CompTIA CySA+ (CS0-003)

Explore security operations, incident response and vulnerability management, and master reporting and communication while preparing for the CompTIA CySA+ exam with multiple choice and performance-based questions.

Learn how time synchronization with NTP keeps server clocks aligned for accurate event timelines and incident response. Explore log ingestion concepts and syslog levels: fatal, error, warn, info, debug, trace.

Explore Windows registry concepts and hive structure, and compare Windows and Linux file structures. Apply system hardening, process monitoring, and architecture basics to defend and troubleshoot systems.

Discover serverless infrastructure, virtualization, and containerization concepts, including bare metal and hosted hypervisors, and practical Docker techniques with Docker Hub and HTTP servers.

Explore identity and access management concepts like MFA, SSO, federation, PAM, and CASB, emphasizing least privilege, secret rotation, and securing cloud services with visibility, compliance, data security, and threat protection.

Explore common encryption concepts through PKI, including certificate management systems, CA, RA, VA, and certificates. Learn about self-signed certificates, CA services, and ssl inspection in encrypted traffic.

Explore data loss prevention, PII, and cardholder data protection through encryption, obfuscation, and strict key management within PCI DSS guidelines to minimize storage, restrict access, and secure data.

Explore common network architectures—on-prem, cloud, and hybrid—and examine how network segmentation and zero trust, with secure access edge (sassy) concepts, shape modern networks.

Identify malicious network activity by monitoring bandwidth consumption, beaconing, irregular peer-to-peer traffic, rogue devices, and unexpected ports; use asset discovery, scans, and SIEM alerts.

Learn to detect malicious host activity by monitoring processor, memory, storage, network usage, and unauthorized software, suspicious processes, privilege changes, and data exfiltration indicators.

Identify anomalous application activity by establishing baselines and using tools like Wireshark and netstat to detect new accounts, unusual output, outbound communications, and service interruptions, triggering incident response.

Explore how social engineering attacks drive malicious activity, focusing on phishing and obfuscated links arising from typosquatting and URL encoding, and learn vigilant practices to avoid clicking dangerous prompts.

Explore packet capture tools, focusing on Wireshark and tcpdump, to capture, filter, and inspect traffic using IP, port, protocol, and flags with logical operators.

Explore log analysis tools, including SIEM and syslog, for aggregating and alerting on security events, and see how SOWAR augments these with orchestration and automation.

Learn how endpoint detection and response uses machine learning to detect sophisticated threats beyond traditional antivirus, establish baselines with agent data, and automate alerts, responses, and remediation.

Explore how DNS and IP reputation tools assess domain and IP trust. Use real-time threat data and abuse databases to block malicious sites and spam.

Learn to analyze files with strings and hashing, verify integrity with MD5 and SHA-256, and use VirusTotal to assess malware risk.

Explore sandboxing tools to safely analyze potential malware, using Joe Sandbox or Cuckoo Sandbox, and learn to configure architectures, samples, and execution.

Learn how to analyze emails using headers, links, and attachments, and apply SPF, DKIM, and DMARC to verify sender authenticity and protect against spoofing.

Explore user and entity behavior analytics (UEBA) to detect anomalous activity, establish baselines, and generate alerts for compromised credentials and insider threats, using tools like Splunk and Microsoft Sentinel.

Learn scripting and programming basics in Python, PowerShell, and shell scripts; understand JSON and XML data exchange, regex, and their role in automating admin tasks and security.

Learn threat actor types from script kitties to nation-state APTs, including insider threats (intentional and unintentional), hacktivists, organized crime, and supply chain attackers.

Explore TTPs—tactics, techniques, and procedures—from high-level attacker goals to specific methods, and map them with the MITRE ATT&CK framework for threat modeling and mitigations and detections.

Explore CTI confidence levels by examining strategic, tactical, and operational CTI, and assess timeliness, relevancy, and accuracy to guide threat intel feeds and defense decisions.

Explore open and closed CTI sources—from social media and blogs to government advisories and paid feeds—to curate threat intelligence for your organization or environments.

Learn how CTI sharing improves attribution, vulnerability management, and detection, using STIX and TAXII, hub-and-spoke and peer-to-peer models, plus Yara and Sigma.

Shorten breach discovery by hunting for indicators of compromise. Collect and analyze IOCs and PCAPs to map the attack to MITRE ATT&CK and enhance defenses.

Identify tasks suitable for automation by focusing on repeatable, high-volume, error-prone, and monotonous workflows with homogeneous data, then coordinate goals, requirements, and best practices to implement tailored automation.

Streamlining operations through automation and orchestration, using a SOAR approach to centralize tools, enrich threat intelligence with context, and minimize human engagement to speed detection and prioritization.

Learn how to integrate tools into security operations using APIs, webhooks, plugins, and a single pane of glass, with VirusTotal API examples and automation through curl and Python.