Security Operations and Incident Response
Security Operations and Incident Response
This domain tests detection, triage, response, and forensic discipline. Expect questions on SOC workflows, SIEM correlation, SOAR automation, the incident response lifecycle, containment, evidence handling, and post-incident improvement.
Core rules
- The NIST SP 800-61 lifecycle is preparation; detection and analysis; containment, eradication, and recovery; post-incident activity. Some questions use identification, containment, eradication, recovery, and lessons learned variants.
- SIEM value depends on log sources, normalization, correlation rules, and tuning. A noisy rule that nobody investigates is not detection.
- SOAR automates enrichment and repetitive response, but high-impact actions should retain human approval.
- Triage establishes scope, severity, and confidence. Containment must not destroy evidence; isolation and credential revocation are common early actions.
- Forensics requires order of volatility, write blockers, hashing of images, chain of custody, and documented timestamps.
- Post-incident reviews should produce corrective actions with owners and dates, not blame.
Worked example
SIEM alerts on a successful login from an unusual country followed by PowerShell execution on a server. The analyst verifies the account owner is traveling, checks impossible-travel timing, reviews process lineage, and finds a new service installed. The analyst isolates the host, disables the account, preserves memory and disk images, and scopes other hosts with the same service. The reasoning: validate the alert before declaring an incident, then contain while preserving evidence; eradicating malware first would destroy forensic artifacts.
Traps
- Reimaging a compromised host before collecting volatile evidence.
- Declaring containment complete without scoping all affected identities and hosts.
- Confusing an event, an alert, and an incident; not every alert is an incident.