Your question is Incident Response on Compromised Hosts. Take a moment with it on the right.
Talk me through your thinking if you like. When you're confident, submit your answer and I'll grade it like a real screen (7/10 or better passes).
Walk through how you would do incident response on a compromised host on Mac, Linux and Windows, including how you would read the process tree.
Asked in the virtual onsite stage. The discussion covered incident response across macOS, Linux, and Windows, including process-tree analysis.
Address containment, evidence preservation, triage, eradication, recovery, and lessons learned. Name platform-specific commands and explain how you would distinguish legitimate parent-child relationships from suspicious execution.
