Security Operations and Incident Response
This domain tests the operational loop: telemetry, detection, triage, response and learning. Questions ask for the correct lifecycle phase, the right first action, and correct handling of evidence.
Core rules and concepts
- SOC functions: monitoring, triage, investigation, threat hunting and detection tuning. SIEM normalises and correlates logs; SOAR automates repeatable steps; detection engineering converts intelligence into use cases.
- NIST SP 800-61 lifecycle: Preparation; Detection and Analysis; Containment, Eradication and Recovery; Post-Incident Activity.
- Metrics: MTTD, MTTA, MTTR, plus alert fidelity. True and false positive rates matter more than alert volume.
- Triage: validate the alert, scope affected assets and identities, assign severity from business impact and data sensitivity, escalate per the playbook.
- Containment choices: isolate the host, disable the account, revoke sessions and tokens, block indicators at proxy or DNS, segment the network. Short-term containment stops spread; long-term containment supports rebuild.
- Evidence: preserve before modifying. Order of volatility runs from CPU and cache, to memory, network state, running processes, disk, logs, backups, archival. Maintain chain of custody, hash evidence, use UTC timestamps.
- Communication: named severity-based escalation, legal and privacy involvement for personal data, one incident commander.
Worked example
Users report a convincing Microsoft 365 sign-in page. Analysis shows a successful login from a new country plus a new OAuth consent grant. First action is identity containment: disable the account, revoke refresh tokens and sessions, remove the illicit consent grant, reset credentials with phishing-resistant MFA. Then scope: search sign-in logs for the same address range and inspect mailbox rules for silent forwarding. Eradicate by purging the phish from all mailboxes, recover access, and monitor for re-entry. Post-incident, add a detection for new consent grants and tighten conditional access. Log capture runs in parallel, but identity containment comes first because it stops the attacker.
Traps that cost marks
- Reimaging before containment and evidence capture.
- Treating recovery as the end of the incident and skipping lessons learned.
- Setting severity from alert count rather than business impact.
- Missing identity persistence: tokens, consent grants, mail rules, app registrations and MFA method changes.