Incident response
Domain 4: Security Operations · Not started
Main exam topics
Hardening; asset and vulnerability management; monitoring and alerting; identity and access management; automation; firewalls and endpoint protection; log interpretation; incident detection, containment, eradication and recovery; forensic evidence and chain of custody.
SY0-701 topic overview · Independent study resource, not a prediction of exam questions.
The process
Incident response follows preparation, detection, analysis, containment, eradication, recovery, and lessons learned. Preparation builds the team, tools, contact lists, and playbooks. Detection and analysis confirm an incident and determine scope. Containment limits damage, eradication removes the cause, recovery restores normal operation, and lessons learned improve future response.
Containment and evidence
Isolate affected systems before wiping them. Collect evidence in order of volatility: CPU cache and registers, memory, temporary files, disk, then remote logs and backups. Maintain chain of custody documenting who handled evidence and when. Legal hold preserves relevant data when litigation is expected. Hashing images proves they were not altered.
Exercises and analysis
Tabletop exercises discuss scenarios, simulations practice them, and root cause analysis identifies why the incident happened. Threat hunting proactively searches for attackers that have evaded detection.
Exam approach
Questions often ask what to do next. Identify the current phase. If the incident is confirmed and spreading, contain. If it is contained, eradicate. Reimaging before evidence collection is a frequent wrong answer.
Saved