Security Operations and Management
Security Operations and Management
This domain tests the operating model: asset and vulnerability management, log collection, SIEM correlation, SOAR playbooks, incident response, change control, and security metrics. The exam favors process discipline and evidence over tool names.
Core rules
- Know the assets first: owner, criticality, exposure, software version, and data classification. A vulnerability score without asset context is not a risk decision.
- Maintain a vulnerability lifecycle: discover, validate, prioritize by exploitability and business impact, remediate or compensate, then verify. Scanning is not exploitation.
- Centralize logs with reliable time sync, retention, and integrity. Correlate identity, endpoint, network, and cloud events before declaring an incident.
- Use SOAR for repeatable enrichment and containment, but keep human approval for destructive actions.
- Follow incident response phases: preparation, detection, containment, eradication, recovery, and lessons learned. Preserve evidence and document decisions.
- Change management must cover firewall policies, VPN keys, and endpoint exclusions; unmanaged exceptions become permanent risk.
Worked example
EDR flags encoded PowerShell on a finance server. The analyst checks the process tree, parent process, user, and network connections, then correlates proxy and DNS logs. The host is isolated, memory and disk evidence are collected, credentials are reset, and the persistence mechanism is removed. After restoration, the team adds a detection rule and reviews why the script bypassed application control. Reasoning: isolation limits spread, evidence supports scope, and the final rule change addresses the root cause rather than only the symptom.
Traps
Closing alerts without evidence; treating a scanner finding as a confirmed breach; missing log time skew; and eradicating before scoping, which destroys evidence and hides lateral movement.