Security Operations, Monitoring and Incident Response
Domain 8 covers seeing an attack and handling it in the right order. L1 items give an alert, a log excerpt or the first minutes of an incident and ask what to do next or which evidence to collect first.
Monitoring foundations
Useful detection depends on sources: operating system and security event logs, firewall and proxy records, DNS queries, authentication logs, EDR telemetry, and network flow data. These are only usable if clocks are synchronized with NTP and logs are shipped to a central store the attacker cannot edit. A SIEM correlates events across sources and raises alerts; its value depends on tuning, because an untuned SIEM produces alert fatigue and analysts start ignoring real events. Retention matters legally as well as operationally: Chinese network operators must keep network logs for at least six months.
Incident response phases
Preparation → Detection and Analysis → Containment, Eradication and Recovery → Post-Incident Activity. In practice: confirm the alert is a real incident, scope it, contain the spread, remove the cause, restore service from clean sources, then write the lessons-learned report with owners and deadlines. Communication and escalation paths are agreed in advance, including legal, privacy and regulatory notification duties.
Evidence handling
Collect in order of volatility: processor state and memory, then network connections and ARP caches, then running processes, then disk, then logs on remote systems, then backups and archives. Maintain chain of custody - who handled the item, when, where and why - and hash forensic images so integrity can be shown later. Pulling the plug destroys volatile evidence.
Worked example
A file server starts renaming files and dropping ransom notes. What is the correct sequence? Reasoning: isolate the server's network segment through the switch or EDR console rather than shutting it down, preserving memory and the encryption process for analysis. Disable the account that was used, block the identified command-and-control address, and determine the entry vector before restoring. Restore from an offline backup taken before the encryption started, verify it is clean, then rebuild the host. Post-incident, close the vector and test the backup again. Wiping and reinstalling immediately would have destroyed the evidence needed to find patient zero.
Traps that cost marks
- Powering off or reimaging before capturing volatile data.
- Deleting the malware sample before imaging the disk.
- Treating every alert as a confirmed incident, or every incident as someone else's problem.
- Skipping the post-incident review, so the same vector recurs.
Laws, Regulations, Standards and Compliance
Domain 9 tests whether you know which Chinese law or standard governs a given obligation, and how compliance differs from security. L1 questions are usually scenario matching: a data-handling practice, a system level, or a breach notification duty.
Chinese legal framework
- Cybersecurity Law (网络安全法, effective 2017-06-01) - network operators must protect systems, keep network logs at least six months, and follow the multi-level protection scheme. It underpins MLPS.
- Data Security Law (数据安全法, effective 2021-09-01) - data classification and grading, security management of data processing activities, and controls on important data and cross-border transfer.
- Personal Information Protection Law (个人信息保护法, effective 2021-11-01) - consent and notice, purpose limitation, minimum necessity, separate consent for sensitive personal information, impact assessments for high-risk processing, and rules on cross-border provision.
- Cryptography Law (密码法, effective 2020-01-01) - commercial cryptography management, with SM2, SM3 and SM4 as the national algorithms.
- Regulations on the Protection of Critical Information Infrastructure (2021-09-01) and the data export security assessment measures add obligations for CII operators.
MLPS 2.0 (GB/T 22239-2019)
Five levels of protection. Level 1 is self-protected; Level 2 and above require filing (备案) with public security; Level 3 and above require annual assessment by a qualified testing organization and stronger monitoring, redundancy and audit controls. Level 5 covers extreme national-interest systems. Grading depends on the harm from compromise to citizens, organizations and national security.
Standards and frameworks
ISO/IEC 27001 is a certifiable ISMS with a risk-driven control set; ISO/IEC 27002 gives implementation guidance; NIST CSF organizes identify, protect, detect, respond, recover; GDPR governs EU personal data with strict breach timelines; PCI DSS applies to cardholder data.
Worked example
A platform collects ID numbers and phone numbers of 1.2 million users and plans to send marketing profiles to an overseas partner. Reasoning: ID numbers are sensitive personal information, so separate consent and a personal information protection impact assessment are required, along with notice of purpose and recipient. Exporting data on that scale crosses the cross-border threshold set by the Cyberspace Administration, so a security assessment is triggered before any transfer. Marketing use needs its own lawful basis. Meeting none of these is a compliance failure even if the systems are technically well secured.
Traps that cost marks
- Treating compliance as equivalent to security: a certified system can still be breached.
- Confusing Cybersecurity Law duties with Data Security Law classification duties.
- Assuming Level 2 needs an annual third-party assessment, which is a Level 3 and above requirement.
- Forgetting that sensitive personal information needs separate consent, not bundled consent.