Today: incident response (8%) and security (14%), together 22% of the exam. Unlike Domains 1-4, these don't cluster as separate topics but rather are cross-cutting. Every pipeline has security gates. Every incident should have audit trail. Today: treat these as properties of all systems, not silos.
Incident response has one north star: Mean Time To Recover (MTTR). From detection to system restored.
MTTR = Detection Time + Diagnosis Time + Remediation Time + Validation Time
💡 Related theory: Each component is attackable. Reduce detection time: lower alarm threshold, add synthetic checks