✳ Practice range / Evidence-based triage / 8 min
The impossible sign-in
A new device, an unfamiliar network, and a successful login. Decide what the evidence supports before you act.
Step 1 of 3
Which observation most strengthens the account-compromise hypothesis?
CASE REFLECTION
Keep the reasoning.
first decisions matched the scenario’s best-supported answer.
A strong triage decision combines observed behavior, context, authority, and outcome verification. An anomaly is a starting point; a supported sequence is evidence.