Study Hub / ISC2 Certified in Cybersecurity (CC) / Domain 5.0
ISC2 Certified in Cybersecurity (CC) Domain 5.0: Security Operations — Explained
Domain 5.0 is security in motion: the operations center that watches, the incident response process that kicks in when watching finds something, and the forensics discipline that preserves the truth about what happened.
Security operations: the SOC
- SOC (security operations center) — the team (and room) that monitors, detects, and responds around the clock. Tiers escalate: Tier 1 triages alerts, Tier 2 investigates deeply, Tier 3 hunts and handles the worst cases.
- Monitoring sources — SIEM (correlated logs from everything), IDS/IPS (network and host intrusion detection/prevention), EDR (endpoint detection and response on workstations/servers), and threat intelligence feeds (what the bad guys are doing this week).
- Alert fatigue — too many low-quality alerts trains analysts to ignore them. Tuning detection (fewer false positives) is an operations task, not just a tooling one.
- Patching and hardening — operations keeps systems patched and configured to baselines. Most breaches exploit known vulnerabilities with available patches — an operations failure, not a zero-day.
The incident response lifecycle
NIST's four phases — know them in order:
- 1. Preparation — before anything happens: the IR plan, the team (with defined roles), the tools, the communication lists, and tabletop exercises. You can't improvise a good response.
- 2. Detection & analysis — notice and scope: is this real? How far did it go? Triage separates "weird but benign" from "breach."
- 3. Containment, eradication & recovery — contain (isolate hosts, block IPs — stop the bleeding), eradicate (remove the cause: malware, backdoors, compromised accounts), recover (restore systems to operation, verify they're clean).
- 4. Post-incident activity — the lessons-learned review: what happened, what worked, what changes. The report goes to management; the improvements go into the plan.
Forensics basics and continuity
- Chain of custody — documented control of evidence from collection to courtroom: who handled it, when, why. Break the chain and the evidence may be inadmissible.
- Order of volatility — collect the most ephemeral evidence first: CPU registers and cache → RAM → network state → running processes → disk → logs → backups. RAM dies when power dies; disk waits.
- Write blockers and hashing — forensic copies are made through write blockers (no accidental modification), and hashes prove the copy matches the original bit for bit.
- Business continuity tie-in — operations also owns keeping the business alive: the BCP (business processes continue) supported by the DRP (technology restored). IR handles the attack; BCP/DR handle the outage — and attacks cause outages, so they interlock.
The must-memorize table: incident response phases
Four phases — know them in order.
| Phase | Goal | Example actions |
|---|---|---|
| 1. Preparation | Be ready before it happens | IR plan, team roles, tabletop exercises |
| 2. Detection & analysis | Find it and scope it | Triage alerts, determine real vs. benign |
| 3. Containment, eradication, recovery | Stop it, remove it, restore | Isolate hosts → remove malware → restore clean |
| 4. Post-incident activity | Learn from it | Lessons-learned review, update the plan |
Try it: 4 sample questions
Sample questions to check your understanding of this domain. Answers and full reasoning are tucked under each one.
1. During an active ransomware outbreak, the IR team debates whether to immediately wipe infected machines or isolate them from the network first. What is the correct order and why?
- A. A. Wipe first — eradication before containment saves time
- B. B. Isolate (contain) first — stop the spread before removing the cause
- C. C. Recover from backup first, then investigate
- D. D. Skip to post-incident review to save time
Show answer & reasoning
B. Containment comes before eradication: isolating hosts stops ransomware from reaching new victims while you work. Wiping first (A) destroys forensic evidence and doesn't stop the still-spreading infection elsewhere. The phase order exists because each step protects the next.
2. An analyst needs to preserve evidence from a running compromised server. Following the order of volatility, what should be captured first?
- A. A. The disk image — it holds the most data
- B. B. System logs from last week
- C. C. RAM contents — the most volatile evidence
- D. D. The backup tapes
Show answer & reasoning
C. Order of volatility: capture the most ephemeral first. RAM (running processes, encryption keys, network connections) vanishes when power dies; disk and logs persist. Imaging the disk first (A) is fine after RAM — but RAM can't wait.
3. A SOC receives 10,000 IDS alerts per day and analysts have started ignoring the queue. What is the underlying problem and the fix?
- A. A. Too few analysts — hire more Tier 1 staff
- B. B. Alert fatigue from untuned detections — tune rules to cut false positives
- C. C. The IDS is misplaced — move it behind the firewall
- D. D. Analysts need longer shifts
Show answer & reasoning
B. This is textbook alert fatigue: noisy, low-fidelity detections train humans to ignore all alerts — including the real ones. The fix is tuning (better rules, correlation, prioritization), not more eyeballs on the same noise. Detection quality is an operations discipline.
4. After containing a breach, what must happen before affected systems return to production?
- A. A. Nothing — containment is the last step
- B. B. Eradication of the root cause and verification the systems are clean
- C. C. A press release to customers
- D. D. Deleting all logs to save disk space
Show answer & reasoning
B. The phase order is contain → eradicate → recover. Returning still-compromised systems to production re-infects the environment and wastes the containment effort. Eradication (remove malware, close the entry point, reset compromised credentials) plus verification comes first — recovery is the reward for clean systems.
This was one domain. The simulator drills all 5.
This free preview covered Security Operations (Domain 5.0, 18%). Not covered here: Access Controls Concepts (Domain 3.0, 22%); Network Security (Domain 4.0, 24%). The two most technical domains — access control models and network security — stay in the paid guide and practice bank. The ByteBar Practice Exam Simulator drills every domain with 1,000 exam-style questions — $9.99 one-time unlocks all 28 exams. Prefer to read? The full ISC2 CC Study Guide is in the ByteBar shop on Etsy.
Practice Exam Simulator — $9.99 one-time, all 28 exams Full Study Guides on Etsy