Teams at workReconstruct and decideExample · 1 question · 2 min

Reconstruct the Incident

Put incomplete signals into a defensible timeline and choose the first containment action.

Answer
Feedback
Finish

Choose one answer

A token is used from Berlin and Singapore within four minutes, then a bulk export begins. What is the strongest first action?

Revoke the token, preserve the logs, and verify the account owner before making a root-cause claim.Wait with any action until the account owner confirms whether she travelled herself.

Show a hint

Choose the reversible action that limits further use, preserves evidence, and keeps the cause explicitly provisional.

About this activity

What you practise: Build a fact–hypothesis–action chain under uncertainty without destroying the evidence needed for the next decision.

A hand-written example with a fixed sequence. It shows what working on a Klarisma activity feels like; your own activities follow your goals and material.

An example with fictional data. Your answers stay on this page and are cleared when you restart or leave.

A token is used from Berlin and Singapore within four minutes, then a bulk export begins. What is the strongest first action? 09:12: successful login in Berlin, observed. 09:15: token refresh in Singapore, observed. 09:16: bulk export begins, observed. 09:18: account-owner confirmation is missing. The travel pattern is a hypothesis about unauthorized use, not a proven root cause. The login, token refresh, and export are observed facts. The geographic pattern supports a strong hypothesis but does not prove who acted or why. Revocation limits further token use while preserving the evidence needed for verification and investigation.