Skip to content
AI Security

Interview question · Detection Engineering & Incident Response

How does one infostealer infection on a personal laptop become a breach of your company, and what breaks that chain?

Infostealers turned stolen passwords and cookies into a commodity with sellers, buyers and price lists. The scored answer follows the supply chain and cuts it at the points you control.

mediumNewPreparation tags: Microsoft, Google, CrowdStrikeUpdated Nov 2026

Infostealers turned stolen passwords and cookies into a commodity with sellers, buyers and price lists. The scored answer follows the supply chain and cuts it at the points you control.

Make your first attempt

What would you say before reading the answer?

  1. 01 State the assumptions your answer depends on.
  2. 02 Explain the mechanism and choose a control.
  3. 03 Name a condition that would change your decision.

The worked answer includes an approach, scoring criteria and follow-up questions. Compare the reasoning with your own.

10 answers per topic instead of 5, plus saved progress and bookmarks · costs nothingor unlock all 529 remaining answers · $25

Every worked answer in all 17 topics, every lesson in every course, the full concept curriculum, the complete practice-test bank, and the downloadable security field guides.

6 months · One payment · No auto-renewal

What if · the follow-ups in this answer

The answer works through 4 follow-ups like an interviewer would

A threat-intelligence feed reports that a stealer log for sale contains a contractor's session cookie for your single sign-on, saved passwords for three internal apps and a cloud access key. The contractor uses a personal laptop.

  1. What do you do in the first hour?
  2. How do you find out whether anything was already used?
  3. What stops the next contractor log from mattering?
  4. How do you summarise the infostealer risk?

Each rung has a nudge, a model answer, the principle that carries over and the weak answer to avoid. Premium opens every answer and ladder.

UP NEXT ON YOUR JOURNEY
Next in this trackSome malware now asks an AI model what to do at run time. What is real so far, and how should detection and response change?Next in this trackYour SIEM receives normal log volume but stops correlating sensitive reads. How would you investigate?Next in this trackA SOAR containment action times out after approval. What should the playbook do next?
DISCUSSION · 0

No comments yet. Share a correction or a different way to answer it.