CompTIA CySA+ (CS0-002)

Explore asset tagging and change management to catalog assets, track details and locations, manage warranties, and implement controlled changes that protect availability and the CIA triad.

Learn how to design a secure network using architecture and segmentation, from physical controls and VLANs to software defined networking, VPNs, and cloud concepts like VPCs and serverless functions.

Explore identity and access management fundamentals, including privileged management and DAC, MAC, RBAC, ABAC, MFA, SSO, federation, and manual review.

Explore how virtual desktop infrastructure and containerization boost security with non-persistent desktops, thin clients, and server-side images. Use Docker to create consistent, cross-platform environments that reduce drift and enable recovery.

Explore honeypots and active defense to frustrate attackers, slow their progress, and gather intel by using obfuscation, port hiding, fake portals, and dummy infrastructure, with OpenCanary and Honeybadger demonstrations.

Cloud access security broker (CASB) integrates enterprise security policies with cloud apps, enabling single sign-on, access controls, malware scanning, and visibility, via forward proxies, reverse proxies, or API integrations.

Master certificate management by installing, updating, and revoking certificates, maintaining trusted roots, and avoiding self-signed certs in production environments.

Explore hardware assurance fundamentals, including the trusted platform module, hardware security modules, anti-tamper, and secure firmware updates to protect data at rest and in transit.

Explore software assurance and secure coding within the secure development lifecycle, and apply input validation, output encoding, and prepared statements to prevent xss and sql injection.

Explore the components of trend analysis to predict security outcomes, using frequency, volume, and deviation against baselines, and apply metrics like alerts, incidents, response times, and compliance.

Identify url analysis components, including domain, path, and query strings, and examine http methods, status codes, and percent-encoding to understand how urls are exploited in attacks.

Identify malware dns tactics such as domain generation algorithms and fast flux using logs and dns reputation; mitigate with recursive dns, dns whitelisting, and Alexa top 500 domains.

Identify security events by analyzing packets and protocols with Wireshark, spot unrecognized connections and beaconing, and inspect DNS, Telnet, and FTP traffic for forensics.

Explore flow analysis to inspect network traffic, identify protocols and ports, and detect anomalies with alerts. Use NetFlow, Argus, and Zeke for visualization and reporting.

Identify endpoint behavior using known-good baselines and UEBA, and detect anomalous activity with AI-powered analytics, EPP/EDR, and comprehensive process monitoring.

Explore malware analysis techniques, including fileless malware, droppers, and living off the land with PowerShell and Python, then learn reverse engineering using strings and decompilers.

Learn to identify log sources, analyze event logs, syslog and var/log entries, and use firewall, proxy, and IDS/IPS logs to detect security events and changes with SIEM tools.

Explore impact analysis for security events, using taxonomy-based and impact-based classifications to assess immediate and total costs, scope local vs organizational, and potential reputational damage.

Explore how SIEMs aggregate and normalize security events, using dashboards, widgets, and Kibana to triage incidents, write rules, and enrich data with threat intelligence.

Explore email threats and defenses by analyzing phishing types, recognizing social engineering vectors like spear phishing and business email compromise, and implementing SPF, DKIM, and DMARC to verify sender integrity.

Explore file permissions across Windows and Linux, using icacls and chmod to set read, write, and execute rights, and learn ownership with chown and group settings for secure access control.

Explore blacklisting and whitelisting to control which applications and traffic run in your infrastructure, weigh pros and cons, and apply execution control across endpoints.

Identify firewall configuration concepts and topologies, including a two-firewall DMZ design. Apply ACL-based rules, block martians and bogons, and implement drop vs reject and egress filtering.

Identify DLP basics, classify sensitive data, and enforce policies with alerts and remediation across endpoints and networks, using structured and unstructured data detection.

Explore how network access control uses 802.1X, supplicant and authenticator roles, and health-check policies to grant or restrict network access, including remediation and policy-based controls.

Differentiate blackholes and sinkholes in network security. Blackholes drop traffic using null routing, while sinkholes forward traffic for analysis to identify threats and quarantine infected devices.

Identify and submit suspicious files to vendors or VirusTotal to expand malware signatures, and use standardized naming (CARO, MAEC) and YARA rules to classify and detect malware.

Explore threat hunting by formulating a hypothesis, modeling threats, and profiling actors with their tactics, techniques and procedures to detect indicators of compromise via SIEM and reduce the attack surface.

Automate repetitive tasks with scripting using Bash to parse logs and reduce administrative burden. Explore PowerShell for Windows logon events and note Python, Ruby, and Golang for cross-platform security tooling.

Explore the differences between artificial intelligence, machine learning, and deep learning, including expert systems, data requirements, and how each powers end-point protection and large data sets.

Explore continuous integration, delivery, and deployment, contrast iterative development with traditional approaches, and see how development, test, staging, and production environments support secure, incremental code delivery.

Learn how to communicate security incidents securely and methodically using out-of-band channels, identify who must be informed, comply with GDPR, and prioritize high-value data in incident response.

Explore the six incident response phases from preparation to lessons learned, including identification, containment, eradication, and recovery, with practical planning, escalation, and playbooks.

Identify indicators of compromise across network, host, and applications to triage security incidents. Detect beaconing, bandwidth spikes, rogue devices, and suspicious processes with tools like Wireshark and NetFlow.

Identify, collect, analyze, and report digital evidence using forensically sound methods; maintain chain of custody, hash evidence, and apply order of volatility across memory, disk, and mobile data.

Explore the distinction and overlap between privacy and security, and how data governance, the CIA triad, and regulatory concerns shape safeguards through policies and controls.

Explore non-technical controls basics, including data governance, the data life cycle, and data classification to uphold confidentiality and integrity through purpose limitation, data minimization, and sovereignty.

Explore retention policies and data life-cycle as non-technical controls, and define data ownership roles—owner, steward, custodians, privacy officer—plus ndas, slas, isas, e-discovery, and regulatory compliance.

Explore software-driven technical controls and access controls, geographic access requirements, and encryption across rest, in transit, and in use, with data loss prevention templates.

Explore advanced technical controls for de-identification, data masking, tokenization, and digital rights management. Learn how re-identification risks and data roles protect PII and PHI in large data sets.

Explore how information security risk is identified and managed through a systematized enterprise risk management frame that assesses, monitors, and responds to threats using NIST SP 839 guidance.

Compute risk by analyzing probability and magnitude to derive risk, using asset value and exposure factor to obtain single loss expectancy, then apply ALE to guide controls.

Explore how business impact analysis informs risk decisions by assessing system importance, potential losses, and recovery metrics like MTD, RTO, WRT, and RPO.

Prioritize and communicate risk using context-driven risk evaluation, four response strategies (accept, avoid, mitigate, transfer), ROSI calculations, and risk registers to inform business decisions.

Document compensating controls and train across the risk lifecycle, using a risk register to prioritize investments, and practice through tabletop exercises and red-blue-white team wargaming.

Apply risk management to supply chains by conducting vendor due diligence, ensuring source authenticity, and evaluating depth of the supply chain with trusted foundry concepts for secure hardware.

Discover how security controls strengthen risk management through governance with the NIST framework and COA matrix, covering categories like administrative, managerial, operational, and technical, plus preventative and detective types.

Define the four phases of digital forensics: identification, collection, analysis, and reporting, through policies, procedures, and a code of ethics; emphasize chain of custody and work product retention.

Explore how prescriptive and risk-based frameworks guide security and risk management, and how audits, assessments, compliance and continuous monitoring verify and improve regulatory alignment.

Examine identity and access management governance, including authentication, authorization, auditing, password policies, data ownership and retention, and acceptable use policies to minimize risk.