Response Planning, Threat Hunting, Forensics, and Data Sources

Introduction

This lesson covers two objectives of Domain 4, Security Operations (28% of SY0-701): objective 4.8, explaining appropriate incident response activities, and objective 4.9, using data sources to support an investigation. Every organization eventually has an incident. What separates a contained event from a headline is preparation, speed, evidence quality, and discipline in following a tested process. The exam asks you to put response phases in order, choose the correct next step in a scenario, preserve evidence properly, and pick the log or tool that answers a given question.