Domain 428% of scored content
Security Operations
The day-to-day work: hardening and asset management, vulnerability management, monitoring, identity and access, automation, incident response, and investigations.
9 topics
About 19 minutes of reading
- 4.1Security techniques for computing resourcesEvery device class needs its own hardening. This objective covers secure baselines, hardening targets from mobile phones to ICS, wireless security settings, application security, sandboxing, and monitoring.2 min read
- 4.2Asset managementYou can't protect what you don't know you have. Asset management covers acquisition and procurement, assignment of owners, classification, monitoring and inventory, and secure disposal with sanitization, destruction, certification, and data retention.2 min read
- 4.3Vulnerability managementVulnerability management is a loop: identify weaknesses, analyze and prioritize them, respond, validate the fix, and report. The exam covers identification methods, CVSS and CVE, false positives and negatives, exposure factor, and remediation choices.2 min read
- 4.4Alerting and monitoringMonitoring turns raw events into alerts that people can act on. The objective covers what to monitor, the activities (log aggregation, alerting, scanning, reporting, archiving, alert response and tuning), and the tools: SCAP, benchmarks, agents, SIEM, antivirus, DLP, SNMP traps, NetFlow, and vulnerability scanners.2 min read
- 4.5Enhancing enterprise securityThis scenario objective asks what to change in the environment: firewall rules, IDS/IPS signatures, web filters, operating system security, secure protocols, DNS filtering, email security, file integrity monitoring, DLP, network access control, EDR/XDR, and user behavior analytics.2 min read
- 4.6Identity and access managementIdentity is the new perimeter. This objective covers provisioning and deprovisioning, identity proofing, federation and single sign-on, access control models, multifactor authentication, password practices, and privileged access management.3 min read
- 4.7Automation and orchestrationAutomation does repeatable tasks without people; orchestration links automated tasks into workflows. The objective lists use cases, benefits, and the risks of automating too much or too carelessly.2 min read
- 4.8Incident responseIncident response follows a defined process: preparation, detection, analysis, containment, eradication, recovery, and lessons learned. This objective also covers training, testing, root cause analysis, threat hunting, and digital forensics.2 min read
- 4.9Data sources for investigationsInvestigations depend on choosing the right evidence. This objective covers log data from firewalls, applications, endpoints, operating systems, IPS/IDS, and the network, plus metadata, and other sources such as vulnerability scans, automated reports, dashboards, and packet captures.2 min read