detection

Most candidates start by deleting the commit. The key was copied the minute it went public; the clock starts with revocation.

Kernel exploits make headlines; misconfigured services, impersonation and stored credentials do the work. The scored answer groups escalation into classes and attaches a control and a detection to each.

Interviewers ask for the protocol first because every AD attack is a protocol property used against you. The strong answer derives each attack from a step in the ticket flow, then attaches the control that breaks it.

You cannot read the payload, but you can see who talked to whom, when, how much and how often. That metadata catches beaconing, exfiltration and lateral movement, if you know what normal looks like.

The attacker never needs the password: the victim grants their app access. The scored answer explains why MFA does not help, then controls consent at the tenant and watches the grants.

Stolen session tokens skip MFA entirely, which is why infostealers sell them. The scored answer looks for the same session appearing in two places, binds what it can, and makes revocation fast.

A practical round that tests clean code and detection judgement together. The scored answer parses defensively, picks a signal that separates stuffing from a forgetful user, and names what it misses.

Training clusters hold the data and the weights, and run code from hundreds of dependencies. Default-deny egress is the control that holds when everything else is fooled.

Many ML tools assume they run on a trusted network and offer 'run this code' as a feature. Put them on the internet and that feature is remote code execution.

Cloud attackers mostly use the same APIs your engineers do. The scored answer collects the right logs, writes detections for attacker behaviour, and keeps the logs out of the attacker's reach.

Three words every SOC uses and many candidates blur. The answer that scores defines each by what it obliges you to do, and names the decision that turns an alert into an incident.

The process tree tells most of the story in five minutes. Interviewers want an order of questions, the evidence for each, and a clear point at which you contain rather than keep looking.

Process creation with full command line and parentage answers more questions than any other event. The rest of the answer is about the next five sources, how sensors collect them, and what attackers do to blind them.

Inbound is blocked, so the compromised host calls out. That single design choice tells defenders where to look: unusual parents spawning shells with network connections, and regular outbound traffic to places nobody else visits.

A hunt is a testable hypothesis about an attacker your detections missed. Without one, it is just browsing logs. The output that justifies it is usually a new detection, not a captured attacker.

Hash lookups catch yesterday's file. A good rule targets what the family cannot easily change, and gets tested against a corpus of clean files before anyone trusts it.

A logging pipeline is a distributed system with a threat model: attackers want it blind, analysts want it fast, finance wants it cheap. The staff answer designs for all three and for the day the queue backs up.

The first half is a Counter. The follow-up, an infinite stream and a memory cap, is the actual question: interviewers want a heavy-hitters algorithm and an honest statement of what it guarantees.

Malware is just software that does what its operator wants on your machine. Every stage leaves evidence, and every stage has a control that can stop it.

Crypto miners steal your compute. LLMjackers steal your model quota and resell it, and the first alert is often the bill.

An expert question that rewards calibration. The scored answer separates what works now (probes and feature monitors as signals) from what does not (proofs of safety), and says where it fits in a defence.

Design signals that distinguish suspicious inputs, unauthorized proposals, blocked operations and confirmed exposure. Test response timing, evidence handling and monitoring health.

Interpret a canary hit using placement, known copies, audience and delivery evidence. Separate a local marker check from an active callback and from complete leak prevention.

Use the seven-stage research framework without forcing every incident through every stage. Work a partial trace, model alternate paths and separate stored state from observed downstream influence.

Connect task authority, evidence, dispatch attempts and observed effects. Learn what references, hashes and signed logs can establish, and test collection gaps without overcollecting sensitive data.

Trace field origin through telemetry, summaries and response proposals. Preserve evidence, verify current targets and playbooks, and test both missed threats and harmful containment.

Design investigation, response policy and execution with distinct authority. Build an action matrix, handle failed dependencies and tenant boundaries, and evaluate useful work alongside missed incidents and wrongful containment.

Compare actions with current grants and policy, distinguish unusual behavior from violations, and handle legitimate task revisions. Verify observation coverage and respond to the affected operation.

The API is the attack surface and every response is a training example. Prevention is unrealistic; slowing, limiting and noticing are not.

Detection alone loses: clean-label poisons look correct. The answer that scores builds a pipeline where poison is hard to add, easy to trace and contained when it slips through.

Drift is the world changing. An attack is someone changing it on purpose. The evidence that separates them is where and how the errors cluster.

Hiding scores slows attackers down; it does not stop them. The scored answer explains decision-based search and transfer, and turns query patterns into a detection opportunity.

A watermark is evidence of origin under conditions, not a detector of all AI text. The scored answer explains how it works, how it fails, and what claims it can support.

Separate a suspicious signal, a verified effect and a causal hypothesis. Then contain the real path, scope exposure and record what is still unknown.

Design records for identity, context provenance, authorization and actual effects. Include missing-event coverage and a protected way to retrieve evidence.

Define the asset and prohibited use before scoring traffic. Distinguish imitation, partial extraction and credential compromise, and test signals against legitimate workloads.

Preserve the source and limits of each signal, verify model claims and bind response actions to exact targets. A passing authentication result does not prove benign mail.