Security Operations
Security Operations tests day-to-day detection, response, continuity, and forensic discipline. Questions focus on incident response phases, evidence handling, monitoring, change control, and recovery metrics.
Core rules and concepts
- Incident response phases: preparation; detection and analysis; containment; eradication; recovery; lessons learned. Containment limits damage before eradication removes the cause.
- Order of volatility guides evidence collection: CPU registers and cache, memory, network connections, disk, backups, archival media. Powering off a host can destroy volatile evidence.
- Chain of custody documents who handled evidence, when, and how; hash values support integrity.
- SIEM correlates logs; tuning reduces false positives. Time synchronization is essential for correlation.
- Change management approves and records changes; emergency changes are retroactively reviewed. BCP/DR metrics include RTO, RPO, and MTTR.
Worked example
A workstation shows ransomware encryption and a live network connection to a command-and-control host. The analyst isolates the switch port to contain spread, preserves memory before reboot, captures the connection table, disables the compromised account, and images the disk. Only then is the host reimaged and restored from a known-good backup. The team verifies the backup’s integrity and checks for reinfection before returning to service. Lessons learned update detection rules and backup testing.
Traps
Powering off a compromised host before capturing memory; eradicating before containing; breaking chain of custody by using uncontrolled tools; and restoring from backups without verifying they are clean.