Security Operations
Security Operations tests the daily detection-and-response cycle: collecting the right telemetry, triaging alerts, containing incidents, and improving detection. The exam favors defensible decisions under uncertainty over memorized alert names.
Core rules
- Centralize identity, endpoint, network, and cloud logs in a SIEM; normalize timestamps and preserve source time zones.
- Triage by asset criticality, identity privilege, threat severity, and corroboration. An alert is a hypothesis, not a conclusion.
- Correlate across sources: failed logins alone are weak; failed logins plus a success from a new ASN, MFA change, and endpoint process execution are stronger.
- Follow the incident response lifecycle: preparation, detection and analysis, containment, eradication, recovery, and lessons learned.
- Contain with least business disruption: disable a session, revoke tokens, isolate a host, or block a destination as appropriate; preserve evidence before destructive cleanup.
- Use threat intelligence for context, not as automatic truth. Map behavior to ATT&CK techniques to find detection gaps.
Worked example
SIEM alerts on 40 failed sign-ins for a finance user, followed by a success from an unfamiliar country and a new mailbox rule. The analyst should not close the alert because the success looks legitimate. First verify the source IP and device, check MFA results, and pull identity, VPN, EDR, and mail audit logs. If the session is active, revoke sessions and reset credentials, isolate the endpoint if it shows malicious processes, block the sending infrastructure, and escalate. Reasoning: the sequence suggests password guessing or credential stuffing followed by account takeover. Containment limits access; evidence preservation supports later scope analysis.
Traps
Do not equate 'alert closed' with 'incident resolved.' Avoid IOC-only detection that misses behavior changes. Do not eradicate before scoping, or you may destroy evidence and miss persistence. Escalating every low-fidelity alert causes fatigue; ignoring context causes misses. Also, a SIEM rule that fires constantly is not necessarily effective; tune it against known benign activity and validate with test events.