A scoped investigation
The fictional responder identifies the CPU-heavy process, checks connections, stops the identified process and checks the outcome. The hand-authored example includes a clear user update; persistence and a full incident response remain outside this sample.
Fixed command evidence
No commands were executed to produce this page. These observations are fictional and must not be treated as a live system record.
ps aux --sort=-%cpuPID 4821 /tmp/.hidden/cryptod uses 94.2% CPU. PID 1204 /usr/sbin/apache2 uses 0.5% CPU.
ss -anAn unexpected outbound connection is present. Preserve the observation and compare it with the incident runbook.
kill 4821Illustrative outcome: the identified process stops. This is a fictional response, not a command to run on a real workstation.
ps aux --sort=-%cpuIllustrative follow-up: PID 4821 is absent and no remaining process exceeds 5% CPU. The business service remains available.
echo "The CPU-heavy process has stopped and responsiveness has returned. We recorded the network observation and escalated investigation of how it started; please report a recurrence."The plain-language ticket update states the observed result and the remaining uncertainty.
Reasoning and limits
- The process listing narrows the hypothesis before changing anything; the connection check adds context instead of treating high CPU alone as proof of malware.
- A follow-up checks the intended outcome and a business-service side effect. The response avoids declaring the workstation clean or the incident closed.
- The example does not investigate persistence or collect a full forensic record. Those limits keep methodology and operational fit below the highest illustrative band.
Illustrative rubric report
Each band is an authored judgment from 0 to 3. The five weights are the current terminal rubric weights; the total is calculated from them.
- Accuracy
Band 3/3 · Weight 30%
The authored follow-up shows the identified CPU-heavy process absent and the immediate symptom resolved without a broken service.
- Methodology
Band 2/3 · Weight 25%
The investigation narrows the process and checks the outcome, but the sample does not demonstrate a full reversible containment or persistence investigation.
- Tool fluency
Band 2/3 · Weight 20%
Process and connection tools are used for specific observations; the example does not demonstrate advanced structured analysis or automation.
- Communication
Band 3/3 · Weight 15%
The ticket update explains the observed fix, avoids an unsupported all-clear and gives the user a next step if the problem returns.
- Real-world fit
Band 2/3 · Weight 10%
The response considers business-service continuity and escalation; the full incident runbook and change record are outside this demonstration.
DEMONSTRATION score: 82/100
Calculation: round((3 × 30 + 2 × 25 + 2 × 20 + 3 × 15 + 2 × 10) ÷ 3) = 82.
This meets the rubric's 75-point reference threshold. This is an illustrative calculation, not an official pass or failure and not a hiring prediction.
No official session, no certificate and no server-graded candidate result are represented by this report.