Section 11: The Whole Attack on One Page - End-to-End Diagram Pack
Executive Summary: Ten sections built this system piece by piece; this one hands it back to you as four drawings you can reproduce on a whiteboard in order. The system map, Contoso's attack as a timeline, the incident lifecycle, and the retro-hunt path together carry the whole interview. For each one you get what to say in the 30 seconds it takes to draw, the probe the interviewer usually aims at it, and the numbers to write beside the boxes. Nothing here re-teaches a mechanism. Each diagram points to the section that owns it, so this page works as a pre-interview skim and as a map back into the deep material.
Picture the interviewer's view of your whiteboard at minute 40. If it's a tangle of boxes with arrows crossing in every direction, they have to take your word for everything you said. If it's four clean drawings, each with a handful of numbers beside it, the board makes your argument for you. The candidates who stand out treat diagrams as claims. Every box is a decision, every arrow carries a rate or a latency, and every number matches one they derived earlier.
Key Insight: Draw the path one event travels before anything else. An interviewer can follow a single sign-in from the Ingest Edge to a SOC page and check every box along the way. Show them a cloud of services first and they'll start probing at random.
The 3-minute whiteboard order
You won't have time to draw all four diagrams in full at the start of the interview, and you shouldn't try. Draw the spine, write the numbers, and leave the rest as labelled stubs that you expand when the interviewer pulls on them.
| Minute | Draw | Leave as a labelled stub |
|---|---|---|
| 0–1 | The data-plane spine: Ingest Edge → raw-events hub → Normalizer → normalized-events hub → Detection Engine → Alert Service → Alert Store → Dispatcher → Connectors |
Enrichment Cache (a small box hanging off the Normalizer) |
| 1–2 | The numbers on the arrows: 3M events/s peak, 400 B normalized, fan-out 2.5, 58 detections/s | Stamp boundary: one dashed rectangle labelled "×12 stamps" |
| 2–3 | The control plane: Rule Service feeding the Detection Engine, Canary Injector feeding the Ingest Edge | Archive and Retro-Hunt Service, Tenant Registry, paired standby region |
The stubs are deliberate. Each one marks a deep dive you're prepared for, and when the interviewer points at one, you've already chosen the next ten minutes together.
Sign in to continue reading
The rest of this lesson is available with a free account. Signing in with Google or Microsoft is free.
Sign in to read the full lesson