★ Starred in your notes: know what the output of nslookup / arp / nbtstat / netstat / route / ping / ipconfig looks like (see Cheat sheets → Command outputs) · tabletop exercise.
Breakdown 1 — Automation vs. orchestration (Day 5, Chapter 13)
From class: Automation → completing a task without human interaction. Orchestration → a product that works well with others — it coordinates and manages automated tasks across multiple systems. SOAR = Security Orchestration, Automation, and Response. Benefits: workforce multiplier, speed, consistency.
| Automation | Orchestration | |
|---|---|---|
| Scope | One task, one system (a script that disables an account) | Many tasks across many tools (SIEM alert → enrich with threat intel → isolate host in EDR → open ticket → notify) |
| Example | Cron job, PowerShell script, Ansible playbook | SOAR platform, CI/CD pipeline, Kubernetes |
| Exam phrase | "runs automatically" | "coordinates", "workflow", "across multiple systems" |
From class — scripting, "might have questions on the extension":
| Language | Extension | Typical use |
|---|---|---|
| Shell / Bash | .sh | Linux automation |
| PowerShell | .ps1 | Windows/AD automation (also fileless malware) |
| Python | .py | Cross-platform tooling, security scripts |
| Ruby | .rb | Metasploit modules, Chef |
| JavaScript | .js | Web/Node automation |
| Visual Basic Script | .vbs | Legacy Windows scripts (Day 4) |
| Batch | .bat / .cmd | Legacy Windows |
Breakdown 2 — Use cases the exam lists
| Use case | What it looks like |
|---|---|
| User provisioning | HR system creates the AD account, groups, mailbox on hire; disables on termination (fixes the #1 offboarding gap) |
| Resource provisioning | IaC (Terraform/CloudFormation) builds servers/networks to a known-good template |
| Guard rails | Policies, procedures, and technical controls that reduce the likelihood or impact of something going wrong (class) — e.g., a pipeline that refuses to deploy a bucket that's public |
| Security groups | Cloud firewall rules applied automatically per role/tag |
| Ticket creation | Alert → ticket with context, assigned to the right queue |
| Escalation | Auto-page the on-call if severity ≥ high or unacknowledged in N minutes |
| Enabling/disabling services and access | Lock an account on impossible-travel; quarantine a host on EDR alert |
| Continuous integration and testing | Every commit is built and tested; security scans (SAST, dependency checks) run in the pipeline |
| Integrations and APIs | Tools talk to each other over APIs — the glue that makes orchestration possible |
From class — testing and implementing changes (ties to 1.3): rolling updates (replace instances a few at a time), blue/green (stand up the new environment beside the old, switch traffic, keep the old for instant rollback), canary (sample test — release to a small % of users first). Regression testing in the maintenance window confirms the change didn't break what already worked. IT service management (ITSM) processes that automation supports: change management, asset management, configuration management, patch management.
Breakdown 3 — Benefits (exam list + class list)
Efficiency/time saving · Enforcing baselines · Standard infrastructure configurations · Scaling in a secure manner · Employee retention (less toil) · Reaction time (speed) · Workforce multiplier · Consistency (class) — machines don't forget step 7 at 3 a.m.
Breakdown 4 — Other considerations (the "but")
| Consideration | Why it matters |
|---|---|
| Complexity | Pipelines and playbooks are systems that need design and testing |
| Cost | Licenses (SOAR), engineering time |
| Single point of failure | If the orchestrator dies, everything stalls — and it holds credentials to everything (protect it like a domain controller) |
| Technical debt | Scripts nobody understands anymore; hard-coded secrets |
| Ongoing supportability | Someone must own and update automations when APIs change |
Exam tip: "Coordinate responses across SIEM, EDR, and ticketing" → orchestration/SOAR. "Every server is built the same way from a template" → standard infrastructure configuration / IaC. "Pipeline blocks deployment when a scan fails" → guard rails / CI testing. "Release to 5% of users first" → canary. "One script disables a user" → automation. Extension
.ps1→ PowerShell;.py→ Python;.sh→ shell.
Quick self-check
- Automation vs. orchestration in one line each.
- Three benefits from class? (Workforce multiplier, speed, consistency.)
- Blue/green vs. canary?
Sources: 20260918_175437.jpg, 20260918_175443.jpg, 20260918_175450.jpg