Security Operations
This domain is about running security as a repeatable service rather than a series of heroic acts. Questions target process ownership, change control and the operational metrics that show the programme is working.
The operational machine
A SOC works from documented runbooks and defined escalation paths. Asset inventory is the foundation - you cannot protect, patch or monitor what you have not recorded, including cloud instances and shadow IT. Configuration management keeps hosts on the approved baseline and detects drift. Patch management follows a cycle: inventory, assess, test, deploy, verify, report.
Change and problem management
Normal changes go to the Change Advisory Board with impact analysis, a rollback plan and test evidence. Emergency changes may be pre-approved but must be documented retrospectively within a defined window. Problem management removes root causes so the same incident does not recur. Separation of duties means the person who builds a change is not the only one who approves and deploys it.
Logging and operational metrics
Centralise logs in a SIEM, set retention to match legal and evidentiary needs, protect log integrity, and synchronise clocks with NTP so correlation works. Monitor the monitoring: a log source that stops sending is itself an alert. Track outcomes such as mean time to detect, mean time to respond, patch compliance percentage and EDR coverage, not just the number of alerts raised.
Worked example
A team needs an inbound firewall rule for a vendor. The correct path is a change request naming source, destination, port, business justification and expiry date; risk review; CAB approval; implementation in a change window; verification by test; documentation; and a scheduled review to remove the rule when the contract ends. Permanent rules with no owner are a recurring audit finding.
Traps
- Treating documentation as optional for emergency changes.
- Measuring activity (alert counts) instead of outcomes (detection and response times).
- Letting one person request, approve and implement a change.
- Forgetting to decommission accounts, rules and access when a project or vendor ends.