Skip to content
AI Security

Interview question · Detection Engineering & Incident Response

Ransomware is spreading through your network. Walk through the first hours, the recovery, and the decisions leadership will face.

Encryption is the last stage of a ransomware attack, not the first. The strong answer contains spread fast, protects backups and identity systems, and knows that recovery depends on choices made months earlier.

hardEssentialNewPreparation tags: CrowdStrike, Microsoft, Palo Alto NetworksUpdated Nov 2026

Encryption is the last stage of a ransomware attack, not the first. The strong answer contains spread fast, protects backups and identity systems, and knows that recovery depends on choices made months earlier.

Make your first attempt

What would you say before reading the answer?

  1. 01 State the assumptions your answer depends on.
  2. 02 Explain the mechanism and choose a control.
  3. 03 Name a condition that would change your decision.

The worked answer includes an approach, scoring criteria and follow-up questions. Compare the reasoning with your own.

signing in unlocks more free answers per topic

What if · the follow-ups in this answer

The answer works through 6 follow-ups like an interviewer would

Ransomware is encrypting file servers across several sites, and the help desk is getting calls from staff who cannot open files.

  1. What happens in the first hour?
  2. Why protect backups and identity first?
  3. Who else needs to be involved?
  4. How do you recover?
  5. Who decides about paying?
  6. How would you lead the response?

Each rung has a nudge, a model answer, the principle that carries over and the weak answer to avoid. Sign in free to open it.

UP NEXT ON YOUR JOURNEY
Next in this trackWhat are the basics of digital forensics in an incident: order of volatility, evidence handling and what each artefact tells you?Next in this trackA standard user account suddenly appears in the Domain Admins group. How do you investigate how it happened and what else changed?Next in this trackA finance employee's cloud mailbox was compromised and a supplier was asked to change bank details. How do you respond?
DISCUSSION · 0

No comments yet. Share a correction or a different way to answer it.