✳ Practice range / Evidence-based identity triage / 8 min
The impossible sign-in
The case includes a new device, an unfamiliar network, a push-fatigue approval, and an unauthorized mailbox forwarding rule at Meridian Space & Robotics. Evaluate what the evidence actually proves before proposing containment.
Step 1 of 3
Which observation most strongly supports the hypothesis that dax.mercer@chronos.orbital has been compromised?
CASE REFLECTION
Result and takeaway
first decisions matched the scenario’s best-supported answer.
Disciplined identity triage separates noisy network heuristics from corroborated behavioral sequences, respects response authority boundaries, and verifies that containment actually changed system state.
