Security Incident Response and Operations Questions
Covers the practices, processes, and tooling for responding to security incidents and operating a security capability. Topics include the security incident lifecycle of preparation, detection, analysis, containment, eradication, recovery, and post incident review; development and execution of playbooks and runbooks tailored to threat types; severity classification and decision criteria for escalation; evidence preservation and forensic analysis and chain of custody; crisis communication to stakeholders and regulators; notification and regulatory compliance considerations; and coordination with legal, privacy, communications, and executive leadership. Also includes operational aspects of building and staffing a security operations center, on call schedules and escalation, ticketing and case management, leadership and coordination during major incidents, running blameless post incident reviews to identify systemic improvements, and integration of security incident learnings into engineering and operations.
MediumTechnical
57 practiced
During an active incident, engineers from product and security disagree on a containment approach: product wants a quick rollback, security wants to isolate affected hosts which may cause downtime. As the incident leader, describe how you would mediate, decide, and communicate the decision to engineers and executives, and how you would document the rationale post-incident.
MediumTechnical
60 practiced
Describe the process and tools an SRE would use to perform memory forensics on a compromised Linux host: how to acquire a memory image, what volatile artifacts to prioritize (process list, loaded modules, network sockets, credentials in memory), and how to analyze with tools like Volatility or Rekall.
MediumTechnical
69 practiced
Explain the difference between Indicators of Compromise (IOCs) and Tactics, Techniques, and Procedures (TTPs). Provide examples of each and describe how SREs should operationalize IOCs and TTPs differently in a detection program.
HardTechnical
59 practiced
A signing CA in your internal PKI was compromised, allowing attackers to issue valid certificates. As lead, outline emergency response steps: revoke certificates, rotate CA keys, update trust stores, notify service owners, manage OCSP/CRL implications, and ensure clients trust the new root. Describe a deployment strategy to minimize downtime.
EasyTechnical
64 practiced
Explain the security incident response lifecycle stages (preparation, detection, analysis, containment, eradication, recovery, post-incident review). For each stage, provide one concrete SRE-focused action, artifact, or KPI you would expect the team to produce (for example: runbook, alert, forensic snapshot, restore verification).
Unlock Full Question Bank
Get access to hundreds of Security Incident Response and Operations interview questions and detailed answers.
