Security Operations
Core ideas
Security operations is the day-to-day execution of security: monitoring, triage, tuning, and continuous improvement. Understand the SOC roles and the value of a runbook for repeatable response. Log management, retention, and time synchronization are operational essentials; without accurate time, correlation fails.
Monitoring and metrics
Know the difference between a false positive (alert on benign activity) and a false negative (missed malicious activity). Tuning reduces false positives but must not create false negatives. Metrics such as mean time to detect (MTTD) and mean time to respond (MTTR) measure operational effectiveness.
Change and configuration management
Change management ensures modifications are reviewed and approved, reducing outages and security regressions. Configuration management keeps systems in a known-good baseline. Vulnerability management is a continuous cycle: discover, prioritize, remediate, verify.
Traps in questions
A frequent trap is over-tuning a detection to silence noise, which raises false negatives. Another is treating a vulnerability scan report as a completed remediation; scanning is discovery, not fixing. Watch for questions that ask for the most effective operational metric versus a vanity metric.
Worked example
An analyst sees hundreds of alerts from one rule. The wrong move is to disable the rule. The right move is to tune thresholds and add context, verify the rule still catches true attacks, and document the change through change management.
Rule of thumb
Reduce noise without blinding the detection. Every operational change should be reviewed, logged, and reversible.
Governance and Compliance
Core ideas
Governance sets direction through policies, standards, procedures, and guidelines. Policies are high-level management intent; standards are specific requirements; procedures are step-by-step; guidelines are recommendations. Know the hierarchy, because questions test which document does what.
Risk and compliance
Risk management identifies, assesses, treats, and monitors risk. Compliance maps controls to frameworks and regulations. Understand the difference between a control framework (e.g., a catalog of controls) and a regulation (a legal requirement). Audits verify that controls operate effectively; gap assessments compare current state to a target.
Roles and responsibilities
Senior management owns risk acceptance; the security team advises and implements; data owners classify data; data custodians maintain it. Separation of duties and least privilege apply to governance too. Business continuity and disaster recovery plans support availability; BCP keeps the business running, DR restores IT after a disaster.
Traps in questions
A common trap is confusing a policy with a procedure, or assuming the security team can accept risk on behalf of the business. Risk acceptance is a management decision. Another trap is treating BCP and DR as identical; BCP is broader and business-focused, DR is IT recovery-focused.
Worked example
An organization must comply with a new regulation. The correct sequence: perform a gap assessment against the requirement, update policies and standards, implement or adjust controls, then audit to verify effectiveness. Writing a policy alone does not achieve compliance.
Rule of thumb
Policy says what and why, standards say specifics, procedures say how, guidelines say recommended. Management owns and accepts risk.