Security Operations and Incident Response
This chapter focuses on running security day to day: detecting threats, responding to incidents, and recovering from disruption. You will learn the incident response lifecycle, monitoring tools like SIEM and EDR, hardening and patching, digital forensics, and resilience metrics. Effective operations turn prevention into detection and recovery when prevention fails.
Incident Response Lifecycle
A structured incident response process ensures that events are handled consistently under pressure and that every incident feeds improvement back into the program. SY0-701 uses a lifecycle you should know in order: preparation, detection, analysis, containment, eradication, recovery, and lessons learned. Preparation builds the capability before anything happens: an incident response plan and policy, a trained and named response team with clear roles, communication and escalation paths, tooling, and predefined playbooks for common scenarios such as ransomware or business email compromise. Detection identifies that something abnormal is occurring, drawing on alerts from monitoring systems, user reports, and threat intelligence. Analysis scopes the incident, determining what happened, which systems and data are affected, how the attacker got in, and how severe the impact is, so responders can classify and prioritize it. Containment isolates affected systems to stop the spread while preserving evidence; short-term containment might quarantine a host or block an address immediately, while long-term containment applies more durable fixes, and responders must balance speed against evidence preservation. Eradication removes the threat entirely, deleting malware, closing the exploited vulnerability, disabling compromised accounts, and rebuilding systems from known-good images. Recovery restores systems to normal operation, validates that they are clean, monitors closely for signs of return, and carefully times the return to production. Lessons learned, conducted in a blameless post-incident review, examines what worked and what did not and turns findings into concrete improvements to controls, plans, and training, closing the loop. Supporting these phases are documented processes the exam expects you to recognize: training and testing through tabletop exercises, simulations, and full drills; threat hunting that proactively searches for adversaries who evaded detection; and root cause analysis that identifies the underlying cause rather than only the symptom. Digital forensics activities, including legal hold, acquisition, preservation, and reporting, often run alongside response when an incident may lead to litigation. Clear communication with leadership, legal, public relations, customers, and regulators is part of a mature response, because how an organization communicates during an incident can matter as much as the technical remediation.
Monitoring and Detection
Continuous monitoring surfaces the threats that slip past preventive controls, and centralized visibility with automation lets a small team keep watch over a large environment. A security information and event management system, or SIEM, aggregates logs from servers, network devices, applications, and security tools into one place, then correlates them to detect patterns that no single source would reveal, supports investigation and alerting, and retains data for compliance. The quality of a SIEM depends on the log sources feeding it, so the exam expects you to know what to collect: operating system and application logs, firewall and IPS logs, endpoint and authentication logs, DNS and web proxy logs, and vulnerability scan output, along with metadata and network flow data. An intrusion detection system alerts on malicious or anomalous traffic, while an intrusion prevention system sits inline and can actively block it; both may be network-based or host-based. Endpoint detection and response, or EDR, records detailed endpoint activity, detects suspicious behavior, and enables investigation and automated response on the host, while extended detection and response, XDR, correlates across endpoints, network, cloud, and identity. Detection methods split into signature-based, which matches known indicators and is precise but blind to novel attacks, and anomaly or behavior-based, which flags deviations from an established baseline and can catch new attacks at the cost of more false positives. Security orchestration, automation, and response, or SOAR, executes playbooks to automate repetitive response steps such as enriching an alert, isolating a host, or opening a ticket, cutting analyst workload and mean time to respond. The exam also covers the tooling and telemetry around monitoring: agent-based versus agentless collection, network taps and port mirroring, SNMP traps and NetFlow, benchmarks and file integrity monitoring, data loss prevention to catch exfiltration, and alert tuning to manage volume and reduce false positives and false negatives. Threat intelligence feeds, indicators of compromise, and frameworks like MITRE ATT&CK give analysts context to interpret what they see. Effective monitoring transforms prevention into detection, giving defenders the chance to respond before an intrusion becomes a breach.
Hardening, Patching, and Forensics
Reducing the attack surface and handling evidence correctly are core operational duties, and both appear frequently on SY0-701. Hardening applies secure baselines and disables everything not needed: unnecessary services, open ports, default and unused accounts, and insecure protocols are removed, strong configurations are enforced, and the result is measured against a benchmark such as those from CIS. You should be able to harden diverse targets: servers and workstations, mobile devices, network appliances, cloud infrastructure, industrial control and SCADA systems, embedded and IoT devices, and specialized systems, each with its own considerations. Endpoint protection layers antivirus, EDR, host firewalls, host intrusion prevention, application allow-listing, and disk encryption. Mobile device management enforces policy on phones and tablets, and deployment models such as bring your own device, corporate-owned, and choose your own device shape the controls, as do connection methods and the risks of jailbreaking or sideloading. Patch management is the disciplined cycle of identifying, testing, and deploying vendor updates promptly to remediate known vulnerabilities, using maintenance windows, staged rollouts, and rollback plans, because unpatched and end-of-life systems are a leading breach cause. Change management underpins all of this, requiring approval, documentation, testing, and rollback so that hardening and patching do not cause outages. Digital forensics preserves evidence so it remains admissible and useful. The chain of custody documents every person who handled evidence and every transfer, establishing an unbroken record. Forensic acquisition follows an order of volatility, capturing the most fleeting data such as memory and cache first, and creates a bit-for-bit forensic image, hashing both the original and the copy to prove nothing was altered. Legal hold suspends normal deletion once litigation is anticipated, and e-discovery locates relevant data. Secure data disposal renders data on retired media unrecoverable through cryptographic erasure, degaussing of magnetic media, or physical destruction, with a certificate of destruction as proof. Tracking assets from acquisition through assignment, monitoring, and sanitized disposal ties hardening and forensics together across the full lifecycle.
Resilience, Recovery, and Assessment
Operations must plan for disruption and validate defenses proactively, and the exam ties recovery metrics to the assessment activities that keep an organization ready. Backups are the foundation of recovery, and you should distinguish the strategies: a full backup copies everything, a differential backup copies all changes since the last full and grows over time, and an incremental backup copies only changes since the last backup of any kind, minimizing backup time but lengthening restore. The 3-2-1 rule, three copies on two media types with one offsite, plus offline or immutable copies, defends against ransomware that seeks out and encrypts connected backups, and every backup strategy is only as good as its tested restore. Two metrics drive recovery planning: the recovery time objective is the maximum tolerable downtime for a function, and the recovery point objective is the maximum tolerable data loss expressed as a point in time; related measures include mean time to repair and mean time between failures. Recovery sites trade cost against speed, with hot sites recovering almost immediately at the highest cost, warm sites needing setup, and cold sites being inexpensive but slow to activate. Proactive assessment finds weaknesses before attackers do. Vulnerability scanning identifies known weaknesses without exploiting them and can run authenticated for depth or unauthenticated from an attacker's view, producing findings that must be validated to weed out false positives and prioritized using severity scores such as CVSS and context. Penetration testing goes further, actively exploiting weaknesses to prove real risk, conducted as unknown, partially known, or known environment engagements, with defined rules of engagement and scope. Responsible disclosure and bug bounty programs channel outside researchers, and audits, both internal and external, along with attestation, verify that controls operate as intended. Testing the plans themselves matters as much as testing the systems: tabletop exercises walk through scenarios on paper, simulations and technical drills exercise the actual response, and failover and parallel processing tests confirm that recovery works. Together these activities turn resilience from a hope into a measured, repeatable capability that the business can rely on when an incident strikes.
Last updated: September 2026
La práctica sigue gratis. La guía completa de CompTIA Security+ (SY0-701) es el material en sí, explicado de principio a fin — un PDF + EPUB descargable que conservas.