Find each operations concept hidden in the grid.
11 terms · Choose how you want to study
New to the CompTIA Security+ exam? Read our how-to-pass guide →
Applying updates to fix vulnerabilities, bugs, or add features.
Patching closes known vulnerabilities and is the single highest-leverage operational control, since most breaches exploit flaws that already had a fix. Prioritize by severity and active exploitation: critical/high and KEV-listed CVEs within days, ideally tested in staging first. Patch SLAs, maintenance windows, and documented exceptions (for systems that can’t be patched) keep the program auditable.
Reducing attack surface by removing unneeded services, accounts, and features.
Hardening shrinks the attack surface by removing unneeded services, default accounts, open ports, and features, then enforcing secure settings. Use a recognized baseline like CIS Benchmarks or DISA STIGs as the target. It’s most effective baked into golden images and provisioning automation rather than bolted on after deployment, where drift and missed hosts creep in.
Recording events from systems, applications, and network devices for monitoring and forensics.
Logs are the raw material for monitoring, detection, and forensics. Centralize them off-host (to a SIEM), because local logs are the first thing an attacker deletes to cover tracks, and synchronize clocks with NTP so events from different sources can be correlated into a timeline. Retention policy then balances compliance mandates, storage cost, and how far back investigations need to reach.
Continuous observation of systems, networks, and identities for signs of compromise or misuse.
Monitoring is the continuous observation that feeds detection, combining endpoint (EDR), network (NDR/IDS), and identity telemetry so a threat that hides in one layer surfaces in another. Effective programs watch for both known signatures and behavioral anomalies (UEBA). Tuning is constant — as the environment changes, yesterday’s good rule becomes today’s noise or blind spot.
Security Information and Event Management — centralizes log collection, correlation, and alerting.
A SIEM centralizes logs from across the environment and correlates them so a sequence harmless in isolation (one failed login here, a new admin account there) surfaces as one alert. Its value is precisely that cross-source correlation — single-source rules belong in the source tool. Modern SIEMs blend with data lakes and UEBA for behavioral analytics, and feed SOAR for automated response.
Security Orchestration, Automation, and Response — automates and connects security tools and workflows.
SOAR orchestrates tools and automates response steps, executing playbooks across SIEM, EDR, ticketing, and threat-intel platforms to cut analyst toil and response time. Automate low-risk, repeatable work first — alert enrichment and triage — and gate destructive actions (isolating hosts, disabling accounts) behind human approval until the playbook is proven, since a buggy automation can take down production faster than any attacker.
A visual summary of security signals — alerts, metrics, threats — used by analysts and leaders.
A dashboard turns raw telemetry into at-a-glance signal, but it only drives good decisions if the underlying metrics are accurate and matched to the audience. Separate operational dashboards (analyst-focused: open alerts, queue depth, MTTD/MTTR) from executive dashboards (KPI- and risk-focused), since each audience acts on very different numbers.
How long data — especially logs — is kept before being archived or destroyed.
Retention sets how long data — especially logs — is kept before archiving or destruction, and it cuts both ways: too short and you can’t investigate a months-old breach; too long and you carry legal liability and storage cost. Drive it by legal, regulatory, and investigation needs, and tier storage accordingly — hot storage for searchable recent logs, cheaper cold storage for long-term archives.
Data Loss Prevention — detects and blocks sensitive data from leaving the organization.
DLP inspects content against classification rules to stop sensitive data — PII, source code, financials — from leaving via email, web upload, USB, or cloud sync. It is only as good as the data classification behind it: garbage in, garbage out. Endpoint, network, and cloud DLP each cover a different egress path, so coverage gaps appear when only one is deployed.
Initial sorting of alerts or incidents by severity and impact to focus response.
Triage is the initial sort of incoming alerts by severity, impact, and confidence so scarce analyst time goes to what matters and false positives get closed fast. It’s where many SOC programs live or die — well-tuned alerts and clear criteria prevent the alert fatigue that lets a real attack slip through. Typical tiers: T1 triage, T2 investigation, T3 threat hunting and forensics.
A step-by-step procedure that responders follow for a specific incident type.
A playbook is the predefined, step-by-step procedure responders follow for a specific incident type (phishing, ransomware, lost device), giving consistency under pressure when judgment alone fails. SOAR platforms automate parts of a playbook — enrichment, ticketing, containment actions. Playbooks are living documents: update them after every tabletop exercise and real incident so lessons learned actually change behavior.
All Security Operations sets and terms → · All CompTIA Security+ study games → · Not sure where to start? Take the CompTIA Security+ diagnostic →