Questions that actually get asked, each answered three times: good, better and best. The difference between them is the lesson, because most candidates stop at good.
Answer out loud before you open anything. Then read good, better and best in order. The gap between them is nearly always the same three things: the limits of the evidence, a second source, and what you would do next.
Whether you look at the sign-in record's detail rather than the country, know that MFA succeeding does not clear it, and are willing to contain before you are certain when containment is cheap.
Whether you connect a field in a log to a decision: which accounts' credentials are sitting in memory on a compromised host and therefore have to be reset.
Order: contain without destroying evidence, protect backups, find the source; restraint about restoring, rebooting and negotiating; and knowing which calls belong to legal, the insurer and the business rather than to you.
Whether you separate what an artifact records from what people assume it records, and whether you reach for a second source without being asked.
