🔑 1. Key Concepts
- Incident Response (IR)
- Logging, Monitoring & SIEM
- Digital Forensics
- Disaster Recovery (DR) & Business Continuity (BC)
- Change Management
- Patch & Vulnerability Management
- Backup Strategies
- Physical Security Operations
- Resource Protection
📖 2. Deep Dive (Expanded)
🔹 Security Operations Overview
Security operations focus on day-to-day security activities:
- Monitoring systems
- Detecting threats
- Responding to incidents
- Maintaining secure environments
Why it matters:
Even the best-designed systems fail without proper operations.
🔹 Incident Response (IR)
A structured process to handle security incidents.
Phases:
- Preparation
- Policies, tools, training
- Detection & Analysis
- Identify and validate incident
- Containment
- Limit damage
- Eradication
- Remove root cause
- Recovery
- Restore systems
- Lessons Learned
- Improve future response
Why it matters:
Minimizes damage and recovery time.
Exam insight:
Order of phases is critical.
🔹 Logging, Monitoring & SIEM
Logging
- Records system and user activity
Monitoring
- Reviews logs for suspicious behavior
SIEM (Security Information and Event Management)
- Centralizes logs
- Correlates events
- Generates alerts
Why it matters:
Provides visibility into security events.
🔹 Digital Forensics
Process of collecting and analyzing evidence after an incident.
Key principles:
- Preserve evidence
- Maintain chain of custody
- Ensure integrity
Chain of Custody
- Tracks evidence handling from collection to court
Why it matters:
Ensures evidence is legally valid.
🔹 Disaster Recovery (DR) & Business Continuity (BC)
Disaster Recovery
- Focuses on IT systems
Business Continuity
- Focuses on entire business operations
Key metrics:
- RTO → recovery time
- RPO → data loss tolerance
Why it matters:
Ensures organization can survive disruptions.
🔹 Backup Strategies
Types:
- Full backup
- Incremental backup
- Differential backup
Storage:
- Onsite
- Offsite
- Cloud
Why it matters:
Protects against data loss.
Exam insight:
Test backups regularly.
🔹 Patch & Vulnerability Management
Patch Management:
- Applying updates to fix vulnerabilities
Vulnerability Management:
- Identifying and prioritizing risks
Why it matters:
Unpatched systems are a major attack vector.
🔹 Change Management
Controls changes to systems:
Steps:
- Request
- Review
- Approve
- Implement
- Document
Why it matters:
Prevents unauthorized or risky changes.
🔹 Physical Security Operations
Controls physical access:
- Guards
- CCTV
- Badges
- Locks
Why it matters:
Physical access = system compromise.
🔹 Resource Protection
Protecting assets such as:
- Hardware
- Software
- Data
Includes:
- Monitoring usage
- Preventing misuse
🧠 3. Manager Mindset
- Prepare before incidents happen
- Detect early, respond quickly
- Maintain visibility (logs)
- Continuously improve processes
👉 Think: How fast can we detect and respond?
❓ 4. Practice Questions
1
What is the first phase of incident response?
A. Detection
B. Preparation
C. Containment
D. Recovery
2
What is the purpose of containment?
A. Remove threat
B. Limit damage
C. Recover systems
D. Monitor logs
3
What happens in eradication?
A. Detect incident
B. Remove root cause
C. Restore systems
D. Log activity
4
What is SIEM used for?
A. Backup
B. Logging and analysis
C. Encryption
D. Monitoring users
5
What is the purpose of logging?
A. Encrypt data
B. Record activity
C. Backup data
D. Monitor users
6
What is digital forensics?
A. Backup
B. Evidence analysis
C. Monitoring
D. Encryption
7
What is chain of custody?
A. Backup process
B. Evidence tracking
C. Monitoring
D. Encryption
8
What is RTO?
A. Data loss
B. Recovery time
C. Risk
D. Threat
9
What is RPO?
A. Downtime
B. Data loss tolerance
C. Risk
D. Threat
10
What is the purpose of backups?
A. Encrypt data
B. Restore data
C. Monitor systems
D. Log activity
11
What is incremental backup?
A. Full backup
B. Changes since last backup
C. Daily backup
D. Partial backup
12
What is patch management?
A. Monitoring
B. Updating systems
C. Backup
D. Logging
13
What is vulnerability management?
A. Backup
B. Identify risks
C. Monitor logs
D. Encrypt data
14
What is change management?
A. Monitoring
B. Controlling changes
C. Backup
D. Logging
15
What is the main goal of physical security?
A. Performance
B. Protect assets
C. Backup
D. Monitoring
16
What is the purpose of monitoring?
A. Backup
B. Detect threats
C. Encrypt data
D. Store data
17
What is the BEST practice for backups?
A. One copy
B. Test regularly
C. Store locally only
D. Encrypt only
18
What is the biggest risk of no patching?
A. Performance
B. Vulnerabilities exploited
C. Storage
D. Backup failure
19
What is the purpose of incident response?
A. Prevent attacks
B. Respond to incidents
C. Monitor systems
D. Backup data
20
What is the final phase of incident response?
A. Recovery
B. Detection
C. Lessons learned
D. Containment
✅ 5. Answers + Reasoning
1
B. Preparation
Preparation ensures tools, policies, and teams are ready before incidents occur.
2
B. Limit damage
Containment prevents the incident from spreading further.
3
B. Remove root cause
Eradication eliminates the source of the incident.
4
B. Logging and analysis
SIEM systems collect and analyze logs to detect threats.
5
B. Record activity
Logs provide a record of system and user actions.
6
B. Evidence analysis
Forensics investigates incidents and collects evidence.
7
B. Evidence tracking
Chain of custody ensures evidence integrity.
8
B. Recovery time
RTO defines how quickly systems must be restored.
9
B. Data loss tolerance
RPO defines acceptable data loss.
10
B. Restore data
Backups allow recovery after data loss.
11
B. Changes since last backup
Incremental backups store only changes since the last backup.
12
B. Updating systems
Patch management fixes vulnerabilities.
13
B. Identify risks
Vulnerability management finds and prioritizes risks.
14
B. Controlling changes
Change management ensures safe system updates.
15
B. Protect assets
Physical security protects systems from physical threats.
16
B. Detect threats
Monitoring identifies suspicious activity.
17
B. Test regularly
Backups must be tested to ensure they work.
18
B. Vulnerabilities exploited
Unpatched systems are easy targets.
19
B. Respond to incidents
Incident response manages and resolves security incidents.
20
C. Lessons learned
The final phase improves future response processes.
⚠️ 6. Exam Traps
- Wrong order of incident response
- Forgetting to test backups
- Confusing RTO vs RPO
- Ignoring chain of custody
🔄 7. Flash Review
- IR phases order
- SIEM = logs + analysis
- Backups = test them
- Patch systems
- Monitor continuously
📊 8. Score
Score: ___ / 20
- 16–20 → ✅ Strong
- 10–15 → ⚠️ Review
- <10 → ❌ Re-study Domain 7