I85PREP
⌘ K
NISP Level 1 - Security Operations study materials
NISP Level 1 - Security Operations study resources

NISP Level 1 - Security Operations: Monitoring and Incident Response

NISP Level 1 - Security Operations · Work through your exam, one topic at a time.

All guide sections

Monitoring and Incident Response

This domain tests detection engineering and the incident response lifecycle. Questions ask what to do first, what evidence to preserve, and which phase a given action belongs to.

Detection

Sources include firewall and proxy logs, DNS queries, authentication logs, EDR telemetry, application logs, cloud audit trails and threat-intelligence feeds. A SIEM correlates events into use cases: impossible travel, brute force followed by success, new service creation, mass file encryption. Tune rules to reduce false positives, because an ignored alert is worse than no alert. Indicators of compromise (hashes, IPs, domains) are cheap and perishable; behaviour-based detection survives infrastructure changes.

Incident response lifecycle (NIST SP 800-61)

  1. Preparation - plans, contacts, tooling, playbooks, training.
  2. Detection and analysis - validate, scope, classify severity.
  3. Containment, eradication and recovery - short-term containment (isolate, block), long-term containment (rebuild), remove the root cause, restore from clean backups.
  4. Post-incident activity - lessons learned, control improvements, formal report.

Evidence handling

Capture volatile data first: memory, network connections, running processes, then disk. Work on copies, hash images with SHA-256, and record the chain of custody. Do not power off a suspected host before memory is captured unless containment demands it. Maintain an incident log recording times, actors and decisions.

Worked example

A workstation shows ransomware notes and encrypted shares. First, isolate the host through EDR without shutting it down (containment). Second, capture memory and preserve logs. Third, find the entry point and check file servers for lateral movement. Fourth, restore data from an offline backup taken before encryption. Finally, patch the entry vector and rehearse the updated playbook, then record lessons learned.

Traps

  • Jumping to eradication before containment, letting the attacker keep access.
  • Shutting down or reimaging the only evidence.
  • Waiting for perfect information instead of containing and then investigating.
  • Reporting to regulators only after resolution; legal deadlines usually run from awareness.