Security Incident Investigation and Remediation Questions

Focuses on systematic investigation methodology and the distinction between immediate mitigation and long term prevention. Topics include collecting and preserving evidence, establishing a reliable timeline, identifying affected systems, performing root cause analysis, containment versus remediation, and documenting findings. Covers basic digital forensics principles and chain of custody, techniques for reducing blast radius and restoring service as a short term response, and planning permanent fixes to prevent recurrence. Also addresses privacy incident investigation practices such as interviewing stakeholders, assessing regulatory and compliance implications, timeliness and documentation requirements, remediation planning, and using post incident analysis to improve processes and controls.

EasyBehavioral

62 practiced

Use the STAR method to tell me about a time you investigated a security incident end-to-end. Be specific: describe the Situation, the Tasks you were responsible for, the Actions you took (tools, analysis steps, evidence collected), and the Results including remediation, communication to stakeholders, and what you learned.

MediumTechnical

76 practiced

Describe best practices and tools for creating forensic images of different storage types: traditional SATA HDDs, SSDs (including TRIM-related caveats), encrypted disks (BitLocker/LUKS), and remote cloud volumes (EBS, GCP Persistent Disk). Include recommended acquisition steps, verification (hashing), and considerations for live systems or wear-leveling effects.

Sample Answer

**Brief approach / goals**Preserve integrity, minimize alteration, document chain-of-custody, acquire verifiable bit-for-bit images where possible, choose acquisition method per media type.

**1) SATA HDD (spinning)**- Tools: hardware write-blocker + FTK Imager, Guymager, dc3dd, ddrescue for damaged disks.- Steps: connect via write-blocker → record metadata/SMART → image to E01/RAW using dc3dd/Guymager → generate SHA256/MD5.- Verification: compute hashes on source (if non-mounted) and target:

bash

sha256sum /dev/sdX
sha256sum image.E01

**2) SSD (TRIM & wear-leveling)**- Caveats: TRIM may zero blocks asynchronously; wear-leveling makes physical-to-logical mapping different.- Best practice: avoid powered live OS that triggers TRIM; prefer powered-off acquisition. If device seized powered-on and live analysis unavoidable, immediately isolate from networks and stop processes; do memory capture first.- Tools: hardware write-blocker supporting SSD, F-Response (read-only remote), Guymager, dd if needed.- Note: imaging logical device returns current LBA view — deleted/trimmed data may be irrecoverable.

**3) Encrypted disks (BitLocker, LUKS)**- Live capture: capture RAM (e.g., Belkasoft, LiME, Volatility-compatible) to obtain keys if disk unlocked.- If unlocked: image logical decrypted view (e.g., image /dev/mapper/crypt) and also image raw encrypted volume for completeness.- If locked: obtain keys via AD/TPM extraction, recovery passwords, or forensic key escrow. Always preserve header (for LUKS use cryptsetup luksHeaderBackup).- Tools: libbde, dislocker (BitLocker), cryptsetup, FTK Imager.

**4) Remote cloud volumes (AWS EBS, GCP PD)**- Preferred: snapshot-based acquisition to avoid instance alteration.- AWS: create EBS snapshot, copy snapshot, create volume from snapshot and attach to dedicated forensic instance; export snapshot to S3 if needed.- GCP: create persistent disk snapshot, create disk from snapshot, attach to forensic VM.- Document API calls, use immutable snapshots, avoid in-guest imaging unless necessary.- Example AWS:

bash

aws ec2 create-snapshot --volume-id vol-xxxx --description "evidence"

**Verification & hashing**- Use SHA256 (and MD5 for legacy) on image file and store hashes in case notes. For E01 use internal checksums and external sha256sum.- Keep dual copy (air-gapped) and store hashes for both.

**Live-system considerations**- Prioritize volatile data: RAM, network connections, running processes, logs.- Record system time, running processes, open files before shutting down.- When shutting down could break encryption keys—capture memory first if encrypted.

**Wear-leveling / TRIM practical note**- Assume some deleted data on SSDs is unrecoverable; document TRIM status and file system support for TRIM.- Consider forensic recovery specialists with NAND-level acquisition only when legal/technical justification exists.

Final note: document every step, use tested tools, maintains chain-of-custody, and validate images with hashes and tool logs.

HardTechnical

69 practiced

Design a SIEM detection approach for 'low-and-slow' data exfiltration that reduces false positives. Describe feature engineering choices (e.g., bytes-per-day per-user, rare-destination scoring), baselining techniques, anomaly scoring and thresholds, aggregation windows, and how to incorporate analyst feedback or supervised labels to iteratively improve precision.

Sample Answer

**Situation & goal** I’d build a SIEM detection for low-and-slow exfil that maximizes true positives while cutting FP by combining robust baselining, multi-feature scoring, temporal aggregation, and analyst-in-the-loop learning.

**Feature engineering**- Per-entity rates: bytes-per-day-per-user, files-per-day, avg bytes/connection, sessions/day.- Destination context: rare-destination score (org-to-destination frequency percentile), external vs internal, geo/ASN reputation.- Protocols & channels: DNS query length, HTTP POST frequency, TLS SNI anomalies, cloud-storage API patterns.- Change metrics: rolling % delta (7d, 30d) and z-score of bytes and session counts.- Behavioral signals: time-of-day deviation, device-change score, simultaneous multi-host access.

**Baselining techniques**- Use hybrid baselines: exponential-weighted moving average (EWMA) for recent trends + seasonal weekly profile for business cycles.- Maintain percentile windows (50/75/95) per user/group and per-destination to handle skew.- Use robust statistics (median, MAD) to resist outliers.

**Anomaly scoring & thresholds**- Compute normalized sub-scores (0–1) per feature, weight them (e.g., bytes-change 0.3, rare-dest 0.25, time-of-day 0.15, protocol 0.15, multi-host 0.15).- Aggregate to a final threat score; apply adaptive thresholds by role/group: higher sensitivity for privileged accounts.- Use dynamic thresholding: trigger alert when score > T and sustained above T for W window (e.g., 24–72 hours) to avoid one-off spikes.

**Aggregation windows**- Short window (1–4 hours) for session bursts; medium (24–72 hours) for low-and-slow; long (7–30 days) for trend shifts and drift detection.- Require cross-window correlation: elevated medium-window score + unusual long-window trend => escalate.

**Feedback & supervised improvement**- Label alerts (TP/FP/benign) in ticketing/SIEM; feed labels to a lightweight classifier (e.g., logistic regression or XGBoost) to learn feature weights and interactions.- Implement active learning: present borderline cases to analysts for labeling to improve model quickly.- Periodically retrain baselines with decay to incorporate legitimate behavior changes; track precision/recall and tune thresholds per group.- Maintain explainability in UI: show top contributing features so analysts can correct feature importance and reduce future FP.

**Operational notes**- Enrich with threat intel and allow suppression rules for known business tools (backup services).- Monitor concept drift and alert on baseline instability; run quarterly reviews with SOC to adjust weights and windows.

HardTechnical

61 practiced

A breach affects customers across multiple countries with differing data-protection laws and notification requirements. Describe an incident response plan that addresses cross-border evidence preservation, legal holds, jurisdictional constraints, coordination with local law enforcement, and timing of customer notifications while minimizing business disruption and legal exposure.

Sample Answer

**High-level approach (purpose):**Create a legally-aware, technically executable incident response plan that preserves cross-border evidence, respects data-residency and notification laws, coordinates with local law enforcement, and minimizes business/legal exposure while keeping operations as normal as possible.

**Preparation**- Maintain a legal/risk map: for each country, list breach notification timelines, required authorities, data residency rules, and acceptable evidence handling (example: EU GDPR 72-hour guidance; certain APAC countries require local reporting).- Pre-agree MOU with cross-border legal counsel and regional privacy leads.- Maintain playbooks that tie technical actions (EDR isolation, SIEM log export) to jurisdictional requirements.

**Containment & Evidence Preservation**- Triage and segment networks by region to limit blast radius; apply EDR live response to capture volatile data and create disk images.- For each affected jurisdiction: create forensic images, preserving timestamps and hashes; document chain of custody; store copies in encrypted, access-controlled repositories in approved jurisdictions.- Capture SIEM logs, VPN logs, cloud provider logs (with provider-preserved snapshots) and export using APIs to immutable storage.

**Legal Holds & Jurisdictional Constraints**- Trigger legal holds immediately for custodians in affected jurisdictions via HR/legal workflow; preserve mailboxes, devices, backups.- Consult local counsel before transferring personal data across borders—use pseudonymization or store evidence locally when required.- If compelled by foreign law enforcement, route requests through corporate legal and global law-enforcement liaison to evaluate scope and protective measures.

**Coordination with Local Law Enforcement**- Use pre-established points of contact per country; prepare joint briefing packages (timeline, impact summary excluding sensitive tactics).- Offer technical assistance: sanitized forensic reports, indicators of compromise (IOCs).- Maintain records of all requests and disclosures.

**Customer Notification Timing & Messaging**- Map each country’s legal deadline; where laws conflict, prioritize the strictest timelines and consult counsel.- Prepare template notifications that meet local legal content (what, when, mitigation, contact) and use staged notifications: preliminary (high-level) within legal windows, detailed follow-up after investigation.- Employ privacy-preserving alerts (no unnecessary technical detail), provide remediation steps and credit monitoring when appropriate.

**Minimizing Disruption & Legal Exposure**- Use segmented containment to keep unaffected services online.- Limit internal distribution of sensitive forensic details; use need-to-know access.- Document decisions and rationale (timestamped) to show good faith compliance.

**Validation & Post-Incident**- After containment, run tabletop exercises to validate the plan; perform a lessons-learned with legal, regional ops, and security to update playbooks and MOU.

As an analyst I would execute the SIEM/EDR evidence captures, coordinate technical hand-off to forensics, log chain-of-custody, and feed legal with precise timelines and artifacts to enable compliant notifications and LE coordination.

EasyTechnical

135 practiced

You receive a high-severity SIEM alert: many failed logins from several IPs followed by a successful administrator login. Within the first 15 minutes, list the exact triage steps you would perform. Specify the data sources you would check (and in what order), commands/tools to run on host(s), what to capture for evidence, and any immediate containment actions you might take while preserving forensic integrity.

Sample Answer

**First 15-minute triage — ordered steps**

1. Quick confirmation (0–2 min)- Review SIEM alert details: timestamps, source IPs, target host, username, event IDs (Windows: 4625/4624; Linux: sshd failures/success).- Check correlated alerts (EDR, proxy, firewall) for same indicators.

2. Data sources to query (order)- SIEM event timeline (pivot timestamps)- EDR console (processes, live session, detections)- Host logs: Windows Security event log / Linux auth.log- Network logs: firewall, VPN, proxy, IDS/IPS- Authentication service: AD logs, RADIUS/LDAP- Threat intel (IP/domain reputation)

3. Live host commands / tools (capture immediately)- If Windows (via EDR/remote session):

powershell

whoami; query user; quser
Get-EventLog -LogName Security -Newest 50 | where {$_.EventID -in 4624,4625}
netstat -ano | findstr :3389
tasklist /v

- If Linux (via SSH/EDR):

bash

whoami; w
last -n 20
sudo cat /var/log/auth.log | tail -n 200
ss -tunap
ps aux --sort=start_time | head -20

- Memory/process snapshot via EDR; collect running processes, network connections, loaded modules.

4. Evidence to capture- Export relevant event logs (time window ±30 min), EDR artifacts, process lists, network connections, open ports, active sessions, full packet captures if possible, volatile memory snapshot, and a forensic copy of disk if escalation needed. Preserve original timestamps and hashes.

5. Immediate containment (while preserving forensics)- Isolate host on network (quarantine VLAN) via EDR/firewall — do not power off.- Disable compromised admin account or force password reset & revoke sessions (after log capture).- Block offending IPs at perimeter (short-term), and add detection rules.- Document all actions, who approved, timestamps; avoid intrusive actions that erase evidence (e.g., do not clear logs or reboot).

6. Communication & next steps- Notify SOC lead, AD/NetOps, and incident response team; escalate for full investigation and remediation.

Unlock Full Question Bank

Get access to hundreds of Security Incident Investigation and Remediation interview questions and detailed answers.

Join thousands of developers preparing for their dream job.