Your question is Lifecycle of a Security Incident. Take a moment with it on the right.
Talk me through your thinking if you like. When you're confident, submit your answer and I'll grade it like a real screen (7/10 or better passes).
Walk me through the lifecycle of a security incident from detection to remediation.
Cover how you validate and classify an alert, establish scope and severity, preserve evidence, contain the threat, eradicate its cause, recover affected systems, and verify that remediation worked. Explain the communication, documentation, and post-incident activities required throughout the process.
Keep the answer focused on a practical incident-response workflow rather than a specific vendor tool or regulation.