Tools / Cyber Security Interview Questions
How do you troubleshoot a suspected data breach in its early stages?
- Confirm the indicator is real by checking logs, alerts, and system behavior rather than acting on assumption
- Establish a timeline by determining when the suspicious activity started and what systems were touched
- Isolate affected systems from the network to stop further spread, without powering them off if memory forensics may be needed
- Preserve evidence, including logs, memory dumps, and disk images, before making further changes
- Identify the initial entry point and scope, checking for lateral movement, privilege escalation, and data exfiltration
- Notify the incident response team and relevant stakeholders per the organization's breach response plan
Acting too fast, like immediately wiping a compromised server, can destroy the forensic evidence needed to understand what actually happened and whether the attacker is still present elsewhere in the environment.
Why should you avoid immediately wiping a compromised server?
What should be preserved before making further changes to affected systems?
More Related questions...
