Incident investigation, security operations and management

Monday, February 22, 2027 · 5:45–8:45 PM · America/Chicago

Preserve evidence, validate recovery and defend governance, operational and risk-management decisions.

HOW THIS MODULE FITS COURSE 201

CompTIA Security+ Guide to Network Security Fundamentals

Preserve evidence, validate recovery and defend governance, operational and risk-management decisions.

Certification alignment: CompTIA Security+ SY0-701.

PREPARATION / DUE BEFORE CLASS

Read the chapter. Complete the handout.

Due Monday, February 22 before 5:45 PM. Read the assigned material, review assigned slides and fill out every handout response before arriving. This preparation is required for the opening quiz; it is not work to postpone until the hybrid deadline.

CompTIA Security+ Guide to Network Security Fundamentals, 8th Edition, ISBN 9798214000749. Textbook modules 13–15: 13: Incident Preparation and Investigation; 14: Oversight and Operations; 15: Information Security Management. Read before class; review instructor-assigned licensed slides when available.

Chapter map verified

Preparation checklist

Read each assigned chapter actively: define unfamiliar terms and connect concepts to a support example.
Review the assigned slides, diagrams and procedures; identify prerequisites for each chapter lab.
Complete the handout in your own words with page or section references, a troubleshooting plan and two questions.
Submit the graded handout before 5:45 PM and arrive with access to the authorized lab environment.

Week 7 preparation handout

Original preparation worksheet — week 7
Read textbook modules 13–15: 13: Incident Preparation and Investigation; 14: Oversight and Operations; 15: Information Security Management.
1. Define six chapter terms in your own words and give a practical security example for each.
2. Explain these outcomes using chapter references: Preserve evidence, validate recovery and defend governance, operational and risk-management decisions.
3. Answer the reading-check prompts: Explain evidence custody; distinguish policy and procedure; justify a risk treatment; identify when automated or AI-generated findings require human verification.
4. Describe one threat/control decision, its trade-off and how you would verify it.
5. List lab prerequisites, authorized scope, safety and evidence-handling precautions.
6. Write two questions for class. Submit completed responses before Monday 5:45 PM; bring them to the opening quiz.

This is a graded assignment within the 5% preparation/documentation category. Submit your completed responses as “Handout” below and bring them to class. Record chapter page or section references and your own explanations.

HYBRID / OUTSIDE OF CLASS

Your independent work

Due Sunday, February 28, 2027 at midnight, end of day.
The submission window ends Monday, March 1 at 12:00 AM America/Chicago. Monday class → following Sunday deadline.

1. MeasureUP — every week

Complete at least one SY0-701 practice with at least 45 questions. Submit the question count, results and corrections or explanations for three weak concepts. Each course has its own weekly practice requirement.

2. NETLAB — graded assignments

Your weekly remote-lab portfolio is graded within the 20% lab category. The instructor assesses the work and evidence for each assigned lab; completion alone is not full credit.

Complete every approved remote-lab title assigned to this week. More than one lab may be required when several titles match the chapter material. Plan the assigned NETLAB work for the weekend after class. Reserve lab time early and allow time to troubleshoot, repeat steps and document results. Submit a remote-lab portfolio with a separate section and completion evidence for each assigned title.

Chapter/topic matching keywords: incident response forensics Autopsy backups recovery governance risk compliance operations automation. Only instructor-approved title matches below are assigned. If none are listed, the catalog match is pending; do not assume that an unrelated lab satisfies the requirement.

NETLAB title candidates — approval pending

Incident Response Procedures; Performing Backups; Using Autopsy for Forensics and Lost Data Recovery

These are topic matches from the NDG Security+ v4 library, which is mapped to SY0-601 and a different textbook. The instructor must verify your installed titles, permissions and SY0-701 objectives before assigning them; candidates alone are not assignments.

3. Reinforcement and reflection

Complete at least one Security+ SY0-701 MeasureUP practice of 45 or more questions. Record question count and result summary; explain corrections for three weak concepts with chapter or objective references. Complete every instructor-approved matching NETLAB assignment, with a separate portfolio section for each exact title, procedure, results, screenshots or command evidence, validation and troubleshooting. Candidate title matches: Incident Response Procedures; Performing Backups; Using Autopsy for Forensics and Lost Data Recovery. These candidates come from an older SY0-601-mapped NDG library and require installed-title, access and SY0-701 objective review before assignment. Submit a reflection describing one justified security decision, residual risk and professional handoff. All independent work is due Sunday at end-of-day midnight after Monday class. Reserve weekend lab time early. Handouts are due before class; quizzes and classroom labs remain in class only.

Time and dedication

This is one intensive eight-week Security+ course, not two concurrent cores. Plan 10–14 hours of independent reading, handouts, practice, NETLAB work and remediation each week, plus the three-hour classroom meeting (13–17 hours total). Fifteen textbook modules are introduced in seven weeks before the comprehensive lab. The pace assumes working familiarity with operating systems, TCP/IP, accounts and basic troubleshooting. These are planning estimates, not a college credit-hour determination. Reserve several study sessions and weekend lab time, allow time for unsuccessful attempts, and ask for support early. Reading and handouts must be finished before class; attendance alone does not complete this hybrid course.

IN CLASS ONLY / 5:45–8:45 PM

Prepare → Quiz → Chapter labs → Closeout

5:45–6:00 · Start-of-class quiz

Take the reading quiz at the beginning of class. Answer each prompt with a technical explanation; prompts are equally weighted.

Explain evidence custody; distinguish policy and procedure; justify a risk treatment; identify when automated or AI-generated findings require human verification.

Use your preparation to explain the answer and the reason for it. Review missed concepts during closeout and add corrections to your study notes.

6:00–8:10 · Chapter-based lab workshop

This module currently has 3 lab activities, approximately 40 minutes each, excluding the 7:00–7:10 break. The instructor may scope the tasks and demonstrations to fit the session. Weeks may use one extended lab, two standard labs, or three to four short chapter activities.

Lab 1

Hash supplied evidence, preserve the original and analyze a working copy. Build an incident timeline, chain of custody and response sequence; restore a disposable dataset and verify integrity against recovery objectives.

Identify the support request, required outcome, authorized environment and safety or rollback precautions.
Record the starting configuration and symptoms. Predict the expected result before changing anything.
Perform the assigned procedure, capture relevant commands or settings, and troubleshoot unexpected results.
Verify the outcome with a repeatable test. Submit your observations, evidence, explanation and a concise service handoff.

Lab 2

Build a risk register and policy change for a fictional organization. Assign owners, treatments and residual risks; evaluate supplier and privacy evidence, and specify compliance checks and change approval.

Identify the support request, required outcome, authorized environment and safety or rollback precautions.
Record the starting configuration and symptoms. Predict the expected result before changing anything.
Perform the assigned procedure, capture relevant commands or settings, and troubleshoot unexpected results.
Verify the outcome with a repeatable test. Submit your observations, evidence, explanation and a concise service handoff.

Lab 3

Review a security-operations automation or AI-assisted triage proposal. Identify permitted inputs, data-handling risks, human review, false-positive checks and escalation; verify conclusions against original evidence.

Identify the support request, required outcome, authorized environment and safety or rollback precautions.
Record the starting configuration and symptoms. Predict the expected result before changing anything.
Perform the assigned procedure, capture relevant commands or settings, and troubleshoot unexpected results.
Verify the outcome with a repeatable test. Submit your observations, evidence, explanation and a concise service handoff.

This is an original provisional sequence. Confirm chapter alignment and lab scope against the licensed text; the exact textbook lab sequence has not been extracted. In-class lab work and its evidence are completed in the supervised class period, not assigned as weekend hybrid work.

8:10–8:45 · Closeout lecture, Q&A and announcements

Debrief incident investigation, security operations and management: compare findings, correct misconceptions, connect procedures to SY0-701 objectives, answer questions and announce the next reading and Sunday deadline. Present evidence for one decision and one remaining question.

Connect lab results to certification concepts, resolve questions, review common errors, and confirm announcements, next week's reading and the hybrid deadline. Any make-up arrangements require instructor approval.

Assigned chapter slides and external resources

Licensed chapter PowerPoints and verified provider links are awaiting instructor setup. Sign in to access approved materials. Preparation prompts and original class activities are shown above.

Your submissions

Handout: before class. Quiz and classroom labs: in class only. Weekly practice, assigned remote-lab portfolio and reflection: the hybrid deadline shown above. These are separate requirements.