Section 10: The Gauntlet - Interviewer Q&A, Deep Dives & Tradeoff Defenses

Executive Summary: Contoso's attack has been traced to INC-20419, and the interviewer starts pulling threads. This section runs ten challenges a Staff-level panel reliably asks of a streaming detection system. Each gets what the interviewer is really testing, a model answer built on a mechanism and a number, and a one-sentence senior line. It closes with where the system goes next.

Key Insight: Every "why not X?" has a true answer of the form "X is right when ___, and here it isn't because ___." Naming the condition that would change your mind proves you made a choice.

Challenge 1: "Why not just run scheduled KQL queries?"

Interviewer: "Land everything in a Log Analytics workspace and run each rule as a scheduled query. Why build a streaming engine?"

What they're really asking: Do you know what streaming buys, or did you reach for Flink out of habit?

You: "A scheduled query pays latency three times: ingestion into the workspace, up to one schedule interval waiting for the next run, then the query itself. Alice's tenth failure would surface minutes late, not seconds. And each of a tenant's 150 enabled rules re-scans its lookback window every run, re-reading the same slice of 86.4 TB a day; the Detection Engine touches each event 2.5 times on average. Queries remain right for hunting, where the question isn't known in advance: that's the Retro-Hunt Service, and long-term search belongs to the neighbouring module, Azure Scale Security Telemetry Ingestion Storage."

The senior line: "Stream the questions you know in advance; query for the ones you don't."