Cyber-security research-note practice

General practice authored by Roamwise. Not actual employer questions.

1. How do you separate known facts from assumptions in an incident note? Use a fictional event card if needed.

Follow-up: Which missing information would change your next decision?
My review: Did I avoid presenting suspicion as a confirmed incident?

My answer (real example / explicitly fictional exercise:


Open point:


2. How would you explain a record’s priority without overwhelming the listener with technical detail?

Follow-up: Which decision is outside your authority?
My review: Did I separate my recommendation from the authorised decision?

My answer (real example / explicitly fictional exercise:


Open point:


3. What context would you add when handing a research file to another team? Share no real access details or confidential records.

Follow-up: What is the recipient’s first question to resolve?
My review: Are source, open question and next action visible?

My answer (real example / explicitly fictional exercise:


Open point:


4. How do you report status when you cannot verify that a check was performed?

Follow-up: Which wording would imply an unmeasured security outcome?
My review: Did I label an unperformed check complete or safe?

My answer (real example / explicitly fictional exercise:


Open point: