Chapter 7 of 8 · ISC2 CISSP
Security Operations
Investigations, monitoring, configuration, change and patch management, incident response, recovery, DR, BC and physical safety.
- 9topics
- 29 minfast track
- 3diagrams and exhibits
- 13%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Investigations and ForensicsEvidence collection and handling, chain of custody, order of volatility, admissibility, digital forensic tools and techniques…Diagram3 min
- 2Logging and MonitoringLogging and monitoring for CISSP: SIEM, SOAR, continuous monitoring, egress monitoring, log management, threat intelligence, UEBA…3 min
- 3Configuration, Change and Patch ManagementConfiguration management with baselines and automation, the change management process and CAB, and patch and vulnerability…3 min
- 4Operations Concepts and Resource ProtectionNeed to know, least privilege, separation of duties, privileged accounts, job rotation, SLAs, and protecting media, hardware and…3 min
- 5Incident ManagementThe CISSP incident management process: detection, response, mitigation, reporting, recovery, remediation and lessons learned…3 min
- 6Detection and Preventative MeasuresFirewalls, IDS and IPS, allow and deny lists, third-party security services, sandboxing, honeypots, anti-malware and machine…3 min
- 7Recovery StrategiesBackup storage strategies, recovery site types from cold to hot, cloud recovery patterns, multiple processing sites, and…Diagram4 min
- 8Disaster Recovery and Business Continuity ExercisesDisaster recovery processes and roles, declaring a disaster, communications, restoration and return, DR plan test types, and…Diagram4 min
- 9Physical Security and Personnel SafetyRunning perimeter and internal physical security controls, and protecting personnel through travel security, training, emergency…3 min
About this chapter
What this chapter covers
Security Operations is worth 13 percent of the CISSP exam and has the most objectives of any domain. It covers the daily work of keeping an organization secure and recovering when things go wrong.
It covers investigations (evidence, forensics, reporting), logging and monitoring, configuration management, foundational operations concepts (need to know, least privilege, separation of duties, job rotation, service level agreements), resource protection, incident management, detection and preventative measures, patch and vulnerability management, change management, recovery strategies, disaster recovery processes, DR plan testing, business continuity exercises, physical security and personnel safety and security.
How the topics fit together
Questions here are about priorities under pressure: what to do first in an incident, how to preserve evidence, when to declare a disaster, which recovery site fits a requirement and how to keep people safe.
In incident questions, the order is usually contain first, preserve evidence, then eradicate and recover. Life safety outranks everything.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with tables and examples.
- What to remember for the exam: the facts to memorise and how questions are phrased.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Ready for more practice?
The full ISC2 CISSP question bank has 1,113 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.