Cybersecurity Security Operations and Defensive Security Syllabus

Security Operations and Defensive Security syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Security Operations and Defensive Security in Cybersecurity, not a summary of it.

1. 1

   Security Operations Center (SOC)

   4 topics

   • SOC Roles and Tiers
   • SIEM and Log Management
   • SOAR and Automation
   • Threat Hunting
2. 2

   Monitoring and Detection

   4 topics

   • Log Sources and Correlation
   • Endpoint Detection and Response (EDR)
   • Network Traffic Analysis
   • Indicators of Compromise (IOCs)
3. 3

   Threat Intelligence

   3 topics

   • Threat Intelligence Lifecycle
   • TTPs and MITRE ATT&CK Mapping
   • Threat Feeds and Sharing (STIX/TAXII)
4. 4

   Incident Response

   3 topics

   • Incident Response Lifecycle
   • Incident Response Team and Playbooks
   • Chain of Custody
5. 5

   Digital Forensics

   4 topics

   • Forensic Process and Order of Volatility
   • Disk and Memory Forensics
   • Network and Mobile Forensics
   • Evidence Acquisition and Imaging
6. 6

   Business Continuity and Disaster Recovery

   4 topics

   • Backup Strategies and the 3-2-1 Rule
   • RTO and RPO
   • High Availability and Redundancy
   • Disaster Recovery Sites

Security Operations and Defensive Security flashcards for Cybersecurity

21 of 51 cards from the Security Operations and Defensive Security deck — real questions with worked answers.

1. What are the three tiers of a typical Security Operations Center (SOC) and their primary responsibilities?

   Tier 1 (Triage/Alert Analyst): monitors alerts, performs initial triage, escalates. Tier 2 (Incident Responder): deeper investigation, correlation, and containment. Tier 3 (Threat Hunter/SME): proactive hunting, advanced forensics, malware analysis, and tool/detection engineering.

2. What is the primary difference between a SOC analyst's role and that of a SOC manager?

   Analysts perform hands-on detection, investigation, and response of security events, while the SOC manager oversees staffing, processes, metrics, escalation paths, and coordination with the broader business and CISO.

3. Define SIEM and state its two core functions.

   A SIEM (Security Information and Event Management) is a centralized platform that (1) aggregates and normalizes log/event data from many sources (log management) and (2) correlates and analyzes them in real time to generate security alerts.

4. In log management, what is the difference between log aggregation, normalization, and correlation?

   Aggregation collects logs from multiple sources into one place; normalization converts them into a common, structured format/schema; correlation links related events across sources using rules to detect meaningful patterns or attacks.

5. What does SOAR stand for and what problem does it solve?

   SOAR = Security Orchestration, Automation, and Response. It integrates tools and automates repetitive response tasks via playbooks/runbooks, reducing analyst workload and mean time to respond (MTTR).

6. What is the difference between orchestration and automation in a SOAR platform?

   Orchestration coordinates multiple disparate tools and systems into a unified workflow, while automation executes individual tasks (e.g., blocking an IP, enriching an indicator) without human intervention.

7. Define threat hunting and explain how it differs from traditional alert-based detection.

   Threat hunting is the proactive, hypothesis-driven search for threats that have evaded existing controls, whereas traditional detection is reactive—responding to alerts generated by predefined signatures or rules.

8. What is the difference between structured and unstructured threat hunting?

   Structured hunting is hypothesis-driven and typically based on TTPs/IoAs (often mapped to MITRE ATT&CK); unstructured hunting is triggered by an indicator or anomaly and explores data more freely without a predefined hypothesis.

9. Name at least four common log sources a SOC correlates for detection.

   Firewalls, endpoint/EDR agents, authentication/identity (AD, IdP), DNS, proxy/web servers, IDS/IPS, operating system logs, and cloud audit logs (e.g., CloudTrail).

10. Why is time synchronization (e.g., NTP) critical for log correlation?

    Correlation relies on accurate event timestamps to sequence and link activity across sources; unsynchronized clocks make it impossible to reliably reconstruct the true order of events across systems.

11. What does EDR stand for and what is its core capability?

    EDR = Endpoint Detection and Response. It continuously monitors endpoint activity (processes, files, registry, network), detects suspicious behavior, and enables response actions such as isolating a host or killing a process.

12. How does EDR differ from traditional antivirus (AV)?

    Traditional AV relies mainly on signature-based detection of known malware, while EDR adds behavioral/heuristic detection, continuous telemetry recording, threat hunting, and remote response/containment capabilities.

13. What is the difference between EDR, XDR, and MDR?

    EDR focuses on endpoints; XDR (Extended Detection and Response) correlates telemetry across endpoints, network, email, and cloud; MDR (Managed Detection and Response) is an outsourced service where a provider operates detection and response on your behalf.

14. What is Network Traffic Analysis (NTA) and what two data types does it examine?

    NTA monitors network communications to detect threats. It examines flow data (metadata such as NetFlow: source/dest IP, ports, bytes) and full packet capture (PCAP, the actual packet payloads).

15. What is the difference between north-south and east-west network traffic?

    North-south traffic crosses the network perimeter (between internal hosts and the outside world), while east-west traffic moves laterally between internal hosts/servers—key for detecting lateral movement.

16. Define an Indicator of Compromise (IOC) and give three examples.

    An IOC is a forensic artifact indicating a system has likely been breached. Examples: malicious file hashes, known-bad IP addresses/domains, unusual registry keys, specific filenames, or C2 URLs.

17. What is the difference between an Indicator of Compromise (IOC) and an Indicator of Attack (IOA)?

    An IOC is evidence that a compromise has already occurred (artifacts/aftermath), while an IOA focuses on the attacker's intent and behavior/techniques in progress, allowing detection before the objective is achieved.

18. According to the Pyramid of Pain, why are TTPs harder for an adversary to change than hash values?

    Hash values are trivially changed (recompile/repack), but TTPs represent the attacker's core behaviors and skills; forcing them to change tactics causes the most 'pain,' making TTP-based detection the most durable.

19. List the phases of the Threat Intelligence Lifecycle.

    1) Planning/Direction (requirements), 2) Collection, 3) Processing, 4) Analysis, 5) Dissemination, 6) Feedback. It is a continuous, iterative cycle.

20. Distinguish strategic, operational, and tactical threat intelligence.

    Strategic: high-level, non-technical trends and risk for executives. Operational: details of specific attacks/campaigns and adversary intent. Tactical: technical, short-lived IOCs and TTPs used by defenders and tools.

21. What does TTP stand for and what does each component describe?

    TTP = Tactics, Techniques, and Procedures. Tactics are the adversary's high-level goals (the 'why'), Techniques are the general methods (the 'how'), and Procedures are the specific step-by-step implementations used by an actor.

See more Security Operations and Defensive Security flashcards →

Planning Security Operations and Defensive Security for Cybersecurity

Security Operations and Defensive Security (Cybersecurity) FAQ