Monitoring and alerting
Domain 4: Security Operations · Not started
Main exam topics
Hardening; asset and vulnerability management; monitoring and alerting; identity and access management; automation; firewalls and endpoint protection; log interpretation; incident detection, containment, eradication and recovery; forensic evidence and chain of custody.
SY0-701 topic overview · Independent study resource, not a prediction of exam questions.
Collecting the right data
Monitoring starts with logs from firewalls, servers, endpoints, identity providers, and cloud services. A SIEM centralizes and correlates them so analysts can see patterns, such as many failed logins followed by a success. Time synchronization with NTP is essential; without it, events cannot be ordered reliably.
IDS and IPS
An intrusion detection system watches traffic and alerts. An intrusion prevention system sits inline and can block. Signature-based detection matches known patterns and misses new attacks; anomaly-based detection compares against a baseline and can catch new attacks but produces more false positives.
Alert quality
A false positive is an alert on benign activity. A false negative is a missed real attack, which is usually more dangerous. Tuning rules reduces noise. SOAR platforms automate repetitive response steps through playbooks. Data loss prevention watches for sensitive data leaving the organization.
Reading log scenarios
Look for repeated failures from one source (brute force), one password tried against many accounts (password spraying), unusual hours or locations, and large outbound transfers. Pick the answer that names the pattern, not just the tool.
Know the difference: IDS vs. IPS
| Aspect | IDS | IPS |
|---|---|---|
| Placement | Out of band / passive | Inline |
| Action | Alerts | Alerts and blocks |
| Risk of failure | Missed alerts | Can block legitimate traffic |
Saved