Security+ exam prep: security operations
You do a security team’s daily work: harden systems, scan and prioritise vulnerabilities, watch logs and handle an incident from detection to report.
Level 201 · 17 lessons · 15 practice labs
Lessons
Asset and vulnerability management
- Secure baselines: hardening a server with a checklist
- Asset inventory: acquisition, ownership, disposal
- Running a vulnerability scan and sorting the findings
- Prioritising with CVSS and context: weeding out false positives
- Patching and confirming the fix with a rescan
- Short task: turn a twenty-finding scan report into this week’s plan
Monitoring and alerting
- Log sources: operating system, application, network device, endpoint
- Correlating events: seeing an attack chain in one query
- Reviewing IDS alerts: real or noise
- Email and DNS security: SPF, DKIM, DMARC and DNS filtering
- Identity operations: provisioning, multi-factor authentication, privileged access
- Short task: report three suspicious events from one night of logs
Incident response and automation
- Incident response phases: from preparation to lessons learned
- Collecting evidence: order, integrity and chain of custody
- Automation and scripting: safely handing repetitive work to the machine
- Threat hunting and using threat intelligence sources
- Capstone: handle a ransomware incident from detection to report
Practice labs
- Sort scan findings by severity: You sort a vulnerability scan output by severity, asset and port and pull out the top five.
- Weed out false positives: You check three reported findings on the server by hand and identify with evidence which ones are not real.
- Patch and close with a rescan: You close two critical findings by updating and reconfiguring, rescan and record the closure in the report.
- Correlate auth and web logs: You merge in time order the logins one IP tried first on the web panel then over SSH from two logs.
- Three suspicious events in one night of logs: From one night of Ardıç Lojistik logs you pick three suspicious events and report the evidence lines and severity of each.
- Show the attack chain in one query: With jq and grep you write one query joining the JSON app log and system log that shows the chain from first access to data theft.
- Read and interpret an IDS alert: You read the signature, source, destination and payload in a Suricata alert and explain in one paragraph what it caught.
- Tell the real alert from the noise: You compare twenty Suricata alerts with packet records and separate the real attack, false positives and known scanners.
- Write a local IDS rule for a missed attack: You write a local Suricata rule from the packet of an attack that raised no alert, replay the capture and show it fires.
- Interpret a domain's SPF and DMARC records: You query a domain's SPF and DMARC records from lab DNS and explain which servers may send its mail.
- Add a new mail provider to SPF: You fix the SPF record that makes the new invoicing server's mail fail and show the result change in a DMARC report.
- Block bad domains at DNS: You set a rule on the internal resolver blocking domains on a threat list and report blocked queries from the log.
- Place incident actions into phases: You sort twelve actions taken during an incident into the preparation, detection, containment, eradication, recovery and lessons-learned phases.
- Write a script that safely blocks an attacker IP: You write a small script that validates a given IP, checks an allow list, adds it to the firewall and logs the action.
- Run the first hour of a spreading ransomware: You find a share whose files are being encrypted, isolate the affected account and machine, preserve evidence and write the first status report.
About this course
You do a security team’s daily work: harden systems, scan and prioritise vulnerabilities, watch logs and handle an incident from detection to report.
What you will learn
- Asset and vulnerability management
- Monitoring and alerting
- Incident response and automation
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.