Question library
Attribution interview questions
Every question comes with the key points a strong answer covers, the mistakes that lose candidates points, and a vetted expert answer. Read them, then practise them under questioning.
3 questions matching your filters
- An executive wants a named attacker for a board slide tomorrow. Your evidence supports clustering the activity but not naming a group. What do you do? A behavioural question testing analytic integrity under stakeholder pressure — and whether you can push back without being obstructive.
- Ransomware has been deployed across part of your estate. A known family was used, a ransom note was left, but no data exfiltration has been observed despite C2 being active for six days beforehand. What are your hypotheses, and how would you test them? A case built around one diagnostic anomaly. The scoring is about whether you notice that the missing exfiltration is the interesting part.
- Which classes of attribution evidence are hardest for an adversary to fake, and which are easiest? How does that change how you weight them? A senior attribution question. The expected answer ranks evidence by cost-to-fake and connects that ranking to how confidence should be assigned.
Practise these
Reading an expert answer and producing one under questioning are different skills. The simulator asks these questions, grades your answer against the same rubric you see here, and asks the follow-up an interviewer would ask next.