CompTIA Advanced Security Practitioner (CASP+) (CAS-004) — Lesson 4: Operations, Incident Response, Forensics, Research, and Resilience

Learning Objectives

• Explain the roles, prerequisites, dependencies, and decision points shaping operations, incident response, forensics, research, and resilience.
• Complete the workflow and produce CASP+ incident and resilience runbook that another practitioner can review.
• Resolve “recovery restores systems before the intrusion path is removed” through a controlled and evidence-led troubleshooting process.

Detailed Topics

• monitoring
• incident response
• forensics
• threat intelligence
• emerging technology
• business continuity
• recovery
• lessons learned
• Security, performance, resilience, rollback, documentation, and support considerations for operations, incident response, forensics, research, and resilience

Instructor Demonstration

The instructor demonstrates the complete operations, incident response, forensics, research, and resilience workflow, records each material checkpoint in CASP+ incident and resilience runbook, and contrasts the accepted state with a controlled condition where recovery restores systems before the intrusion path is removed.

Hands-On Exercise

Implement or analyze Operations, Incident Response, Forensics, Research, and Resilience in a controlled environment. Establish a baseline, reproduce or examine “recovery restores systems before the intrusion path is removed,” isolate the proven cause, apply a reversible correction, and retain the accepted outcome in CASP+ incident and resilience runbook.

1. Confirm scope, access, dependencies, expected behavior, and safety constraints.
2. Execute the planned workflow while preserving configuration and operational checkpoints.
3. Test an expected path, a boundary condition, and the identified failure or exception.
4. Retest after correction and document rollback, ownership, escalation, and preventive action.

Scenario Analysis

• Identify the requirement with the greatest influence on operations, incident response, forensics, research, and resilience.
• Compare two valid implementation or recovery choices using impact and evidence quality.
• Explain how the CASP+ incident and resilience runbook should be retained and transferred to the operational owner.

Troubleshooting Guidance

Start with effective configuration, recent changes, identities, connectivity, health, logs, and timing. Use CASP+ incident and resilience runbook to locate the earliest divergence between intended and observed behavior. Treat “recovery restores systems before the intrusion path is removed” as a hypothesis until the corrected path passes the original test and a relevant boundary test.

Validation Checklist

• The implemented state for operations, incident response, forensics, research, and resilience is traceable to approved requirements and inputs.
• The CASP+ incident and resilience runbook contains baseline, test, exception, correction, and accepted-result evidence.
• Security, data handling, capacity, performance, resilience, downstream impact, and rollback were considered where relevant.
• Monitoring, escalation, recovery, documentation, and support ownership are clear.

Lesson Outcome

Learners can apply Operations, Incident Response, Forensics, Research, and Resilience, explain the decisions made, and defend the result with CASP+ incident and resilience runbook.