Escalate immediately and assume the attacker has had three weeks, so scope wide before you contain. Reopen the case, rebuild the timeline from retained telemetry, and hunt for the follow on activity you would expect: persistence, credential theft, lateral movement and exfiltration. Contain based on current findings rather than the original alert, in one coordinated action. Afterward, run a blameless review of why the original decision looked correct.
Why interviewers ask this
This tests integrity and composure. The interviewer wants to see that you surface the mistake fast rather than quietly fixing it, that you widen scope instead of tunneling on the original host, and that you treat the closure as a process defect (missing enrichment, missing telemetry, an unclear runbook) rather than an individual failure. Defensiveness or blame shifting here is the disqualifying answer.
How to structure your answer
- Raise it immediately and say who you tell first.
- Explain why scoping comes before containment at this stage.
- Describe the retrospective hunt across the intervening weeks.
- Close with a blameless process fix, not a personal apology.
Example answer
I tell my lead straight away, before I have the full picture, because three weeks of dwell time is an incident and the worst version of this is an analyst quietly investigating alone to save face. Then I resist the urge to isolate the original host immediately, because after three weeks that host is probably not the only one and containing early tips the attacker off. So I scope first: rebuild the timeline from whatever retention I still have, then hunt forward for what should have followed, meaning persistence mechanisms, new service accounts, credential access, new account to host authentication edges, and outbound volume anomalies. Once I know the footprint I contain in one coordinated action rather than host by host. Afterward I want the review to be about the process, not the person. When we did this at a previous job the honest finding was that the analyst had no command line logging on that host, so the decision looked correct with the evidence available. The fix was telemetry plus a runbook rule about closing on absence of evidence.
Walking into this interview soon? GhostPilot listens to your live call, spots the question the moment it is asked, and puts a structured answer on your screen in real time. Try it on your next mock, or grab a $29 Session Pass, no subscription, for the real thing.
See how it worksFollow-up questions to expect
- How far back would you hunt, and what limits that?
- How do you decide when to notify regulators or customers?
- What would you change in the triage runbook?
Related cybersecurity analyst questions
Your interviewer will ask their own version of this. Paste your actual job description into the free Question Predictor and get the 20 questions that role is most likely to ask, with what each one is really probing.
Predict my questions