Prep Room
Coach note

Interviewers ask this kind of question to surface how you think, not what you remember. The strongest answers are specific, calmly told, and end on what changed.

Create an account or sign in to see model answers and concept guides, and to track the questions you’ve practiced.

Judgment & ambiguity · When to escalate

A security researcher emails you a plausible but unverified report of a data-exposure bug, with a 90-day disclosure clock now running. You can't yet reproduce it. When does this stop being an engineering triage item and become an escalation?

0of ~160 wordsAbout a minute spoken
Type your answer

Voice isn’t supported in this browser. Type your answer in the box.

Create a free account to get more critiques.

Your answer
Your answer appears here as you speak.
Model answerFree with an account

It escalates the moment the report is credible, not the moment it's confirmed — those are different thresholds and conflating them is how companies miss disclosure obligations.

The full answer: structure, worked example, likely follow-up.

Practice more

Thousands of questions, calibrated to your role. Your progress is saved across every session, with model answers and full breakdowns.

© Prep Room. This question is part of the Prep wiki. You’re welcome to quote it with a link to this page.