Skip to content
AI Security

Interview question · Detection Engineering & Incident Response

A cloud server's CPU is pegged and you find a cryptocurrency miner. Walk through your response.

The miner is the symptom. The incident is how it got there and what else the attacker could reach. Interviewers watch whether you stop at killing the process or follow the entry point and the credentials.

mediumNewPreparation tags: Google, Amazon, CrowdStrikeUpdated Nov 2026

The miner is the symptom. The incident is how it got there and what else the attacker could reach. Interviewers watch whether you stop at killing the process or follow the entry point and the credentials.

Make your first attempt

What would you say before reading the answer?

  1. 01 State the assumptions your answer depends on.
  2. 02 Explain the mechanism and choose a control.
  3. 03 Name a condition that would change your decision.

The worked answer includes an approach, scoring criteria and follow-up questions. Compare the reasoning with your own.

signing in unlocks more free answers per topic

What if · the follow-ups in this answer

The answer works through 6 follow-ups like an interviewer would

Cloud bills spike and GPU instances appear in an account running a cryptocurrency miner, and an engineer proposes terminating them.

  1. Why is the miner more than a nuisance?
  2. How do you contain without destroying evidence?
  3. How did the attacker get in?
  4. What if leaked access keys launched the instances?
  5. How do you recover?
  6. How would you run the response?

Each rung has a nudge, a model answer, the principle that carries over and the weak answer to avoid. Sign in free to open it.

UP NEXT ON YOUR JOURNEY
Next in this trackRansomware is spreading through your network. Walk through the first hours, the recovery, and the decisions leadership will face.Next in this trackWhat are the basics of digital forensics in an incident: order of volatility, evidence handling and what each artefact tells you?Next in this trackA standard user account suddenly appears in the Domain Admins group. How do you investigate how it happened and what else changed?
DISCUSSION · 0

No comments yet. Share a correction or a different way to answer it.