Security Operations
Security Operations tests how you turn telemetry into resolved incidents: ingestion, normalization, detection, correlation, triage, and response. The exam favors reasoning about data quality and incident logic over memorizing console screens.
Core rules
- Detection depends on data. Identify which sources are required for the question at hand: endpoint process events, identity logs, network flows, cloud audit logs, and SaaS activity.
- Normalize before correlating. Fields such as user, host, IP, and process must mean the same thing across sources, or correlations silently fail.
- Prefer incident-centric triage over alert-centric triage. A single alert is a signal; an incident groups related alerts into a causal story.
- Map detections to MITRE ATT&CK so coverage gaps are visible by tactic rather than by product.
- Automation is for repeatable, reversible steps. Destructive or user-impacting actions need approval gates and an audit trail.
Worked example
An alert shows a workstation running an encoded PowerShell command, followed by a new service account login and outbound traffic to a rare domain. The analyst pivots on the host, user, and process to build one incident; the causality chain is execution, credential access, then command and control. The reasoning is that three separate alerts would each look low severity, but the linked sequence justifies isolation and credential reset.
Traps
Tuning out alerts before establishing a baseline. Treating every alert as an incident, which floods the queue. Automating containment without approval. Forgetting that missing logs look like clean systems. Assuming a detection name proves the technique; verify the underlying event.