Security Operations, Monitoring, and Cloud Security
Domain 8: Security Operations, Monitoring, and Cloud Security
This domain tests continuous visibility and response across on-premises and cloud environments. Expect questions on SOC workflows, log sources, SIEM tuning, detection engineering, baselines, cloud shared responsibility, CSPM, CIEM, workload identity, and cloud-native logging.
Core rules and concepts
- Monitoring starts with requirements: which assets, data, and threats matter; which log sources answer those questions; how long logs are retained and protected.
- A SIEM correlates and alerts, but value depends on normalized data, tuned rules, and a response process. Alert fatigue is a control failure, not a badge of diligence.
- Detection engineering: define the behavior, map it to a technique, test it, measure false positives, and version the rule.
- Baselines: know normal identity, network, and API behavior. Anomalies such as a new region, unusual data volume, or disabled logging are high-value signals.
- Cloud shared responsibility: the provider secures the cloud; the customer secures what they put in it, including identity, configuration, data, and workloads. The split varies by service model.
- CSPM finds misconfigurations; CIEM analyzes identity permissions; workload identity replaces long-lived keys. Control-plane logs (for example, cloud audit logs) are essential.
Worked example
CSPM flags a storage bucket allowing public read. The team checks cloud audit logs for policy changes and data access, blocks public access, removes the offending policy, and rotates any credentials embedded in objects. They then search for other buckets with the same policy and add a preventive guardrail. Reasoning: the finding is a symptom; audit logs establish whether data was accessed; preventive policy stops recurrence. Simply clicking remediate without checking access would miss a possible breach.
Traps that cost marks
Do not assume the cloud provider secures customer data and identities. Do not centralize only host logs and ignore control-plane and identity logs. Do not create alerts without an owner and runbook. Do not treat a CSPM pass as proof of secure configuration. Do not use long-lived access keys where workload identity is available.