CompTIA Security+ (SY0-601) Cert Prep: 9 Operations and Incident Response

This course prepares you for the Operations and Incident Response domain of the Security+ exam, covering incident responses and investigations, as well as digital forensic techniques.

This course covers cybersecurity operations and incident response to prepare for the Security+ exam, an entry-level exam for cybersecurity professionals. Instructor Mike Chapple covers topics such as designing an incident response program, conducting incident investigations, and using digital forensic techniques. Mike explains how to develop a solid foundation for an organization's information security incident response program. He goes over the process of selecting and training a diverse incident response team and incident communications plan. He details incident identification, escalation, and notification, then goes into how to mitigate and recover from incidents. Mike discusses attack frameworks such as the MITRE ATT&CK framework, the Diamond Model of Intrusion Analysis, and cyber kill chain analysis. He walks through all the steps of incident investigation, then introduces you to a variety of forensic techniques you may use in investigations.We are a CompTIA Partner. As such, we are able to offer CompTIA exam vouchers at a 10% discount. For more information on how to obtain this discount, please download these PDF instructions.

Introduction

• Operations and incident response
• What you need to know
• Study resources

1. Incident Response Programs

• Build an incident response program
• Creating an incident response team
• Incident communications plan
• Incident identification
• Escalation and notification
• Mitigation
• Containment techniques
• Incident eradication and recovery
• Validation
• Post-incident activities
• Incident response exercises

2. Attack Frameworks

• MITRE ATT&CK
• Diamond Model of Intrusion Analysis
• Cyber kill chain analysis

3. Incident Investigation

• Logging security information
• Security information and event management
• Cloud audits and investigations

4. Forensic Techniques

• Conducting investigations
• Evidence types
• Introduction to forensics
• System and file forensics
• File carving
• Creating forensic images
• Digital forensics toolkit
• Operating system analysis
• Password forensics
• Network forensics
• Software forensics
• Mobile device forensics
• Embedded device forensics
• Chain of custody
• Ediscovery and evidence production
• Exploitation frameworks

Conclusion

• Continuing your studies