Security Operations
What this domain tests
Security Operations tests the detect-investigate-respond loop. Expect Cortex XDR and Cortex XSIAM concepts, alert grouping, telemetry sources, threat intelligence, automation, and incident response actions. The exam favors causal reasoning over alert-by-alert reaction.
Core rules
- XDR ingests endpoint, network, cloud, and identity telemetry, normalizes it, and groups related alerts into an incident. A causality chain links a process to its parent, child processes, network connections, and files.
- Detections come from behavioral analytics, indicators, custom BIOC rules, and third-party feeds. Tuning changes detection logic or exceptions; it should not simply silence a noisy rule.
- Investigation establishes scope: which hosts, users, and accounts are involved, what executed, and whether data left. Response actions include isolate endpoint, terminate process, quarantine file, block hash or domain, and disable user account.
- SOAR playbooks automate enrichment and containment tasks. Destructive actions should have approval gates and clear rollback paths.
Worked example
A finance laptop opens a Word document, then PowerShell runs an encoded command and contacts a rare domain. XDR shows the Word process as parent, PowerShell as child, and a later rundll32 execution. The analyst isolates the endpoint, collects a triage package, blocks the domain and hash, and searches the estate for the same causality pattern. Because the chain links the document to execution and command-and-control, it is one incident, not three unrelated alerts.
Traps that cost marks
Do not close alerts individually when they share a root cause. Do not contain a host before preserving volatile evidence unless the risk demands it. Do not automate account deletion without approval. Do not ignore identity or cloud telemetry that explains lateral movement. Do not confuse a benign admin script with malware solely because it uses PowerShell.