Overview
Security Operations covers the work of keeping an organization secure once systems are running. Its 15 sub-objectives span investigations and digital forensics; logging and monitoring with IDPS, SIEM, SOAR, threat intelligence and user and entity behavior analytics; configuration management; foundational concepts such as need to know, separation of duties, privileged account management, job rotation and SLAs; resource protection; incident management; detective and preventive measures; patch and vulnerability management; change management; recovery strategies; disaster recovery processes and plan testing; business continuity exercises; physical security; and personnel safety.
Candidates must sequence activities correctly: incident steps, evidence handling, DR testing types and change approvals all have an order the exam expects. This domain operationalizes the continuity requirements and personnel policies of Domain 1, the network controls of Domain 4 and the access controls of Domain 5, and it produces the evidence Domain 6 analyzes.
How it's tested
Domain 7 favors sequencing (FIRST, NEXT, LAST) and best-practice questions set during an incident, investigation or recovery. Many options are reasonable actions; the right one belongs at this point in the process. Watch for clues about whether an incident is confirmed, whether evidence may go to court, and whether people are in danger, since those facts reorder priorities.
-
Sequence the response
An incident or investigation is under way and you choose the next correct step, such as containment before eradication or evidence preservation before restoration.
-
Pick the recovery option
RTO, RPO and budget are given, and you choose a recovery site, backup method or resilience technique that meets them.
-
Operational control choice
A risk such as fraud, insider abuse or unauthorized change is described, and you pick separation of duties, job rotation, change control or monitoring.
Monitoring flags ransomware encrypting a file server. Options are to restore from backup, wipe the server, disconnect it from the network, or notify customers. Restoration and wiping come after containment, and premature wiping destroys evidence. Customer notification depends on investigation findings and legal advice. Isolating the server stops spread while preserving its state, so containment is the correct NEXT step.
Sub-objectives 15
Official sub-objectives from the ISC2 outline, in outline order.
7.1 Understand and comply with investigationsEvidence collection and handling, reporting, investigative techniques, forensics and artifacts.
- What it means
- This covers evidence collection and handling, reporting and documentation, investigative techniques, digital forensics tools, tactics and procedures, and artifacts from data, computers, networks and mobile devices.
- What to understand
- Collect evidence in order of volatility: CPU registers and cache, RAM, network state and running processes, then disk, then remote logs and archival media. Work on forensic copies verified by hashes, maintain chain of custody for every transfer, and keep the original unaltered. Admissible evidence must be relevant, reliable and legally obtained.
- How it shows up
- A compromised server is still running and the question asks what to capture FIRST: memory contents before shutting it down.
- Common confusion
- Pulling the power or imaging the disk first, which destroys volatile memory evidence such as running processes and encryption keys.
7.2 Conduct logging and monitoring activitiesIDPS, SIEM, SOAR, continuous monitoring, egress monitoring, log management, threat intelligence and UEBA.
- What it means
- This covers intrusion detection and prevention, security information and event management (SIEM), security orchestration, automation and response (SOAR), continuous monitoring and tuning, egress monitoring, log management, threat intelligence including threat feeds and threat hunting, and user and entity behavior analytics (UEBA).
- What to understand
- SIEM aggregates and correlates logs; SOAR automates response playbooks; UEBA baselines normal behavior to spot anomalies such as compromised accounts. Logs need synchronized time (NTP), integrity protection and retention. Threat hunting proactively searches for attackers who evaded alerts, using hypotheses informed by threat intelligence.
- How it shows up
- Analysts are overwhelmed by repetitive alerts and the answer is SOAR playbooks, or a valid user logs in at unusual hours from a new country and UEBA is the detecting control.
- Common confusion
- Treating SIEM and SOAR as the same; SIEM detects and correlates, SOAR orchestrates and automates the response.
7.3 Perform configuration management (CM) (e.g., provisioning, baselining, automation)Secure baselines, provisioning and automated configuration.
- What it means
- Configuration management establishes approved secure baselines, provisions systems from them, tracks configuration items and detects drift, increasingly through automation and infrastructure as code.
- What to understand
- A baseline is the documented, approved configuration against which drift is measured. Automation applies baselines consistently and can auto-remediate drift, but the templates themselves must be protected and changed through change management.
- How it shows up
- Servers built manually show inconsistent settings, and the BEST answer is automated provisioning from an approved baseline with drift monitoring.
- Common confusion
- Confusing configuration management (what the approved state is) with change management (how that state is allowed to change).
7.4 Apply foundational security operations conceptsNeed to know, least privilege, SoD, privileged account management, job rotation and SLAs.
- What it means
- These are need to know and least privilege; segregation of duties and responsibilities; privileged account management; job rotation; and service-level agreements.
- What to understand
- Separation of duties prevents one person completing a sensitive task alone, so fraud requires collusion. Job rotation and mandatory vacations help detect fraud already happening, because someone else performs the duties. Privileged accounts should be separate from daily accounts, vaulted and monitored.
- How it shows up
- A payments clerk both creates vendors and approves payments, and the fix is separation of duties.
- Common confusion
- Picking job rotation to prevent fraud when the scenario asks for prevention; rotation primarily detects, while separation of duties prevents.
7.5 Apply resource protectionMedia management, media protection techniques and data at rest and in transit.
- What it means
- Resource protection covers managing media throughout its use, applying protection techniques such as encryption, labeling and secure storage, and protecting data at rest and in transit operationally.
- What to understand
- Media inherits the classification of its most sensitive data, must be labeled, tracked and stored securely, and sanitized according to Domain 2 rules before reuse or disposal. Backup media taken offsite needs the same encryption and tracking as production data.
- How it shows up
- Unencrypted backup tapes are lost in transit to an offsite vault, and the corrective answer is encrypting backup media and tracking custody.
- Common confusion
- Assuming offsite backup media is low risk because it is old data; it often contains complete copies of sensitive systems.
7.6 Conduct incident managementDetection, response, mitigation, reporting, recovery, remediation and lessons learned.
- What it means
- The outline's incident management sequence is detection, response, mitigation, reporting, recovery, remediation and lessons learned. Response activates the team and begins containment; mitigation limits damage; reporting informs management, regulators and others as required.
- What to understand
- Containment comes before eradication and recovery. Recovery restores systems to operation; remediation addresses the root cause so the incident does not recur; lessons learned feeds improvements back into controls and plans. Reporting obligations, such as breach notification deadlines, may begin during the incident, not after it.
- How it shows up
- A question lists incident steps and asks which comes NEXT after detection and initial response, or what the final phase is (lessons learned).
- Common confusion
- Skipping lessons learned once systems are running; the exam treats it as a required phase that prevents recurrence.
7.7 Operate and maintain detection and preventative measuresFirewalls, IDS and IPS, allow and deny lists, third-party services, sandboxing, honeypots, anti-malware and AI-based tools.
- What it means
- This covers next-generation, web application and network firewalls; intrusion detection and prevention systems; whitelisting and blacklisting (allow and deny lists); third-party security services; sandboxing; honeypots and honeynets; anti-malware; and machine learning and AI-based tools.
- What to understand
- An IDS detects and alerts out of band; an IPS sits inline and can block. Signature detection misses novel attacks, while anomaly detection catches them at the cost of more false positives. Application allow listing is stronger than deny listing because unknown code cannot run. Honeypots must avoid entrapment: they may offer opportunity but must not induce a crime.
- How it shows up
- A scenario requires blocking malicious traffic in real time rather than only alerting, pointing to an inline IPS.
- Common confusion
- Expecting an IDS to block attacks, or treating a honeypot as a production defense rather than a detection and research tool.
7.8 Implement and support patch and vulnerability managementIdentifying, prioritizing, testing and deploying fixes.
- What it means
- Patch and vulnerability management continuously identifies vulnerabilities, prioritizes them by risk, tests patches, deploys them through change management and verifies remediation.
- What to understand
- Patches should be tested in a non-production environment before broad deployment, except where an actively exploited critical flaw justifies an emergency change with expedited approval. Prioritize by exploitability and asset criticality, not just CVSS score, and verify with rescans.
- How it shows up
- A vendor releases a critical patch and the question asks what to do FIRST: test it in a representative environment.
- Common confusion
- Deploying patches directly to production for speed, bypassing testing and change control.
7.9 Understand and participate in change management processesRequest, review, approve, test, implement and document changes.
- What it means
- Change management controls modifications to systems through requests, impact assessment, approval by a change advisory board or authority, testing, scheduled implementation with rollback plans, and documentation.
- What to understand
- Its security purpose is preventing unauthorized or untested changes from weakening controls or causing outages. Emergency changes still require documentation and retroactive review.
- How it shows up
- An administrator makes an urgent firewall change during an outage, and the question asks what must follow: documenting it and submitting it for post-implementation review.
- Common confusion
- Treating emergency changes as exempt from change management rather than following an expedited path.
7.10 Implement recovery strategiesBackup storage, recovery sites, multiple processing sites and system resilience.
- What it means
- Recovery strategies include backup storage (cloud, onsite, offsite), recovery sites (cold versus hot, plus warm and mobile), resource capacity agreements, multiple processing sites, and system resilience through high availability, quality of service and fault tolerance.
- What to understand
- Hot sites are ready within hours but costly; warm sites need days of preparation; cold sites provide space and power only. Full backups take the most time but restore fastest; incremental backups are fastest to make but need the last full plus every incremental since; differential backups need the last full plus the latest differential. RAID provides fault tolerance, not backup.
- How it shows up
- An RTO of four hours rules out cold and warm sites, or a scenario asks which backups are needed to restore after a mid-week failure with incrementals.
- Common confusion
- Treating RAID or replication as a backup; both faithfully copy corruption and deletion.
7.11 Implement disaster recovery (DR) processesResponse, personnel, communications, assessment, restoration, training and lessons learned.
- What it means
- DR processes cover response, assigning personnel and roles, communications methods, damage assessment, restoration, training and awareness, and lessons learned.
- What to understand
- Restore the most critical functions first at the alternate site, as prioritized by the BIA. When returning to the primary site, move the least critical functions first, so problems at the repaired site do not hit critical operations.
- How it shows up
- After a disaster the primary site is repaired, and the question asks which functions move back first: the least critical.
- Common confusion
- Moving the most critical functions back to the primary site first, which risks them on an unproven environment.
7.12 Test disaster recovery plan (DRP)Read-through, walkthrough, simulation, parallel, full interruption and communications.
- What it means
- The outline lists read-through or tabletop, walkthrough, simulation, parallel and full interruption tests, plus communications with stakeholders, test status reporting and regulators.
- What to understand
- Tests increase in realism and risk: read-through reviews documents, tabletop and walkthrough talk through scenarios, simulation rehearses a scenario without affecting operations, parallel brings up the alternate site while production keeps running, and full interruption shuts down primary operations. Full interruption gives the most assurance but carries the highest risk and needs senior management approval.
- How it shows up
- Management wants to validate the alternate site's ability to process real workloads without disrupting production, which is a parallel test.
- Common confusion
- Choosing full interruption as the default best test; it is rarely appropriate because it can cause the outage it is meant to prepare for.
7.13 Participate in Business Continuity (BC) planning and exercisesContributing to BC plans and exercises.
- What it means
- Security professionals contribute to business continuity planning, which keeps critical business functions running during disruption, and take part in exercises that test the plan.
- What to understand
- BC is broader than DR: DR restores IT systems, while BC keeps the business operating, including people, facilities, suppliers and communications. Plans must be maintained as the business changes, and exercises must include business stakeholders, not only IT.
- How it shows up
- A question asks which plan keeps payroll processing running manually during a system outage: the business continuity plan.
- Common confusion
- Treating BC and DR as interchangeable or assuming IT alone owns BC.
7.14 Implement and manage physical securityPerimeter and internal security controls.
- What it means
- This covers perimeter controls such as fencing, lighting, gates, bollards and guards, and internal controls such as badges, mantraps, locks, CCTV and visitor management.
- What to understand
- Layer physical controls from the perimeter inward and combine deterrent, preventive and detective types. A mantrap (access control vestibule) stops tailgating by allowing one person through at a time, and visitor logs plus escorts maintain accountability.
- How it shows up
- Employees routinely hold doors for others at a secure entrance, and the BEST control is a mantrap or turnstile with awareness training.
- Common confusion
- Relying on CCTV to prevent intrusions; cameras primarily deter and detect, they do not stop entry.
7.15 Address personnel safety and security concernsTravel, training and awareness, emergency management and duress.
- What it means
- This covers travel security, training and awareness on insider threat, social media impacts and two-factor authentication fatigue, emergency management, and duress situations.
- What to understand
- Human safety always takes precedence over assets and data. MFA fatigue attacks bombard users with push prompts until one is approved, countered by number matching and training. Duress codes let an employee signal coercion silently while appearing to comply.
- How it shows up
- During a fire, a question asks whether staff should secure servers or evacuate; evacuation always wins.
- Common confusion
- Choosing to protect equipment or evidence when people are at risk.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Order of volatility
Collect the most short-lived evidence first: registers and cache, memory, network connections and processes, disk, then logs and archives.
- Remember
- Capture RAM before powering down a live system.
- Tested as
- Forensic sequencing questions.
- Trap
- Pulling the plug to preserve the disk.
-
Chain of custody
Documentation of who collected, handled, transferred and stored evidence, when and why.
- Remember
- A gap in custody can make evidence inadmissible.
- Tested as
- Evidence handling questions.
- Trap
- Thinking hashing alone replaces custody records.
-
Incident management sequence
Detection, response, mitigation, reporting, recovery, remediation and lessons learned, as the outline lists them.
- Remember
- Contain before eradicating and recovering; finish with lessons learned.
- Tested as
- NEXT and FIRST incident questions.
- Trap
- Restoring from backup before containing the threat.
-
IDS vs. IPS
An IDS monitors and alerts; an IPS sits inline and can block traffic in real time.
- Remember
- IPS false positives can block legitimate traffic, so tuning matters.
- Tested as
- Control selection questions.
- Trap
- Expecting an IDS to stop an attack.
-
SIEM, SOAR and UEBA
SIEM correlates logs and alerts; SOAR automates response playbooks; UEBA detects anomalous behavior by users and entities.
- Remember
- SOAR reduces analyst workload; UEBA catches misuse of valid credentials.
- Tested as
- Monitoring tool questions.
- Trap
- Choosing SIEM when the requirement is automated response.
-
Separation of duties vs. job rotation
Separation of duties splits a sensitive task so collusion is needed; job rotation moves staff between roles so others can spot irregularities.
- Remember
- SoD prevents; rotation and mandatory vacations detect.
- Tested as
- Fraud control questions.
- Trap
- Choosing rotation as the preventive control.
-
Recovery sites
Hot sites are fully equipped and current; warm sites have equipment but need data and setup; cold sites have space and utilities only.
- Remember
- Cost and readiness rise together; match to RTO.
- Tested as
- Recovery strategy selection.
- Trap
- Choosing a cold site for a short RTO.
-
Full, incremental and differential backups
Full copies everything; incremental copies changes since the last backup of any type and clears the archive bit; differential copies changes since the last full and does not clear it.
- Remember
- Restore incrementals with the full plus every incremental; differentials with the full plus the latest differential.
- Tested as
- Restore sequencing questions.
- Trap
- Restoring only the last incremental.
-
DR test types
Read-through, walkthrough or tabletop, simulation, parallel and full interruption, in rising realism and risk.
- Remember
- Parallel tests the alternate site without stopping production; full interruption stops production.
- Tested as
- Test selection questions.
- Trap
- Selecting full interruption as the best test by default.
-
Return to primary site
After recovery, the least critical functions move back to the primary site first.
- Remember
- Critical functions stay at the proven alternate site until the primary is validated.
- Tested as
- DR sequencing questions.
- Trap
- Moving critical systems back first.
-
Entrapment vs. enticement
Enticement presents an opportunity to someone already intending to attack; entrapment induces someone to commit a crime they otherwise would not.
- Remember
- Honeypots must entice, never entrap.
- Tested as
- Honeypot and legal questions.
- Trap
- Advertising a honeypot to lure people into hacking.
-
Change vs. configuration management
Configuration management defines and tracks the approved state; change management governs how that state may be modified.
- Remember
- Emergency changes still require documentation and review after the fact.
- Tested as
- Process questions.
- Trap
- Skipping the post-implementation review after an emergency change.
-
Life safety priority
Human safety outranks data, equipment, evidence and cost in every scenario.
- Remember
- Fail-safe exits open for people even if security fails open.
- Tested as
- Physical and emergency questions.
- Trap
- Protecting servers during an evacuation.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Hot vs. warm vs. cold site
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Hot site | Fully equipped, connected and current | Operational within hours; highest cost | Choosing it when the RTO is long and budget is limited |
| Warm site | Equipment present but data and configuration incomplete | Operational in days; moderate cost | Assuming it meets an RTO of a few hours |
| Cold site | Space, power and HVAC only | Weeks to operate; lowest cost | Thinking equipment is already installed |
Incremental vs. differential backup
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Incremental | Changes since the last backup of any type | Fastest backup, slowest restore (full plus all incrementals) | Restoring only the most recent incremental |
| Differential | Changes since the last full backup | Growing backup size, faster restore (full plus latest differential) | Thinking differentials reset the archive bit |
DR test types
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Read-through and tabletop | Review the plan and discuss a scenario | No systems touched; lowest risk | Expecting it to prove technical recovery works |
| Simulation | Rehearse a scenario through to response actions | No impact on production or alternate site processing | Confusing it with a parallel test |
| Parallel | Bring up the alternate site and process alongside production | Validates real processing without stopping production | Thinking production is shut down |
| Full interruption | Shut down primary and fail over completely | Most realistic, highest risk; needs senior approval | Choosing it as the routine best test |
Separation of duties vs. job rotation vs. least privilege
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Separation of duties | No one person completes a sensitive process alone | Prevents fraud unless collusion occurs | Confusing it with least privilege |
| Job rotation | Staff periodically change roles | Detects ongoing fraud and builds cross-training | Choosing it as a preventive control |
| Least privilege | Grant only the access a role needs | Limits damage from any one account | Assuming it stops one person controlling an entire transaction |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Restore first
- What candidates pick
- Restoring the affected server from backup immediately after detecting malware.
- Why it looks right
- It returns the business to operation quickly.
- Why it's wrong
- Without containment and root-cause analysis, the threat may persist or reinfect, and evidence is lost.
Clue to watch for The incident is ongoing or its source is unknown.
-
Power off to preserve
- What candidates pick
- Shutting down a compromised machine to protect evidence.
- Why it looks right
- Stops further changes to the disk.
- Why it's wrong
- Memory contents, network connections and encryption keys are lost; capture volatile data first.
Clue to watch for The system is still running and may be part of a legal case.
-
Full interruption is best
- What candidates pick
- A full interruption test to validate DR.
- Why it looks right
- It provides the most realistic assurance.
- Why it's wrong
- It risks causing a real outage; a parallel test usually validates the alternate site without disrupting production.
Clue to watch for Requirement to avoid disrupting production while testing real processing.
-
Critical systems go home first
- What candidates pick
- Moving the most critical functions back to the repaired primary site first.
- Why it looks right
- Critical functions seem to deserve the permanent site soonest.
- Why it's wrong
- The repaired site is unproven; move less critical functions first to validate it.
Clue to watch for The question concerns returning from the alternate site.
-
IDS will stop it
- What candidates pick
- Deploying an IDS to block an attack in progress.
- Why it looks right
- IDS is the familiar detection tool.
- Why it's wrong
- An IDS alerts but does not block; an inline IPS or firewall rule is needed.
Clue to watch for The requirement says prevent or block in real time.
-
Save the equipment
- What candidates pick
- Securing servers or backup media before evacuating during a fire.
- Why it looks right
- The data center is valuable and evidence may be lost.
- Why it's wrong
- Human life always comes first; assets can be replaced.
Clue to watch for Any threat to personnel safety.
-
Emergency means no process
- What candidates pick
- Making an emergency change and moving on once service is restored.
- Why it looks right
- The urgent problem is solved.
- Why it's wrong
- Emergency changes must still be documented and reviewed after implementation to preserve control integrity.
Clue to watch for A change was made outside the normal approval window.
Answer framework
For Domain 7 incident, investigation and recovery scenarios, place yourself in the process before choosing an action.
- Check for any threat to human life or safety, and if one exists, choose the option that protects people before assets, data or evidence.
- Identify where you are in the process, such as detection, containment, investigation, recovery, return to primary site or lessons learned.
- Pick the action that belongs at that stage: contain before eradicating, capture volatile evidence before shutdown, and test before deploying patches or changes.
- Match recovery choices to BIA outputs, using RTO and RPO to select sites, backup types and test methods within budget.
- Close the loop with documentation, change review, chain of custody and lessons learned so the organization can prove due care and improve controls.
Practice question
Want more like this? The CISSP practice test has questions for every domain.
Checklist
0 of 15
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Organize this domain into four clusters rather than 15 separate objectives. First, investigations and monitoring (7.1, 7.2, 7.7): learn evidence handling and the detection toolset. Second, operational discipline (7.3, 7.4, 7.5, 7.8, 7.9): configuration, change, patching and foundational controls. Third, incidents and recovery (7.6, 7.10 to 7.13): drill the incident phases, backup restore logic, site types and DR tests until you can sequence them without notes. Fourth, physical and personnel safety (7.14, 7.15).
High-priority concepts are incident sequencing, order of volatility, IDS versus IPS, backup types, recovery sites and DR test types. Commonly underestimated areas are personnel safety topics such as duress and MFA fatigue, the return-to-primary-site rule and UEBA and SOAR, which the 2024 outline names explicitly.
Practice with FIRST and NEXT questions specifically, because they dominate this domain. After that, review Domain 1 business continuity requirements and Domain 6 DR and incident metrics, since questions often blend requirement setting, execution and measurement.
FAQ
Why does Domain 7 have so many sub-objectives?
ISC2 lists 15 objectives because security operations covers many distinct activities, from forensics and monitoring to recovery and physical safety. The domain is weighted at 13%, the same as Domains 3, 4 and 5.
What is the incident management order on the CISSP?
The outline lists detection, response, mitigation, reporting, recovery, remediation and lessons learned. In practice, containment happens early in response and mitigation, and reporting obligations can begin before recovery is complete.
How is BC different from DR?
Business continuity keeps critical business functions running during disruption, including people, facilities and suppliers. Disaster recovery restores IT systems and data, and is one part of continuity.
Which DR test is best?
It depends on the goal and the risk tolerance. Parallel tests usually give strong technical assurance without disrupting production, while full interruption gives the most realism but carries the highest risk and needs senior management approval.
Is forensics deeply tested?
You need investigation principles rather than tool skills: order of volatility, chain of custody, working on verified copies, admissibility and artifacts from different device types.
How do Domains 1 and 7 split business continuity?
Domain 1 (1.7) identifies and prioritizes BC requirements through the BIA. Domain 7 implements recovery strategies, runs DR processes, tests DR plans and participates in BC exercises.
How long should I study Domain 7?
Our editorial planning estimate is 30 to 35 hours within a 250-hour plan. Its breadth means many short topics, so spaced review works better than a single long session.
Other Cybersecurity certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
- CompTIA Cybersecurity Analyst+ Same subject: Domain 1: Security Operations (34%)
- Microsoft Security Operations Analyst Associate Same subject: Domain 1: Manage a security operations environment (40–45%)
- CompTIA SecurityX (CASP+) Same subject: Domain 4: Security Operations (22%)
- CompTIA Security+ Same subject: Domain 4: Security Operations (28%)
- Certified Cloud Security Professional Same subject: Domain 5: Cloud Security Operations (17%)
- Certified Ethical Hacker Study guide
- Penetration Tester Study guide
- Systems Security Certified Practitioner Study guide
- Certified in Risk and Information Systems Control Study guide
- CompTIA PenTest+ Study guide
- Azure Security Engineer Associate Study guide
- CISM (Certified Information Security Manager) Study guide
- Certified Information Systems Auditor Study guide
Test your Domain 7 knowledge
You have covered investigations, monitoring, incident management, change and patching, recovery and physical safety. See whether you can sequence operational responses correctly under time pressure.