Look for authentication patterns that do not match an account history: a workstation account logging into servers it has never touched, type 3 logons fanning out across many hosts in minutes, or an administrator credential appearing on a user endpoint. Add remote execution artifacts (service creation, WMI or WinRM sessions, remote scheduled tasks), writes to administrative shares, and new internal paths on ports 445 or 5985 between segments.
Why interviewers ask this
Lateral movement is where a small intrusion becomes an incident, so the interviewer wants to know you can see it. They are listening for identity telemetry, not just endpoint alerts, and for the idea of a baseline: the signal is the deviation from normal for that account and that host pair. Mentioning east west visibility gaps shows you understand why many teams miss this stage entirely.
How to structure your answer
- Anchor on identity behavior first, then execution artifacts, then network paths.
- Explain the baseline you compare against.
- Give the specific log sources behind each signal.
- Call out the visibility gap that would hide it from you.
Example answer
The first place I look is identity. Security logs on domain controllers and member servers give me logon type, source workstation and account, and the question I ask is whether this account has ever authenticated to this host before. A finance workstation account suddenly authenticating to three file servers is more interesting to me than any single endpoint alert. Type 3 logons fanning out across many hosts in a short window is the classic spray pattern. Then execution: 7045 service installs, remote scheduled task creation, WinRM sessions, WMI process calls, and writes to ADMIN$ or C$ shares. Network side I want east west flow data, because if I only have north south I am blind to exactly the traffic I care about, and I have worked somewhere with precisely that gap. What pulls it together is graphing account to host pairs over thirty days and alerting on new edges, especially for privileged accounts. A new edge plus remote execution in the same hour is my escalation trigger.
Walking into this interview soon? GhostPilot listens to your live call, spots the question the moment it is asked, and puts a structured answer on your screen in real time. Try it on your next mock, or grab a $29 Session Pass, no subscription, for the real thing.
See how it worksFollow-up questions to expect
- How would you detect lateral movement that uses only RDP with valid credentials?
- What would you do first to contain it?
- How would you get east west visibility in a flat network?
Related cybersecurity analyst questions
Your interviewer will ask their own version of this. Paste your actual job description into the free Question Predictor and get the 20 questions that role is most likely to ask, with what each one is really probing.
Predict my questions