CompTIA CySA+ (Cybersecurity Analyst+) CS0-002

Name: CompTIA CySA+ (Cybersecurity Analyst+) CS0-002
Rating: 4.5 (18 reviews)

Cyber Security CYSA+ CS0-002 Exam Prep

Created byVision Training Systems : IT Training

Last updated 4/2022

English

English [Auto],

What you'll learn

Apply behavioral analytics to networks and devices with the intention to prevent, detect, and combat cybersecurity threats
Learn how to proactively defend and continuously improve the security of an organization
Understand how to leverage intelligence and threat detection techniques
Learn to analyze and interpret data, identify and address vulnerabilities, suggest preventative measures, and effectively respond to and recover from incidents.

Course content

7 sections • 36 lectures • 15h 4m total length

Instructor Intro1:02
Meet John Boog, a seasoned technical trainer and retired army communications and signal soldier, introducing the CompTIA CySA+ course and his IT certification expertise.
About the Exam2:22
Explore the CompTIA CySA+ CS0-002 exam, a workforce certification for cybersecurity analysts focused on threat detection and continuous monitoring across five domains.
Test Taking Tips and Techniques18:24
Learn practical test-taking strategies for the CompTIA CySA+ CS0-002 exam, including answering exactly what the question asks, and prioritizing human safety, laws, and business needs, and skipping performance-based questions first.
Explain the importance of threat data and intelligence25:30
Explain the importance of threat data and intelligence, including open vs closed source sources, confidence levels, indicators of compromise, and the intelligence cycle guiding sector ISACs.
Given a scenario, utilize threat intelligence to support organizational security15:33
Apply threat intelligence to support organizational security by using attack frameworks such as the minor attack framework, the diamond model, and cyber kill chain to map adversaries, capabilities, and infrastructure.
Given a scenario, perform vulnerability management activities Pt 113:25
Explore vulnerability management: identify assets and criticality, perform vulnerability scans (passive vs active), understand scan results, remediate with baselines, patching, testing, backouts, automation, and hardening to reduce attack surface.
Given a scenario, perform vulnerability management activities Pt 225:25
Explore compensating controls, risk appetite, and regulatory considerations, and learn vulnerability scanning and remediation strategies, including governance and service level agreements.
Given a scenario, analyze the output from common vulnerability assessment tools17:55
Analyze outputs from common vulnerability assessment tools such as OWASP Zap, Nessus, OpenVAS, and Qualys, and interpret scan results, static vs dynamic analysis, and enumeration findings.
Explain the threats and vulnerabilities associated with specialized technology25:14
Analyze threats and vulnerabilities in embedded systems, real-time operating systems, system on a chip. Assess risks across IoT devices, BYOD, MDM, FPGA, and SCADA with Modbus and CAN bus.
Explain the threats and vulnerabilities associated with operating in the Cloud11:55
Explore cloud service models—SaaS, PaaS, IaaS, and serverless—along with deployment types and infrastructure as code, highlighting security and governance concerns.
Given a scenario-use controls to mitigate attacks & software vulnerabilities pt130:21
Analyze how to mitigate attacks and software vulnerabilities by applying input validation, parameterized queries, and patch management, while recognizing SQL injection, buffer overflows, and privilege escalation.
Given a scenario-use controls to mitigate attacks & software vulnerabilities pt226:22
Protect web sessions from hijacking by encrypting data, randomizing session ids, and re-authenticating regularly; guard against rootkits and cross-site scripting with hardening and input validation.

Given a scenario, apply security solutions for infrastructure management Pt 129:51
Evaluate cloud versus on-premises deployments to balance cost, convenience, and control while securing data and access. Implement defense in depth with segmentation, DMZs, bastion hosts, jump servers, and policy-driven access.
Given a scenario, apply security solutions for infrastructure management Pt 230:31
Examine software defined networking, including controllers, data plane and application plane, and how it enables dynamic infrastructure management; explore VPNs, VDI, containerization, CASB, and honeypots as security solutions.
Given a scenario, apply security solutions for infrastructure management Pt 331:29
Examine identity and access management, including privilege management, multi-factor authentication, SSO and federated identity, RBAC/ABAC/MAC, and the importance of change management, auditing, and proactive monitoring to prevent privilege creep.
Explain software assurance best practices32:24
Define software assurance per National Information Assurance Glossary and outline how secure development life cycle practices, devsecops, and testing across mobile, embedded, and web platforms ensure safety and functionality.
Explain hardware assurance best practices17:09
Explain hardware root of trust, TPMs and remote attestation, EFI/secure boot, measured boot, secure enclaves, and anti tampering within a zero-trust hardware security model.

Given a scenario, analyze data as part of security monitoring activities Pt 131:29
Analyze security monitoring data with heuristics and signatures. Explore sandbox malware analysis, endpoint monitoring, file integrity checks, and user and entity behavior analytics to detect anomalous activity and guide remediation.
Given a scenario, analyze data as part of security monitoring activities Pt 226:47
Analyze incident impact and costs, distinguishing immediate versus long-term effects, while leveraging a SIEM to correlate events, compare agent-based and agentless deployments, and use queries and regex to surface logs.
Given a scenario, analyze data as part of security monitoring activities Pt 325:21
Analyze security monitoring data with regex patterns to locate private IP addresses and port numbers of 1000 or greater, and assess email threats using DKIM, SPF, DMARC, and header analysis.
Implement configuration changes to existing controls to improve security Pt 129:17
Explore how to implement configuration changes to Linux and Windows controls to improve security, including file permissions, chmod, setuid/setgid, ownership, and firewall ACLs with implicit and explicit denies.
Implement configuration changes to existing controls to improve security Pt 233:18
Explore how firewalls handle packets, with drop or reject decisions, along with ingress and egress filtering, and learn core concepts of idps, dlp, edr, and nac.
Explain the importance of proactive threat hunting8:37
Establish a hypothesis, profile threat actors and their tactics, techniques and procedures, and pursue analytic actions to drive proactive threat hunting, reducing risk and improving detection.
Compare and contrast automation concepts and technologies22:42

Explain the importance of the incident response process14:51
Explain the importance of the incident response process. Outline a communication plan, data breach disclosure considerations, reporting requirements, and coordination with leadership, legal, HR, and PR.
Given a scenario, apply the appropriate the incident response procedure25:04
Learn how to build and apply an incident response program, covering policy, roles, preparation, detection and analysis, containment, eradication, recovery, and post-incident reporting.
Given an incident, analyze potential indicators of compromise35:57
Examine network indicators of compromise, including bandwidth baselines, unusual traffic, rogue devices, and scans on non-standard ports, plus host signs like memory use and data exfiltration indicators.
Given a scenario, utilize basic digital forensic techniques30:32
Identify digital evidence, secure the scene, collect and analyze copies with proper tools, and report findings according to chain-of-custody, order of volatility, and legal holds.

Understand the importance of data privacy and protection41:24
Explore the distinction between privacy and security, and learn data classification, retention, and data owner, custodian, and steward roles to safeguard privacy while complying with GDPR, HIPAA, and SOX.
Apply security concepts in support of organizational risk mitigation pt 134:20
Apply enterprise risk management by identifying threats and vulnerabilities affecting assets, evaluating probability and impact, and using qualitative and quantitative assessments to prioritize controls and communicate business risk.
Apply security concepts in support of organizational risk mitigation pt 237:55
Examine mitigating organizational risk by applying metrics such as MTD, RTO, and RPO, managing service levels, vendor due diligence, tabletop and pen testing, and compensating controls.
Explain the importance of frameworks, policies, procedures, and controls Pt 127:34
Explore how frameworks guide enterprise security, comparing prescriptive and risk-based approaches, and examine policies, procedures, data ownership, and password controls.
Explain the importance of frameworks, policies, procedures, and controls Pt 220:41
Learn how policies, procedures, and continuous monitoring support data retention, account management, least privilege, and audits to ensure regulatory compliance.

Recap12:21
Explore threat and vulnerability management, intelligence gathering, IOC concepts, and threat frameworks (diamond model, minor attack framework); cover cloud security, incident response, and risk compliance.
Review Questions1:20:40
Practice review questions for the CompTIA CySA+ CS0-002 cover live forensic imaging, double blind tests, VDI, SQL injections, cross-site scripting, mobile security, honeypots, directory traversal, risk and incident response.
Before the Exam11:15
Master exam readiness for the CompTIA CySA+ CS0-002 by building dump sheets, understanding the whys of questions, and optimizing study, rest, and test-time strategies.

Requirements

IT Security knowledge a plus but not necessary to take this course

Description

This CompTIA training certification course taught by Vision Training Systems covers applied behavioral analytics to networks and devices with the intention to prevent, detect, and combat cybersecurity threats via continuous security monitoring. The CompTIA CySA+ certification, earned after passing the CS0-002 exam, validates an IT professional’s ability to proactively defend and continuously improve the security of an organization. The course is intended for Security analysts at a Tier II level, Intermediate/mid-career cybersecurity specialists, Students holding a DoD IAT Level II or CSSP position, CompTIA Network+ or CompTIA Security+ certification holders wanting to take that next step, or anyone else wanting to expand their skillset and knowledge.

As attackers have learned to evade traditional signature-based solutions such as firewalls and anti-virus software, an analytics-based approach within the IT security industry is increasingly important for organizations. Behavioral analytics in regards to networks helps to improve the overall state of security through identifying and combating malware and advanced persistent threats (APTs), resulting in enhanced threat visibility across a broad attack surface.

The CompTIA Cybersecurity Analyst (CySA+) certification verifies that successful candidates have the knowledge and skills required to leverage intelligence and threat detection techniques, analyze and interpret data, identify and address vulnerabilities, suggest preventative measures, and effectively respond to and recover from incidents.

You will learn to leverage intelligence, and threat detection techniques, to analyze and interpret data, to identify and address vulnerabilities, to suggest preventative measures, and to effectively respond to and recover from incidents.

This CompTIA training course reviews topics for the CS0-002 version of the CySA+ exam, which became the only version available as of October 22, 2020. It does not currently have a retirement date, but an exam version is typically active for three years.

Who this course is for:

The course is intended for Security analysts at a Tier II level, Intermediate/mid-career cybersecurity specialists, Students holding a DoD IAT Level II or CSSP position, CompTIA Network+ or CompTIA Security+ certification holders wanting to take that next step, or anyone else wanting to expand their skillset and knowledge.

CompTIA CySA+ (Cybersecurity Analyst+) CS0-002

What you'll learn

Explore related topics

Course content

Module 1: Threat and Vulnerability Management12 lectures • 3hr 33min

Module 2: Software and Systems Security5 lectures • 2hr 21min

Module 3: Security Operations and Monitoring7 lectures • 2hr 58min

Module 4: Incident Response4 lectures • 1hr 46min

Module 5: Compliance and Assessment5 lectures • 2hr 42min

Module 6: Afterword3 lectures • 1hr 44min