Security Operations, Monitoring, and Incident Response
This domain tests detection engineering and the response lifecycle: where logs live, how alerts are tuned, how incidents are contained without destroying evidence, and how recovery targets are set. Expect questions on NIST SP 800-61 phases, order of volatility, and RTO/RPO.
Detection
Centralise logs from identity, network, endpoint, application, and cloud control planes into a store attackers cannot modify. Synchronise time, retain beyond expected attacker dwell time and per regulation, correlate in a SIEM, baseline with UEBA, and manage detections as code with tests. Map coverage to MITRE ATT&CK to expose gaps. Alert quality beats alert volume; tune or retire noisy rules.
Incident response lifecycle
NIST SP 800-61: preparation; detection and analysis; containment, eradication, and recovery; post-incident activity. Playbooks encode severity, escalation, communications, and evidence handling. Involve legal, privacy, and communications early; regulatory clocks such as the 72-hour GDPR notification start when personal-data impact is confirmed.
Forensics
Order of volatility: CPU registers and cache, memory, network state, disk, backups and archival media. Maintain chain of custody, hash evidence, use write blockers, and document tooling. Containment should preserve memory where feasible - powering off destroys volatile evidence.
Resilience
Business impact analysis drives RTO (time to restore service) and RPO (tolerable data loss). Use 3-2-1 backups with at least one immutable or offline copy, and test restores rather than only backups. Run tabletop and DR exercises; include crisis management and out-of-band communications.
Worked example
Ransomware hits a file server. Reasoning: network-contain the host through EDR rather than powering it off, preserving memory while cutting lateral movement. Capture forensic images, hunt for initial access and spread, disable compromised accounts, reset privileged credentials and the KRBTGT account if domain compromise is suspected, and verify backups are immutable and clean before restoring. Start the regulatory notification clock once personal-data impact is confirmed. Recovery is not complete until the entry vector is closed and re-entry is validated.
Traps
- Pulling the plug and losing volatile evidence.
- Leaving noisy rules running until analysts ignore all alerts.
- Log retention shorter than attacker dwell time.
- Confusing RTO with RPO.
- Backups that were never restore-tested.
- An untested IR plan with no out-of-band comms.