Investigate a departing employee's privilege abuse, data exfiltration, and attempted log tampering, then choose a response that preserves the case
Derek Voss, a systems administrator at Ironvale Credit Union, submitted his resignation with the standard two-week notice. Days before his last day, IAM/PAM, database, endpoint, network, and Windows Event Log telemetry all show a coordinated privilege-escalation and data-exfiltration event, followed by an attempt to erase the evidence. Reconstruct what happened, determine how the cover-up was caught, and choose a response that preserves the case.