Guides

Incident Response Interview Questions (50) — IR / DFIR Beginner

By Ravindra Bagale, Cyber Security trainer · LinkedIn · Published: 29 September 2026 · Last updated: 30 September 2026

This beginner IR/DFIR interview pack has 50 process-first Q&As — lifecycle, triage, evidence care, containment and lessons learned — without malware weaponisation or attack how-tos.

Prepare → detect → contain → eradicate → recover → learn
Evidence first, drama never
Hack-back = wrong answer

How to use this interview pack

1. Memorise a lifecycle you can draw on a whiteboard.
2. Practise a 60-second executive brief (impact, status, ask).
3. Write a sample timeline from synthetic logs (label IST).
4. Tabletop with a friend: ransomware or mailbox compromise scenario.
5. Related guides: IR first 24 hours, digital forensics beginners, SIEM/SOC.
6. Never practise by attacking third-party systems.

Fifty interview questions and answers

Speak ethics first when a question sounds offensive. Prefer defence, detection and process. These answers are conceptual — not exploit, PoC, cracking or Metasploit recipes.

Q1. What is incident response (IR)?

IR is the organised process to detect, contain, eradicate, recover and learn from security incidents. Interviewers want calm process, evidence care and communication — not panic or random tool names.

Q2. Name a common IR lifecycle model.

A widely taught model is Preparation → Detection & Analysis → Containment → Eradication → Recovery → Lessons Learned (NIST-style phrasing varies). Preparation is half the battle.

Q3. What belongs in IR preparation?

Contacts, playbooks, logging that actually works, backups tested, access to forensic-capable accounts, and tabletop exercises. Tools without playbooks fail under stress.

Q4. How do you define a security incident vs an event?

An event is an observed occurrence. An incident is an event (or set) that threatens confidentiality, integrity or availability and needs response. Clear severity definitions reduce chaos.

Q5. What is triage in SOC/IR?

Quickly deciding severity, scope and next action from an alert or report: false positive, monitor, escalate, or contain. Document decisions with timestamps (use IST labels for this audience).

Q6. What is chain of custody?

Documented control of evidence — who handled it, when, and how — so investigations remain trustworthy for management or legal needs.

Q7. Why must you avoid panic-wiping disks?

Wiping destroys volatile and persistent evidence. Contain first per playbook; image or preserve when required; eradicate after evidence goals are met.

Q8. What is the difference between IR and digital forensics?

IR focuses on stopping harm and restoring operations. Digital forensics focuses on preserving and analysing evidence to understand what happened. DFIR blends both.

Q9. What volatile data might matter first?

Running processes, network connections, logged-in users, and memory — because they disappear on power-off. Collect only with authorised procedures.

Q10. How do you build an incident timeline?

Order facts by synchronized timestamps across hosts, identity and network logs. Note time zones explicitly. Gaps are documented, not invented.

Q11. What is containment vs eradication?

Containment limits spread (network isolate, disable account). Eradication removes cause (malware, persistence, misconfig). Premature eradication without containment can tip off attackers.

Q12. Give examples of containment actions (high level).

Disable compromised credentials, block malicious egress, isolate a host via EDR/network, revoke sessions — all per policy with change logging.

Q13. What is a P1 vs lower severity talking point?

P1 often means active breach with data loss/ransom/critical outage. Lower severities still need tracking. Agree severity matrix before incidents.

Q14. How should you communicate during an incident?

Single source of truth channel, factual updates, no speculation on public social media, legal/PR involved when customer data may be affected.

Q15. What is RTO and RPO in recovery conversations?

RTO is how fast you must restore service; RPO is how much data loss you can tolerate. Backups and IR plans must match those business numbers.

Q16. How do you handle ransomware IR themes?

Isolate affected systems, preserve samples/logs as directed, restore from clean backups, rotate credentials, and improve controls — paying ransom is a business/legal decision, not a technical 'fix'.

Q17. What evidence sources does a beginner DFIR list?

Endpoint EDR telemetry, OS auth logs, VPN/proxy, email gateway, cloud audit logs, and disk images when warranted.

Q18. What is a write blocker conceptually?

Hardware/software that prevents writes while imaging storage so evidence is not altered. Used in formal forensic acquisition.

Q19. How do you talk about imaging a disk?

Bit-for-bit copy with hashing to prove integrity, labelled evidence IDs, and controlled storage. Done under authorisation and procedure.

Q20. Why hash evidence?

To detect later modification. Record algorithm and hash in the custody log.

Q21. What is memory forensics at interview level?

Analysing RAM captures for processes, network artefacts and malware artefacts that never hit disk. Advanced topic — juniors know why it matters and when specialists are called.

Q22. How does MITRE ATT&CK help IR?

Maps observed behaviours to techniques so you can check coverage, hunt related activity and brief executives with a shared language.

Q23. What is a post-incident review / lessons learned?

Blameless review of timeline, what worked, what failed, and concrete backlog items with owners — within a fixed time after major incidents.

Q24. How do you detect account compromise indicators?

Impossible travel themes, MFA fatigue patterns, sudden privilege changes, odd OAuth grants, and unusual mailbox rules — investigated with identity logs.

Q25. What is legal hold in IR?

Instruction to preserve relevant data from deletion when litigation or regulation may apply. Coordinate with counsel.

Q26. How do you scope an incident?

Ask which identities, hosts, data stores and time ranges show attacker activity. Expand and shrink with evidence, not fear.

Q27. What is the role of a scribe / incident commander?

Commander drives decisions; scribe keeps timeline and actions. Clear roles beat everyone typing in chaos.

Q28. How do cloud incidents differ?

Evidence is often API audit logs and provider tools; containment may be key revocation and IAM changes more than pulling cables. Still need playbooks.

Q29. What should a first 24-hour IR checklist include?

Confirm incident, start timeline, contain obvious bleed, engage stakeholders, preserve evidence, communicate status, and plan eradication/recovery.

Q30. How do you treat PII during investigations?

Need-to-know access, minimise copies, encrypt evidence stores, and follow retention policy. Curiosity browsing customer data is itself an incident.

Q31. What is tabletop exercise value?

Practice decisions without production pain. Reveals missing contacts, unclear severity, and logging gaps.

Q32. How do you answer 'Would you hack back?'

No. Hack-back is illegal/unauthorised and unsafe. Defence, containment, law enforcement channels as policy directs.

Q33. What metrics improve IR programs?

MTTD, MTTR, percent incidents with complete timelines, and backlog completion from lessons learned.

Q34. How do phishing incidents get handled?

Preserve the email, analyse headers/links safely, reset credentials if entered, search for similar messages, and train without shaming.

Q35. What is IOC vs IOA?

Indicators of Compromise are artefacts (hashes, IPs). Indicators of Attack / behaviours focus on techniques. Modern detection leans on behaviour plus IOC context.

Q36. How do you safely analyse malware samples?

Isolated lab, no production credentials, organisation policy, and often specialist sandboxes — never on your daily laptop casually.

Q37. What is living-off-the-land in IR language?

Attackers using built-in admin tools. Detection needs telemetry on unusual admin patterns, not only malware signatures.

Q38. How do you coordinate with HR/Legal?

Insider cases and employee privacy need HR/Legal early. Security does not freelance investigations that break policy.

Q39. What is evidence volatility hierarchy idea?

Collect more volatile data before less volatile when following forensic procedure — memory before disk power-off decisions, etc.

Q40. How do you validate recovery?

Restore to clean state, rotate secrets, monitor closely, verify business functions, and confirm attacker persistence is gone.

Q41. What belongs in an executive IR brief?

Impact in business terms, current containment status, customer risk, next decisions needed, and confidence level — short and factual.

Q42. How do SOAR playbooks relate?

Automated steps for repeatable enrich/contain actions with human approval gates. Automate toil, not unreviewed destructive actions.

Q43. What is a false positive culture tip?

Tune noisy rules so analysts trust alerts. Untuned SIEM causes alert fatigue and missed true positives.

Q44. How do you handle vendor breach notifications?

Verify official notice, assess your data exposure, rotate shared credentials, review logs for abuse, and follow contract/legal obligations.

Q45. What beginner DFIR mistake do you avoid?

Boasting illegal access stories, altering evidence, or publishing victim data. Professionalism equals employability.

Q46. How do time zones appear in your answers?

I convert and label times. For this class audience I report IST clearly when discussing timelines.

Q47. What is retention vs forensic need?

Security logs need retention aligned to detection and legal needs. If logs rotate too fast, IR goes blind.

Q48. How do you practise IR skills ethically?

Tabletops, labs you own, capture-the-flag defence tracks, and writing sample timelines from synthetic logs — not attacking third parties.

Q49. What is your IR closing interview line?

I prepare before the fire drill, preserve evidence, contain with policy, communicate facts, recover with verified backups, and write lessons that become real fixes.

Q50. Name one public incident lesson you cite carefully.

Public reporting on major retail and pipeline ransomware cases repeatedly showed that detection without practised response and tested backups still fails — process and preparation matter as much as tools.