Security Operations
Security Operations
Security Operations questions on the CySA+ exam test whether you can say what a given control actually does, not whether you recognize a product name. Start with the detection stack: host-based telemetry (HIDS/EDR agents collecting process, file-integrity, registry, and command-line data) versus network-based telemetry (NIDS/NIPS signatures, flow analysis, full packet capture). Know the plumbing - syslog and its severity levels, SNMP traps, NetFlow/IPFIX versus full pcap, and the difference between a SPAN/mirror port and a physical network TAP. A hardware TAP is passive and lossless; a SPAN port can be oversubscribed and silently drop frames, which is a favorite exam distinction.
Expect items on indicator types: atomic (IP address, file hash, domain - trivial for an attacker to rotate), computed (a regex or byte pattern in a URI), and behavioral (a process spawning an encoded PowerShell command). Atomic indicators are cheap to change, so behavioral, TTP-based detection outlasts them.
Email and network hardening appear constantly: SPF authorizes sending IPs for a domain, DKIM cryptographically signs headers and body, and DMARC sets policy plus alignment and generates reports on top of the first two. Mixing these up loses the item.
Other recurring topics: honeypots (low vs. high interaction), sandboxing, DLP, NAC, segmentation and zero trust, TLS inspection, and SOAR automation for tier-1 triage. Automation trap: a playbook that auto-blocks on a single low-fidelity alert creates outages - enrich first, then act.
Worked example. A syslog message arrives with severity 5. Syslog runs 0 (emergency) to 7 (debug), and lower numbers are more severe. So 5 is "notice": notable but normal. Severity 2 would be critical. Candidates routinely invert this scale.