OSIR study plan

Define the incident response lifecycle phases and sequence them in writing without notes

Compare at least four security-operations roles and list the decision authority each holds during an active incident

Diagram a sample escalation path from tier-1 analyst to incident commander, labeling handoff triggers

Write a one-page glossary of 20 core terms covering triage, containment, eradication, and recovery

Map common detection data sources (endpoint telemetry, DNS, proxy, authentication logs) to the attack behaviors each reveals

Build a table of at least 15 detection signals with the log source, the observable, and the false-positive drivers for each

Explain how a detection rule moves from hypothesis to tuned production alert, including baselining steps

Draft three original detection hypotheses for credential misuse and state what evidence would confirm or refute each

Trace a synthetic multi-stage intrusion through logs and identify the earliest defensible detection point

Prioritize alerts from a written triage scenario using an explicit severity rubric you construct

Distinguish true positives from benign triggers in at least five worked alert examples

Produce a triage decision record that documents rationale for escalating and closing alerts

Write containment, eradication, and recovery steps for three distinct incident types (ransomware, business email compromise, insider data theft)

Select containment strategy per scenario and justify the tradeoff between speed and evidence preservation

Draft a communication cadence for an incident lasting more than 48 hours, including stakeholder update intervals

Build a post-incident review template that captures root cause, control gaps, and corrective actions with owners

Apply order-of-volatility principles to rank at least eight evidence sources by collection urgency

Write a chain-of-custody form and a collection log that record who, what, when, where, and integrity checks

Explain how hashing supports evidence integrity and where it does not substitute for proper handling

Outline legal and privacy constraints that limit collection on employee endpoints and third-party systems

Interpret network flow records to separate normal egress from beaconing behavior, citing interval and jitter patterns

Analyze DNS and proxy evidence to identify tunneling or data-staging indicators

Explain what full packet capture adds over flow data and when each is the right collection choice

Document at least six network indicators with the sensor type that would surface each one

Draft an executive incident summary that states impact, current status, and decisions needed in under 300 words

Identify regulatory and contractual notification triggers and the timelines attached to each for a given scenario

Distinguish what technical detail belongs in an analyst report versus a leadership brief

Write a lessons-learned report that links each finding to a specific control improvement

Run a timed full-length practice assessment and record per-domain accuracy

Re-study the two weakest domains using your own notes and detection matrix

Re-derive the incident lifecycle, evidence handling rules, and notification timelines from memory

Review every missed practice question and write a corrected explanation for each