Describe a security incident you were involved in. How did you handle it?

Follow the standard incident response phases, which shows you work to a process rather than improvising.

• Detection and analysis. How it surfaced — an alert, a user report, a third-party notification — and how you determined it was a genuine incident rather than a false positive. State the scope you established: which systems, which accounts, what data.
• Containment. Short-term first: isolating the host, disabling the account, blocking the indicator. Crucially, preserve evidence before you wipe anything — memory capture and disk imaging, because rebuilding the machine destroys the ability to understand what happened.
• Eradication. Removing the foothold and closing the entry point. If you do not know how they got in, you have not eradicated anything.
• Recovery. Restoring service with monitoring in place to catch a return, and validating the systems are clean before reconnecting.
• Lessons learned. What controls failed, and what specific changes followed.

Note: Mentioning that you involved legal and communications early — and that notification obligations may have regulatory deadlines — shows you understand a breach is not purely a technical event. If you handled a simulated incident or tabletop exercise rather than a real one, say so honestly; that is still valuable and lying about it is easily caught.