Incident Response and Vulnerability Management for Security+

Domain 4 on SY0-701 is where security theory meets operational reality. Two programs run in parallel across every mature organization: vulnerability management finds and closes weaknesses before attackers exploit them, and incident response handles the breach when prevention fails anyway. The exam does not ask you to run a SOC shift, but it does expect you to recognize which phase of which process applies to a scenario—and to avoid the traps that confuse scanning with pen testing, or containment with eradication.

This post walks through both lifecycles with enough depth to answer scenario questions, plus the forensics hygiene and threat hunting concepts that appear under the same domain umbrella.

Why These Two Programs Belong Together

Vulnerability management is proactive and cyclical. Incident response is reactive and linear (until the next incident). In practice they feed each other: a post-incident root cause often reveals a missing patch, a misconfiguration, or a gap in detection that vulnerability management should have caught. Conversely, a critical CVE on an internet-facing server may trigger an emergency IR workflow if exploit activity is already visible in logs.

Exam trap: A question describes "weekly authenticated scans with remediation SLAs" and asks what program is being described. That is vulnerability management, not incident response—even if the word "incident" appears in a distractor like "incident prevention program."

The Vulnerability Management Loop

Think of vulnerability management as a closed loop, not a one-time project. SY0-701 expects you to know the stages and what happens at each.

Discover and Inventory

You cannot protect assets you do not know exist. Discovery includes network scanning, agent-based inventory, cloud asset APIs, and CMDB reconciliation. Shadow IT—departments spinning up SaaS tools without security review—is a recurring exam scenario because un inventoried assets never enter the scan queue.

Scenario: A security analyst finds a database exposed to the internet. The CMDB shows no record of that server. The first remediation step is not "patch the database" but add it to inventory and assign an owner. Without ownership, patches and exceptions have no accountable party.

Scan and Assess

Scanning tools (Nessus, Qualys, OpenVAS, and similar) identify missing patches, weak configurations, and known CVEs. Authenticated scans log in to the target and produce more accurate results than unauthenticated scans, which can miss issues visible only after login.

Exam trap: "A scan reported zero critical findings on a web server" does not mean the server is secure. Unauthenticated scans often miss application-layer flaws, and scanners cannot find zero-day vulnerabilities or logic bugs.

Assessment adds context: CVSS score, exploit availability, asset criticality, network exposure, and compensating controls. A CVSS 9.8 on an internal lab VLAN with no route to the internet is treated differently from the same score on a payment gateway.

Analyze and Prioritize

Prioritization is where security teams earn their salary. Raw CVE counts create noise; risk-based prioritization creates action.

Scenario: Two critical vulnerabilities land on the same day. One affects a public-facing API with known exploit code. The other affects an internal print server with no known exploit and no sensitive data. Patch the API first. The exam expects you to justify priority with business impact, not CVSS alone.

Remediate

Remediation options include patching, configuration hardening, software replacement, network segmentation, or compensating controls when patching is impossible (legacy OT systems are a classic constraint).

Exam trap: "Risk acceptance" is valid when remediation cost exceeds risk, but it requires a documented decision, named owner, and review date. Eternal acceptance without expiry is a governance failure, not a valid control.

Validate and Report

After remediation, rescan to confirm the fix. Report to stakeholders using risk language—"reduced external attack surface on payment systems"—not a spreadsheet of CVE IDs that executives cannot interpret.

Metrics the exam may reference:

• Mean time to remediate (MTTR) by severity tier
• Scan coverage (% of assets scanned on schedule)
• Recurrence rate (same vulnerability class appearing repeatedly signals process failure)

The Incident Response Lifecycle

CompTIA defines a six-phase IR process. Memorize the order, but more importantly understand what changes at each phase.

Preparation → Detection & Analysis → Containment → Eradication → Recovery → Lessons Learned

Preparation

Preparation happens before any incident. It includes documented playbooks, contact lists (legal, PR, insurance, law enforcement), forensic tooling, evidence-handling procedures, and tabletop exercises that reveal gaps before real attackers do.

Scenario: During a tabletop, the team discovers no one knows who can authorize shutting down the production e-commerce site. That gap belongs in preparation—assign decision authority now, not at 2 a.m. during a ransomware event.

Detection and Analysis

Detection comes from SIEM alerts, EDR telemetry, user reports, threat intelligence, and anomaly detection. Analysis confirms whether the alert represents a true incident, determines scope, and identifies affected systems and data.

Exam trap: "An IDS alert fired" is detection, not containment. The next step is analysis—correlate with other logs, determine if the alert is a false positive, and establish scope before taking disruptive action.

Useful data sources for analysis:

• SIEM — correlated events across the environment
• EDR/XDR — endpoint process, file, and network telemetry
• Identity logs — authentication successes and failures, privilege changes
• DNS and proxy logs — C2 beaconing, data exfiltration patterns
• Cloud audit trails — API calls, configuration changes
• Email gateway logs — phishing delivery and click-through

Containment

Containment limits damage without necessarily removing the threat. Strategies include isolating a host from the network, blocking an IP or domain at the firewall, disabling a compromised account, or quarantining a VLAN.

Scenario: EDR detects lateral movement from a workstation in the finance department. Containment options:

1. Network isolation of the workstation (preserves memory for forensics)
2. Account disable for the compromised user (stops credential abuse)
3. Firewall block on the C2 IP (may alert the attacker)

The best choice depends on evidence preservation needs and business impact. The exam often tests whether you pick containment (stop the bleeding) versus eradication (remove the root cause).

One-sentence distinction:

• Containment: Stop the incident from spreading; the threat may still exist on the isolated system.
• Eradication: Remove the threat entirely—delete malware, close the exploited vulnerability, revoke all persistence mechanisms.

Eradication

Eradication removes the threat from the environment. This includes deleting malware, patching the exploited vulnerability, removing attacker-created accounts, and clearing persistence mechanisms (scheduled tasks, registry keys, web shells).

Exam trap: Reimaging a compromised laptop is eradication on that endpoint, but if the initial access vector (unpatched VPN appliance) remains, the organization is not eradicated—just contained on one device.

Recovery

Recovery restores systems to normal operation from known-good backups or clean rebuilds. Validate that restored systems are patched and monitored before returning them to production.

Scenario: Ransomware encrypted a file server. The team restores from last night's backup. Recovery is complete only after confirming the backup was not also encrypted, verifying no persistence remains, and patching the entry vector before reconnecting to the network.

Lessons Learned

The post-incident review documents timeline, root cause, what worked, what failed, and action items with owners and dates. This feeds back into preparation (updated playbooks) and vulnerability management (new scan targets, patch priorities).

Skipping lessons learned guarantees the same incident recurs. The exam may present a scenario where the team closes the ticket immediately after recovery and ask what was missed.

Forensics Hygiene and Evidence Handling

SY0-701 does not require you to perform a forensic examination, but it tests conceptual knowledge of evidence handling.

Order of Volatility

Collect evidence from most volatile to least volatile:

1. CPU registers and cache
2. RAM (memory)
3. Network state and active connections
4. Running processes
5. Disk storage
6. Remote logging and archival systems
7. Physical configuration and documentation

Exam trap: "The help desk rebooted the server to fix performance issues" may have destroyed memory-resident malware evidence. The question asks what was compromised—chain of evidence or order of volatility—not whether the reboot was a good troubleshooting step.

Chain of Custody

Every transfer of evidence must be documented: who collected it, when, where it was stored, and who accessed it. Gaps in chain of custody can invalidate evidence in legal proceedings.

Key Practices

• Hash evidence (MD5/SHA-256) before and after collection to prove integrity
• Write blockers for disk imaging to prevent modification
• Document everything with timestamps
• Minimize handling — copy for analysis, preserve the original

Threat Hunting Basics

Threat hunting is proactive and hypothesis-driven. The hunter starts with a theory ("attackers may be using living-off-the-land binaries in the finance VLAN") and searches telemetry for indicators that confirm or deny it.

This differs from:

• Automated alerting — reactive, rule-based
• Vulnerability scanning — finds weaknesses, not active adversaries
• Penetration testing — simulates attack, time-boxed engagement

Scenario: A SIEM rule catches nothing, but a hunter notices powershell.exe spawning from winword.exe on three finance workstations during the same hour. That correlation is hunting—no signature fired, but behavior matches a known TTP.

Threat hunting feeds incident response when hypotheses confirm active compromise. It feeds vulnerability management when root cause analysis reveals systemic gaps.

Tabletop Walkthrough: Ransomware at 02:15

A file server in the operations VLAN begins encrypting files. EDR alerts on suspicious process behavior. Walk through the phases:

Notice how lessons learned produces vulnerability management action items: patch the VPN, segment the network, and test backup isolation.

Common Exam Traps in Domain 4

1. Scanning vs. penetration testing — Scanning finds potential vulnerabilities; pen testing validates exploitability through simulated attack.
2. Containment vs. eradication — Containment stops spread; eradication removes the threat.
3. Hot site vs. warm site vs. cold site — Recovery time and cost tradeoffs (hot = fastest, most expensive).
4. Full backup vs. incremental vs. differential — Know what each restores and how much storage/time each requires.
5. Automated response vs. manual approval — SOAR can auto-contain, but some actions need human authorization to avoid business disruption.

Practice Tips

1. Draw the IR lifecycle on paper from memory. Label one action per phase.
2. Write containment and eradication definitions without looking. If they blur together, you will lose points on ordering PBQs.
3. Practice a prioritization scenario: Given three vulnerabilities with different CVSS, exposure, and asset values, rank them and justify each decision.
4. Recite the order of volatility aloud once daily for a week.
5. Connect IR to VM: After every practice question about incidents, ask "what vulnerability management change would prevent recurrence?"

Domain 4 rewards operational thinking. The candidate who visualizes a real SOC shift—alerts firing, a manager asking "how bad is it," a sysadmin asking "can I reboot"—answers scenario questions faster than the candidate who memorized definitions in isolation.