Incident Response and Application Security Monitoring
Core concepts
Know the incident response lifecycle: preparation, detection and analysis, containment, eradication, recovery, and lessons learned. Understand preparation artifacts: an IR plan, contact tree, playbooks, forensic tooling, and log retention. Know containment options (isolate host, revoke sessions/tokens, rotate keys, block at WAF) and that evidence preservation precedes destructive cleanup when legal or forensic needs exist.
Monitoring and detection
Know what to log: authentication events (success and failure), authorization denials, input validation failures, admin actions, and security-relevant configuration changes, with correlation IDs and accurate timestamps. Understand SIEM correlation, alert tuning to reduce false positives, and the value of baselining. Application-level signals include spikes in 4xx/5xx, unusual error patterns, WAF hits, and anomalous data access volume. Know that logs must be protected from tampering and that PII in logs is a privacy risk.
Traps
Questions jump straight to eradication before containment, or wipe a host before collecting evidence. Another trap: assuming a WAF block ends the incident, or that logging everything is better than logging the right events with context.
Rule of thumb
Contain first, preserve evidence, then eradicate; every incident ends with a lessons-learned action that changes a control.
Worked example
Anomalous admin logins appear from a new region. Steps: revoke sessions and rotate credentials (containment), preserve logs and snapshots (evidence), remove the foothold (eradication), restore service (recovery), then add geo-anomaly alerting (lessons learned).