Interview question
Critique this line from a draft report: "It is believed that this sophisticated attack may possibly be linked to a nation-state actor." Rewrite it.
A red-pen exercise. Every fault in this sentence is one interviewers see regularly in real drafts.
What a strong answer covers
- Identifies "it is believed" as passive voice hiding who holds the judgement and on what basis.
- Identifies "sophisticated" as an empty descriptor, often standing in for "not yet understood".
- Identifies "may possibly" as double hedging that makes the statement unfalsifiable.
- Identifies "linked to" as unspecified — no statement of what the link is or how strong.
- Notes the absence of any confidence level or sourcing.
- Notes the absence of evidence and of what would change the judgement.
- Produces a rewrite with an explicit probability term, a stated confidence with its basis, and the key evidence.
- The rewrite avoids asserting more than the original evidence supports.
Expert answer
There are five separate problems in one sentence.
"It is believed" is passive and ownerless. Who believes it? On what basis? An assessment needs an owner.
"Sophisticated" carries no information. In practice it usually means "we do not fully understand it yet". If the tooling was genuinely notable, describe the specific capability instead.
"May possibly" is double hedging. Almost anything may possibly be the case, so the statement cannot be wrong, which means it cannot inform a decision either.
"Linked to" is unspecified. Linked how — shared infrastructure, code overlap, targeting consistency? Each of those carries very different weight.
And there is no confidence level, no sourcing, and no evidence — so a reader has no way to judge it or to know what would change it.
A rewrite has to stay within whatever the original evidence actually supported, so assuming the underlying basis was some infrastructure and tooling overlap:
"We assess it is unlikely that this intrusion was conducted by a state-directed actor. The tooling is a commodity loader with a widely distributed builder, and the victimology is consistent with opportunistic financially motivated targeting. We hold this at moderate confidence: the assessment rests on our own telemetry plus two vendor reports that appear to share a collection source, and we have no visibility into the actor's post-access objectives. Evidence of targeted selection without a monetisation path, or of custom tooling, would move us toward a state-directed assessment."
That version has an owner, a probability term, a confidence level with its basis stated, the key evidence, and an explicit indicator of what would change it. It is also longer, which is the correct trade — the original was short because it said nothing.
Mistakes that cost candidates points
- Identifying only the hedging and missing "sophisticated" or the passive voice.
- Rewriting it to be more confident than the underlying evidence supports.
- Producing a rewrite that is still unfalsifiable.
- Omitting the "what would change my mind" clause.
- Adding invented technical detail to make the rewrite sound better.
You have read the answer, which is the easy part. Answer it in your own words and get graded against this same rubric, with the follow-up probe an interviewer would ask next.
Go deeper
Related questions
- It is 2am during a live incident and the incident commander asks you "is this ransomware?" You genuinely do not know yet. What do you say?
- What is the difference between saying something is "likely" and saying you have "high confidence" in an assessment? Can you have high confidence in an unlikely outcome?
- How do the Diamond Model, the Cyber Kill Chain and MITRE ATT&CK relate to each other? Do they compete?
- An endpoint alert shows that a scheduled task was created which launches a PowerShell one-liner from a user's AppData directory. Map this to MITRE ATT&CK.
- You have one piece of evidence: a single IP address that a compromised host was beaconing to. Walk me through how you would develop this.