Domain 4 — Operations and Incident Response

Week of 2026-10-27 · Download .docx

Objectives

Compare authentication factors, access control models (DAC, MAC, RBAC, ABAC), and federation protocols.
Apply the NIST SP 800-61 incident response phases in the correct order with correct actions at each phase.
Explain the order of volatility for digital forensic evidence collection.
Describe chain of custody, write blockers, and hash-based integrity verification.
Explain SIEM and SOAR functions and their roles in detection and automated response.

Key terms

MFA: Multi-Factor Authentication — requires two or more factors from different categories: know, have, are, location, or behavior.
TOTP: Time-based One-Time Password — changes every 30 seconds; implemented by authenticator apps (RFC 6238).
RBAC: Role-Based Access Control — permissions assigned to roles; users assigned to roles; most common enterprise model.
MAC: Mandatory Access Control — sensitivity labels (Top Secret, Secret, Unclassified); access based on clearance matching label.
SAML: Security Assertion Markup Language — XML-based federated identity standard for enterprise SSO.
OAuth 2.0: Authorization framework — delegates resource access without sharing credentials; OIDC adds authentication on top.
least privilege: Grant users only the minimum permissions required to perform their job — foundational Zero Trust principle.
PAM: Privileged Access Management — controls, monitors, and audits administrative accounts with session recording and JIT access.
NIST SP 800-61: NIST incident response guide — Preparation → Detection → Containment → Eradication → Recovery → Lessons Learned.
order of volatility: Forensic collection sequence from most volatile (RAM) to least (disk/backup) — collect most volatile first.
chain of custody: Documentation tracking who handled evidence, when, and how — required for court admissibility.
write blocker: Hardware or software preventing writes to original storage media during forensic imaging — preserves evidence integrity.
SIEM: Security Information and Event Management — aggregates and correlates security events from multiple sources.
SOAR: Security Orchestration Automation and Response — automates incident response playbooks to reduce mean time to respond.

The concept

IDENTITY AND ACCESS MANAGEMENT

Identity is the foundation of security — you must know who (or what) is accessing a resource before deciding whether to allow it. Authentication factors come in five categories: something you know (password, PIN), something you have (TOTP token, smart card), something you are (biometric), somewhere you are (geolocation), and something you do (behavioral biometrics). MFA combines two or more categories — adding a TOTP code to a password means stealing the password alone is not enough. Access control models determine who can access what once authenticated: DAC lets the resource owner decide; RBAC (the most common enterprise model) assigns permissions to roles and users to roles; MAC uses government-style sensitivity labels; ABAC evaluates combinations of user, resource, and environment attributes for maximum flexibility. Separation of duties prevents one person from controlling an entire sensitive process — a key fraud prevention control. Zero Trust extends least privilege to every access request, continuously verifying rather than implicitly trusting.

FEDERATED IDENTITY

Federation allows users to authenticate once and access services across organizational boundaries. SAML (XML-based) is the enterprise SSO standard — an identity provider (Okta, Azure AD) issues SAML assertions to service providers. OAuth 2.0 is an authorization framework — it allows a third-party app to access your resources without sharing your credentials (the basis of 'Sign in with Google'). OIDC (OpenID Connect) adds authentication on top of OAuth 2.0. The exam distinction: OAuth 2.0 is authorization; OIDC is authentication.

INCIDENT RESPONSE (NIST SP 800-61)

The NIST SP 800-61 IR lifecycle has six phases: (1) Preparation — build the team, develop playbooks, test the plan. (2) Detection and Analysis — identify the incident from alerts, logs, or user reports; determine scope. (3) Containment — isolate affected systems to stop the spread without destroying forensic evidence. (4) Eradication — remove the threat from all affected systems (malware, backdoors, attacker footholds). (5) Recovery — restore systems from clean backups, validate functionality, return to production. (6) Post-Incident Activity (Lessons Learned) — review what happened, what failed, and what must change. This is the most frequently skipped phase — and the one where organizations most improve.

DIGITAL FORENSICS

Forensic investigation must follow strict procedures to maintain evidence admissibility. The order of volatility defines collection sequence: CPU registers and RAM (lost on power-off) first, then running processes, network state, disk images, logs, and off-site backups last. A write blocker prevents the forensic tool from accidentally writing to the original media. After imaging, both the original and the image are hashed with SHA-256 — matching hashes prove a bit-for-bit copy. Chain of custody documents every person who handled the evidence, when, and in what state. Any break in the chain can disqualify the evidence in court. Memory forensics captures running processes, open network connections, encryption keys in RAM, and credentials — data that exists nowhere on disk.

SIEM AND SOAR

A SIEM aggregates logs from firewalls, servers, endpoints, and cloud services, applying correlation rules to detect patterns no single source reveals. SOAR automates the response: when the SIEM fires an alert, SOAR can isolate the endpoint, block the IP, create a ticket, and notify the analyst in seconds — reducing MTTR from hours to minutes.

Standards alignment: CompTIA Security+ SY0-701 Domain 4.1 (Operations and Incident Response); Maryland Blueprint College and Career Readiness — Technology and Engineering.

Worked examples

Example 1: A SOC analyst receives a SIEM alert: 'Potential credential stuffing — 850 failed login attempts against the customer portal from 23 different IPs in 4 minutes.' The SOAR playbook triggers automatically: temporary CAPTCHA enforcement on the login page, IP reputation check (12 of 23 IPs on threat intelligence feeds), and rate limiting applied. The analyst reviews the SOAR report and approves a 24-hour block on the flagged IPs. Three accounts that had successful logins from the flagged IPs are forced to reset passwords. Response time from alert to mitigation: 3 minutes automated, 7 minutes analyst decision. Without SOAR, this would take 45 minutes of manual work.

Example 2: A forensic analyst is called to examine a workstation suspected of data exfiltration. Using proper IR procedure: (1) She connects a write blocker before attaching any forensic storage. (2) She acquires a RAM image first (order of volatility — RAM lost on power-off). (3) She acquires a full disk image. (4) She hashes both images with SHA-256 immediately and records the hashes in the chain of custody log. (5) She documents the time, her identity, and the device serial number in the evidence log. Analysis of the RAM image reveals a fileless malware process running in PowerShell with an active connection to a C2 server — this data would not have existed in any disk file.

Common mistakes

Confusing OAuth 2.0 (authorization — what you can do) with authentication (who you are) — OIDC built on OAuth 2.0 handles authentication.
Skipping Lessons Learned because the incident is resolved — this phase is where preventive controls are improved; skipping it means the same incident recurs.
Collecting disk images before RAM — RAM is most volatile and lost on power-off; always collect RAM first.
Assuming two passwords constitute MFA — two factors from the same category (both 'something you know') is not multi-factor authentication.
Thinking containment means rebuilding the system immediately — containment isolates the system without destroying forensic evidence; eradication and recovery come later.

Self-check

Try each question before reading the answer. Answers at the bottom of this page.

1. In RBAC, a new employee is granted access by:

An administrator manually assigning each permission
Being assigned to a role that has the required permissions pre-defined
The employee requesting their own access
The system automatically based on their name

2. The NIST SP 800-61 phase after Containment is:

Recovery
Lessons Learned
Eradication
Detection

3. What is the first evidence type to collect based on order of volatility?

Disk images
Log files
Off-site backup tapes
CPU registers and RAM

4. A write blocker is used to:

Speed up disk imaging
Prevent any modifications to the original evidence media
Decrypt encrypted volumes
Connect to a remote forensic server

5. SOAR differs from SIEM in that SOAR:

Aggregates logs from multiple sources
Only sends email alerts
Automates incident response playbooks to reduce human response time
Stores forensic disk images

Self-check answers

1. B — RBAC assigns permissions to roles — the administrator assigns the employee to the appropriate role, and they inherit all role permissions.
2. C — The order is: Containment → Eradication → Recovery → Lessons Learned. The threat must be removed before systems are restored.
3. D — RAM is most volatile — it is lost when the system powers off. Collect it before any other evidence.
4. B — A write blocker ensures no writes reach the original media during imaging — preserving evidence integrity for chain of custody.
5. C — SIEM detects and alerts; SOAR automates the response — isolating endpoints, blocking IPs, creating tickets — reducing MTTR from hours to minutes.

Canvas is the official record. This companion enhances the PGCC curriculum; it does not replace it. Last name and class year only. Students with a 504 plan or IEP: your accommodations apply.

↑ Back to top