Originally published on CertLand.
The CyberOps Associate exam is not just about knowing security concepts — it is about knowing how to apply them correctly in realistic SOC scenarios. Many of the hardest questions present two or three plausible-sounding answers where the distinction comes down to precise understanding of a process, protocol, or framework. This guide covers the most commonly missed questions and explains exactly why the "obvious" answer is wrong. In this guide:
- Incident Response Traps
- Digital Forensics Traps
- Network Analysis Traps
- Framework and Terminology Traps
Incident Response Traps
Trap 1 — NIST IR Phase Order: Detection Is NOT First
The NIST 800-61 incident response lifecycle has four phases:Preparation → Detection & Analysis → Containment, Eradication & Recovery → Post-Incident Activity. Many candidates assume an incident response starts with Detection — but Preparation comes first. Preparation includes building playbooks, setting up monitoring tools, training the team, and establishing communication procedures. On exam questions asking "what is the first phase of incident response," the answer is Preparation, not Detection.
Trap 2 — Containment Comes BEFORE Eradication
Within the third phase, the order is: Containment → Eradication → Recovery. You cannot safely eradicate malware until you have first contained the affected system (isolated it from the network) to prevent further spread. Jumping to eradication before containment is a common operational mistake and a trap on exam scenario questions asking "what should the analyst do next?"
Trap 3 — False Negative Is Worse Than False Positive
A false positive means an IDS/SIEM alert fired on benign activity — wasted analyst time but no harm done. A false negative means a real attack happened and no alert fired — the attack may proceed undetected. In security operations, false negatives are far more dangerous. On exam questions asking which outcome is more acceptable, false positives are tolerable; false negatives are not. SIEM rule tuning should reduce FPs without increasing FNs.
Digital Forensics Traps
Trap 4 — Volatile Data Must Be Collected First
Digital forensics follows the order of volatility: collect the most volatile evidence first before it is lost. The correct order is: (1) CPU registers and cache, (2) RAM/memory contents, (3) Network connections and routing tables, (4) Running processes, (5) Disk/file system, (6) Logs and backups, (7) Physical media. Many candidates assume starting with disk imaging — but RAM must be captured first because it contains running process data, encryption keys, and network connections that disappear when the system is powered off or rebooted.
Trap 5 — Chain of Custody: What Breaks It
Chain of custody is the documented record of who handled evidence, when, and what was done with it. Breaking chain of custody makes evidence inadmissible in legal proceedings. Common violations: accessing evidence without logging it, failing to use write blockers when imaging drives, allowing unauthorized personnel to handle evidence, or not sealing evidence bags properly. On exam scenario questions, the answer involving a write blocker or proper documentation is almost always correct when chain of custody is the theme.
Trap 6 — Write Blockers Prevent Modification, Not Access
A forensic write blocker allows an investigator to read data from a storage device without writing anything to it — preventing accidental modification of evidence. It does not prevent reading or analyzing the data. On exam: when should you use a write blocker? Any time you are making a forensic copy of a drive that will be used as evidence. Failure to use one may alter timestamps or metadata.
Network Analysis Traps
Trap 7 — TCP Scan Signatures: Know Each Type
Different port scan techniques leave different TCP flag patterns in packet captures:
- SYN scan (half-open):Sends SYN, if port open receives SYN-ACK but never completes handshake (sends RST). Stealthy — does not complete connection.
- NULL scan:No flags set. Open ports do not respond; closed ports respond with RST/ACK.
- XMAS scan:FIN, PSH, and URG flags all set simultaneously. Same response behavior as NULL scan.
- FIN scan:Only FIN flag. Works like NULL and XMAS on closed ports.
On exam: NULL, XMAS, and FIN scans work against Unix/Linux hosts (which follow RFC behavior) but not against Windows hosts (which respond with RST to all unrecognized flag combinations).
Trap 8 — 5-Tuple Definition
The 5-tuple uniquely identifies a network flow and is referenced frequently in traffic analysis questions: (1) Source IP address, (2) Destination IP address, (3) Source port, (4) Destination port, (5) Protocol (TCP/UDP/ICMP). Some questions ask what differentiates two sessions — the answer is usually the source port (ephemeral port), which changes for each new connection even when source IP, destination IP, destination port, and protocol are the same.
Trap 9 — DNS Exfiltration in NetFlow Data
DNS exfiltration encodes data in DNS query names and sends it to an attacker-controlled DNS server. In NetFlow data, this appears as: many small UDP flows to port 53 (DNS), destined for an unusual external DNS server (not the corporate resolver), with query names that are unusually long or contain random-looking characters. Key indicator: high volume of DNS queries to a non-standard DNS server IP.
Framework and Terminology Traps
Trap 10 — CVE vs CWE vs CVSS: Three Different Things
- CVE (Common Vulnerabilities and Exposures):A unique identifier for a specific known vulnerability in a specific product (e.g., CVE-2021-44228 is Log4Shell). Maintained by MITRE.
- CWE (Common Weakness Enumeration):A catalog of software weakness types (e.g., CWE-79 is Cross-Site Scripting as a weakness category). Describes the class of vulnerability, not a specific instance.
- CVSS (Common Vulnerability Scoring System):A numerical score (0–10) measuring the severity of a vulnerability. Base score considers attack vector, attack complexity, privileges required, user interaction, and impact on CIA.
Trap 11 — Syslog Facility and Severity Codes
Syslog messages carry both a facility code (which system generated the log: 0=kernel, 1=user, 3=daemon, 4=security/auth) and a severity code (0=Emergency to 7=Debug). The trap: when a question says "configure logging level 4", it means capture Emergencies through Warnings (levels 0–4), NOT just level 4. Syslog levels are thresholds, not exact matches.
Trap 12 — When to Escalate From Tier 1 to Tier 2
SOC Tier 1 analysts perform initial triage: determine if an alert is a true positive, gather basic context, and follow documented playbooks. Escalation to Tier 2 is triggered when: the alert is confirmed as a true positive that exceeds Tier 1's authority, the incident involves executive accounts or sensitive data, lateral movement or persistence mechanisms are detected, or the playbook does not cover the scenario. On exam: Tier 1 triages and follows playbooks; Tier 2 investigates and hunts; Tier 3 handles advanced threats and creates new detection rules.
Ready to Practice?
Our 340-question CyberOps practice exam covers every trap in this guide — with detailed explanations for every answer. Practice CyberOps Now →
Top comments (0)