Data-Center Camera Access Incident Response

A data-center security-camera password or access failure has occurred. Explain the response within the first hour, within 24 hours, and within one week. Requirements Scenario: password or access has failed for data-center security cameras. Explain the actions to take within the first hour. Explain the actions to take within 24 hours. Explain the actions to take within one week. Notes Immediate containment alone was not treated as a complete answer; the interviewer expected distinct actions across all three time horizons. A defensible structure separates containment, restoration, and prevention: First hour: confirm the scope and owner, establish temporary physical monitoring, preserve access and audit logs, revoke or rotate affected credentials through the approved emergency path, and escalate to security and facility operations. Within 24 hours: restore controlled access, verify camera coverage and recording end to end, review recent access changes, document the incident timeline, and communicate residual risk. Within one week: complete root-cause analysis, close credential and recovery gaps, test the revised recovery path, and assign follow-up owners with verification dates. For every action, state who owns it, how success is verified, and what evidence must be preserved. Preparation Draft a one-page response table with columns for time window, owner, action, verification, and escalation trigger. Rehearse a three-minute answer that clearly transitions from immediate containment to service restoration and then prevention. Add one verification criterion and one fallback for each time horizon; avoid listing actions without explaining how coverage is confirmed.