Methods and Procedures
Process thinking
This domain tests whether you can sequence work correctly. Know the shape of a risk assessment (identify, analyze, evaluate, treat, monitor), an incident response lifecycle (prepare, detect and analyze, contain, eradicate, recover, learn), and a change management flow (request, assess, approve, implement, verify, record).
Documentation and evidence
Understand why procedures are written, versioned, and approved, and why evidence must be retained. Questions often hinge on whether an activity was authorized and recorded, not merely performed.
Traps to watch
- Skipping containment to jump straight to eradication - questions reward stopping the spread first.
- Treating the post-incident review as optional; lessons learned is a formal step.
- Confusing a workaround (temporary fix) with a permanent remediation.
- Forgetting that testing a procedure is itself part of the method; an untested plan is an assumption.
- Assuming approval can be retroactive; change control expects approval before implementation.
Rule of thumb
For any process question, ask: What phase is this, and what must happen before it? The correct answer is usually the step that preserves evidence, limits damage, or maintains an audit trail.
Worked example
A laptop with client data is lost. Preparation already defined reporting channels. Detection confirms the loss; containment begins with remote wipe and credential revocation; eradication removes the exposed access path; recovery restores the user's working environment; lessons learned updates the device-encryption standard. Notice that containment precedes investigation of root cause - preserving evidence while limiting harm.