Security Operations and Incident Response
Visibility before action
Operations is largely about knowing what normal looks like: centralized logging, a SIEM correlating events, a SOC triaging alerts, asset inventories, configuration baselines, change management and vulnerability management (scan, prioritize by risk, patch, verify). A vulnerability scan enumerates weaknesses; a penetration test safely exploits them; a red team exercises people, process and technology together. Backups follow 3-2-1 (three copies, two media, one offsite), should be immutable, and must be tested - ransomware targets backups first.
Incident response lifecycle
Prepare (plan, roles, contact lists, playbooks, tabletop exercises); detect and analyze; contain, eradicate and recover; then post-incident activity - lessons learned and evidence retention. Containment precedes eradication: isolate the host, preserve evidence, scope the intrusion, then remove the cause and restore from known-good backups. Forensics follows order of volatility (registers and memory, then disk, then logs, then archival media) and chain of custody. For a live malware host, isolate the network connection rather than powering the machine off, which destroys volatile evidence.
Social engineering and malware
Phishing, vishing, smishing, pretexting, tailgating and business email compromise target people, so awareness training plus verification procedures are the control. Know the malware families: virus, worm, trojan, ransomware, rootkit, spyware, logic bomb.
Rule of thumb
If an answer option says "shut down the machine" or "delete the malicious file" early in an incident, reject it - contain, preserve, then eradicate. Asked what to do first, the answer is usually to follow the plan: notify, isolate, document.