Security Operations
Core concepts
This domain is broad: incident response, business continuity, forensics, and monitoring. Know the incident response lifecycle: preparation, detection/analysis, containment, eradication, recovery, lessons learned. Memorize that containment comes before eradication, and that evidence preservation must happen before destructive actions. Understand the order of volatility (CPU/cache → memory → network state → disk → backups) for forensic collection.
Operations
Know change management, configuration management, and the principle that emergency changes still require documentation. Understand backup types (full, incremental, differential) and that restore testing is what proves a backup is valid. Know monitoring concepts: SIEM, log retention, and alert triage. Understand malware categories and that least functionality reduces attack surface.
Traps
A classic trap is choosing "eradicate" before "contain" in an active incident - contain first. Another is collecting disk before memory, violating order of volatility. Watch for questions where the answer is "notify management/legal" early for a suspected breach with legal implications. Also, backups that are never tested are a false sense of security.
Rule of thumb
In an active incident, ask: Is it contained? Is evidence preserved? Is the business protected? Containment and evidence preservation generally outrank root-cause eradication until the situation is stable.