QuestionCONSTRUCTEDMembers
Interview prep: the first fifteen minutes of a ransomware call at 02:10
The senior incident response question. It tests order under pressure, what you will not do, and whether you know which decisions are yours to make.
senior levelir processa spoken answer of about 4 minutes
The question
“You are on call. At 02:10 a file server's shares start filling with files ending in .locked. Talk me through your first fifteen minutes.”
What they are listening for
Order: contain without destroying evidence, protect backups, find the source; restraint about restoring, rebooting and negotiating; and knowing which calls belong to legal, the insurer and the business rather than to you.