D7: Security Operations

CISSP (ISC2) study guide

Domain 7 is the largest single domain by scenario density even at 13% weight: incident response, digital forensics, disaster recovery, business continuity, physical security operations, and day-to-day monitoring/logging. It's heavily scenario-based; expect "what should you do first/next" sequencing questions more than definitional recall.

Key Concepts

Incident response lifecycle
Preparation, then Detection & Analysis, then Containment, Eradication & Recovery, then Post-Incident Activity (lessons learned). The exam frequently tests correct sequencing, such as containment before eradication.
RTO vs. RPO
Recovery Time Objective is how long a system can be down before the business impact is unacceptable. Recovery Point Objective is how much data loss (measured in time) is acceptable. These drive backup frequency and DR site selection.
Backup types
Full (everything), differential (everything changed since the last full backup, grows each day but faster to restore), and incremental (everything changed since the last backup of any type, smaller each day but slower to restore since it requires every incremental since the last full).
Disaster recovery site types
Hot site (near-instant failover, most expensive), warm site (partially configured, moderate recovery time), and cold site (basic infrastructure only, slowest/cheapest). Choice depends on the organization's RTO.
Order of volatility
In digital forensics, evidence must be collected in order from most to least volatile: CPU registers/cache, then RAM, then network state, then running processes, then disk, then backups/archival media.

Confusable Pairs

Differential vs. incremental backup
Differential backs up everything changed since the last full backup (restore needs only the full plus the latest differential). Incremental backs up everything changed since the last backup of any kind (restore needs the full plus every incremental in sequence). Differential is faster to restore, incremental is faster to create.
Business continuity plan (BCP) vs. disaster recovery plan (DRP)
BCP is the broader plan for keeping the business running during a disruption (people, processes, alternate operations). DRP is the narrower, technical plan for restoring IT systems specifically: a DRP is typically a subcomponent of a full BCP.

Sources

Sources: NIST SP 800-61 Rev. 2, Computer Security Incident Handling Guide; NIST SP 800-86, Guide to Integrating Forensic Techniques into Incident Response

Practice D7 questions with instant feedback, free to start, no card required.

Start Free