Incident responders lead the technical handling of confirmed incidents such as ransomware, account takeover and data theft. They scope the attack, contain systems, collect forensic evidence, build timelines, coordinate with IT, legal and management, and write reports with lessons learned. The role needs strong Windows and Linux knowledge, calm communication and an understanding of CERT-In and DPDP reporting obligations. They also improve playbooks after each case.
Digital forensics Memory analysis Containment planning Timeline building Incident reporting
Solved for this roleStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
How do you find stale and privileged accounts in Active Directory with PowerShell?
Silent log gaps create blind spots where attacks go undetected, and they can also break compliance. Raise it as a priority issue, check the forwarder or agent health, network path, licence limits and parsing errors, and restore ingestion. Check whether the gap overlapped any suspicious activity. Then add log source health monitoring that alerts when expected volume drops, so gaps are found in hours, not days.
MITRE ATT&CK is a public knowledge base of adversary tactics and techniques observed in real attacks, organised in matrices for Enterprise, Mobile and ICS. Tactics are the goal, such as Persistence, and techniques are the method, such as T1053 Scheduled Task. Teams use it to map detection coverage, write threat-informed detections, plan red and purple team exercises, and describe incidents in a common language.
04
A guest Wi-Fi user can reach internal printers. What is wrong and how do you fix it?
Guest traffic is not properly isolated, likely because the guest SSID shares a VLAN with internal devices or the firewall allows inter-VLAN routing. Fix by placing guests on a separate VLAN with internet-only access, applying ACLs that deny all RFC 1918 internal ranges, and enabling client isolation on the wireless controller. Then test from a guest device and document the design.
05
A finance employee transferred money after a fake email from the CEO. What do you do?
Contact the bank immediately to try to stop or recall the transfer; speed matters most. Report to the cybercrime portal and police. Investigate the email: was the CEO mailbox compromised or spoofed? Check sign-in logs, forwarding rules and other targeted staff. Reset credentials, enforce MFA and DMARC, and add a call-back rule for payment changes. Include legal and management throughout.
06
Developers share one admin account for a production database. What do you propose?
Shared accounts break accountability and are hard to rotate. Give each person an individual named account with least privilege, and provide admin access through PAM with just-in-time approval and session recording. Store the remaining break-glass credential in the vault with alerts on use. Use read-only roles for daily troubleshooting. Roll out with the team so it does not slow urgent fixes.
Threat hunting is proactive searching for attackers who evaded existing detections. Hunters start from a hypothesis, for example that attackers use scheduled tasks for persistence, then query EDR and SIEM data to confirm or reject it. Findings become new detection rules. Hunting requires good data retention, knowledge of normal behaviour and frameworks like MITRE ATT&CK to guide hypotheses.
08
How would you design a joiner, mover, leaver process for a growing company?
JML is the identity lifecycle. Joiners get accounts and baseline access from HR data on day one. Movers change roles, and their old access must be removed, not just new access added, to avoid privilege creep. Leavers must be disabled promptly, ideally automatically when HR records their exit. Automating JML from the HR system to the identity platform reduces orphan accounts, which auditors frequently flag.
09
How do you create a forensic disk image and verify it?
Use a write blocker or a forensic tool, image the whole disk, and hash both source and image.
sudo dc3dd if=/dev/sdb of=/evidence/case12.img hash=sha256 log=/evidence/case12.log
sha256sum /evidence/case12.img
Record the hashes, time, examiner and device details in the chain of custody form. Analyse a working copy, never the original.
10
How do you collect basic triage data from a suspected compromised Windows host?
Collect volatile data first, ideally with EDR live response or a trusted triage tool. Useful built-in commands:
tasklist /v
netstat -ano
schtasks /query /fo LIST /v
wmic service get name,pathname,startmode
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run
wevtutil epl Security C:\IR\security.evtx
Save output to external media and hash every file.
Common attacks are password spraying, Kerberoasting, which requests service tickets for accounts with SPNs and cracks them offline, AS-REP roasting on accounts without pre-authentication, pass-the-hash, DCSync to pull password hashes, and abusing misconfigured ACLs and delegation. Defences include long random service account passwords or gMSAs, tiered admin models, LAPS for local admin passwords, Protected Users group and monitoring ticket requests.
Pick a realistic scenario, such as ransomware on a weekend, and invite IT, security, legal, communications and business leaders. A facilitator releases injects step by step, like a ransom note appearing or a journalist calling, and participants explain decisions using the real plan. Record gaps in contacts, authority, backups and reporting timelines. Share findings and track fixes, and repeat at least twice a year.
PAM protects powerful accounts like domain admins, root, database admins and cloud owners. It includes a vault for credentials with automatic rotation, just-in-time elevation, session brokering with recording, approval workflows and alerts on unusual use. Tools include CyberArk, BeyondTrust and Delinea. PAM is important because attackers aim for privileged credentials to move laterally and deploy ransomware across the network.
14
Which cloud logs are essential for security monitoring?
Essential sources are control plane audit logs such as AWS CloudTrail, Azure Activity Log and Entra sign-in logs, and Google Cloud Audit Logs. Add network flow logs, DNS logs, load balancer and WAF logs, storage access logs for sensitive buckets, and Kubernetes audit logs. Send them to a central account or SIEM that workload owners cannot delete, and enable threat detection services like GuardDuty.
15
Attackers bypassed MFA by sending repeated push notifications until a user approved. How do you prevent this?
This is MFA fatigue. Enable number matching and show app and location context in push requests, limit the number of prompts, and alert on repeated denials. Move high-risk users and admins to phishing-resistant methods such as FIDO2 keys or passkeys. Train users to report unexpected prompts. Also revoke the attacker's sessions and review what they accessed.
16
What is threat intelligence and what are IOCs and TTPs?
Threat intelligence is analysed information about adversaries, their tools and behaviour. Indicators of Compromise are artefacts like malicious IPs, domains and file hashes; they are easy to use but change quickly. TTPs, tactics, techniques and procedures, describe how attackers operate, and are harder for attackers to change. The Pyramid of Pain shows that detecting TTPs causes attackers more cost than blocking hashes.
17
Tell me about a time you had to say no to a senior person's access request.
Situation: a senior manager asked for permanent admin rights on production to speed up reports. Task: protect production without blocking the work. Action: I explained the audit and breach risk, then offered a read-only reporting role and a scheduled export within a day. Result: the manager got the data faster than before, and the audit later had no finding on that system.
18
You find a web shell on a public web server. What steps do you take?
Do not just delete it. Capture the file, web logs and a memory image if possible, then identify when it was created and which request uploaded it. Search logs for commands executed through it and lateral movement from the server. Contain by isolating the server or blocking the path at the WAF, then patch the vulnerable application, rebuild from a clean image and rotate any credentials stored on it.
19
A ransomware attack has encrypted 50 servers. Walk through your response.
Activate the incident plan and set up a war room with a separate communication channel. Contain by isolating affected segments, disabling compromised accounts, and blocking known command and control. Preserve evidence from a few hosts. Identify initial access and scope, including data theft. Verify offline backups, rebuild from clean images, and restore by business priority. Report to CERT-In within six hours and involve legal before any ransom discussion.
20
Your company is acquiring another firm with its own Active Directory. How do you approach identity integration securely?
Start with assessment: their AD health, privileged accounts, trust relationships, MFA coverage and any signs of compromise. Avoid creating a full two-way forest trust early, as it can import their risks. Prefer bringing users into your cloud identity provider with B2B access or migration, with conditional access. Reset privileged credentials, apply your tiering model, and migrate application by application.
Important metrics are mean time to detect, mean time to respond, alert volume per analyst, false positive rate per rule, percentage of alerts closed within SLA, detection coverage against priority ATT&CK techniques and log source health. Metrics should drive improvement, not punish analysts. For example, a rule with 95 percent false positives should be tuned, and long response times may point to missing automation.
22
You find an application storing user passwords as unsalted MD5. What do you recommend?
MD5 is fast and broken, so these hashes can be cracked quickly if leaked. Recommend Argon2id or bcrypt with proper cost settings. To migrate without forcing resets, wrap existing hashes: compute Argon2id over the MD5 value now, and on next login replace it with a direct Argon2id hash of the password. Also check whether the database was ever exposed, and enforce MFA.
23
A scan shows an S3 bucket with customer documents is publicly readable. What do you do?
Block public access on the bucket immediately and confirm with the owner whether any public access was intended. Check access logs and CloudTrail data events, if enabled, to see who downloaded files and when. If personal data was accessed, start the incident and breach notification process with legal. Then enable account-level block public access, add a preventive guardrail and alert on policy changes.
24
Tell me about a time you improved a process with automation.
Situation: our team checked cloud accounts manually every week for public buckets, which took hours. Task: make it faster and continuous. Action: I wrote a small script using the cloud CLI, scheduled it, and sent findings to a team channel with owner tags, then moved it into the CSPM tool. Result: checks ran hourly and average exposure time dropped from days to under an hour.
25
How would you build a forensic timeline of an incident?
Collect timestamps from many sources: Windows event logs, file system MFT records, prefetch, browser history, EDR telemetry, proxy, firewall and cloud logs. Normalise all of them to UTC, then merge them using tools like Plaso and Timeline Explorer. Mark key points such as initial access, privilege escalation, lateral movement and exfiltration. The timeline drives scoping, root cause and the incident report.
Short-term containment stops the spread quickly, for example isolating hosts through EDR, disabling accounts, blocking IPs or domains and segmenting networks. Long-term containment keeps business running while preparing clean systems, such as rebuilding servers in a separate network. Responders must balance speed with evidence preservation and avoid alerting a sophisticated attacker too early if they need to understand the full scope.
27
What is the difference between OAuth 2.0 and OpenID Connect?
OAuth 2.0 is an authorisation framework; it lets an app get an access token to call an API on a user's behalf, without the user's password. It does not define who the user is. OpenID Connect adds an identity layer with an ID token, a signed JWT containing user claims, and a userinfo endpoint. Use OIDC for login, and OAuth access tokens for API authorisation.
28
What are India's CERT-In incident reporting requirements?
Under the CERT-In directions issued in April 2022, service providers, intermediaries, data centres and body corporates must report specified cyber incidents to CERT-In within six hours of noticing them. They must also keep ICT system logs for 180 days within India and synchronise clocks with NTP servers of NIC or NPL. Reportable incidents include ransomware, data breaches, and attacks on servers and cloud systems.
29
How would you use Sysmon to improve endpoint visibility on Windows?
Sysmon is a free Microsoft Sysinternals tool that logs detailed endpoint events to the Windows event log. Useful events are ID 1 process creation with hashes and command line, ID 3 network connection, ID 11 file creation, ID 13 registry changes and ID 22 DNS queries. With a tuned configuration, it gives rich telemetry for SIEM detections when a full EDR is not available or as an extra source.
Start with admins and remote access, then high-risk groups like finance. Pick methods, preferring authenticator app number matching and passkeys or FIDO2 keys for admins. Pilot with one department, prepare helpdesk scripts and self-service registration, and communicate clearly with deadlines. Use conditional access in report-only mode to find gaps, then enforce. Block legacy authentication and track registration rates weekly.
31
Describe a time you worked under pressure during an incident.
Situation: during a phishing campaign, 40 users received a credential-harvesting email on a Friday evening. Task: contain it before attackers used stolen accounts. Action: I purged the email across mailboxes, identified six users who clicked, reset their passwords, revoked sessions and blocked the domain, while updating my lead every 30 minutes. Result: no account misuse was found and the playbook was updated.
CSPM, Cloud Security Posture Management, checks cloud configurations against benchmarks like CIS and flags risks. CWPP, Cloud Workload Protection Platform, protects running workloads such as VMs, containers and serverless with vulnerability scanning and runtime detection. CNAPP combines these with identity analysis, IaC scanning and attack path analysis in one platform. The goal is to prioritise risks that combine, like a public VM with a critical flaw and admin role.
33
What is the order of volatility in evidence collection?
Collect the most volatile evidence first because it disappears quickly. The order is CPU registers and cache, memory including running processes and network connections, temporary files, disk, remote logs, and finally archived media. That is why responders capture RAM before shutting down a machine, since malware running only in memory, decrypted keys and active connections are lost at power off.
34
Which Windows event IDs should a SOC analyst know?
Key Security log events are 4624 successful logon, 4625 failed logon, 4672 special privileges assigned, 4688 process creation, 4720 user created, 4728 and 4732 user added to privileged groups, 4740 account lockout, 1102 audit log cleared, 4698 scheduled task created and 7045 service installed in the System log. Logon type in 4624, such as 3 for network and 10 for RDP, adds important context.
35
How do you analyse a memory dump with Volatility 3?
Run plugins to list processes, network connections and injected code, then dig into suspicious items.
vol -f mem.raw windows.info
vol -f mem.raw windows.pstree
vol -f mem.raw windows.netscan
vol -f mem.raw windows.cmdline
vol -f mem.raw windows.malfind
Look for unusual parent-child processes, processes in odd paths and connections to unknown IPs.
36
What is a man-in-the-middle attack on TLS and how do certificates prevent it?
In a MITM attack, an attacker intercepts traffic and pretends to be the server. Certificates prevent this because the client checks that the server certificate chains to a trusted root, matches the hostname and is valid. An attacker cannot produce a valid certificate without the private key or a compromised CA. Certificate warnings that users click through, and apps that skip validation, break this protection.
37
How would you implement just-in-time privileged access in the cloud?
Remove standing admin roles. Make users eligible for roles through a PIM or PAM tool, so they request activation with justification, MFA and optional approval, for a limited time like two hours. Log every activation and alert on unusual ones. For automation, use workload identities with narrow roles instead of admin keys. Review eligible assignments quarterly to keep the list small.
38
An audit finds 200 active accounts belonging to employees who left. How do you fix it?
Disable the accounts immediately after confirming with HR, then check each for recent logins, since any use after the exit date is a potential incident. Find the root cause, usually manual offboarding or apps not connected to SSO. Integrate the HR system with the identity platform for automatic disabling, connect apps to SSO and SCIM provisioning, and run monthly orphan account reports.
Sigma is a generic YAML detection format that converts to SIEM queries.
title: Office Spawning PowerShell
logsource:
product: windows
category: process_creation
detection:
selection:
ParentImage|endswith: ['\winword.exe', '\excel.exe']
Image|endswith: '\powershell.exe'
condition: selection
level: high
tags: [attack.execution, attack.t1059.001]
40
How do you write a Splunk search to find brute-force attempts on Windows?
Search failed logon events, count per account and source, and filter high counts.
index=wineventlog EventCode=4625
| stats count AS failures dc(TargetUserName) AS users BY IpAddress
| where failures > 50
| sort - failures
A high distinct user count from one IP points to password spraying rather than a single account brute force.
Frequently asked questions
What does a Incident Response Analyst do?
Incident responders lead the technical handling of confirmed incidents such as ransomware, account takeover and data theft. They scope the attack, contain systems, collect forensic evidence, build timelines, coordinate with IT, legal and management, and write reports with lessons learned. The role needs strong Windows and Linux knowledge, calm communication and an understanding of CERT-In and DPDP reporting obligations. They also improve playbooks after each case.
Which skills are tested in a Incident Response Analyst interview?
Expect questions on Digital forensics, Memory analysis, Containment planning, Timeline building, Incident reporting. Most rounds also ask you to explain a project and solve one practical problem live.
How do I prepare for a Incident Response Analyst interview?
Revise Incident Response and Forensics, SOC Operations and SIEM, Identity and Access Management first using the topic sheets, practise the questions on this page aloud, then do one full mock interview to practise timing.