DOMAIN 5: Security Operations

SIEM (Security Information and Event Management)

The "brain and eyes" of security operations; it aggregates logs from all over the network, correlates events, and triggers alerts.

SOAR (Security Orchestration, Automation, and Response)

The "muscles" of operations; it takes SIEM alerts and uses automated playbooks to take action without human delay (e.g., auto

NetFlow (or IPFIX)

Network metadata tracker that records who talked to whom, when, and how much data was sent—without capturing the actual message contents.

EDR (Endpoint Detection and Response)

Agent software running on workstations and servers that continuously monitors behavioral activity, spots threats, and allows remote isolation.

Playbook

Focus on security incident response workflows, often with automation and orchestration components. A step-by-step automated or manual workflow that guides security analysts on exactly how to respond to a specific type of incident (e.g., a ransomware outbreak). Event-driven

PSIRT (Product Security Incident Response Team)

A specialized team inside a software or hardware company responsible for fixing and disclosing security vulnerabilities found in their own products.

ISAC (Information Sharing and Analysis Center)

A trusted, industry-specific non-profit (like financial, healthcare, or energy) where companies share threat intelligence and cyber attack alerts with each other.

ISAO (Information Sharing and Analysis Organization)

Similar to an ISAC, but more flexible—any group of businesses or agencies (even across different industries) can form one to share cyber threat data.

CERT (Computer Emergency Response Team)

An expert group (either internal to a company or a national agency) that responds to active cyber attacks, handles coordination, and issues security warnings.

OOV (Order of Volatility)

The golden rule of digital forensics: you must collect evidence starting from the most fragile and temporary data (CPU cache, RAM) down to the most permanent (hard drives, backup tapes).

Federation

A system linking different organizations together for Single Sign-On (SSO), allowing a user from Company A to securely access applications in Company B using their home credentials.

SAML 2.0

Relies on certificate trust between Identity Provider (IdP) and Service Provider (SP).

Runbook

Typically contain operational procedures like firewall configuration (B), network troubleshooting (C), and patch deployment (D). Task-oriented

A security team calculates that a database server has an asset value (AV) of $50,000. If compromised, the exposure factor (EF) is estimated at 40%, and the annual rate of occurrence (ARO) is 2. What is the Annualized Loss Expectancy (ALE)?

SLE = AV × EF = $50,000 × 0.4 = $20,000.
ALE = SLE × ARO = $20,000 × 2 = $40,000.

Zero standing privileges

Means users should not have permanent administrative access