ORIGINAL WORKED REFERENCE

The timeline contains four planned injects at 0, 10, 20 and 30 minutes. The first alert does not establish the cause of the reported file exposure. A good log preserves these as separate evidence items until the simulated investigation connects them.

CRITICAL CONDITION
Every artifact is marked EXERCISE and no real containment action, message or incident outcome is claimed.

LIMITS
This is a discussion rehearsal, not incident response on a real system or proof of operational readiness.

This reference is not a learner submission or proof of provider-course completion. See material-verification.json in the production package for actual preparation checks.
