{
  "kind": "synthetic-educational-scenario",
  "version": "1.0",
  "slug": "identity-triage",
  "title": "The impossible sign-in",
  "description": "A new device, an unfamiliar network, and a successful login. Decide what the evidence supports before you act.",
  "minutes": 8,
  "skill": "Evidence-based triage",
  "evidence": "SYNTHETIC CASE / ID-1042\nAll times UTC. No real people or systems.\n\n09:02  ava@example.net signs in from managed laptop.\n       IP 192.0.2.40; password + phishing-resistant MFA.\n09:11  Same account signs in from an unfamiliar device.\n       IP 198.51.100.22; password + push approval.\n09:12  User reports: “I approved a prompt I did not start.”\n09:14  A new mailbox forwarding rule targets an external address.\n09:16  Resource owner confirms the account handles invoices.\n\nGeo-location label: 1,800 km apart. VPN status: unknown.\nAuthority: you may gather logs; containment requires incident lead approval.",
  "steps": [
    {
      "prompt": "Which observation most strengthens the account-compromise hypothesis?",
      "choices": [
        {
          "text": "The geographic distance proves the user could not have signed in.",
          "correct": false,
          "feedback": "IP location is approximate, and VPNs can change it. Treat distance as a lead, not proof."
        },
        {
          "text": "An unsolicited approval followed by a new external forwarding rule.",
          "correct": true,
          "feedback": "The user report and follow-on action form a stronger sequence than location alone. Preserve both records and check whether the forwarding was authorized."
        },
        {
          "text": "The second IP address appears in a different range.",
          "correct": false,
          "feedback": "Different ranges can occur legitimately. You need behavior and context before making a conclusion."
        }
      ]
    },
    {
      "prompt": "What is the most useful immediate next step within your authority?",
      "choices": [
        {
          "text": "Delete the mailbox and block every external email domain.",
          "correct": false,
          "feedback": "That is disruptive, exceeds your stated authority, and destroys useful context."
        },
        {
          "text": "Preserve the sign-in and rule evidence, contact the user through a trusted channel, and request scoped containment.",
          "correct": true,
          "feedback": "This combines evidence preservation with verification and a proportionate response through the approved authority."
        },
        {
          "text": "Wait until the geographic lookup is perfectly accurate.",
          "correct": false,
          "feedback": "The stronger behavioral evidence already justifies escalation. Resolving every uncertainty before acting would delay a useful response."
        }
      ]
    },
    {
      "prompt": "The lead approves session revocation and removal of the unauthorized rule. What closes the loop?",
      "choices": [
        {
          "text": "An API returned 200, so close the incident.",
          "correct": false,
          "feedback": "A successful request is not proof that the security outcome occurred."
        },
        {
          "text": "Verify the sessions and rule state, check related activity, and record residual uncertainty and recovery steps.",
          "correct": true,
          "feedback": "Verification connects the action to its intended outcome and preserves a clear handoff for recovery and follow-up."
        },
        {
          "text": "Reset all employee passwords to be safe.",
          "correct": false,
          "feedback": "The evidence does not establish organization-wide compromise. Wider actions need their own justification and authorization."
        }
      ]
    }
  ],
  "takeaway": "A strong triage decision combines observed behavior, context, authority, and outcome verification. An anomaly is a starting point; a supported sequence is evidence."
}