Domanda di colloquio di Salesforce

How would you approach identifying malicious user behavior?