Whenever you're ready, walk me through how you'd approach this.
Describe how you would walk through a security scenario end to end, including what logs or telemetry you would check and how you would reason across security domains.