containment

GPU hosts attract cryptominers and hold valuable weights and data. The scored answer contains without destroying evidence, scopes across the fleet, and rebuilds rather than cleans.

The miner is the symptom. The incident is how it got there and what else the attacker could reach. Interviewers watch whether you stop at killing the process or follow the entry point and the credentials.

Design response automation when a remote action may have succeeded despite a lost reply. Preserve target identity, approval scope and audit evidence while reconciling the result.

Contain affected authority, preserve evidence in parallel and reconcile actual effects. Work through shared inputs, queued jobs, uncertain outcomes and a tested path back to useful service.

Contain financial actions and reconcile provider state in parallel. Work through a synthetic exposure table, uncertain dispatch, cancellation limits and the evidence needed for a controlled restart.

The leak is in the weights, so the playbook differs from a database breach. The scored answer confirms, contains at the output, scopes from data lineage, and decides between filtering, retraining and withdrawal.