Security Operations: IAM, Monitoring, and Hardening at Scale

Domain 4—Security Operations—is the largest slice of SY0-701 at roughly 28%. If you burn another evening memorizing threat-actor names while skimming how accounts get created and killed, you are studying the wrong weighting. Operations questions rarely ask “what is MFA?” They ask what breaks when a contractor leaves on Friday and the ticket sits until Monday, or why the SIEM went quiet the week before ransomware.

Think of this domain as the day job after architecture diagrams look nice: people join, move, and leave; logs arrive or they do not; someone needs admin rights for “just five minutes.” The exam rewards people who can walk that story end to end.

IAM: the lifecycle beats the login page

Identity and access management is not a login screen. SY0-701 expects you to follow an identity the way an auditor would: provision → authenticate → authorize → review → deprovision. Break any link and you get orphan accounts, privilege creep, or a terminated analyst still authenticating on Tuesday.

Joiner, mover, leaver—where exams actually bite

Provisioning should ride HR reality, not tribal knowledge. A joiner gets an account, groups, and entitlements from a workflow; a mover changes role and loses yesterday’s access; a leaver gets disabled, tokens revoked, VPN certificates pulled, and shared mailboxes reassigned. Delayed deprovisioning is not a paperwork annoyance—it is an open door. The classic stem is resignation on Friday, disable Monday. The IoC is a successful login after termination. The fix is automated HR sync plus periodic access reviews, not “we changed the password once.”

Watch the compliance twist: if the stem mentions e-discovery or legal hold, “delete the mailbox immediately” is the distractor. Retention and investigation can outrank tidy cleanup.

Authentication that survives the phone call

Authentication proves who you are. MFA stacks factors, but not all MFA is equal when the stem smells like SIM swap, vishing, or credential phishing. SMS OTP is better than nothing and worse than a phishing-resistant method—FIDO2 keys, passkeys, certificate-based auth. Exams like candidates who upgrade the method, not the password length.

SSO and federation are how one Identity Provider (IdP) opens many Service Providers (SPs). You do not need to recite every SAML XML tag. You do need the story: the browser hits the app, the app trusts an assertion or token from the IdP, MFA can be enforced once at the center, and offboarding gets faster because you kill the hub. The flip side is blast radius—compromise the IdP and you compromise the estate. Protect IdP admins like crown jewels.

Passwordless themes (Windows Hello, passkeys) show up as the modern side of that story. Legacy IMAP or basic auth left enabled on mail is the exam’s favorite “we bought SSO and still got phished” punchline.

Authorization and the five-minute Domain Admin

Authorization decides what an authenticated subject may do. Least privilege is the north star; RBAC packages rights by job; ABAC adds attributes like department, clearance, or device posture when roles alone are too blunt.

Shared admin accounts destroy accountability. If “everyone uses admin,” the answer path runs through named accounts, PAM, and logging—not a stern email. When a developer needs read-only prod access during an incident, the strong move is a time-bound role with approval and audit. The weak move is temporary Domain Admin “because it is faster.” Temporary has a habit of becoming permanent.

PAM vaults credentials, rotates them, records sessions, and supports just-in-time elevation that expires without a second ticket. Contractors with elevated access should meet MFA, session recording, and an approval gate—never an emailed root password.

Match the problem in the stem to a row. Do not recite definitions into the void.

Monitoring: collection with a purpose

Operations centers run on visibility, but SY0-701 cares why a log source exists. Identity events (success, failure, MFA challenges, group changes, privileged role grants) tell you who became dangerous. Endpoints tell you what executed. Network and DNS tell you where it talked. Cloud audit trails tell you who opened a bucket or changed a security group. None of that helps if clocks disagree—NTP is boring until timelines refuse to line up in court.

Attackers delete or starve logs for a reason. Out-of-cycle cleanup, sudden ingestion gaps, or a SIEM disk that quietly fills are themselves signals. A SIEM earns its keep with use cases: password spray that flips to success, a new service account followed by lateral movement, a host suddenly denied everywhere as it scans. Baselining learns normal; a SaaS rollout may need a baseline reset so the whole company does not look like an anomaly. Alert fatigue is how real alerts die—tune, prioritize, and let SOAR enrich before a human burns out.

If a stem asks how you would detect DCSync-style abuse, “add more firewall logs” is theater. You need the right directory audit events forwarded with a correlation rule that understands suspicious replication rights—not a bigger haystack.

IDS watches; IPS can block inline. After an IPS upgrade, a payment app that intermittently fails is often a false positive problem. Strong answers talk about tuning, starting in monitor mode, or a documented exception with risk acceptance. “Turn IPS off forever” is how you fail both security and the question.

Enterprise controls where they actually sit

A firewall is a policy enforcement point at a boundary or on a host. Default deny inbound, explicit allows, log the denies. Next-gen features add application awareness; the exam still loves least-open port thinking.

DNS filtering kills a surprising amount of early kill-chain activity by refusing to resolve bad domains. Pair it with proxy, EDR, and SIEM when the stem asks for response, not just prevention. DLP watches content on the way out, at rest, and sometimes on the endpoint clipboard. If the insider copies to USB, an email-gateway-only DLP policy is the wrong layer—you needed endpoint DLP and device control.

NAC asks whether the device is healthy and enrolled before it joins the VLAN you care about. Contractor and BYOD stems live here. EDR watches behavior on the box—process chains, odd PowerShell, persistence—not just signatures. XDR is the marketing word for correlating email, endpoint, network, and cloud so containment is not a scavenger hunt. After ransomware executes, the strong narrative is EDR containment, network isolation, SIEM for scope, then backups for recovery—not a single silver bullet.

Email remains the front door. Secure gateways plus SPF/DKIM/DMARC themes reduce impersonation; they do not retire user judgment.

Read the table as placement practice: given a symptom, which control is first or best, not which acronym sounds expensive.

Hardening without the theater

Hardening is how you shrink attack surface after the architecture meeting ends: secure baselines, unused services gone, patches in a change window with a rollback, default accounts dead, Telnet retired, SNMP communities not left at public. It is continuous because configuration drift is continuous. Gold images that pass CIS on Monday get hand-edited iptables by Thursday. Configuration management and compliance scans exist to make snowflake servers embarrassing again.

SOAR playbooks that enrich alerts, isolate hosts, or disable accounts are powerful when a human still approves the destructive steps. Fully autonomous “block all outbound on first alert” is how you become the outage.

Assets you forgot you owned

You cannot patch, NAC, or wipe what you do not know exists. Asset management runs from acquisition through assignment, monitoring, and secure disposal—clear, purge, or destroy media by sensitivity. Shadow IT returns here as the SaaS or access point that bypassed every control you documented. An unknown Wi-Fi AP on the corporate floor is not a “wireless question” first; it is an asset visibility failure that needs survey, physical find, removal, and a story about how it joined.

MDM belongs in the same conversation for phones and laptops: encryption, remote wipe, and a chance of surviving loss without a press incident.

Contractor access, written the way the exam composes it

Stem: A ninety-day contractor needs VPN and one internal web app. The laptop is corporate-managed.

A strong answer sounds like a checklist only because the lifecycle is ordered—not because Domain 4 is a shopping list. You provision an account tied to the contract end date. You enforce MFA at VPN and app, phishing-resistant if the options allow. You grant a least-privilege group for that app alone. Prefer ZTNA or split access so the contractor never inherits the whole LAN. NAC checks posture before the session becomes useful. SIEM sees the logons; anomalies after midnight earn a look. Access reviews at thirty and sixty days catch scope creep. Day ninety—or early termination—deprovisions the same day.

Weak: email the shared VPN password and wish them luck.

That one stem touches identity, monitoring, network placement, and time—exactly how Domain 4 packs multiple objectives into one story.

Physical security, briefly, because stems still use doors

Badges, biometrics, mantraps, cameras, and visitor logs are still defense in depth for rooms that hold the keys to everything. Tailgating questions want both culture and hardware—training without a turnstile is a speech, not a control.

How Domain 4 hides the real ask

Operations stems disguise the verb. “What should you do first?” often means contain or preserve evidence, not rebuild. “What best prevents recurrence?” wants root cause—automated joiner/leaver, not one more password reset. “What detects versus prevents?” wants you to match mode to objective.

Carry a private mantra into the exam room: for any identity or asset, what happens on day zero, on day ninety, and on termination day?

Self-test with weak paths named out loud

SIM-swapped executive. Strong: move them to phishing-resistant MFA, watch IdP logs, involve the carrier fraud process. Weak: “make the password longer.”

SIEM disk full, logs stop. Strong: treat monitoring availability as an incident, free or expand capacity, alert on ingestion failure, prioritize critical sources. Weak: notice next month during the breach review.

Helpdesk resets MFA after a polite caller asks. Strong: out-of-band verification, ticketed approval, logged action. Weak: reset because the caller knew the employee ID.

IPS blocks a legitimate API after a signature update. Strong: tune, exception with expiry, communicate in a change window. Weak: disable IPS globally until “things calm down.”

If you can explain each in three calm sentences, you are studying operations as judgment—not as vocabulary.

Exam traps summary

Closing frame

Security operations is where architecture and threat knowledge meet Monday morning. IAM without reviews becomes privilege debt. Monitoring without tuned use cases becomes expensive storage. Hardening without inventory misses the laptop that never joined MDM. Study Domain 4 as connected processes—who gets in, what you can see, what you locked down—and the largest exam domain stops feeling like a product catalog.

Companion reading: the architecture post on Zero Trust and secure enterprise design for ZTNA and trust boundaries, and the incident response / vulnerability management post for what happens after detection fires.