Cybersecurity drills

Final panel for a SOC analyst seat. An identity alert fired for a privileged account at 02:14. Walk the panel through how you would decide it is real, who you would tell, and what evidence you would want in the ticket before you recommend containment. Do not invent log lines you have not seen.

Closing panel, cloud security. A teammate found a storage bucket with a public listing that holds application logs. Explain the blast radius to the hiring manager, what you would check first, and what you would not claim you already know.

Tabletop: the EDR console shows a finance laptop ran an unexpected script, then connected to an unfamiliar host. You have ten minutes before the shift lead asks for a call. What do you confirm, what do you park, and what would make you escalate to incident response?

Tabletop: a domain-admin session looks stolen. Name the containment options you would put in front of the IR lead, the business impact of each, and the evidence you still need. This is a decision briefing, not a tool walkthrough.

Ninety minutes into a SOC tabletop, the CISO wants a five-sentence update. What belongs in it, what you leave out, and how you say what you do not know yet?

A CI role can read every object store in the production account. Describe the blast radius and the first control you would tighten. Stick to what you can defend in an interview.

An interviewer says the audit trail was off in one region during a deployment. What do you ask before you call it an incident, and which control would you want to see restored first?

Audit asks for evidence that privileged access is reviewed quarterly. What artifact would you show, what gap would you admit if the review was late, and what would you refuse to invent?

A product owner wants a six-month exception for an internet-facing admin panel that is behind on patches. Frame likelihood, impact, a compensating control, and the expiry. This is a governance answer.

Security+-style oral, not an exam item: a user enabled a macro in a document, then their mailbox sent mail they do not remember. Which control failed first, what would you check, and which part of your answer would be guessing?

CISSP-style oral: leadership wants to accept the risk of shared admin accounts on a legacy app. Argue it as a risk decision — accountability, monitoring, and what “accept” has to include. No control dump.

OSCP-style oral, not a lab walkthrough: you were in scope on a test and confirmed a serious misconfiguration. How do you write the finding a client can act on — condition, impact, and evidence — without turning the interview into a demonstration?

A hiring manager asks how you open a pen-test engagement. Talk about written scope, rules of engagement, and what you would refuse to touch. This is an interview answer, not a test plan.

You confirmed a serious misconfiguration that was in scope. Explain condition, impact, and evidence to a client who is not a tester. Do not turn the interview into a demonstration.

The client says the finding is fixed. How do you talk about a retest in the interview — what you would ask to see, what “fixed” has to mean, and what you would not claim from a screenshot alone?

Sector note: a crew is calling IT helpdesks, posing as staff, and asking for VPN MFA resets. No victim is named. Confidence is medium. Nothing here says it is in your environment.

Using only that brief, answer the question a hiring manager should ask next: which helpdesk checks or detections would you propose, what would you tell users, and what would you refuse to claim?

A peer in your sector reported ransomware that started from a compromised vendor remote-access account. They did not share indicators. Leadership forwarded the paragraph and asked whether you are exposed.

Turn the brief into the interview answer: what you can say today, what evidence you would need before naming a threat, and which team you would pull in first.