Study guide 12: Incident response and monitoring
Domain 4: Security Operations · Not started
Main exam topics
Hardening; asset and vulnerability management; monitoring and alerting; identity and access management; automation; firewalls and endpoint protection; log interpretation; incident detection, containment, eradication and recovery; forensic evidence and chain of custody.
SY0-701 topic overview · Independent study resource, not a prediction of exam questions.
Lesson plan · 90 minutes
By the end of this lesson you will be able to:
- Order the incident response phases
- Preserve evidence with chain of custody and order of volatility
- Use logs, metadata and packet captures as data sources
- Tune SIEM alerting, SOAR and monitoring tools
Topic 12A — Incident response
Phases: preparation, detection, analysis, containment, eradication, recovery, and lessons learned. Containment limits damage (isolate a host or segment) before eradication removes the cause. Playbooks, tabletop exercises and simulations prepare the team; threat hunting looks for undetected compromise; root cause analysis prevents recurrence.
Topic 12B — Digital forensics
Collect evidence from most to least volatile: CPU cache and registers, RAM, swap, disk, then remote logs and backups. Use write blockers and hashes to prove images are unaltered. Maintain chain of custody. Legal hold preserves data for litigation; e-discovery searches it.
Topic 12C–12D — Data sources and tools
Sources: firewall, application, endpoint, OS and network logs, IDS/IPS alerts, vulnerability scans, packet captures, and metadata. A SIEM aggregates and correlates logs; tune rules to reduce false positives. SOAR automates response. Other tools: NetFlow, SNMP traps, agents, DLP and benchmarks. Alert fatigue is reduced by tuning and quarantining noisy sources.
Saved