Prep RoomSign inStart free
Code RoomBreach lateral movement active
HardPrep Room Coding #2934

Breach lateral movement active

On-callSecuritySenior–Staff~45 min

EDR fires on a production app server: a process spawned by your web app ran whoami, then nmap against the internal /16, then attempted SSH to 14 internal hosts using a key it found at /home/app/.ssh/id_rsa. Two of those SSH attempts succeeded. The web app had a known unpatched deserialization bug. Auth logs show the same key now logging into a database bastion. It's 04:00 and you're the on-call incident commander. How do you run this?

What a strong answer looks like

Stop the bleeding first (mitigate), then form hypotheses from real signals. Separate root cause from symptom, communicate status as you go, and close with what prevents a repeat.

0:00 of about 45 min
Which questions mattered is sealed until you submit. Telling you now would just be handing over the edge cases.