Cybersecurity Analyst Interview Questions & Incident Scenarios

I follow the NIST 800-61 framework. Step 1: Immediate Containment—isolate the infected host from the network at the EDR/switch level to stop lateral movement, but do NOT power off the machine to preserve volatile RAM memory. Step 2: Evidence Preservation—dump memory with WinPmem and extract event logs for forensic triage. Step 3: Scoping & Root Cause—query the SIEM/EDR for outbound C2 beaconing and MITRE ATT&CK TTPs to find Patient Zero. Step 4: Eradication—revoke compromised service account credentials and patch the exploited CVE. Step 5: Recovery—re-image the host and restore data from air-gapped, immutable backups.

Zero Trust Architecture replaces the outdated "castle-and-moat" perimeter security model with the core axiom: "Never trust, always verify." Every access request—regardless of whether it originates inside or outside the corporate VPN—must be explicitly authenticated, authorized, and encrypted. It operates on three fundamental pillars: 1) Explicit verification using multi-factor signals (device health, identity, risk score), 2) Least Privilege Access (JIT and RBAC permissions), and 3) Assume Breach, which enforces micro-segmentation to strictly limit blast radiuses.