Security Operations and Incident Response Fundamentals
Security Operations and Incident Response Fundamentals
This domain tests whether you can separate routine security operations from a real incident and apply a recognized response lifecycle. Expect questions that give you a log entry, a user report, or a policy snippet and ask what happens next, who owns the action, and how the case is prioritized.
Core rules and concepts
- An event is any observable occurrence; an incident is an event that actually or potentially violates security policy. A single failed login is an event; confirmed password spraying against privileged accounts is an incident.
- The NIST SP 800-61r2 lifecycle is: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity.
- A SOC monitors and triages; a CSIRT/CERT handles escalated incidents. Tier 1 triage, Tier 2 investigation, and Tier 3 hunting/advanced response is a common staffing model.
- Severity reflects business impact and scope, not just the alert's technical score. Consider data sensitivity, system criticality, blast radius, and whether the adversary is still active.
- Playbooks are prescriptive for a known scenario; runbooks are operational procedures. Both must define escalation, evidence preservation, and communication paths.
Worked example
A user reports a suspicious invoice email. The attachment hash is unknown, the sender domain is a lookalike, and no one opened the attachment. Reasoning: this is a security event and a potential phishing incident, but impact is low because execution did not occur. Triage confirms quarantine caught the message for two of three recipients. Because no credential entry or execution is evident, severity is Low/Medium; the analyst blocks the sender, searches for other recipients, and documents the outcome. CSIRT escalation is not automatic unless scope expands.
Traps
Do not label every alert an incident; do not contain before scoping; do not skip documentation because an alert was benign; do not confuse the SOC's monitoring role with the CSIRT's response authority.