Security Operations, Incident Response and Risk Management
Domain focus
Security Operations, Incident Response and Risk Management tests monitoring, detection, response phases, risk assessment, controls and continuity planning rather than isolated tool names.
Core rules and concepts
- A SOC monitors alerts and logs; a SIEM correlates events. Use cases should map to risks, not collect data without purpose.
- Incident response phases: preparation; detection and analysis; containment, eradication and recovery; post-incident lessons learned.
- Containment may be short-term or long-term; preserve evidence while stopping spread. Do not destroy logs during cleanup.
- Risk is commonly assessed as likelihood times impact. Treatments are avoid, reduce, transfer or accept; residual risk remains.
- Controls can be preventive, detective or corrective. RTO is the target recovery time; RPO is the acceptable data loss window.
- Tabletop exercises test decisions and communications before a real incident.
Worked example
Several staff report a credential-phishing email. The analyst confirms the sender, identifies clicked accounts, resets passwords, revokes sessions, enables MFA, searches mail logs for similar messages, blocks the domain and records the timeline. Reasoning: containment protects accounts; log searching finds other victims; documentation supports lessons learned and legal review.
Traps that cost marks
Do not say risk can be eliminated completely. Do not begin by deleting evidence. Do not confuse RTO with RPO. Do not treat a SIEM as an automatic responder. Do not skip lessons learned because service is restored.