How do you stop a burglar who is already inside your house? You can't just ignore them and hope they leave. That is the problem Security Operations and Incident Response solves: how to detect, contain, and recover from a live security breach while gathering evidence to prevent it happening again. For the CAS-005 exam, this topic is one of the most heavily tested areas because it covers what security professionals actually do in a real crisis.
Jump to a section
A simple way to picture Security Operations and Incident Response
Because a hospital can't stop patients from getting sick, it builds an Emergency Room (ER) to handle the chaos. This is the same reason organisations build a Security Operations Centre (SOC) — you can't prevent every cyber problem, but you can build a team and a process to handle them when they happen.
In a hospital ER, the triage nurse is the first person you see. They don't treat you; they quickly sort you into 'critical', 'urgent', or 'stable'. This maps to a SOC analyst doing 'triage' on security alerts — deciding which ones need immediate action and which can wait. The ER doctor then runs tests (like a CT scan) to work out exactly what is wrong. In IT, this is the 'forensic investigation' phase where analysts collect logs and evidence to understand the attack. The surgeon operates to stop the bleeding, which is the 'containment' phase of incident response — cutting off the attacker's access to the network. Finally, the patient goes to a recovery ward and the hospital reviews what went wrong to improve for next time. This is the 'lessons learned' phase, where the team updates their playbook to prevent a repeat incident. Every step in the ER has a clear process, just like the incident response lifecycle has six defined phases. Without the ER, chaos. Without the SOC, the same.
Security Operations and Incident Response is the discipline of monitoring an organisation's IT systems for security threats and then reacting to them in a structured way. It sits inside the broader field of 'Security Operations', which includes everything from staffing a 24/7 monitoring team to choosing the right software tools.
The central hub for this work is the Security Operations Centre (SOC). A SOC is a dedicated team — often in a room full of screens — that watches the organisation's network, servers, and endpoints (laptops, phones) for suspicious activity. Think of it as the security guard booth for the whole company, but instead of watching a single door, they watch thousands of digital doors at once.
When the SOC spots something suspicious, they use the Incident Response Lifecycle (often called the IR Lifecycle). This is a standard six-phase process defined by the National Institute of Standards and Technology (NIST). The phases are:
Preparation: The team gets ready before any incident happens. They write playbooks (step-by-step response guides), install detection tools, and train staff.
Detection and Analysis: The team identifies that something is wrong. They confirm it is a genuine threat (not a false alarm) and work out what kind of attack it is — for example, ransomware or a data breach.
Containment, Eradication, and Recovery: The team stops the attack from spreading (containment), removes the attacker's tools from the network (eradication), and brings systems back to normal operation (recovery).
Post-Incident Activity: The team writes a report on what happened, what they did well, and what they will improve. They also hand over evidence for potential legal action.
Each phase has its own sub-tasks. For example, 'Containment' might mean disconnecting an infected laptop from the network, while 'Eradication' might mean wiping that laptop's hard drive and reinstalling the operating system.
Forensic Investigations are a subset of incident response. Forensics is the careful collection and analysis of digital evidence. The key rule is to preserve the 'chain of custody' — a documented trail of who handled the evidence and when, so it can hold up in court. Forensics analysts use tools to create a 'forensic image' (an exact bit-by-bit copy) of a hard drive, because working directly on the original drive would alter it and destroy evidence.
Why does this matter for an organisation? Without a SOC and an IR lifecycle, a small ransomware infection can spread across an entire network in minutes, costing millions in ransom payments, lost business, and legal fines. By having a structured process, the organisation reduces the 'dwell time' — how long the attacker sits undetected — from months to hours or even minutes.
CAS-005 expects you to know the exact order of the IR lifecycle phases, the difference between a SOC analyst (level 1), a lead investigator (level 2), and a manager (level 3), and the legal requirements for forensic evidence. You also need to understand that detection tools like SIEM (Security Information and Event Management) correlate logs from many sources to spot patterns, such as a user logging in from New York and Tokyo within 10 minutes.
Detection and Alert Triage
The SOC receives an alert from the SIEM. The Level 1 analyst verifies the alert is not a false positive by checking raw logs. If confirmed as a real threat, the analyst assigns a severity level (low, medium, high, critical) and escalates to Level 2. This step is critical because it filters out noise so the senior team only spends time on genuine incidents.
Incident Confirmation and Analysis
The Level 2 analyst investigates the details: what systems are affected, what accounts are compromised, and what type of attack it is (e.g., phishing, ransomware, data exfiltration). They use tools like packet captures (Wireshark) and log analysis (Microsoft Entra ID logs) to confirm the attack vector. This step determines the correct containment strategy.
Containment
The analyst takes immediate action to stop the incident from spreading. Common containment actions include disabling compromised user accounts, blocking malicious IP addresses at the firewall, isolating infected machines from the network, and disconnecting external connections. This is the 'stop the bleeding' phase and must be done quickly but carefully to avoid destroying evidence.
Eradication and Recovery
After containment, the team removes all traces of the attacker from the environment. This includes deleting malware, restoring clean backups, patching vulnerabilities, and changing passwords. Then recovery begins — bringing systems back into production in a safe state. Both steps are documented for the post-incident report.
Post-Incident Activity and Lessons Learned
The team writes a detailed report summarising the incident timeline, what worked, what failed, and recommended improvements. The chain of custody is finalised and stored. The playbook is updated based on lessons learned. This phase prevents the same incident from recurring and is essential for regulatory compliance and insurance claims.
Imagine you are a SOC analyst for a mid-sized e-commerce company called 'ShopFast'. You have 500 employees and thousands of customers. It is a Tuesday afternoon and you are monitoring a dashboard called a SIEM. The SIEM shows a spike in failed login attempts from an IP address in Russia against an employee account named 'jsmith'. Your job is to decide if this is a real attack or just a customer typing the wrong password.
Step one: you open the SIEM alert and look at the details. You see that the login attempts are for 'jsmith@shopfast.com', which is the CEO's assistant. That account has access to financial spreadsheets and customer data. This is a red flag. You 'triage' the alert as 'high severity' and escalate it to a Level 2 analyst within the SOC.
The Level 2 analyst, Maria, takes over. She runs a 'packet capture' tool called Wireshark to see the network traffic from that IP address. She also checks the 'authentication logs' from Microsoft Entra ID (formerly Azure Active Directory) to see if any login succeeded. She finds that one login did succeed two minutes ago, and then the attacker immediately changed the password. This confirms an incident.
Maria follows the IR playbook. First, she 'contains' the incident by disabling JSmith's account and blocking the Russian IP address at the firewall. Then she 'eradicates' by scanning JSmith's computer for malware and forcing a password reset for all accounts that had access to the same financial data. She then 'recovers' the environment by restoring a clean backup of a shared drive that was accessed by the attacker.
Next, the team does a 'forensic investigation'. A forensic analyst creates a 'bit-for-bit' image of JSmith's laptop hard drive and stores it in a secure evidence locker (a locked hard drive cabinet). They document every step in a 'chain of custody' form, noting who removed the drive, when, and where it is stored. They find that the attacker installed a 'keylogger' that captured JSmith's password.
Finally, the team writes a 'post-incident report'. They recommend adding multi-factor authentication (MFA) for all executive assistants and scheduling monthly security awareness training. The report is sent to the Chief Information Security Officer (CISO) who approves the changes. The SOC team also updates their playbook to include a new step: checking Microsoft Entra ID logs within the first minute of a high-severity alert.
What you, as the IT professional, actually do in this job is:
Monitor SIEM dashboards for alerts
Triage alerts by severity (low, medium, high, critical)
Escalate confirmed incidents to Level 2 analysts
Run basic containment actions (disable accounts, block IPs at the firewall)
Participate in post-incident reviews
Maintain the chain of custody for any evidence you collect
All of these tasks require following a strict process. There is no room for guessing, because a mistake can destroy evidence or let an attacker slip through.
CAS-005 tests Security Operations and Incident Response heavily. Expect at least 15-20% of your exam questions to come from this domain. The exam writers love to check if you know the exact definitions and order of things. Here is what you need to memorise perfectly:
First, the six phases of the NIST Incident Response Lifecycle. The official order is: Preparation, Detection and Analysis, Containment/Eradication/Recovery, and Post-Incident Activity. Some study guides combine Containment, Eradication, and Recovery into one phase, so you get four phases. CAS-005 uses the four-phase model (NIST SP 800-61 Rev 2). Know the phases by heart and know what activities happen in each.
Second, the difference between a SIEM and a SOAR. A SIEM (Security Information and Event Management) collects logs and alerts. A SOAR (Security Orchestration, Automation, and Response) automates the response to those alerts — for example, it can automatically disable a compromised account. The trap question will give you a scenario where an alert fires and ask whether you use a SIEM or SOAR. Answer: if the question says 'automatically blocks the IP', it is SOAR.
Third, forensic evidence rules. CAS-005 loves testing the 'chain of custody'. A typical question: 'An analyst collects a hard drive from a compromised server. What document must they complete to ensure the evidence is admissible in court?' Answer: the chain of custody form. Also know that a forensic image must be a bit-for-bit copy (not a file copy) and that you should never work on the original drive.
Fourth, types of SOC analysts. Know the three-tier model:
Tier 1: Monitors alerts, triages, escalates
Tier 2: Investigates confirmed incidents, performs deeper analysis
Tier 3: Threat hunting, advanced forensics, incident management
Fifth, key legal concepts like 'order of volatility' when collecting evidence. You must collect the most volatile data first (RAM, running processes) before powering down a machine to collect the hard drive. If you turn off a computer, you lose the data in memory.
Common traps they set:
They give you a scenario where the incident is over and ask what to do next. The correct answer is always 'post-incident activity' or 'lessons learned'.
They ask about 'containment' versus 'eradication'. Containment stops the bleeding (e.g., disconnect the cable). Eradication removes the cause (e.g., delete the malware). They will mix these up.
They ask about 'false positive' versus 'true positive' versus 'false negative'. A false positive is an alert that fires when there is no attack (like a fire alarm going off because of burnt toast). A false negative is when an attack happens but no alert fires (the worst case).
Key definitions to memorise:
Dwell time: the time an attacker is present in a network before being detected
Mean Time to Detect (MTTD): average time from start of incident to detection
Mean Time to Respond (MTTR): average time from detection to containment
Playbook: a step-by-step guide for responding to a specific type of incident
Runbook: a broader set of procedures for operating a system (less specific than a playbook)
The exam expects you to pick the right tool for the right job. For example, if the question says 'an organisation needs to correlate logs from multiple sources to detect anomalies', the answer is SIEM. If the question says 'an organisation needs to automatically respond to phishing emails', the answer is SOAR.
The NIST Incident Response Lifecycle has four phases: Preparation, Detection and Analysis, Containment/Eradication/Recovery, and Post-Incident Activity.
A SIEM (Security Information and Event Management) detects threats by correlating logs; a SOAR (Security Orchestration, Automation, and Response) automatically responds to those threats.
The chain of custody is a documented log of who, when, and where evidence was handled; without it, digital evidence is inadmissible in court.
Dwell time is the duration an attacker remains undetected in a network; reducing dwell time from months to hours is the primary goal of a SOC.
Order of volatility requires collecting the most fragile data first (RAM, active network connections) before powering off a system to collect the hard drive.
A false negative (attack occurs but no alert fires) is far more dangerous than a false positive (alert fires but no attack), because a false negative means the attacker goes unnoticed.
These come up on the exam all the time. Here's how to tell them apart.
SIEM (Security Information and Event Management)
Focuses on detecting threats by correlating logs from multiple sources
Does not take automatic action; generates alerts for human review
Primary function is visibility and detection
SOAR (Security Orchestration, Automation, and Response)
Focuses on automating the response to threats (e.g., automatically blocking an IP)
Takes automatic action based on playbooks without waiting for a human
Primary function is response and remediation
False Positive
Alert fires but there is no actual attack (burnt toast causing fire alarm)
Wastes analyst time chasing non-threats
Better than a false negative because it does not let an attacker go unnoticed
False Negative
No alert fires but there is a real attack
The attacker remains undetected, causing damage
Far more dangerous; the organisation does not know they are breached
Containment
Stops the incident from spreading (e.g., disconnecting a laptop from the network)
Is done first, immediately after detection
Does not remove the underlying cause; it just isolates it
Eradication
Removes the attacker's tools and malware from the environment
Is done after containment is complete
Includes scanning, cleaning, and applying patches to remove the root cause
Tier 1 SOC Analyst
Monitors alerts and performs initial triage
Has limited decision-making authority; escalates most issues
Focuses on speed and filtering false positives
Tier 2 SOC Analyst
Investigates confirmed incidents in depth
Has authority to make containment decisions
Focuses on understanding the attack and containing it properly
Playbook
Specific to one type of incident (e.g., ransomware playbook)
Contains step-by-step instructions for response actions
Used during an active incident to guide decision-making
Runbook
Covers broader operational procedures for maintaining a system (e.g., patching a server)
Not incident-specific; used for routine maintenance
Used for regular operations, not crisis response
Mistake
Incident response is only about stopping the attack; forensics is a separate, optional step.
Correct
Forensics is an integrated part of incident response. Every step in the IR lifecycle must be documented for potential legal action. You cannot separate the two.
TV shows often portray forensics as a process that happens days after the 'action' is over. In reality, forensics begins at the moment of detection, because the decisions you make during containment can destroy evidence if not done carefully.
Mistake
A SOC is a physical room full of people staring at screens, and that is the only model.
Correct
A SOC can be fully virtual, outsourced to a Managed Security Service Provider (MSSP), or a hybrid model. Many organisations do not have the budget for an in-house room.
The visual of a 'war room' from movies is powerful. Beginners assume every company has that. In small businesses, the SOC might be one person in a home office checking alerts on a laptop.
Mistake
The chain of custody only matters if the case goes to court, so for small incidents you can skip it.
Correct
Chain of custody must be maintained from the first moment you touch any piece of evidence, even for internal investigations. If you skip it and the incident later escalates to a lawsuit or regulatory fine, the evidence is worthless.
Beginners think of 'evidence' as something for criminal trials only. They forget about civil lawsuits from customers or regulatory fines from GDPR or HIPAA, which also require admissible evidence.
Mistake
A SIEM automatically stops attacks.
Correct
A SIEM only detects and alerts. It generates warnings, but a human (or a SOAR platform) must take action. SIEM is purely a detection tool.
The name 'Security Information and Event Management' sounds active. Beginners assume 'Security' in the name means it provides security. It is only a visibility tool, like a security camera that records but does not call the police.
Mistake
The most important skill in incident response is technical hacking ability.
Correct
The most important skill is following a process and documenting everything. Technical hacking skills help, but if you cannot follow the incident response playbook and maintain chain of custody, you will fail in a real incident.
Pop culture glorifies the 'hacker' who breaks into systems. In incident response, you are the defender, and the process (not the hacking) is what stops the attack and preserves evidence.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
A SOC is a team or department of people who monitor threats. A SIEM is a software tool that collects logs and generates alerts. The SOC uses the SIEM as their primary tool, but they are not the same thing.
Yes, absolutely. The exam will ask you to identify which phase a specific action belongs to, and it will give you distractor answers that are out of order. Memorise the four phases: Preparation, Detection and Analysis, Containment/Eradication/Recovery, and Post-Incident Activity.
A playbook is a step-by-step written guide for handling a specific type of incident, such as a ransomware playbook that tells you exactly which commands to run and who to call. It is different from a runbook, which covers broader operational procedures.
Yes, many organisations use a Managed Security Service Provider (MSSP) to run their SOC 24/7 at a lower cost. The MSSP monitors the client's logs remotely and alerts them when an incident is detected. This is called a virtual or outsourced SOC.
It is the rule that you must collect the most volatile data first — data that will disappear if you turn off the machine. The order is: RAM, running processes, network connections, temporary files, then the hard drive. If you power off the computer, you lose everything in RAM.
A false negative is when a real attack occurs but the SIEM does not generate any alert. This is the most dangerous type of error because the attacker continues undetected. It happens when the SIEM's detection rules are poorly configured or missing.
You've finished Security Operations and Incident Response. Continue through the CAS-005 study guide to build a complete picture of the exam.
Done with this chapter?