Suspect stolen session tokens or an adversary in the middle proxy rather than a password attack. Pull the sign in logs and compare session IDs, device IDs, user agents and IP reputation against that user baseline. A replayed token usually shows an existing session ID arriving from a new address. Revoke refresh tokens, force reauthentication, then review inbox rules, registered MFA methods and OAuth application consents.
Why interviewers ask this
Token theft is the dominant identity attack pattern now, so interviewers use this to see whether your mental model is still stuck on password guessing. They want the specific artifacts: session and device identifiers, conditional access results, consented applications and mailbox rules. Revoking sessions rather than only resetting the password is the detail that shows you have actually responded to one of these before.
How to structure your answer
- Say up front which attack classes fit the evidence.
- List the identity artifacts you compare against baseline.
- Give the containment order and explain why a password reset alone is not enough.
- Name the persistence you check for after containment.
Example answer
No failed MFA with a new geography points at a stolen session rather than a guessed password, so I go straight to the sign in telemetry. I compare the session identifier and device identifier against the user history: if the same session ID appears from a new address with a different user agent, that is a replayed token, not a fresh login. I check whether conditional access evaluated at all, and whether the original sign in came through a proxy pattern consistent with an adversary in the middle phishing kit. Containment order matters here. Resetting the password does not kill an existing refresh token, so I revoke sessions and refresh tokens first, then reset, then require reauthentication on managed devices. After that I hunt persistence: new inbox rules, added OAuth consents, newly registered MFA methods, mailbox delegation. In the one I worked, the attacker had added a rule filing anything containing the word invoice into an archive folder, which is what gave away the business email compromise motive.
Walking into this interview soon? GhostPilot listens to your live call, spots the question the moment it is asked, and puts a structured answer on your screen in real time. Try it on your next mock, or grab a $29 Session Pass, no subscription, for the real thing.
See how it worksFollow-up questions to expect
- How would you catch this earlier, before the login succeeded?
- What conditional access policy would have blocked it?
- How do you scope how many other users were phished by the same kit?
Related cybersecurity analyst questions
Your interviewer will ask their own version of this. Paste your actual job description into the free Question Predictor and get the 20 questions that role is most likely to ask, with what each one is really probing.
Predict my questions