Security Operations: Incident Response, Evidence Handling, and Recovery
What this domain tests
Domain 7 covers running security day to day: detecting and responding to incidents, preserving evidence defensibly, keeping backups restorable, controlling change, and protecting facilities. Questions often hinge on sequencing: what happens first, and what action destroys something you cannot get back.
Core rules
- The incident response lifecycle in NIST SP 800-61 r2 is preparation; detection and analysis; containment, eradication, and recovery; and post-incident activity. NIST's newer revision frames the same work around cybersecurity framework functions. Containment precedes eradication; scope the intrusion before rebuilding.
- Order of volatility runs from processor registers and cache, to memory, to network state, to disk, to backups and archival media. Collect the most perishable evidence first, hash it, document every transfer, and maintain chain of custody. Write blockers protect disks.
- Do not power off a compromised host if memory or full-disk encryption keys are needed; isolate it from the network instead. Pulling the plug destroys volatile evidence and can trigger encryption of remaining data.
- Backups follow 3-2-1: three copies, two media types, one offsite, plus immutable or air-gapped copies and regular restore tests. Untested backups are an assumption, not a control.
- Logging requires centralized collection, synchronized time via NTP, and retention long enough for investigation and compliance; SIEM correlation supports detection, and deleting logs during response destroys both evidence and future detection.
- Disaster recovery sites are hot, warm, or cold by readiness. Change management with approval, testing, and rollback protects availability. Physical security is layered, and personnel safety outranks asset protection in fire or life-safety events.
Worked example
Ransomware is detected on a file server. The team isolates the host's network connection rather than shutting it down, captures memory, and uses EDR and SIEM data to find the initial access and any other affected hosts. Backups are checked for integrity and immutability before any restore, restoration happens to an isolated network segment, functionality is validated, and only then is the server reconnected. Legal and regulatory notification runs on its own timeline, and a post-incident review produces corrective actions.
Traps that cost marks
- Powering off a host first and losing volatile evidence.
- Eradicating and rebuilding before the scope of compromise is known.
- Restoring from backups without verifying they are clean and complete.
- Deleting logs or wiping systems during response.
- Prioritizing asset protection over personnel safety in a life-safety scenario.