Skip to content
AI Security

Interview question · Security Foundations & Threat Modeling

Walk through the incident response lifecycle using a leaked API key as the example.

Most candidates start by deleting the commit. The key was copied the minute it went public; the clock starts with revocation.

easyEssentialNewPreparation tags: Amazon, Google, CrowdStrikeUpdated Nov 2026

Most candidates start by deleting the commit. The key was copied the minute it went public; the clock starts with revocation.

Make your first attempt

What would you say before reading the answer?

  1. 01 State the assumptions your answer depends on.
  2. 02 Explain the mechanism and choose a control.
  3. 03 Name a condition that would change your decision.

The worked answer includes an approach, scoring criteria and follow-up questions. Compare the reasoning with your own.

signing in unlocks more free answers per topic

What if · the follow-ups in this answer

The answer works through 6 follow-ups like an interviewer would

A developer pushes a cloud API key with broad permissions to a public GitHub repository, and an automated alert fires within minutes.

  1. What are the incident response phases?
  2. What do you do immediately?
  3. How do you analyse what happened?
  4. How do you eradicate and recover?
  5. What lessons should follow?
  6. How would you run the incident?

Each rung has a nudge, a model answer, the principle that carries over and the weak answer to avoid. Sign in free to open it.

UP NEXT ON YOUR JOURNEY
Next in this trackThreat-model a password-reset flow.Next in this trackHow do attack trees and kill chains help in threat modelling, and where do they mislead?Next in this trackWhy does STRIDE need adapting for ML components, and how would you adapt it?
DISCUSSION · 0

No comments yet. Share a correction or a different way to answer it.