# CISSP Domain 7 — contain first, then restore with proof Source: https://ai.techclick.in/blog_cissp_d7_security_operations Markdown: https://ai.techclick.in/blog_cissp_d7_security_operations.md Publisher: Techclick Infosec Pvt Ltd CISSP Domain 7 manager lesson: validate then contain, preserve evidence, pick need-to-know vs job rotation, match RTO/RPO to the BIA. Official ISC2 outline + NIST 800-61. Quick answer An event is noise until you prove harm. An incident is a confirmed adverse event. FIRST on a SIEM fire is validate and assess scope. Mitigation in the official 7.6 list is containment — stop the bleed — not a rebuild. Capture volatile evidence first , hash it, and keep a chain of custody. Need-to-know is which information. Least privilege is which rights. Job rotation (and mandatory vacation) is the detective control for one-person fraud. BIA first , then RPO/RTO, then a site and a test. People safety outranks the server. Say this out loud I do not wipe first. I confirm it is an incident, contain the blast radius, preserve what I will need in court, then recover to the BIA numbers — and I write the lesson so the next one is cheaper. ## 1. Why IMMEDIATELY is not “wipe it” Interview, 35 minutes in. “Ransomware alert on a file server. What does the security professional do first ?” The engineer answers “reimage from last night’s backup.” That is recovery. It is not first. It also destroys the only copy of the attacker’s foothold. ISC2 Domain 7 — Security Operations — is 13% of the official April 2024 exam outline. The outline is not asking you to click Rebuild in vCenter. It is asking whether you can run investigations, logging, incident management, and continuity so the business survives and the evidence still stands up. Hero · the SOC is a decision desk, not a wipe button Notice: the signed ticket is the work. Detect / Respond / Recover are phases, not three products you buy. Three reasons this domain fails strong operators: - FIRST / IMMEDIATELY are sequencing words. They pull you to the current IR phase — usually validate or contain — not to the most satisfying technical fix. - Evidence is perishable. Power-off, AV full-scan, and “just restore” all change or destroy live artifacts. Once contaminated, you cannot decontaminate. - Continuity is a BIA number, not a brand of DR site. A hot site that nobody tested is a hope. A cold site that cannot meet RTO is a budget line, not a plan. Hard words before the runbook Event — any observable occurrence. Most are noise. NIST SP 800-61 Rev. 2 uses this split. Incident — a violation or imminent threat of violation of security policy, or an event that jeopardizes CIA. Outline 7.6 starts once you have one. Mitigation (7.6) — containment. Stop further damage. Not the same as eradication or a rebuild. Need-to-know — access to specific information required for the job. Content. Least privilege — the minimum rights needed to perform the function. Actions. RPO — how much data you can lose (backup frequency). RTO — how fast IT must return to a defined service level. MTD / MAO — how long the business can stand the outage. Typically RTO + WRT ≤ MTD. ## 2. Mental model · detect, decide, preserve, restore Hold four parts. Interviews fail when people treat SIEM as “the answer,” treat IR as “wipe and patch,” or shop for a hot site before the BIA. Journey · detect, contain, eradicate, recover Read left to right. Contain sits before eradicate. Recover is last among the four — and lessons learned still come after recover. ### Part 1 · two official IR lists, one sequence Objective 7.6 names seven activities in this order: detection, response, mitigation, reporting, recovery, remediation, lessons learned . That is the list to recite on the exam. NIST SP 800-61 Rev. 2 (the CBK workhorse, August 2012) uses four phases: Preparation → Detection and Analysis → Containment, Eradication, and Recovery → Post-Incident Activity . Mitigation in 7.6 is the containment bucket. Remediation plus lessons learned is post-incident. NIST SP 800-61 Rev. 3 (April 2025) remaps the same work onto CSF 2.0. Govern, Identify, and Protect are preparation — they are not the incident itself. The incident is Detect, Respond, Recover . Improvement is continuous, not a meeting you skip. Know r3 exists; the stem will still reward the 7.6 verbs and “contain before eradicate.” ### Part 2 · logging is how detection earns its keep Objective 7.2 is not “buy a SIEM.” It is IDPS, SIEM, continuous monitoring and tuning , egress monitoring, log management, threat intelligence (feeds and hunting), and UEBA. A SIEM that is not tuned is an alarm clock nobody believes. The official Domain 7 AI note is the same idea: use ML to cut alert fatigue and raise fidelity — then a human still validates. Logs only correlate if clocks agree. Protect log integrity (append-only, separate store) or the investigation is hearsay with a timestamp. ### Part 3 · people controls are operations, not IAM trivia Objective 7.4 lists need-to-know / least privilege, SoD, privileged account management, job rotation, and SLAs. These are how you run the shop every day. Domain 5 designs the access model. Domain 7 is whether the SOC, the admin team, and the finance clerk actually live it. Flow 1 · four people controls, four jobs Need-to-know, least privilege, SoD, and job rotation - Outline 7.4 · pick the control the stem actually named Need-to-know Which files? Analyst sees only their queue — not HR salary data. Content Least privilege Which rights? Helpdesk resets passwords — cannot export the directory. Actions SoD Split the process Requester cannot also approve the wire and reconcile. Fraud prevention Job rotation Swap the chair Detective + backup skill. Vacation is the close cousin. Detect + resilience Read left → right. If the stem is about seeing a file , it is need-to-know. If it is about being able to do a thing , it is least privilege. If one person can complete a crime alone, it is SoD. If you need to catch ongoing fraud or remove a single point of failure, it is rotation. Say this out loud Need-to-know is the file. Least privilege is the button. SoD splits the process. Job rotation finds the fraud the SIEM never saw. ## 3. Decision flow · the IR path Decision · contain vs eradicate is not the first diamond Caption, not the art: you only reach contain vs eradicate after the alert is validated. Skipping analysis is the engineer-brain miss. Eradicate is the later branch. Flow 2 · from SIEM fire to lessons learned Incident decision flow from alert to lessons learned 7.6 verbs on the 800-61 path Alert / event (SIEM, UEBA) Validated incident with scope? no · tune Close as event document + tune yes · 7.6 Response Activate IR + impact Preserve volatile evidence Mitigation = contain Isolate. Do not rebuild yet. Eradicate → recover Remediate + lessons Fix root cause. Write it down. 800-61 r2 phases 1 Preparation (before the fire) 2 Detection & Analysis 3 Contain · Eradicate · Recover 4 Post-incident activity r3: Detect / Respond / Recover Govern · Identify · Protect = prep Read top → bottom on the right. Diamond = decision. Green = you can leave the incident path. Reporting in 7.6 runs throughout — legal, leadership, regulators — not only at the end. 800-61 Rev. 2 is explicit: document containment strategies before you need them, and preserve evidence while you contain. Eradication without a picture of scope leaves a second foothold. Recovery without a clean image puts the same malware back. ## 4. How to choose people controls, sites, tests Use the tables. Qualitative judgment is enough for most FIRST questions. Numbers (RPO hours, RTO hours) show up when the stem hands them to you. If the ticket looks like… Control Why not the cousin Analyst can open only their queue, not payroll files. Need-to-know Least privilege is about the action (reset vs export), not the file set. Helpdesk can reset passwords but cannot create domain admins. Least privilege (+ PAM for the admin path) Need-to-know would hide a document. This hides a capability. One clerk requests, approves, and reconciles the same payment. Separation of duties Rotation might later detect the fraud. SoD tries to make the fraud impossible. Long-tenured operator, no backup, auditor suspects silent fraud. Job rotation or mandatory vacation A new SIEM does not watch a paper process. Rotation is detective + resilience. Vendor must restore email in four hours or pay. SLA An SLA is a contract metric. It is not a substitute for your own BIA. BIA number What it measures What you buy RPO Maximum acceptable data loss (time). Backup frequency, replication, journal. Hourly RPO is not a weekly tape. RTO Maximum time to restore a defined service level . Hot / warm / cold / cloud / reciprocal site, HA, spare capacity agreements (outline 7.10). WRT Time to verify integrity and resume the business after IT is up. Runbooks, people, comms. A restored database that finance cannot trust is not recovered. MTD / MAO How long the process can be down before irrecoverable harm. If RTO + WRT > MTD, the strategy fails the BIA. Declare disaster when MTD is at risk. Flow 3 · time numbers and site heat RPO RTO WRT MTD and hot warm cold sites BIA clock · then pick the site that can hit it Disaster t = 0 RTO IT service back WRT business verified ≤ MTD or the firm dies RPO data look-back Hot Live or near-live replica Hours or less. Expensive. Tight RTO / RPO Warm Hardware in place, data / staff to load. Medium RTO Cold Empty space / power. Cheap. Days to weeks. Loose RTO only Read left → right on the clock, then pick heat. Outline 7.10 says “cold vs. hot” and resource capacity agreements. Cloud and reciprocal sites are valid strategies if they hit the BIA. Geographic separation so one flood does not take both sites. Official 7.12 test What you actually do Hits production? Read-through / tabletop Sit with the plan. Talk the scenario. Find missing names and phone trees. No Walkthrough Role-owners walk their own steps and correct the document. No Simulation Act the disaster. Stop before you touch live systems or data. No Parallel Bring the recovery site up while production stays up. Compare results. No (recovery side only) Full interruption Take production down and run the real fail-over. Yes — highest proof, highest risk Communications Stakeholders, test status, regulators — named in 7.12 on purpose. Depends on the exercise BCP is not DR Objective 7.11 is Disaster Recovery (IT, facilities, comms, restoration). Objective 7.13 is Business Continuity (the business process keeps running). Domain 1.7 already told you the BIA comes first. Domain 7 is where you implement and test. People safety (7.15 — travel, 2FA fatigue, emergency, duress) outranks the server every time. ## 5. Runbook · Side A log, B IR/forensics, C BCP/DR This is not a vendor console path. It is the Domain 7 operating path you walk on an alert, a laptop seizure, or a declared disaster. Each side cites one primary source. ### Side A · logging and detection (due diligence of the SOC) Primary source: ISC2 outline 7.2 and NIST SP 800-92, Guide to Computer Security Log Management . #### Collect the right sources, not every syslog on earth IDPS, firewalls, endpoints, identity, cloud control plane, egress. 7.2 names egress monitoring on purpose — exfil is how you find the quiet incident. - #### Normalize, correlate, tune SIEM aggregates and correlates. UEBA watches user and entity baselines. Threat intel (feeds + hunting) tells you what “interesting” looks like this week. Untuned rules are alert fatigue — the official Domain 7 AI paragraph is about raising fidelity, not auto-closing tickets. - #### Protect the log itself Time sync. Integrity. Retention that matches legal hold and policy. If the attacker can edit the only copy, you have no investigation. - #### Treat the first fire as an event Validate. Deduplicate. Ask “what else is in scope?” A single host alert that is really a subnet is a different incident. This is Detection and Analysis, not Recovery. ### Side B · incident, investigation, forensics Primary source: ISC2 outline 7.1 / 7.6 , NIST SP 800-61 Rev. 2 (four-phase handling) and Rev. 3 (CSF 2.0 Detect / Respond / Recover). - #### Secure the scene, then decide live vs dead Once evidence is contaminated, you cannot decontaminate it. Live systems hold RAM, cache, and crypto keys. Power-off destroys them. A dead-box disk image is right when volatility is already gone or the box is off. Do not “just pull the plug” because a blog said so. - #### Collect in order of volatility Well-known order (RFC 3227 / NIST SP 800-86): registers and cache → routing/ARP/process table/memory → temp file systems → disk → remote logs → physical config and topology → archives. Hash before and after the image. Use a write blocker on media. Bit-for-bit copy; work from the copy. - #### Start and keep the chain of custody Who handled what, when, where, why. Seal it. Outline 7.1: evidence collection and handling, reporting and documentation, artifacts (data, computer, network, mobile). Five classic rules of evidence: authentic, accurate, complete, convincing, admissible. Chain of custody helps admissibility; it does not guarantee it. - #### Contain, then eradicate, then recover Mitigation = isolate, sinkhole, disable the account, segment the VLAN. Reporting runs in parallel to legal, leadership, and any regulator the incident triggers. Recovery returns service. Remediation removes the root cause (patch, key rotate, kill the bad rule). Lessons learned is a dated meeting, not a Slack shrug. ### Side C · continuity and recovery Primary source: ISC2 outline 7.10–7.13 and NIST SP 800-34 Rev. 1, Contingency Planning Guide . - #### BIA first — then strategy Critical processes, impact over time, RPO / RTO / WRT / MTD, resource dependencies. Shopping for a hot site before the BIA is Domain 1’s “buy the WAF first” mistake in a different jacket. - #### Pick backup and site to hit the numbers 7.10: cloud / on-site / off-site storage; cold vs hot; resource capacity agreements; multiple processing sites; HA, QoS, fault tolerance. Incremental vs differential is CBK restore-math (incremental = last full + every incremental; differential = last full + one differential). Mirror is fastest and fattest. Test a restore, not just a backup job. - #### Declare when MTD is at risk, restore in BIA order 7.11: response, personnel, communications, assessment, restoration, training, lessons learned. Most critical first on the way to the recovery site. Least critical first when you fail back , so you prove the primary site before you bet the crown jewels on it. - #### Test with the official 7.12 name Tabletop if you have never walked it. Parallel if you must prove the site without taking production. Full interruption only when leadership accepts the risk. Communications to stakeholders and regulators is a test type, not an afterthought. 7.9 change management still wraps patches (7.8) — a Friday-night emergency change is still a change. Green path — you finished Domain 7 work when The event was validated. Scope is written. Containment happened before the rebuild. Evidence is hashed and chained. Recovery matches the BIA. Root cause is fixed. A lessons-learned note exists. The next tabletop uses that note. ## 6. Runtime path after the incident Recovery is not the end. 800-61 Rev. 3’s whole point is that Detect / Respond / Recover feed Identify.Improvement, which retunes Govern / Protect / Detect. A closed ticket with the same detection gap is a care failure. Proof · chain of custody and a clean restore Notice: the sealed bag and the signed clipboard are the investigation. The green screen is only useful if it matches a tested restore. #### After IR Indicators go into detection. Patch and vuln (7.8) close the hole through change (7.9). Configuration baselines (7.3) so the rebuilt host is not the same soft image. #### After DR Update the plan, the call tree, and the BIA if the business changed. A parallel test that failed is a gift — treat it as a finding, not a secret. #### Physical + people 7.14 perimeter and internal physical controls. 7.15 travel, awareness (insider, social media, 2FA fatigue), emergency, duress. Life safety still wins over lock-down. #### Media 7.5: manage and protect media at rest and in transit. Encrypt, track, sanitize at end of life. A backup tape in a rideshare is an incident, not a courier story. ## 7. Traps + proof checklist Stem pattern What ISC2 is testing Engineer trap Manager move SIEM / AI alert fires. FIRST? Detection and analysis (7.2, 7.6). Validate. Escalate, wipe, or page the CEO. Validate the alert and assess scope. Confirmed malware. IMMEDIATELY / BEST next? Mitigation = contain (7.6, 800-61). Eradicate / restore now. Contain, preserve evidence, then eradicate. Live laptop, insider theft 7.1 forensics. Volatility. Pull the plug or run full AV. Capture volatile data, write-block, hash, chain of custody. One person can complete a payment 7.4 SoD vs rotation. Buy monitoring. Split the process (SoD). Rotation detects what SoD missed. Cannot see payroll, can still admin Need-to-know vs least privilege. Call both “least privilege.” Hidden files = need-to-know. Hidden buttons = least privilege. RPO 4 hours, RTO 1 hour 7.10 / 7.11 metrics. Swap the two letters. Buy a cold site. RPO is data loss. RTO is downtime. One-hour RTO is not a cold site. Prove the DR plan without risking Friday traffic 7.12 test types. Full interruption because it sounds serious. Parallel (or tabletop if the plan has never been read). Fire alarm vs locked data-centre doors 7.15 life safety. Fail-safe. Keep doors locked for confidentiality. People out. Fail-safe unlocks. Fail-secure is for the firewall, not the fire exit. Common trap Do not recite PICERL as if it were the ISC2 list. SANS PICERL is useful in a SOC. The exam outline’s 7.6 verbs are detection, response, mitigation, reporting, recovery, remediation, lessons learned. Mitigation is contain. Remediation is the lasting fix. They are not synonyms. Pilot / interview proof checklist - I can say the seven 7.6 verbs in order and map them to 800-61 r2’s four phases. - I can explain why r3 moved preparation into Govern / Identify / Protect. - I can separate event from incident in one sentence. - I can order volatile evidence without looking it up. - I can tell need-to-know from least privilege from SoD from job rotation. - I can assign RPO and RTO from a one-line business ask, and reject a cold site that cannot hit RTO. - I did not invent an exam percentage. Domain 7’s official weight is 13% of the whole exam — that is the only percentage this page uses. Interview angle Weak: “Domain 7 is the SOC and backups.” Strong: “I validate before I contain, I contain before I eradicate, and I do not recover on top of a dirty image. Need-to-know is the file; least privilege is the right; rotation is how I catch the fraud the SIEM never saw. RPO is data, RTO is time, and the BIA decides the site — not the brochure.” ## Knowledge check Six judgment items. Map each one to a FIRST/BEST stem, not a definition. Check answers, then reset and retry the misses. Q1 A high-severity ransomware signature fires on one file server. An engineer opens a change to wipe and restore from last night. What does the security professional do FIRST? Approve the wipe so the RTO clock starts immediately Validate the alert and assess scope before containment Notify the press so customers hear it from you Patch every server in the fleet in parallel Correct: b . FIRST on a SIEM fire is Detection and Analysis — confirm it is an incident and learn the blast radius. A wipe is recovery and destroys evidence. Press and fleet-wide patching come after scope. Re-read Decision flow and Side A. Q2 SOC analysts can open only tickets in their own queue. They cannot open HR salary files even though they have a domain account. Which 7.4 control is this? Need-to-know — access to specific information required for the job Job rotation — another analyst will sit in the chair next month Full-interruption DR test Fail-open firewall policy Correct: a . Hidden files are need-to-know. Least privilege would be about which admin actions they can perform. Rotation and DR tests are different 7.4 / 7.12 controls. Re-read Mental model and the choose table. Q3 Legal seizes a still-running laptop suspected of insider data theft. What is the FIRST forensic move? Pull the power cable so nothing else changes Run a full antivirus scan to clean the box before imaging Capture the most volatile evidence first, then image with a write blocker and hash Email an unencrypted disk image to counsel so they can start reading Correct: c . Order of volatility (RFC 3227 / NIST 800-86): memory and live state die first. Pulling power destroys them. AV changes the disk. Unencrypted email breaks confidentiality and chain of custody. Re-read Side B. Q4 Scope is confirmed: one subnet is beaconing to a known C2. Leadership asks for the BEST next action. Hold the lessons-learned meeting while the C2 is still live Restore the subnet from backup without isolating it Wait for a finished forensic report before any containment Contain the subnet (isolate / block C2), preserve evidence, then eradicate Correct: d . 7.6 mitigation is containment. 800-61 wants you to stop the bleed and keep evidence, then eradicate and recover. Lessons learned is last. Waiting for a perfect report while C2 runs is not IMMEDIATELY. Re-read Decision flow . Q5 Finance says they can lose at most four hours of ledger data, but the payment service must be back in one hour. What did they set, and which site class can even try? RPO 1 hour, RTO 4 hours — a cold site is enough RPO 4 hours, RTO 1 hour — a hot (or equivalent) capability, not a cold empty room MTD 1 hour and RPO 4 hours — skip the BIA The two numbers are synonyms; buy any off-site tape Correct: b . RPO is data loss (4 hours). RTO is downtime (1 hour). A cold site cannot make a one-hour RTO. MTD is the business ceiling, not a substitute for naming RPO/RTO. Re-read How to choose and Side C. Q6 An auditor flags a 12-year finance operator who is the only person who understands a manual reconciliation. No SIEM will ever see it. What is the MOST appropriate operations control? Job rotation or mandatory vacation — detective plus a trained backup Buy a second SIEM and hope the paper process appears in syslog Schedule a full-interruption DR test this Friday Whitelist the finance application on the firewall Correct: a . Outline 7.4 names job rotation. Mandatory vacation is the well-known cousin. Both detect fraud and remove a single point of failure. A SIEM, a DR test, and a firewall allow-list do not watch a paper desk. Re-read Mental model and traps. Check answers Reset ## Sources - ISC2 — CISSP Certification Exam Outline (effective 15 April 2024). Domain 7 weight 13%. Objectives 7.1–7.15 used as the spine of this lesson. No other exam percentages are claimed. - NIST — SP 800-61 Rev. 2, Computer Security Incident Handling Guide (Preparation → Detection and Analysis → Containment, Eradication, and Recovery → Post-Incident Activity; event vs incident). - NIST — SP 800-61 Rev. 3 (April 2025). CSF 2.0 community profile: Govern / Identify / Protect as preparation; incident work is Detect, Respond, Recover; continuous improvement. - NIST — Incident Response project (life-cycle figure and r2 supersession note). - NIST — SP 800-86, Guide to Integrating Forensic Techniques into Incident Response and IETF RFC 3227 (order of volatility). - NIST — SP 800-92, Guide to Computer Security Log Management . - NIST — SP 800-34 Rev. 1, Contingency Planning Guide (BIA before recovery strategy; RTO / RPO as well-known CBK metrics). - Well-known CBK (not an ISC2 percentage claim): five rules of evidence; incremental vs differential restore math; fail-safe vs fail-secure; RTO + WRT ≤ MTD. Related: CISSP overview (all 8 domains) · Domain 1: BIA and risk treatment · Domain 6: Assessment and Testing · Domain 8: Software Security · 8-week roadmap --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt