3 rounds of interviews. First round focusung on IR scenarios containment, forensics investigation (ransomware, exfiltration and etc.) Second and third interviews largely on personalities, windows forensics, and M365 BEC. You need to be good in windows forensics, M365 BECs, small portion for incident containment steps.