CSX Interview & Interrogation Techniques 2 — Questions and Answers
Question 1: During a cybersecurity incident interview, a witness becomes defensive when asked about their access logs. Which technique is most appropriate to re-establish rapport?
- Increase the intensity of questioning to break resistance
- Use an empathic statement acknowledging their concerns before continuing (Correct answer)
- Immediately escalate to a formal interrogation format
- Document the defensiveness and end the interview
Correct answer: Use an empathic statement acknowledging their concerns before continuing
Empathic statements validate the subject's feelings and reduce defensiveness, helping to re-establish rapport and encourage cooperation.
Question 2: What is the primary purpose of a 'cognitive interview' technique in cybersecurity investigations?
- To challenge the suspect's alibi with contradictory evidence
- To enhance memory recall by reinstating the mental context of an event (Correct answer)
- To detect deception through physiological monitoring
- To legally compel testimony from an uncooperative witness
Correct answer: To enhance memory recall by reinstating the mental context of an event
The cognitive interview technique uses mental reinstatement of context and other memory-enhancing strategies to improve the accuracy and completeness of witness recall.
Question 3: A CSX analyst is interviewing an employee suspected of data exfiltration. When is it appropriate to confront the subject with incriminating evidence?
- At the very start to shock the subject into confession
- Only after establishing rapport and obtaining a baseline account from the subject (Correct answer)
- Evidence should never be disclosed during an interview
- Immediately after the subject provides their first denial
Correct answer: Only after establishing rapport and obtaining a baseline account from the subject
Presenting evidence after obtaining a baseline account allows the investigator to assess inconsistencies and prevents the subject from tailoring their story to match known facts.
Question 4: Which behavioral cue is considered the most reliable indicator of deception during an investigative interview?
- Avoiding eye contact consistently throughout the interview
- A cluster of verbal and non-verbal behavioral changes from the subject's baseline (Correct answer)
- Crossing arms during questioning about a specific topic
- Speaking more slowly when answering sensitive questions
Correct answer: A cluster of verbal and non-verbal behavioral changes from the subject's baseline
No single cue reliably indicates deception; a cluster of deviations from the subject's established behavioral baseline is a more reliable signal for further inquiry.
Question 5: In the PEACE model of investigative interviewing, what does the 'E' stand for?
- Elimination of suspects
- Explanation of rights
- Engage and Explain (Correct answer)
- Evidence collection
Correct answer: Engage and Explain
In the PEACE model, 'E' stands for Engage and Explain, which involves building rapport with the subject and explaining the interview process.
Question 6: An interviewee claims they have no knowledge of a security breach but their network activity logs show otherwise. What is the best interview strategy?
- Immediately accuse them of lying and present the logs
- Use open-ended questions to get their full account before strategically introducing the log discrepancy (Correct answer)
- End the interview and report them to law enforcement
- Ask another colleague to verify the logs before continuing
Correct answer: Use open-ended questions to get their full account before strategically introducing the log discrepancy
Obtaining a full account first maximizes the strategic value of the contradicting evidence and helps assess the extent of the subject's knowledge.
Question 7: What legal consideration is paramount when interviewing an employee who may be a suspect in a criminal cybercrime investigation?
- Ensuring the interview is conducted by the most senior IT staff member
- Determining whether the subject must be advised of their Miranda rights or equivalent legal protections (Correct answer)
- Completing the interview before notifying HR to avoid tipping off the suspect
- Using only written questions to create a formal record
Correct answer: Determining whether the subject must be advised of their Miranda rights or equivalent legal protections
When an interview crosses into criminal territory, the investigator must consider whether legal warnings (such as Miranda rights in the US) are required to ensure evidence admissibility.
CSX Interview & Interrogation Techniques 2
During a cybersecurity incident interview, a witness becomes defensive when asked about their access logs.
Which technique is most appropriate to re-establish rapport?