CompTIA Cybersecurity Analyst (CySA+) Certification Course

Discover the CSA plus exam overview, objectives, and a roadmap from cybersecurity basics to threats, vulnerabilities, risk management, and incident response.

Explore how the CompTIA CySA+ exam is vendor neutral, with 85 questions across multiple choice and performance-based formats, 165 minutes, and a 750 passing score.

Arrive early at the CySA+ testing location, stay calm and rested. If you fail, no wait for the second attempt; wait 14 days after the second attempt, then prepare again.

Explain ACL, ARP, BYOD, and CCTV concepts and how they affect security. The lecture highlights acronyms you may see on the CySA+ exam and suggests further reading.

Explore how DDoS attacks overwhelm systems, how DNS maps names to IPs, and how HBSS, ICS, and IDS contribute to security.

Explore the fundamentals of cybersecurity through the CIA triad—confidentiality, integrity, and availability—while demystifying intruder threats and clarifying core objectives.

Explore the CIA triad—confidentiality, integrity, and availability—and how unauthorized access and misconfigurations threaten data, systems, and end-user availability, in preparation for the CSA+ exam.

See risk analysis as the foundation for building an effective security structure, identify vulnerabilities and threats, and implement controls with periodic reassessment and backups.

Learn how risk arises from threats and vulnerabilities, assess it with a four-step NIST framework, and mitigate it through patches, upgrades, physical security, or training.

Identify threats, vulnerabilities, and risks through routine risk assessments, focusing on adversarial, accidental, structural, and environmental threats, as outlined by NIST SP 830.

Explore environmental threats and internal risks, assess likelihood and impact with a risk matrix, and prioritize mitigations to protect data centers and prevent admin abuse.

Explore network access control with 802.1X, supplicant, authenticator, and radius servers to build a multi-layered, obfuscated network using segmentation and deception techniques.

Deploy firewalls to restrict traffic and segment the network into security zones, including a DMZ for public services.

Explore endpoint security by securing user devices through system hardening, patch management, policy-based configurations, and security software, while contrasting discretionary and mandatory access control models.

Explore how penetration testing informs security planning through the planning, discovery, and attack phases, and learn ethical permission practices, risk mitigation, and real-world threat assessment.

Navigate the discovery phase to gather system information, perform port scans, and identify vulnerabilities. Use social engineering and exploitation to escalate to administrative control, then complete reporting per NIST 801-15.

Learn reverse engineering in cybersecurity by using isolated sandboxes with virtual machines and monitoring tools (Wireshark, port, file, and network monitors) to analyze suspicious software or hardware.

Compare wireless and wired networks and explain the security implications for wireless access points. Assume wireless packets are read by unauthorized users and require encryption to protect sensitive data.

Learn how wireless access points connect to wired networks, the threat of rogue APs, and key security measures: WPA/WPA2, 802.1X, MAC filtering, and controlled radio power.

Virtualization lets multiple operating systems run on one server, improving efficiency and reducing hardware needs. It also introduces security concerns such as VM escape, unsecured migration, sprawl, and hypervisor attacks.

Explore the security challenges of virtual environments, including inadequate isolation, hypervisor risks, and host vulnerabilities, and learn to monitor VM traffic and harden both host and guests with up-to-date patches.

Analyze cloud security challenges and protections, including secure access and encryption, multi-tenancy, residual data, virtualization risks, availability, and data jurisdiction involving cloud service provider practices.

Perform environmental reconnaissance to reveal how a network truly operates, balancing administrator insights with hands-on testing, and use procedures, variables, and tools to reveal the actual security posture.

Explore environmental reconnaissance for cybersecurity analysts to identify threats and vulnerabilities, applying topology discovery, OS fingerprinting, service discovery, and ACL review, plus host scanning and network mapping.

Learn how topology and service discovery reveal network structure and running services, including devices, subnetting, IP addresses, and vulnerabilities in DNS, DHCP, and web servers.

Discover how operating system fingerprinting reveals OS type, version, and build numbers during network discovery, exposing vulnerabilities including zero-day weaknesses and informing mitigation via ids/ips and secure configurations.

Inspect and secure routers and firewalls to prevent unauthorized traffic and detect potential threats by reviewing ACLs, verifying configurations, and applying firmware updates.

Explore packet capture and sniffing to read raw TCP/IP packets, revealing addresses, ports, DNS data, and unencrypted information on private networks, with tools like Wireshark and Tcpdump.

Learn how log files capture network and system activity, how detail levels affect performance, and how to review, filter by information, warning, error, and alert, then detect intrusions across devices.

Explore email harvesting methods that collect addresses from mailing lists, web pages, forms, and ident protocols to enable phishing and spamming, and mitigate with email munging, image displays, and Captcha.

Explore how human behavior and social media profiling enable social engineering, and learn practical mitigation through clear policies, identity verification, and ongoing training.

Learn how DNS harvesting gathers DNS records to reveal network structure, devices, and services, including A, AAAA, CNAME, NS, MX, SOA, SRV, and zone transfers.

Learn how dns harvesting works using traceroute, whois lookups, and zone transfers, and explore practical strategies to mitigate exposure by limiting traceroute responses, protecting whois data, and securing zone transfers.

Explore phishing as a social engineering attack using genuine-looking emails to steal credentials, with PayPal examples, and emphasize cybersecurity analyst training as the primary defense.

Identify threats, vulnerabilities, and weaknesses through network reconnaissance to strengthen defenses and protect critical systems, data, and processes.

Identify open ports and vulnerable services, assess vulnerabilities from penetration testing, and implement prioritized countermeasures to mitigate threats within budget and time constraints.

Discover how network segmentation strengthens security beyond perimeter firewalls by dividing networks into segments, using DMZs, VLANs, ACLs, and group policies to protect sensitive resources.

Analyze how local area networks are segmented into intranet, extranet, and DMZ to create layered security, with controlled interconnections and monitoring.

Securely segment intranet, extranet, and DMZ using VLAN-based segmentation, with routers and firewalls enforcing tight access controls and monitoring between network segments.

Leverage honeypots and honeynets to lure attackers into a realistic fake network, distract them from real resources, and gather attacker origins and attack details to inform vulnerability scans.

Leverage policy based configuration with group policy to enforce consistent settings across thousands of devices by using active directory domains, OUs, sites, and GPOs.

Learn how group policy enforces policy-based config in an Active Directory environment, from domain to OU, via inheritance and precedence, and apply USB blocking, password policies, and firewall rules.

Understand how endpoint security systems protect end-user devices via a client-server model, enforcing encryption, remote wipe, automatic patches, and data access controls to mitigate malware and BYOD risks.

Balance ease of use with strong security across servers, endpoints, and the physical environment through ongoing hardening. Implement group policy and train users to maintain secure setups as devices evolve.

Explore system hardening techniques across mandatory access control, administrative controls, logical controls, physical controls, and patching to protect sensitive data in high-security environments.

Examine how network access control extends user authentication by evaluating a connecting device's security posture, malware presence, antivirus status, and updates before granting network access.

Authenticate the user and assess device health with the network policy server (NPS) against health policies to grant access or route to a restricted network for remediation.

Learn to configure access control lists (ACLs) on routers and firewalls using sequential if-then rules and network or transport criteria. Mitigate ip spoofing, icmp, traceroute, and tcp syn dos attacks.

Learn how sinkholes, paired with access control lists, redirect suspicious traffic to a sinkhole for analysis, monitoring attack activity and blocking back-communication.

Explore how penetration testing simulates attacks to identify vulnerabilities, test security solutions, and assess real-world performance through blind, double blind, and target tests, with zero, partial, and full knowledge tests.

Explore common pen test tools such as Retina, Metasploit, Wireshark, Nessus, and John the Ripper, and learn when to use each based on the system and test through logging practice.

Evaluate risks and mitigate threats through threat modeling, asset identification, and penetration testing. Prioritize risks by technical impact and likelihood, balancing security controls with resource constraints.

Explore vulnerability management as the core of risk analysis, defining vulnerabilities and threats, and learn a seven-step process from scanning to remediation and ongoing monitoring for secure, iterative vulnerability management.

Identify requirements for vulnerability management, align with regulations, data classification, asset inventory, and review SOX, GLBA, HIPAA, and PCI DSS to understand penalties and compliance across finance, healthcare, and retail.

Enforce written security procedures, standards, and guidelines; implement a data classification policy with confidential data warnings, maintain asset inventory, and support vulnerability management under external regulatory requirements.

Explore how to set vulnerability scanning frequency within the vulnerability management process, balancing risk appetite, regulatory requirements, and budget, using common tools like Nessus and OpenVAS.

Configure vulnerability scanning tools to meet defined criteria, balancing discovery and assessment scans, credentialed or non-credentialed modes, and server or agent-based deployments.

Learn how to conduct vulnerability scans by configuring tools, testing changes one at a time, and understanding five basic steps and how execution varies by scanning tool.

Generate and analyze vulnerability scan reports to protect data and inform designated security officers and management, covering technical, change, trend, and executive formats while addressing HIPAA and Sarbanes-Oxley compliance.

Remediate vulnerabilities after scanning by prioritizing and scheduling fixes, evaluating risk, budgetary concerns, and business operations, testing changes in sandbox, and enforcing change control with upper management.

Explore ongoing monitoring in the seven-step vulnerability management process, highlighting regular scanning and remediation tailored to an organization's size, budget, and risk.

Analyze vulnerability scan results to separate false positives from true issues, create exceptions, and prioritize remediation, then validate and correlate findings with logs and trends for proactive security.

Examine web server vulnerabilities, including maintenance hooks and backdoors, and how IDs and auditing help detect and remediate attacks; cover time of check and time of use flaws.

Assess and mitigate web server vulnerabilities by enforcing atomic transactions for all-or-nothing execution, guarding direct object references with access checks, and validating or encoding input to prevent XSS and CSRF.

Explore clickjacking defenses using the X frame options header to deny overlays, and prevent SQL injection with input validation and parameterized queries; apply generic error messages to avoid information leakage.

Identify common endpoint vulnerabilities and remediate with policies, patches, anti-malware, firewalls, host-based intrusion detection, while enforcing least privilege, encrypting data on devices, and testing updates.

Identify common network vulnerabilities in switches, routers, and network devices—mac flooding and arp poisoning—plus defenses like dynamic arp inspection and dhcp snooping.

Discover virtual environment vulnerabilities, including virtual machine escape, host and hypervisor risks, data remnants, and secure virtual networks, and learn mitigation strategies and cloud provider service level agreements.

Identify and mitigate mobile device vulnerabilities by combining user education with centralized management, focusing on lost or stolen devices, data encryption, remote wipe, and BYOD versus company-owned strategies.

Master how to design and implement a well designed cyber incident response plan, covering its creation and structure, implementation characteristics, threat classifications, and forensics tools to preserve trust.

Classify threats to drive incident response by assessing severity and scope, correlating with attack types, and prioritizing known, unknown, zero-day, and advanced persistent threats based on data at risk.

Explore threat classification by known, unknown, zero-day, and apt threats, using signature analysis, anomaly detection, and incident response planning to defend networks.

Prioritize incident responses by assessing scope of impact, including downtime, criticality, data integrity threats, and economic and intangible impact. Learn metrics like MTD, Mttr, Mtbf, RTO, RPO to guide recovery.

Embed criticality levels in the incident response plan's scope of impact. Assess data integrity with auditing and hashing to reveal unauthorized data modifications and evaluate tangible and intangible assets' impact.

Identify and protect sensitive data types such as PII, PHI, credit card information, patent information, intellectual property, and trade secrets; implement non-disclosure agreements and plan incident response.

Set up a forensic workstation with write blockers to perform bit-level drive copies, verify image integrity, analyze file systems, and manage removable media evidence for incident response.

Explore how a forensic investigation suite supports digital investigations with analysis and imaging utilities, chain of custody, hashing, operating system and mobile device forensics, cryptographic tools, and log viewing.

Explore the five CSA security tool categories—preventative, collective, analytical, exploit, and forensics—and learn each tool’s purpose for CySA+ exam success using the study sheet and hands-on practice.

Explore incident response basics and the significance of a well-prepared, coordinated team like the computer security incident response team (csirt), whose experience drives effective incident handling.

Identify a multidisciplinary CSIRT before incidents, with roles including management, legal, and HR. Refine the incident response process with test environments, post-incident reviews, and investigative tools, guided by the NIST.

Learn how to manage incident response by aligning stakeholders from IT, human resources, legal, marketing, and management, and securing ownership through formal documentation and buy-in.

Coordinate human resources, legal, marketing, and management to support incident response through policies, education, and communications, ensuring unified stakeholder priorities and timely decision making during incidents.

Develop and follow a detailed incident response communications plan to engage trusted parties with updated contact information, escalate appropriately, and securely share timely updates while complying with regulatory requirements.

Define clear role-based responsibilities for technical, managerial, and law enforcement tasks within incident response, coordinating stakeholders to plan, stop attacks, and limit damage.

Identify network-related symptoms that reveal ongoing or impending cyber incidents, including bandwidth spikes, irregular peer-to-peer traffic, rogue devices, beaconing, scan sweeps, and botnet activity, using IDS tools.

Identify host-related symptoms that signal cyber incidents, including CPU and memory spikes, disk space usage drops, unauthorized software or changes, and missing data, then investigate with logs.

Identify common application-related symptoms that signal ongoing attacks, such as new accounts, unexpected outbound communication, abnormal output, memory issues, and app lockups; security teams investigate to confirm incidents.

Learn the incident recovery phase within the NIST four-step incident handling process, including containment, eradication, validation, and recovery, plus preparation, detection, threat classification, and stakeholder communication.

Contain the ongoing security incident by stopping the attack and stabilizing systems, using segmentation, isolation, and acls or vlans, then removal and reverse engineering to restore operations.

Use isolation to block traffic from a suspected compromised device, weighing segmentation and removal options, and apply log data and reverse engineering to identify affected areas and stop spread.

Eradicate threats by choosing sanitization, reconstruction, or disposal, evaluating remaining hazards and verifying effectiveness. Collaborate with vendors and peers to optimize safe, repeatable eradication procedures across devices.

Sanitize devices, wipe drives, and reinstall the operating system with latest updates; verify security and operational configurations using clean images or backups to prevent new vulnerabilities.

Perform validation after incident recovery to verify patches, permissions, vulnerability scan, and logging are restored, ensuring a secure, compliant, and operational environment.

Identify lessons learned immediately after a security incident, produce a formal lessons learned report with stakeholder input, and implement cost-aware changes to enhance future incident response.

Document the incident summary report for stakeholders, detailing when and how it was detected, what happened, how it originated, how it was contained, its impact, and recovery and improvement opportunities.

Explore frameworks, policies, and procedures in cybersecurity and how security frameworks shape compliance, penalties, and responsibilities for employees, vendors, and consultants.

Explore regulatory compliance essentials for the CySA+ course, including Sarbanes-Oxley, HIPAA, and the Kennedy-Kassebaum act, data protection, and penalties for violations.

Explore the Patriot Act, GLBA, CFAA, FISA, and ECPA, and their amendments. Assess how these acts shape data privacy, access to records, and regulatory obligations for security professionals.

Explore major security frameworks such as NIST, ISO, Cobit, Sabsa, TOGAF, and ITIL and how they shape an ISMS with defined controls.

Explore password policies and how they drive security plans, detailing static, complex, passphrase, cognitive, and graphical passwords, and outline data ownership and data classification.

Understand how password policies define password length, rotation intervals, and complexity to resist cracking, and how data ownership, classification, retention, and account management shape security policies and acceptable use guidelines.

Explore how a security framework ties policies, standards, and guidelines to control objectives, with physical, logical, and administrative controls across seven forms: compensative, corrective, detective, deterrent, directive, preventative, and recovery.

Learn how operational procedures translate security policies into daily practices through continuous monitoring, establishing operational baselines, detecting abnormal conditions, and guiding incident response and patch management.

Verify that security plans and controls are implemented correctly and deliver the intended data protection outcomes through audits, evaluations, and assessments.