CompTIA CySA+ Course Content
This is the largest portion of the exam. It moves beyond knowing tools to interpreting their output.
- Malicious Activity Analysis: Identifying anomalies in network traffic (beaconing, unauthorized pings) and host behaviors (unauthorized processes, registry changes).
- Threat Hunting & Intelligence: Using frameworks like MITRE ATT&CK to map attacker tactics and integrating threat feeds (STIX/TAXII).
- Modern Tools: Working with SIEM (Security Information and Event Management) and SOAR (Security Orchestration, Automation, and Response) to automate repetitive tasks.
This domain focuses on the cycle of finding and fixing weaknesses.
- Scanning Methods: Understanding the difference between agent-based vs. agentless and credentialed vs. non-credentialed scans.
- Prioritization: Using CVSS 4.0 scores to decide which bugs to fix first based on environmental risk.
- Secure Coding & AppSec: Identifying web-specific flaws like SQL injection, XSS, and broken access control.
When a breach occurs, this domain provides the playbook for action.
- Attack Methodology: Using models like the Cyber Kill Chain or the Diamond Model to understand an intrusion.
- Response Activities: Practical steps for Containment (isolating a system), Eradication (removing the threat), and Recovery (restoring from backups).
- Forensics: Basics of chain of custody, evidence preservation, and data integrity validation.
A shift in the 003 version is a higher focus on soft skills.
- Metrics & KPIs: Identifying the "Mean Time to Detect" (MTTD) and "Mean Time to Respond" (MTTR).
- Communication: Knowing when to escalate an incident to legal, HR, or executive leadership.
- Post-Incident Handling: Conducting "Lessons Learned" meetings to prevent future occurrences.
- Packet Analysis: Wireshark, tcpdump.
- Scanning: Nessus, OpenVAS, Nmap, Burp Suite.
- Intelligence/Forensics: Maltego, WHOIS, AbuseIPDB, VirusTotal.
- Scripting: Heavy emphasis on Python and PowerShell for log parsing and automation.
Since you've recently explored AWS VPC security and ServiceNow configuration, would you like to see how CySA+ applies those skills specifically to cloud-based incident response?