S11. Security operations, governance and risk

Outcome: you can detect and respond to incidents and explain security in business terms.

Skills: threats and vulnerabilities, log analysis, incident response, security tools, risk assessment, policy and compliance, data protection, security awareness.

Labs

1. Centralize logs from the lab into one place and write three detection rules.
2. Run a tabletop incident exercise from a written scenario. Document the timeline and lessons learned.
3. Write a risk register for the lab with likelihood, impact and controls.
4. Draft an acceptable use policy and a backup policy and map each to controls in the lab.
5. Simulate a phishing report and walk the response steps.

Prove it: the risk register, an incident report and three tested detection rules.

Certs: Security+ (security operations, threats and vulnerabilities, governance, risk and compliance). The V8 objectives add more AI risk, so review them when published.

Gate: Security+.