Practical tips: 6–8 concise, actionable tips the candidate can use during the exercise (forensics-first approach, imaging before changes, checking TPM/BitLocker status, collecting logs, using alternative boot tools, escalation path).