Security+ · Domain 4
Security Operations
About 28% of the exam
Baselines and hardening
- Establish, deploy, then maintain the baseline
- Harden servers, clients, mobile, network gear
- Disable unused services and ports
- Application allow list on critical hosts
- Host firewall and host intrusion prevention
- Encrypt disks and enforce screen lock
- Use SCAP content and published benchmarks
- Rescan to prove the baseline held
Mobile and wireless
- MDM
- enrolls, configures and wipes devices
- BYOD
- personal device, corporate data
- COPE
- company owned, personally enabled
- CYOD
- chosen from an approved list
- Site survey
- measures real coverage and interference
- Heat map
- signal strength drawn on plan
- WPA3
- SAE replaces the WPA2 handshake
- Enterprise wireless
- 802.1X with RADIUS and EAP
- Cellular, Bluetooth
- extra vectors needing policy
Asset lifecycle
- Acquire
- Assign an owner
- Deploy
- Monitor
- Sanitize
- Dispose and certify
- Acquisition
- procure through an approved route
- Assignment
- named owner and classification
- Inventory
- you cannot protect unknown assets
- Enumeration
- discover what inventory missed
- Monitoring
- track location and configuration
- Sanitization
- clear, purge or destroy
- Destruction
- shred, pulverize, incinerate, degauss
- Certification
- written proof of destruction
- Retention
- keep only as long as required
Clear if the media is reused internally, purge if it leaves your control, destroy if the data is too sensitive
Finding vulnerabilities
- Credentialed scans see far more
- Agent based or agentless collection
- SAST reads code, DAST attacks the running app
- Package monitoring for vulnerable dependencies
- Feeds: open source, proprietary, ISAC, dark web
- Penetration test proves exploitability
- Bug bounty and responsible disclosure
- System and process audits find gaps
Vulnerability analysis and response
Confirm the finding
- True positive: real and reachable
- False positive wastes remediation effort
- False negative is the dangerous one
- Rescan with credentials to confirm
Score and prioritize
- CVE names it, CVSS scores it
- Base, temporal and environmental metrics
- Exploit availability beats raw severity
- Asset criticality and business impact decide
- Exposure factor feeds the loss calculation
Respond and validate
- Patching is the default answer
- Segment or compensate when patching is impossible
- Exceptions need an owner and expiry
- Insurance transfers cost, not the risk
- Rescan, audit, then verify closure
A critical score on an isolated lab box loses to a lower score that is internet facing with a public exploit
Incident response and forensics
The phases
- Preparation before anything happens
- Detection and analysis
- Containment, short term then long
- Eradication of cause and persistence
- Recovery with heightened monitoring
- Lessons learned with owners and dates
Handling evidence
- Order of volatility: memory before disk
- Bit for bit image, then hash
- Write blocker on the original media
- Chain of custody stays unbroken
- Legal hold suspends normal deletion
- E-discovery answers the litigation request
Practice and hunting
- Tabletop is discussion only
- Simulation injects a live scenario
- Root cause analysis asks why repeatedly
- Threat hunting is proactive and hypothesis led
Contain first, but capture volatile memory before you pull the power or the best evidence is gone
Monitoring and alerting
- Log aggregation
- collect and normalize many sources
- SIEM
- correlates events and raises alerts
- Alert tuning
- cut noise, keep the detection
- Quarantine
- isolate the file or host
- Archiving
- hold logs for the retention period
- SNMP trap
- the device pushes an event
- NetFlow
- who talked to whom, how much
- DLP
- watches data at rest and moving
- User behavior analytics
- flags activity unlike the baseline
Tuning enterprise capabilities
- Firewall rules follow least access
- Screened subnet for public services
- IPS signatures updated and tuned
- Web filter by category and reputation
- Agent based or centralized proxy filtering
- Group policy or SELinux enforces settings
- File integrity monitoring on key files
- Network access control checks posture first
- EDR and XDR respond, not just alert
Email and DNS defenses
- SPF
- lists servers allowed to send
- DKIM
- signs the message with a key
- DMARC
- policy and reporting over both
- Email gateway
- filters spam, malware and links
- DNS filtering
- blocks known malicious domains
- DNSSEC
- signs records against poisoning
- Sandboxing
- detonate the attachment safely
- External banner
- marks mail from outside
SPF, DKIM and DMARC together stop spoofing of your own domain; any one alone leaves a gap
Identity operations
- Provisioning
- created on hire, from HR
- Deprovisioning
- disable at exit, delete later
- Identity proofing
- prove the human before issuing
- Federation
- trust another identity provider
- SSO
- one login, many services
- SAML
- enterprise browser single sign-on
- OAuth
- delegated authorization, not authentication
- OpenID Connect
- identity layer above OAuth
- Attestation
- manager recertifies who has access
- Access models
- MAC, DAC, RBAC, ABAC, rule
Passwords and MFA in practice
- Length beats forced complexity
- Screen against breached password lists
- No routine expiry without evidence of compromise
- Password manager for unique credentials
- Factors: know, have, are, where, do
- Security keys are phishing resistant
- SMS codes are the weakest factor
- Vault, rotate and record privileged sessions
- Just in time beats standing privilege
Automation and orchestration
- User provisioning
- joiners get rights automatically
- Resource provisioning
- infrastructure built from code
- Guard rails
- policy blocks unsafe configuration
- Ticket creation
- alerts open tracked work
- Escalation
- unattended tickets move up
- Continuous integration
- every build is tested and scanned
- Benefits
- speed, consistency, fewer human errors
- Costs
- complexity, technical debt, supportability
- Risk
- the platform becomes a dependency
Log sources
- Firewall log
- allowed and denied connections
- Application log
- errors and transactions
- Endpoint log
- process and file activity
- Security log
- logon success and failure
- IDS or IPS
- signature and anomaly alerts
- Network log
- flows, DNS and DHCP
- Metadata
- sender, timing and size
- Packet capture
- the full payload, briefly
- Scan report
- findings ranked by severity
Key numbers
- CVSS critical
- 9.0 to 10.0
- CVSS high
- 7.0 to 8.9
- CVSS medium
- 4.0 to 6.9
- Order of volatility
- registers, memory, disk, backups
- Response phases
- six, preparation to lessons learned
- Critical patch
- days, not months
- Log retention
- driven by regulation and investigation
Reference strip: operate, detect, respond, prove
Operate
- Baselines, hardening, configuration enforcement
- Asset inventory through to disposal
- Mobile deployment models and MDM
- Automation, guard rails, provisioning
Detect
- SIEM, log aggregation, alert tuning
- NetFlow, packet capture, SNMP traps
- DLP, file integrity monitoring, UBA
- EDR and XDR telemetry
Respond
- Preparation through lessons learned
- Short term and long term containment
- Quarantine, isolate, reimage, restore
- Root cause analysis and threat hunting
Prove
- Order of volatility and imaging
- Chain of custody and write blockers
- Legal hold and e-discovery
- Reporting to management and regulators
Identity
- Provision, attest, deprovision
- SAML, OAuth, OpenID Connect, LDAP
- MFA factors and phishing resistance
- Privileged access vaulting and just in time
Quick exam traps
- Trap: A vulnerability scan proves the flaw is exploitable
- Trap: A false negative is safer than a false positive
- Trap: A quick format counts as media sanitization
- Trap: Disabling a leaver account can wait for the paperwork
- Trap: SPF on its own stops spoofing of your domain
- Trap: Alert tuning means switching the noisy rule off
- Trap: Lessons learned is optional once service is restored
- Trap: Automation removes the need for human approval
cybercertprep.com · original revision sheet written from the public body of knowledge