad.append((line, str(e)))
    for l, err in bad:
        print(f"Malformed line skipped: {l} -> {err}", file=sys.stderr)
    parsed.sort(key=lambda x: x[0])
    return [line for _, line in parsed]

**Explanation & Complexity**- Tries formats in order of specificity. Assumes naive timestamps are UTC for simplicity in SIEM ingestion; adjust timezone parsing if needed.- Time: O(n log n) due to sort. Space: O(n).- Edge cases: leap seconds, different timezones, ambiguous syslog year rollover (Dec->Jan) — could compare to ingestion time and adjust year if future date appears.

EasyTechnical

59 practiced

After completing a PIR with ten recommended corrective actions, describe a practical, risk-based method to prioritize those actions for implementation. Include considerations such as impact, likelihood, cost/effort, dependencies, detection improvements, compliance obligations, and balancing short-term containment with long-term fixes.

MediumTechnical

70 practiced

A vendor that manages part of your authentication stack reports a breach. Describe how you would run the post-incident analysis for your organization: what evidence you would request from the vendor, how you would verify their claims, how to assess your exposure, what compensatory controls to deploy immediately, and criteria for continuing or terminating the vendor relationship.

Sample Answer

**Situation & objective**I would treat this as a high-priority third‑party incident: determine vendor compromise scope, verify vendor claims, quantify our exposure, and rapidly implement controls to protect users and systems.

**Evidence to request from vendor**- Incident timeline, root cause analysis, IOC list (IPs, domains, hashes), affected systems, affected user lists, auth logs, access tokens/keys potentially exposed, ingress/egress logs, patching status, containment steps, audit trail of privileged actions, and evidence of forensic collection (hashes, chain-of-custody).

**How to verify their claims**- Cross-check vendor IOCs against our SIEM/IDS, authentication logs, and cloud audit logs.- Validate timelines with our telemetry (login anomalies, token use, IP correlations).- Request signed forensic reports from independent firm if vendor’s artifacts or procedures seem insufficient.- Use packet captures, MFA logs, and token revocation records to corroborate.

**Assessing our exposure**- Map vendor-managed components to our auth flow (SSO, token issuance, credential stores).- Identify affected principals (service accounts, users), sessions, and systems.- Query for anomalous logins, privilege escalations, API calls, and lateral movement indicators.- Estimate data access: PII, credentials, session tokens.

**Immediate compensatory controls**- Force rotate/revoke credentials, tokens, and client secrets the vendor could access.- Enforce step-up MFA and block suspicious geo/IP ranges.- Apply conditional access policies (deny legacy auth, require compliant devices).- Isolate impacted systems, increase logging/retention, enable real‑time alerting for vendor-related IOCs.- Engage legal/communications and notify stakeholders per breach plan.

**Criteria to continue or terminate vendor**- Continue if vendor provides timely, verifiable forensics, full containment, remediation plan, and compensating controls; plus contractual SLA/insurance covers losses and they accept external audit.- Terminate if they delay, provide inconsistent evidence, fail to remediate, had preventable controls missing (e.g., lack of MFA, poor key management), or violate contract clauses. Maintain a risk-based migration plan and ensure data recovery/portability.

**Lessons & next steps**- Conduct tabletop, update vendor risk assessments, tighten SLAs and audit rights, and implement stronger segmentation and defense-in-depth for any third‑party auth dependencies.

MediumTechnical

52 practiced

Explain how you would convert incident findings into prioritized policy or process changes that feed back into the enterprise risk assessment. Describe how you would quantify risk reduction attributable to changes, what governance you'd use to approve policy updates, and how to ensure changes are operationalized across engineering and operations teams.

Unlock Full Question Bank

Get access to hundreds of Post Incident Analysis and Improvement interview questions and detailed answers.

Join thousands of developers preparing for their dream job.