Operations and Incident Response
This domain tests whether you can keep services running and handle a live intrusion without destroying the evidence you will need later.
Operational hygiene
- Change and configuration management against documented baselines; maintain a CMDB; patch on severity-based SLAs.
- Backups: 3-2-1 with at least one immutable or offline copy; record restore tests, not just backup jobs.
- BCP/DR: RTO is the time to restore service; RPO is acceptable data loss measured backwards from the incident.
Incident response lifecycle (NIST SP 800-61)
- Preparation. 2. Detection and Analysis. 3. Containment, Eradication and Recovery. 4. Post-Incident Activity.
- Containment choices: isolate by switch port, VLAN, or host firewall; disable the account; block the hash or IP. Prefer isolation over shutdown.
- Order of volatility (RFC 3227): CPU and cache, memory, network state, running processes, disk, then backups and archives.
- Chain of custody: who, what, when, where, why; hash before and after transfer.
Worked example
Ransomware on a file server. Reasoning: do not power off, because memory holds encryption keys and the process list. Capture memory, then image the disk. Isolate at the switch port. Preserve logs centralised off-host. Verify backups are immutable before eradication. Restore, validate integrity, watch for reinfection, then run lessons learned and update detections. Notifications follow legal and regulatory timelines, not convenience.
Traps
Pulling the plug and losing volatile evidence; deleting malware before imaging; reinstalling without proving backups are clean; declaring an incident before confirming scope; confusing BCP invocation with incident declaration; skipping lessons learned.