An exported Excel file contains customers outside a manager's territory, but the live report now passes RLS tests. How would you investigate and contain this?

Instruction: Senior-level, open-ended case. Several approaches can be defensible; explain your assumptions, recommendation, tradeoffs and what evidence would change your choice. Use a hypothetical incident or an example you are authorized to discuss. Explain your own role and when an administrator or security responder would act. Distinguish downloaded data from a workbook's live connection, and avoid claiming audit access, complete historical evidence or recovery of external copies that you cannot demonstrate. For a mock interview, allow two minutes for your first answer, then 30 seconds to respond to the pressure-test twist. State what changed, your next action and what you cannot safely promise.

Context: This open-ended senior case assesses decision quality. Investigates the historical access path instead of trusting current tests, preserves evidence, and balances prompt containment with scoped disruption and honest uncertainty about copies already distributed.

Updated

Official answer available

Read the opening below, then unlock the full answer and practical guidance.

I'd treat the file as evidence of a possible disclosure and involve the security team and data owner through the incident process. I'd preserve the original in an approved restricted location, record what was reported, and avoid forwarding customer details widely. Passing today's RLS test doesn't establish which identity, model or permissions produced an earlier file...

Upgrade to view official answer

Related Questions