Security Operations

The heaviest domain — nearly a third of the exam. Nine objectives spanning system hardening and secure baselines, hardware/software/data asset management, vulnerability management lifecycle, security monitoring and alerting (SIEMSecurity Information and Event Management — Centralized log collection, correlation, and alerting, SOARSecurity Orchestration, Automation, and Response — Automates security operations workflows, EDREndpoint Detection and Response — Monitors endpoints for threats and enables response/XDRExtended Detection and Response — EDR extended across network, cloud, email, identity), identity and access management (federation, MFAMulti-Factor Authentication — Requiring multiple authentication factors, access control models, PAMPrivileged Access Management — Securing and monitoring privileged accounts), enterprise security enhancement (firewalls, IDSIntrusion Detection System — Monitors and alerts on suspicious activity (passive)/IPSIntrusion Prevention System — Detects and blocks suspicious activity (inline), email security, DLPData Loss Prevention — Prevents unauthorized data exfiltration, NACNetwork Access Control — Enforces security policy on devices connecting to network), automation and orchestration, incident response (preparation through lessons learned), and forensic data sources.

Four of the nine objectives are “Given a scenario” (PBQ-likely): 4.1 (security techniques), 4.5 (IAMIdentity and Access Management — Framework for managing digital identities and permissions), 4.6 (enterprise capabilities), and 4.9 (investigation data sources). This is where the most study time goes and where the most labs are built.

Touches every offensive discipline: hardening as friction multiplication, packet analysis and TLSTransport Layer Security — Port 443 (HTTPS). Encryption protocol for data in transit fingerprinting for monitoring, incident response under an assume-breach model, understanding attacker automation to build better detection, and purple team feedback loops between offense and defense.