Your question is Security Incident Response and Recovery. Take a moment with it on the right.
Talk me through your thinking if you like. When you're confident, submit your answer and I'll grade it like a real screen (7/10 or better passes).
What is your experience with security incident response and recovery?
Describe a real incident or a representative hands-on response you have performed. Cover detection, triage, containment, eradication, recovery, communications, evidence handling, and lessons learned. Name the technologies used, the decisions you made under pressure, and how you verified that systems were safe to restore.