FlashGenius Logo FlashGenius
SecurityX CAS-005 · Domain 3 of 4

Security
Operations

The third domain (22%) — covers SIEM/SOAR configuration, vulnerability management, incident response phases, digital forensics, and threat hunting with MITRE ATT&CK.

22%
Exam Weight
4
Concept Areas
12
Flashcards
8
Quiz Questions
🏠 Hub 1 · Engineering 2 · Architecture 3 · Operations 4 · GRC ⚖️ vs CISSP

What Domain 3 Covers

At 22%, Security Operations tests your ability to detect, investigate, and respond to threats. This includes building detection rules in SIEM, prioritizing vulnerability remediation, executing incident response procedures, and proactively hunting threats using adversary behavior frameworks.

Objective A

Configure & Tune SIEM/SOAR

Build detection rules, tune baselines, automate response playbooks.

Objective B

Manage Vulnerability Programs

Prioritize with CVSS/EPSS, integrate SCA and SBoM.

Objective C

Conduct IR & Threat Hunting

Execute PICERL phases, collect forensic evidence, hunt with MITRE ATT&CK.

SIEM SOAR PICERL MITRE ATT&CK IoC / IoA CVSS / EPSS Memory Forensics STIX / TAXII
💡
Exam focus: PICERL order is a guaranteed question. Know volatile vs non-volatile evidence collection order. Understand the IoC vs IoA distinction — reactive artifact vs proactive behavior pattern.

Key Concept Areas

Click each card to expand. Four areas cover the full Domain 3 objective set.

1. SIEM Configuration & Monitoring ▾
Log Ingestion & Processing
  • Log sources — Windows Event Logs, Syslog, NetFlow, cloud audit logs, EDR telemetry.
  • Normalization — converting logs to a common schema for correlation across diverse sources.
  • Correlation rules — detecting patterns across multiple sources (e.g., failed logins + success from new IP = credential stuffing).
  • Baseline building — establishing normal behavior per user, device, and network segment.
  • Alert tuning — reducing false positives by refining thresholds and adding contextual enrichment.
SOAR Automation
  • SOAR — automates playbooks triggered by SIEM alerts; integrates ticketing, threat intel, and response actions.
💡
Study tip: Know the SIEM use case flow: log ingestion → normalization → correlation → alerting → SOAR playbook → ticket.
2. Vulnerability Management ▾
Scoring & Prioritization
  • CVSS — 0-10 score measuring base, temporal, and environmental factors of a vulnerability.
  • EPSS — probability a CVE will be exploited within 30 days. Use alongside CVSS for risk-based prioritization.
  • SCA in VM — identifying vulnerable third-party dependencies, tied to SBoM.
  • SBoM in VM — using bill of materials to track where vulnerable components are deployed across the environment.
  • Patch priority — internet-facing systems, critical assets, CISA Known Exploited Vulnerabilities (KEV) catalog first.
💡
Study tip: CVSS measures severity; EPSS measures exploitation probability. High CVSS + high EPSS on internet-facing system = highest priority.
3. Incident Response & Digital Forensics ▾
PICERL Phases
  • Preparation → Identification → Containment → Eradication → Recovery → Lessons Learned
  • Containment must always precede eradication.
Digital Forensics
  • Evidence collection order — volatile first (memory, running processes, network connections) before powering down.
  • Chain of custody — documented evidence handling ensuring admissibility and integrity.
  • Memory forensics — capturing RAM to analyze running processes, injected code, network connections, decrypted secrets (Volatility, WinPmem).
  • Disk forensics — image with write blockers; never work on originals.
  • Malware analysis — static (strings, PE headers, YARA) vs dynamic (sandbox, behavioral).
💡
Study tip: PICERL order is always tested. Containment must precede eradication. Volatile data collection must precede shutdown.
4. Threat Intelligence & Threat Hunting ▾
Intelligence Types
  • IoC — artifact evidence an attack occurred (file hashes, malicious IPs, domain names). Reactive.
  • IoA — behavioral evidence an attack is in progress (unusual process execution, lateral movement). Proactive.
  • MITRE ATT&CK — knowledge base of adversary TTPs. Used for detection rule development, gap analysis, hunting hypotheses.
  • CTI levels — Strategic (exec trends), Operational (campaign details), Tactical (specific IoCs/TTPs).
Threat Hunting
  • Threat hunting — proactive search without specific trigger. Hypothesis-driven (TTP-based) or IoC-driven (artifact-based).
  • STIX — standard format for threat intel; TAXII — transport protocol for sharing STIX data.
💡
Study tip: IoC = artifact/evidence (reactive). IoA = behavior/pattern (proactive). MITRE ATT&CK maps attacker behavior — learn to read it.

Flashcards

12 terms covering Domain 3's operations, forensics, and threat intelligence concepts. Click to flip.

Knowledge Check

Question 1 of 8 · Score: 0

🎉

SecurityX CAS-005 · V1

Domain 4: Governance, Risk & Compliance (20%)

NIST frameworks, compliance-as-code, threat modeling, and supply chain risk.

📝 Practice Tests on FlashGenius Domain 4 → Official Exam Page