ISC2 · ISC2 CC
Security operations and incident response
ISC2 CC · Lesson 15 of 16 · 1:58:09
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the ISC2 Certified in Cybersecurity (CC) exam, on the 2026 outline. In this lesson: logging and monitoring with a SIEM, triage of events, threat actors, threat intelligence and frameworks like MITRE ATT&CK, and the incident response process. Includes three original practice questions, with Maplewood Schools, a fictional school district, as the example.
Preview the topics
- The SIEM combines thirty failed sign-ins, one successful sign-in, and a large download from the same account into a single alert. What is it doing?
- Analysts want a knowledge base of adversary tactics and techniques, built from real attacks, to check their detections. Which one should they choose?
- Leaders and IT staff meet in a room and walk through a ransomware scenario, step by step, without touching any system. What kind of activity is this?