Security Operations, Monitoring and Incident Response
What this domain tests
Security Operations tests the detection-and-response pipeline: collect, detect, triage, respond, and handle evidence in a defensible way.
Core rules
- Logging: centralize into a SIEM. Key sources are EDR, firewall, proxy, DNS, identity provider and cloud audit logs. Consistent NTP time sync is mandatory for correlation.
- Detection: signature, anomaly and behavioural methods; map coverage to MITRE ATT&CK; write each use case with a hypothesis, required data source, logic and response. Tune to cut false positives without blinding the rule.
- Triage: validate the alert, scope affected assets and identities, judge severity from impact and confidence, then follow the playbook.
- IR lifecycle (NIST SP 800-61): preparation; detection and analysis; containment, eradication and recovery; post-incident activity. Containment options include host isolation, account disablement, IP blocking and token revocation.
- Forensics: order of volatility runs from CPU and registers, to memory, to network state, to disk, to remote logs and backups. Hash evidence, work from copies, and maintain chain of custody.
- Metrics: MTTD, MTTR, alert-to-incident ratio, and coverage against the ATT&CK matrix.
Worked example
An impossible-travel alert fires for a finance user: logins from two countries within 20 minutes. Triage: confirm the source IPs and device identifiers, check the MFA result, review mailbox rules and file access, then revoke sessions and reset credentials, notify the user and preserve identity-provider logs. Reasoning: impossible travel can be a VPN or a false positive, so verify before disrupting the user; but session revocation is fast and reversible, while waiting risks data loss. Order matters - preserve logs before making account changes that overwrite state.
Traps that cost marks
- Containing a suspected intrusion first and destroying volatile memory evidence.
- Labelling every alert an incident; an alert is a signal requiring triage.
- Powering off a compromised host instead of isolating it from the network.
- Writing detection rules without naming the data source that must be ingested.
- Reporting MTTR without defining when the clock starts.
Governance, Compliance and Cyber Law
What this domain tests
This domain tests the hierarchy of security documentation, the frameworks auditors measure against, legal obligations after a breach, and resilience planning through BCP and DR.
Core rules
- Document hierarchy: policy states intent and is mandatory, approved by management; standards give specific measurable requirements; procedures give step-by-step instructions; guidelines are recommended practice. A policy is not a configuration item.
- Frameworks: ISO/IEC 27001 defines an ISMS with Annex A controls and is certifiable by external audit; the NIST CSF 2.0 functions are Govern, Identify, Protect, Detect, Respond and Recover; SOC 2 reports on trust services criteria; PCI DSS governs cardholder data; HIPAA governs protected health information; GDPR governs EU personal data.
- Governance: risk appetite and tolerance set by leadership, defined roles such as CISO and steering committee, third-party and supplier risk management, awareness training, internal versus external audit, and tracked corrective actions.
- Legal: breach notification timelines, data-subject rights, cross-border transfer restrictions, e-discovery, evidence admissibility, contractual liability and due care.
- Resilience: a BIA comes first; RTO is the maximum tolerable downtime, RPO the maximum tolerable data loss measured backwards from the outage; then BCP and DR strategies, tested through tabletop and failover exercises.
Worked example
A payment processor specifies RTO 4 hours and RPO 15 minutes. Design: synchronous or near-synchronous replication to a warm standby in a second region, automated failover, and a runbook drilled quarterly to prove the 4-hour restore. Nightly backups alone would breach the 15-minute RPO by hours. Reasoning: RTO measures time to restore service forward from the outage; RPO measures acceptable data loss backward from the outage. Replication lag must stay under 15 minutes for the design to hold.
Traps that cost marks
- Swapping RTO and RPO.
- Treating a certification as a legal safe harbour.
- Assuming GDPR applies only to organizations established in the EU - it follows the data subject.
- Quoting a guideline as if it were a mandatory policy.
- Writing a DR plan with no test evidence.