Cloud Security Operations, Monitoring, and Incident Response
What this domain tests
Cloud Security Operations, Monitoring, and Incident Response tests detection, logging, triage, containment, and forensics in elastic environments. You must know which logs the provider supplies, which the customer must enable, and how to preserve evidence before destroying it.
Core rules and concepts
- Centralize control-plane, data-plane, network, identity, and application logs in a protected account or SIEM. Enable organization trails, flow logs, DNS logs, and workload telemetry; set retention before an incident.
- Use CSPM for misconfiguration and posture, CWPP for workload protection, and SIEM/SOAR for correlation and response. Alerts need owners, thresholds, and runbooks.
- Incident response follows preparation, detection and analysis, containment, eradication, recovery, and lessons learned. In cloud, containment can be IAM revocation, security-group isolation, key disablement, or account quarantine.
- Preserve evidence: snapshot volumes, export logs to immutable storage, capture metadata and timestamps, and document chain of custody. Do not terminate the instance before acquisition unless containment requires it.
- Automate safely: response automation must have tested guardrails and audit trails, because a bad rule can isolate production.
Worked example
A compute instance is beaconing to a known command-and-control domain. First, isolate it with a deny-all security group while retaining a forensic access path; do not terminate it. Snapshot the disk and memory if supported, export VPC flow logs and identity logs to a write-once bucket, and rotate credentials that were on the instance. Scope other instances by searching for the same indicator. The reasoning is to stop spread, preserve evidence, and determine blast radius before recovery.
Traps that cost marks
- Terminating or rebuilding the instance before snapshotting evidence.
- Assuming the provider's logs cover customer application activity.
- Relying on default log retention that expires before investigation.
- Rotating credentials without checking for persistence.
- Testing response automation for the first time during an incident.