Security Operations

The heaviest domain — nearly a third of the exam. Nine objectives spanning system hardening and secure baselines, hardware/software/data asset management, vulnerability management lifecycle, security monitoring and alerting (SIEM, SOAR, EDR/XDR), identity and access management (federation, MFA, access control models, PAM), enterprise security enhancement (firewalls, IDS/IPS, email security, DLP, NAC), automation and orchestration, incident response (preparation through lessons learned), and forensic data sources.

Four of the nine objectives are “Given a scenario” (PBQ-likely): 4.1 (security techniques), 4.5 (IAM), 4.6 (enterprise capabilities), and 4.9 (investigation data sources). This is where the most study time goes and where the most labs are built.

Touches every offensive discipline: hardening as friction multiplication, packet analysis and TLS fingerprinting for monitoring, incident response under an assume-breach model, understanding attacker automation to build better detection, and purple team feedback loops between offense and defense.