🚨 Security Operations

Domain 7 — Choose a game to play

Match incident response, chain of custody, SIEM, IPS, DRP, SOAR, and MTTR to their descriptions.

RAID keeps the system running. Backup recovers the data. Ransomware faithfully mirrors encrypted data to RAID. Match each characteristic.

Order all 8 ISC2 eDiscovery steps. Preserve = legal hold. Collect = chain of custody. Process ≠ Review.

Differential vs Incremental — archive bit, restore time, storage tradeoffs. Exam rule: minimize restore time → Differential.

Match OEP, BCP, COOP, DRP, and MTD to their scenarios. People first → Business → IT. Know the order.

Scenario quiz: when is SIEM the best answer? When is NIPS? When is NGFW? Pick the right control from 5 real-world scenarios.