What's changed: Created Professional Security Operations Engineer Chapter 5 (Domain 5 "Incident response": evidence collection/forensic images-artifacts/alert observation (SCC-SecOps)/scope analysis (Logs Explorer-Log Analytics-BigQuery-Cloud Logging-Cloud Monitoring)/isolating affected services/forensic analysis (Hash-IP-URL-binaries via GTI)/root cause analysis (SecOps SIEM); SOAR playbooks/response steps for automation/high-value enrichment priority/integrations/new process design/new playbook recommendations/notifications/case management lifecycle (response stages-escalation-handoffs)).
5.1Containing and investigating security incidents
Understand collecting evidence on incident scope (forensic images/artifacts), observing/analyzing alerts (SCC, Google SecOps), analyzing scope with tools (Logs Explorer, Log Analytics, BigQuery, Cloud Logging, Cloud Monitoring), collaborating with teams, isolating affected services/processes, forensic analysis (Hash, IP, URL, binaries via GTI), and root cause analysis (SCC, Google SecOps SIEM).
Incident response aims to "minimize damage and find the cause." Prioritize containment, and investigate while preserving evidence.
5.1.1Containment and evidence collection
On detecting an incident, first stop the spread: isolate affected services/processes (separate, disable, cut network) to prevent attack propagation. In parallel, collect evidence: preserve forensic images of memory/disk and artifacts (logs, processes, connections) without tampering (for later analysis and legal needs). Observe/analyze alerts in SCC and Google SecOps, and analyze scope (how far the compromise reached) with Logs Explorer/Log Analytics/BigQuery/Cloud Logging/Cloud Monitoring. Map "stop the spread = isolate affected services" and "preserve for later analysis = forensic images/artifacts."
5.1.2Forensic analysis and root cause
Evaluate collected artifacts (Hash, IP, URL, binaries) with forensic analysis, checking them against GTI to judge whether they are known-bad and which actor/campaign they tie to. Finally, perform root cause analysis (RCA) in Google SecOps SIEM or SCC to reconstruct "which entry point, how they got in, what they did" on a timeline. Collaborate with other engineering teams to improve detection and drive long-term remediation. Map "judge artifact maliciousness = GTI lookup" and "reconstruct the full intrusion = root cause analysis (SecOps SIEM)."
Common: requirement → means. E.g., "stop attack propagation" = isolate affected services/processes; "preserve for later analysis/legal" = collect forensic images/artifacts; "judge if a Hash/IP/URL is known-bad" = GTI lookup; "how far the compromise reached" = scope analysis (Logs Explorer/BigQuery); "reconstruct the full intrusion" = root cause analysis (Google SecOps SIEM).
Watch the mix-ups: (1) Containment (stop the spread) comes first—cause analysis can follow while damage is limited. (2) Preserve evidence without tampering—don't destroy evidence around isolation/remediation. (3) Scope analysis (extent) vs root cause analysis (cause) are different questions—do both.
5.1.3Section summary
- First isolate affected services/processes to stop spread; preserve forensic images/artifacts
- Scope analysis = Logs Explorer/Log Analytics/BigQuery/Cloud Logging/Cloud Monitoring
- Check artifacts against GTI; root cause analysis on a timeline in Google SecOps SIEM/SCC
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. In an ongoing incident, which is the most appropriate first action?
Q2. To preserve memory/disk state and artifacts without tampering for later analysis/legal needs—what is this?
Q3. To judge if collected Hash/IP/URL/binaries are known-bad and which actor they tie to, which is best?
Q4. To reconstruct "which entry point, how they got in, what they did" on a timeline, which is best?
Q5. Which tool combination fits analyzing "how far the compromise reached (scope)"?
Keep track of your progress
The full study guide is free to read. Sign up free to practice with the question bank, track what you have read, review your mistakes, and highlight passages.