Workshop  ›  Lessons  ›  Lesson 8

Day 5 — Morning · Domain 5B

Protection of Information Assets — Part B

Part B, Security Event Management, is the operational half of Domain 5: the human layer and attack landscape, security testing and monitoring, and what happens when prevention fails — incident response and forensics.

Session: Morning, Day 5 Duration: ~3 hrs Exam Weight: 26% (Domain 5) Knowledge Check: 6 Questions

Overview

Detect, respond, and preserve the evidence

Where Part A built the protective controls, Part B is about security events: the human attack surface, finding weaknesses before attackers do, watching for what gets through, and responding when it does. The signature exam lessons here — train and measure the human layer; test and monitor with independence; in incident response, contain before you eradicate; and in forensics, preserve volatile evidence first. The auditor evaluates whether these capabilities exist and are exercised — not whether they can run the SOC.

Learning Objectives

By the end of this lesson you will be able to…

Key Terms

Vocabulary flashcards

👈 Read the term, recall the definition, then click or press Enter to check yourself.

Lesson Content

Study the material

1

Security Awareness & Attack Methods

People are both the largest attack surface and the first line of defense. The exam tests whether the auditor can match controls to threats — not the technical mechanics of each attack.

  • Awareness program: annual baseline plus role-specific training, phishing simulations with follow-up, new-hire orientation; measure via click-rate trends, completion, pre/post scores, and reporting rates.
  • Attack methods: malware (ransomware, trojans, worms, rootkits, fileless); social engineering (phishing, spear-phishing, vishing, smishing, pretexting, baiting, business email compromise); web (SQLi, XSS, CSRF — OWASP Top 10); network (MITM, DoS/DDoS, ARP/DNS poisoning); insider threats; APTs (kill chain).
  • Auditor: training mandatory and tracked; topics aligned to the current threat landscape; effectiveness measured and improvements made.
💡 Exam TipThe exam doesn't require deep technical attack knowledge. It tests (1) which controls mitigate which attack types, and (2) whether the organization can detect and respond. Focus on the control, not the mechanics of the attack.
Explore furtherSocial Engineering, Phishing, and Malware/APT — interactive modules on the human-layer and malware threats.
Social Engineering ↗ Phishing ↗ Malware & APT ↗
2

Security Testing & Monitoring

Security testing finds the gaps; security monitoring catches what gets through. Both feed the auditor's evidence on whether defenses actually work.

  • Testing: vulnerability assessment (automated scanning, no exploitation); penetration testing (black/white/gray box; authorized scope and rules of engagement); SAST (source code) and DAST (running app); authorized social-engineering tests.
  • Monitoring: SIEM (correlation and alerting), UEBA (behavioral baselines), threat intelligence (IoCs, TTPs; MITRE ATT&CK), network traffic analysis.
  • Auditor: scans at least quarterly (PCI DSS); pen tests at least annually or after major change; findings tracked to remediation; tests performed by independent parties; SIEM coverage across critical systems; alerts tuned; results reviewed by qualified staff.
🔎 In practice

If the same high-severity penetration-test findings appear year after year, the problem isn't the test — it's that remediation never happened. The auditor's first concern is whether prior findings were closed.

🔎 In practice

“Independent” testing has limits: if the firm that designed or implemented the controls also runs the penetration test, that is a self-review / familiarity threat to independence. Confirm the testers are independent of the work they assess — a consulting relationship can compromise the objectivity of the test.

Try it — tune the alerts (catch attacks vs. drown in noise)

A SIEM scores every event; you set the line above which it raises an alert. Slide the threshold and watch the trade no tool escapes: set it high and attacks slip past; set it low and analysts drown in false alarms. A sharper detector is the only way to get more of both.

Interactive · adjust & explore
Tune the SIEM

Baseline: 5,000 security events a day.

60
Raise an alert when an event scores above this.
60%
How well it separates real threats from normal noise.
40
How many of the day’s events are truly malicious.
What the SOC sees
Attacks caught
—
Attacks missed / day
—
False alarms / day
—
Precision (alerts that are real)
—
— — Slide the threshold to see the trade-off.
Where the threshold falls

Two clouds of events by risk score — normal (blue) and malicious (red). Everything right of the line alerts: red-shaded = caught attacks, blue-shaded = false alarms. The clouds overlap, so no line separates them cleanly.

Normal events Malicious events Alert threshold
🔎 In practice

This is the base-rate problem the exam loves: when real attacks are rare, even a good detector floods the SOC with false alarms, so precision stays low. Chasing 100% detection by dropping the threshold just buries analysts — which is why auditors check that alerts are tuned and reviewed by qualified staff, not merely that a SIEM exists.

Explore furtherPenetration Testing — an interactive module on pen-testing methodologies.
Pen Testing ↗
3

Security Incident Response Management

When prevention fails, response determines the damage. The exam tests the incident-response lifecycle sequence — and one ordering in particular.

  • NIST SP 800-61 lifecycle: Preparation → Detection & Analysis → Containment → Eradication → Recovery → Post-Incident Activity.
  • Version note: this lifecycle is SP 800-61 Rev. 2, which the current exam aligns to. Rev. 3 (finalized 2025) reframes incident response around cybersecurity risk management rather than a fixed phase list — useful context, but answer to Rev. 2 unless a question says otherwise.
  • Classification P1–P4 with escalation triggers; team roles (IR lead, technical analyst, communications lead, legal/compliance, executive sponsor).
  • Regulatory reporting: GDPR (72 hours), PCI DSS (immediate), HIPAA (60 days), SEC (publicly traded companies).
  • Auditor: a documented IR plan with roles and escalation; tested at least annually; complete incident logs retained; post-incident reviews tracked to improvement.
🔎 In practice

When a security incident is also a reportable breach, the IR plan must branch into the regulatory notification path — the direct link between Domain 5B response and Domain 2 privacy. One exfiltration of EU cardholder data can trigger GDPR (72 hours), PCI DSS, and contractual notice at once; the plan must name who declares a breach and who notifies each party.

💡 Exam TipIR questions often test sequence: Preparation → Detection → Containment → Eradication → Recovery → Lessons Learned. Watch for scenarios that eradicate before containing — wrong, because it risks the attack spreading. Contain first, then eradicate.
4

Evidence Collection & Forensics

When an incident may lead to legal action, how evidence is handled determines whether it is usable. Forensics is about preserving integrity and provenance.

  • Principles: preserve the original (work on forensic copies), maintain chain of custody, document every action, verify integrity (cryptographic hash before and after).
  • Order of volatility (collect most volatile first): CPU registers/cache → routing/ARP/process tables → RAM → temp/swap → disk → remote logs → physical/topology → archival media.
  • Chain of custody: who collected, when, from where, custody history, storage conditions.
  • Admissibility: evidence must be authentic, complete, reliable, and believable; improper handling can render it inadmissible.
  • Auditor: forensic procedures documented; staff trained in preservation and chain of custody; capability available (internal or contracted).
💡 Exam TipA classic trap: a system compromise is suspected — what first? Not to immediately power it down (that destroys volatile memory evidence). Follow the IR plan and preserve evidence by order of volatility — capture RAM and network state before taking the system offline.

Scored Knowledge Check

Test your Domain 5B judgment

Select the best answer for each question, then submit for your score and the rationale. Remember: contain before eradicate, and preserve volatile evidence first.

Q1.During an incident investigation, a first responder immediately powers off a compromised server to prevent further damage. The auditor's MOST significant concern is:

Question 1 options
Correct: B. Powering off before capturing volatile evidence destroys RAM contents (processes, network connections, keys in memory). Network isolation (C) is the preferred first containment action — it stops spread while preserving evidence — but the most significant concern is the destroyed volatile evidence. Why the others fall short: A the change-management framing misses the evidence loss; C isolation is preferable, but the key concern is the destroyed volatile evidence; D CAB approval misframes a forensic problem.

Q2.An organization runs annual external penetration tests; results show high-severity findings every year. The auditor should FIRST determine:

Question 2 options
Correct: B. Recurring high-severity findings indicate remediation isn't happening. The primary concern is whether prior findings were remediated — repeated findings signal a management remediation failure, not a testing problem. Why the others fall short: A methodology is secondary to unremediated repeat findings; C scope matters but isn’t the first concern when findings recur; D frequency isn’t the issue when prior findings persist.

Q3.During a malware incident, the response team begins eradicating the malware from infected hosts before isolating them from the network. The IS auditor should note that:

Question 3 options
Correct: B. The NIST sequence is Preparation → Detection → Containment → Eradication → Recovery → Lessons Learned. Containing first stops lateral spread; eradicating before containment risks the infection moving to other hosts. Why the others fall short: A eradicating first risks the malware spreading; C restoring before eradication can reintroduce the threat; D law enforcement doesn’t lead technical eradication.

Q4.When collecting digital evidence from a live, compromised system, which should the auditor confirm was captured FIRST?

Question 4 options
Correct: C. The order of volatility requires collecting the most volatile data first — RAM, running processes, and network state — before it is lost. Disk and archival media are far less volatile and can be captured later. Why the others fall short: A disk data is less volatile and captured later; B archived backups are the least volatile source; D configuration documentation isn’t volatile evidence.

Q5.An organization's phishing-simulation click rate has risen over three consecutive quarters despite annual security training. The MOST appropriate auditor observation is:

Question 5 options
Correct: B. A rising click rate is a measured decline in awareness-program effectiveness. The auditor's observation targets the program (content, frequency, reinforcement), not punitive action or blocking all email. Why the others fall short: A discontinuing simulations removes the measurement, not the problem; C terminating employees is punitive and ignores program effectiveness; D blocking all external email is impractical and misses the awareness gap.

Q6.A retailer confirms attackers exfiltrated a database holding EU residents’ personal data and cardholder data. Under the GDPR, by when must the supervisory authority be notified?

Select one answer
Correct: C. GDPR Article 33 requires notifying the supervisory authority without undue delay and, where feasible, within 72 hours of the organization becoming aware. A is the wrong window — 24 hours is not the GDPR rule. B is the HIPAA breach window (60 days), not GDPR. D is wrong: notification cannot wait for the investigation to finish, and the cardholder data separately triggers PCI DSS and payment-brand reporting.