Incident Response, AI Security, and OT Questions

Incident Response

  1. A public repository contains a cloud token. Lead the first 30 minutes.
  2. A critical alert fires during a major customer launch. How do you balance containment?
  3. Build a timeline when endpoint, cloud, and application clocks disagree.
  4. An executive asks whether customer data was accessed before evidence is complete.
  5. Decide when to isolate a host, disable an identity, rotate keys, or rebuild.
  6. A detection rule produces 500 alerts a day. How do you tune it safely?
  7. Explain chain of custody to an engineering team during an urgent incident.
  8. Write the structure of a useful post-incident review.
  9. Distinguish root cause, trigger, contributing factors, and control failures.
  10. Turn one incident into a prioritized detection and prevention backlog.

AI and Agent Security

  1. Threat-model an assistant that reads email and creates calendar events.
  2. Prevent a malicious retrieved document from causing tool execution.
  3. Design a policy gateway for an agent with cloud read and ticket-write tools.
  4. Where should human approval occur, and what must the user see?
  5. Detect cross-tenant RAG leakage and prove deletion.
  6. Evaluate hallucinated remediation that could cause an outage.
  7. Secure an AI code-fix workflow from repository input through merge.
  8. Manage model, plugin, connector, prompt, embedding, and document supply chains.
  9. Compare sandboxing, egress control, credentials, and output validation.
  10. Measure task quality, leakage, unsafe action, false refusal, cost, and latency.

ICS/OT

  1. A Windows engineering workstation is suspected compromised. Who decides containment?
  2. Design remote vendor access for a plant.
  3. Connect a historian to cloud analytics safely.
  4. Prioritize a critical CVE on an unpatchable PLC.
  5. Explain passive inventory and its blind spots.
  6. Design zones and conduits for a water treatment environment.
  7. How can an IT security control create a physical safety risk?
  8. Plan recovery when replacement hardware has a long lead time.

Executive Drill

For any scenario, give a 90-second update:

  • what is known and with what confidence;
  • plausible business/safety exposure;
  • action already taken;
  • decision or resource needed;
  • next update time.