Security+ quiz 3: security operations and governance

Common models start with preparation (plans, tools, training), then detection and analysis, containment, eradication, recovery and lessons learned.

A SIEM gathers logs centrally, correlates events and raises alerts. A WAF protects web apps; DLP stops data leaks; NAC controls network access.

A scan finds and reports known weaknesses. A penetration test goes further and tries to exploit them, with permission.

3-2-1: three copies of data, on two different media, with one kept off-site (and ideally one offline or immutable).

Recovery time objective is the maximum acceptable downtime. Recovery point objective (RPO) is the maximum acceptable data loss.

Insurance transfers some financial impact to another party. Mitigate reduces risk with controls; avoid stops the activity; accept takes the risk knowingly.

An acceptable use policy (AUP) sets the rules for using company systems. An SLA defines service levels; an NDA protects confidential information.

Chain of custody shows evidence was not tampered with, which is essential if it is used in court.

Least privilege limits damage from mistakes and compromised accounts. Separation of duties splits critical tasks between people.

It reviews what happened and what worked, then updates plans, controls and training so the next incident is handled better.

Preparation comes first and lessons learned last; containment comes before eradication and recovery.

Recovery point objective is how far back in time you can afford to lose data, which drives backup frequency.

Avoidance removes the activity that creates the risk.

SOAR (security orchestration, automation and response) automates repeatable response steps.

Recording cameras detect and provide evidence. A visible camera can also deter.

A service level agreement sets measurable commitments such as availability and response times.

Tabletop exercises talk through a scenario to find gaps in plans and responsibilities without touching systems.

The order of volatility says collect the most short-lived data, such as memory, before it disappears.

Separation of duties prevents one person from completing a sensitive task alone.

A false positive is an alert for something that is not really there. A false negative misses a real problem.