Incident Response and Forensics, Interview Questions.

Preparation; detection and analysis; containment, eradication and recovery; post-incident activity. Preparation (plans, tooling, contacts, practice) decides how well the rest goes.

A documented set of roles, severity levels, procedures, communication paths and decision rights. The team usually has an incident commander, analysts, forensics, IT and system owners, legal, HR, communications and an executive sponsor.

Collect the most volatile evidence first: CPU registers and cache, memory (RAM), network state and connections, running processes, disk, remote logs and backups. Memory and live connections vanish on reboot, so capture them before shutting a machine down.

A record of who collected, handled and stored evidence, when, and how its integrity was preserved (hashes, sealed storage, access logs). It supports admissibility in legal or HR proceedings.

Containment stops the spread (isolate hosts, disable accounts). Eradication removes the attacker's foothold and cause (malware, persistence, vulnerability). Recovery restores services safely and monitors for return.

A bit-for-bit copy of storage. Analysts work on the copy, verified by hash, and use a write blocker on the original so nothing is changed during acquisition.

By impact (data, systems, safety, regulatory), scope (number of assets and users), and urgency (active attacker, spread). Define levels with response times and escalation paths in advance, and allow re-grading as facts change.

Memory image, running processes and connections, event logs (Security, System, PowerShell, Sysmon), autoruns and scheduled tasks, prefetch and Amcache, registry hives, browser history, the file system timeline (MFT), and the suspicious files with hashes. Use trusted tooling and record every action.

Volatile data (processes, connections, logged-in users), auth and system logs, shell histories, cron and systemd units, SSH authorized keys, recently modified files, loaded modules, and a disk or memory image if warranted.

# quick triage view of a Linux host (read only)
ps auxf
ss -tulpn
last -a | head -20
find / -xdev -mtime -2 -type f 2>/dev/null | head -50

Review sign-in logs and mailbox audit data, forwarding and inbox rules, OAuth consents, sent items to finance contacts, and look-alike domains. Reset credentials, revoke sessions, alert finance and the bank to recall funds quickly, and notify affected partners.

A discussion-based drill where the team walks through a realistic scenario to test plans, roles and communication without touching systems. Findings become action items. Run them at least yearly with executives included.

Rebuild when attacker access reached kernel or administrator level, persistence is unknown, or integrity cannot be proven. Cleaning is only reasonable for contained, well-understood commodity malware. Rebuilding from a known-good image is usually safer and often faster.

Initial access, credential theft, discovery, lateral movement, data theft, backup destruction, then encryption. Defences: MFA and patched edge devices, EDR, tiered admin, segmentation, offline or immutable backups tested for restore, and detection for mass file changes and shadow copy deletion.

Who speaks to whom and when: internal updates, executives, customers, regulators, law enforcement, media. Use pre-approved templates, a single source of truth and a fixed cadence. Avoid speculation, and have an out-of-band channel in case email is compromised.

Collect timestamps from file systems, logs, memory and network sources, convert to UTC, document timezone and skew per source, and merge into a super timeline. Cross-check with independent sources, and flag anything that depends on a single clock.

Acquire memory, then list processes and parent-child relations, look for hidden or injected code, network sockets, command lines, loaded modules and credential material, and extract malware for analysis. Compare against a known-good baseline. Volatility-class tools support this.

Preserve audit logs immediately (they may have short retention), snapshot affected resources, revoke tokens and keys, review role assumptions and new identities, identify data access via storage and database logs, and use provider support if needed. Build cross-account forensic access before you need it.

Notification deadlines (for example GDPR 72 hours to the authority; CERT-In 6 hours for specified incident types in India; sector rules for finance and health), privilege over investigation reports, evidence handling, contracts with customers, and cyber insurance conditions. Engage counsel early and keep a decision log.

Within days, gather the timeline, ask how the system allowed it rather than who failed, separate contributing factors from root cause, list what worked, and set owned, dated actions. Share lessons widely and track actions to completion.

Watching can reveal scope and tooling, but it risks more damage and data loss. Decide with the incident commander and leadership: if sensitive data is actively leaving or destructive actions are likely, contain now. If scope is unknown and risk is manageable, a short, controlled observation with a prepared eviction plan can make eradication complete.

No attacker activity after credentials, keys and tokens are rotated, persistence removed, vulnerabilities fixed, hosts rebuilt, and enhanced monitoring in place for a defined period. Hunt for known attacker infrastructure and behaviours during that window.

Open an incident, appoint a commander, confirm facts without alarming speculation, preserve logs and evidence, restrict the suspected access path, assemble legal, communications and IT, set a briefing cadence and start scoping the data and period. Record decisions and timestamps.

Assess for other backup copies (offline, immutable, cloud, vendor), engage specialists, avoid reconnecting anything to the network until clean, prioritise rebuilding identity and critical services, evaluate data theft, and handle the payment question as a business and legal decision, not a technical one.

Keep the circle small, involve HR and legal, preserve logs (endpoint, cloud, repository, USB, email) without alerting the person, establish what left and when, secure access, and let HR and legal lead any interview or action.

Rotate every shared secret and revoke their access, review logs for their activity, assess what data they hold, check contract notification terms, and decide on continued service. Add vendor risk checks and scoped access.