7 Security Operations and Incident Readiness Free Online FlashCards

What is the operational security feedback loop?

Connect system events and asset data to protected central logging and monitoring, then feed findings into response and remediation workflows and back into system design.

What four questions should logging requirements answer?

For each important event, decide what to record, where logs go, who may access them, and how long they are retained.

Which events commonly belong in security logs?

Useful events include sign-ins and failures, privilege or configuration changes, access to sensitive records, security alerts, and deployment or administrative actions.

What makes log events easier to interpret and correlate?

Consistent timestamps, stable actor and resource identifiers, event outcomes, and sufficient context make events easier to interpret and correlate.

What sensitive information should security logs avoid capturing?

Do not log passwords, authentication tokens, encryption keys, or unnecessary sensitive personal data; redact or minimize sensitive fields at the source when feasible.

How should logs be protected as security-sensitive data?

Restrict read and write permissions, protect log transmission and storage, and monitor for collection failures or unexpected changes.

How does context improve security monitoring?

Combine events with context such as asset importance, identity privileges, network location, known vulnerabilities, and expected behavior to prioritize findings.

How can an organization check that monitoring itself works?

Track whether expected sources report, ingestion is delayed, and storage or processing problems threaten coverage; test detections and verify alerts reach responders.

What are the recurring steps in vulnerability management?

Maintain an inventory, discover and assess weaknesses, prioritize treatment, apply patches or other mitigations, and verify the result.

What factors should guide vulnerability prioritization?

Consider exploitation, reachability, asset importance and sensitivity, and the effectiveness of existing safeguards—not severity score alone.

What should happen after a vulnerability fix?

After a fix, rescan or otherwise verify that the weakness is resolved, then update the asset record.

What response responsibilities should be established before an incident?

Define who can declare and lead an incident, authorize containment, communicate across teams, and preserve evidence; ensure responders can access relevant logs and asset information.