Risk-Priority Detection Store
Reported by candidates from Crowdstrike's online assessment. Pattern, common pitfall, and the honest play if you blank under the timer.
The Crowdstrike Risk-Priority Detection Store OA, reported in October 2026, looks like a easy heap question until a PUT hits an id that already exists. Replace semantics are the edge case that breaks the naive version. If you just push every PUT onto a priority queue, GET will hand back stale scores and you'll fail hidden tests. The pattern is a heap with lazy deletion, or a sorted structure with a map beside it. If you blank under the clock, StealthCoder runs invisibly during the live OA and gives you a working solution. Here's the trick first.
The problem
Process operations "PUT id score" and "GET". PUT inserts or replaces the detection with that id. GET removes and returns the id with the highest risk score; break ties by lexicographically smaller id. Return an empty string for GET on an empty store. Return the sequence of GET results. Function processDetections(operations: String[]) → String[] Examples Example 1 operations = ["PUT a 5","PUT b 9","GET","GET"] return = ["b","a"] The higher-risk detection is returned first. Example 2 operations = ["GET"] return = [""] An empty store returns the empty sentinel. Constraints 1 <= operations.length <= 5000. Ids are nonempty lowercase strings; scores are nonnegative 32-bit integers.
Reported by candidates. Source: FastPrep
Pattern and pitfall
Keep a hash map from id to current score. Also keep a max-heap ordered by score descending, then id ascending. On PUT, update the map and push a new (score, id) entry. Don't try to remove the old one. On GET, pop the top and check it against the map. If the id is missing or its score differs from the map, it's stale, so discard it and keep popping. When a valid entry shows up, delete the id from the map and return it. If the heap empties, return an empty string. The pitfall is a re-PUT with the same score after a GET, or a replacement that lowers the score. Duplicate heap entries with matching scores are harmless once the map entry is deleted. Tie-breaking matters too: in languages with min-heaps, negate the score and compare ids normally. With 5000 operations, O(n log n) is plenty. If the tie-break or stale check slips in the live OA, StealthCoder is your hedge.
The honest play: practice the pattern, and have StealthCoder ready for the one you didn't see coming.
You can drill Risk-Priority Detection Store cold, or you can hedge it. StealthCoder runs invisibly during screen share and surfaces a working solution in under 2 seconds. The proctor sees the IDE. They don't see what's behind it. Built for the candidate who saw this exact problem leak two days before his OA and wondered if anyone had a play.
Get StealthCoderYou've seen the question.
Make sure you actually pass Crowdstrike's OA.
Crowdstrike reuses patterns across OAs. Built for the candidate who saw this exact problem leak two days before his OA and wondered if anyone had a play. Works on HackerRank, CodeSignal, CoderPad, and Karat.
Risk-Priority Detection Store FAQ
What's the trick in the Risk-Priority Detection Store problem?+
Use a map of id to current score plus a heap, and delete lazily. On PUT, update the map and push a new heap entry. On GET, pop until the top entry matches the map, then remove that id. Stale entries get skipped instead of removed.
How hard is this Crowdstrike OA question really?+
It's easy to medium. The heap part is standard. The difficulty is handling replacement on PUT and the tie-break by smaller id. Candidates who skip the stale-entry check usually fail hidden tests, not the examples.
How do I handle ties on risk score?+
Order the heap by score descending, then id ascending. In a min-heap language, store (-score, id) so the smallest tuple wins. Lowercase string comparison gives lexicographic order directly, so no custom parsing is needed for ids.
What should GET return on an empty store?+
Return an empty string and still add it to the result list. Example 2 shows [""] for a lone GET. Also treat a heap holding only stale entries as empty, since popping them all leaves nothing valid to return.
How do I prepare for this in 48 hours?+
Write a heap with lazy deletion from scratch twice. Test PUT on an existing id with a higher score, a lower score, and the same score. Test GET on empty, and a GET after all entries are removed. Parse scores as 32-bit ints, and watch the input splitting.