Skip to content
AI Security

Interview question · Detection Engineering & Incident Response

A finance employee's cloud mailbox was compromised and a supplier was asked to change bank details. How do you respond?

Resetting the password is step four, not step one. Attackers keep access through sessions, app consents and mailbox rules, and the money moves faster than the investigation.

mediumNewPreparation tags: Microsoft, Google, CrowdStrikeUpdated Nov 2026

Resetting the password is step four, not step one. Attackers keep access through sessions, app consents and mailbox rules, and the money moves faster than the investigation.

Make your first attempt

What would you say before reading the answer?

  1. 01 State the assumptions your answer depends on.
  2. 02 Explain the mechanism and choose a control.
  3. 03 Name a condition that would change your decision.

The worked answer includes an approach, scoring criteria and follow-up questions. Compare the reasoning with your own.

10 answers per topic instead of 5, plus saved progress and bookmarks · costs nothingor unlock all 529 remaining answers · $25

Every worked answer in all 17 topics, every lesson in every course, the full concept curriculum, the complete practice-test bank, and the downloadable security field guides.

6 months · One payment · No auto-renewal

What if · the follow-ups in this answer

The answer works through 6 follow-ups like an interviewer would

A user reports that colleagues and a supplier received strange invoice emails sent from their mailbox, one asking to change bank details.

  1. What are the two urgent priorities?
  2. What does eviction involve beyond a password reset?
  3. How did they get in?
  4. How do you scope what was read and sent?
  5. What prevents a repeat?
  6. How would you handle the incident?

Each rung has a nudge, a model answer, the principle that carries over and the weak answer to avoid. Premium opens every answer and ladder.

UP NEXT ON YOUR JOURNEY
Next in this trackWhat does NIST SP 800-61 Revision 3 change about how incident response is framed, and how would you apply it?Next in this trackYour SOC is drowning in alerts. How do you reduce alert fatigue, and which metrics tell you it is working?Next in this trackYou have 40,000 open vulnerabilities. How do you decide what to fix first, using CVSS, EPSS, KEV and your own context?
DISCUSSION · 0

No comments yet. Share a correction or a different way to answer it.