Security Operations and Incident Response
What this domain tests
Security Operations and Incident Response tests how alerts become validated incidents and how incidents are contained, eradicated, and learned from. Expect SIEM, log sources, triage, the incident-response lifecycle, evidence handling, and metrics.
Core rules
- A SOC monitors and triages; a SIEM correlates logs; SOAR automates repetitive response steps.
- The NIST incident-response lifecycle is Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity.
- Chain of custody documents who handled evidence, when, and how, preserving integrity for legal or HR use.
- Containment may be short-term, such as isolating a host, or long-term, such as rebuilding a segment. Preserve evidence before destructive actions when possible.
- Useful metrics include MTTD and MTTR, plus alert false-positive rates and containment time.
Worked example
A user reports a suspicious invoice attachment. Triage confirms a malicious macro and outbound traffic to an unknown host. Contain the endpoint, disable the account, block the destination, collect logs and memory, then eradicate the malware and restore from a clean image. Notify according to policy, and hold a post-incident review with corrective actions.
Traps that cost marks
- Wiping and rebuilding a host before collecting evidence.
- Confusing eradication with recovery: removing malware is not the same as restoring trusted service.
- Treating every alert as an incident without validation.
- Missing regulatory or contractual notification timelines in the response plan.