CompTIA CySA+ CS0-003The Complete Beginner's Guide

Threat Intelligence and Threat Hunting

Objective 1.1 · Security Operations

SIEM Log Analysis

Objective 1.2 · Security Operations

Network Traffic Analysis

Objective 1.3 · Security Operations

Endpoint Detection and Response

Objective 1.4 · Security Operations

MITRE ATT&CK Framework for SOC Analysts

Objective 1.1

Cyber Kill Chain and Diamond Model

Objective 1.1

Threat Hunting Techniques and Hypothesis Development

Objective 1.1

OSINT Sources for Threat Intelligence

Objective 1.1

Malware Analysis: Static vs Dynamic

Objective 1.2

Critical Windows Event IDs for Security

Objective 1.2

SOAR Platforms and Automation

Objective 1.2

User and Entity Behaviour Analytics (UEBA)

Objective 1.2

IOCs vs IOAs and Threat Indicators

Objective 1.1

Splunk SPL Queries for Security Analysts

Objective 1.2

Elastic Stack (ELK) for Log Analysis

Objective 1.2

Microsoft Sentinel for CySA+

Objective 1.2

SIGMA and YARA Detection Rules

Objective 1.2

Snort and Suricata IDS/IPS Rules

Objective 1.3

Zeek for Network Traffic Analysis

Objective 1.3

DNS Analysis and Anomaly Detection

Objective 1.3

Packet Capture: Wireshark and tcpdump

Objective 1.3

NetFlow and Traffic Flow Analysis

Objective 1.3

Email Header Analysis for Phishing

Objective 1.2

Malware IOCs: Hashes, IPs, Domains, URLs

Objective 1.1

Malware Sandboxing and Detonation

Objective 1.2

Advanced Persistent Threat (APT) Groups

Objective 1.1

Dark Web Monitoring and Threat Feeds

Objective 1.1

Information Sharing (ISAC, ISAO, AIS)

Objective 1.1

AWS CloudTrail and Azure Audit Log Analysis

Objective 1.2

Container and Kubernetes Security Analysis

Objective 1.4

Identity-Based Attack Patterns: Pass-the-Hash, Kerberoasting

Objective 1.2

SOC Tier 1, Tier 2, and Tier 3 Analyst Roles

Objective 1.2

Network Baseline and Anomaly Detection

Objective 1.3

Honeypots and Deception Technologies

Objective 1.1

Geolocation Analysis in Threat Hunting

Objective 1.1

Phishing Email Analysis Techniques

Objective 1.2

Threat Emulation and Purple Team Exercises

Objective 1.1

Attack Simulation Tools: Atomic Red Team

Objective 1.1

EDR vs XDR vs MDR Platforms

Objective 1.4

Privileged Access Management and PAM Tools

Objective 1.4

Vulnerability Scanning Techniques

Objective 2.1 · Vulnerability Mgmt

Vulnerability Prioritization

Objective 2.2 · Vulnerability Mgmt

Patch and Remediation Workflows

Objective 2.3 · Vulnerability Mgmt

Cloud Vulnerability Management

Objective 2.4 · Vulnerability Mgmt

Nessus Vulnerability Scanner

Objective 2.1

Qualys and OpenVAS Scanners

Objective 2.1

CVE, CVSS, and EPSS Scoring

Objective 2.2

Remediation SLAs and Risk Acceptance

Objective 2.3

Cloud Security Posture Management (CSPM)

Objective 2.4

Penetration Testing vs Vulnerability Assessment

Objective 2.1

Vulnerability Management Workflow

Objective 2.2

Attack Surface Analysis and Reduction

Objective 2.1

OWASP Top 10 for Security Analysts

Objective 2.4

Web Application Vulnerability Scanning

Objective 2.1

Container Image Vulnerability Scanning

Objective 2.4

EPSS Probabilistic Scoring for Prioritisation

Objective 2.2

Compensating Controls for Unpatched Vulnerabilities

Objective 2.3

Zero-Day Vulnerability Response

Objective 2.3

Continuous Compliance Monitoring

Objective 2.4

DevSecOps and Shifting Security Left

Objective 2.4

Software Bill of Materials (SBOM)

Objective 2.4

API Security Testing and Analysis

Objective 2.4

Infrastructure-as-Code Security Scanning

Objective 2.4

SAST vs DAST Tools and Integration

Objective 2.4

Incident Categories and Severity

Objective 3.1 · Incident Response

Incident Response Process

Objective 3.2 · Incident Response

Digital Forensic Evidence Collection

Objective 3.3 · Incident Response

Containment and Eradication

Objective 3.4 · Incident Response

NIST Incident Response Framework

Objective 3.2

Memory Forensics and Volatile Data

Objective 3.3

Network Forensics: Packet Capture Analysis

Objective 3.3

Legal Considerations in Incident Response

Objective 3.4

Root Cause Analysis (RCA)

Objective 3.4

Lessons Learned and Post-Incident Activities

Objective 3.4

Ransomware Incident Response

Objective 3.2

Business Email Compromise (BEC) Response

Objective 3.2

DDoS Attack Incident Response

Objective 3.2

Insider Threat Investigation

Objective 3.3

Supply Chain Attack Response

Objective 3.2

Cloud Incident Response in AWS and Azure

Objective 3.2

Digital Forensics Tools: Autopsy, FTK, Volatility

Objective 3.3

Log Preservation and Chain of Custody

Objective 3.3

IOC Enrichment with VirusTotal and AbuseIPDB

Objective 3.4

Tabletop Exercises and IR Simulations

Objective 3.4

Mobile Device Forensics and MDM Evidence

Objective 3.3

Data Breach Incident Response

Objective 3.2

Security Metrics and KPIs

Objective 4.1 · Reporting Comms

Compliance Reporting

Objective 4.2 · Reporting Comms

Communication and Chain of Custody

Objective 4.3 · Reporting Comms

Risk Scoring and Heat Maps

Objective 4.1

Executive Security Reporting

Objective 4.2

Threat Intelligence Platforms (TIP) and STIX/TAXII

Objective 4.3

Cyber Insurance and IR Coordination

Objective 4.3

Stakeholder Reporting and Escalation

Objective 4.2

Security SLAs and SLOs

Objective 4.1

Regulatory Breach Notification Requirements

Objective 4.2

GDPR and HIPAA Incident Reporting

Objective 4.2

Security Posture Reporting and Dashboards

Objective 4.1

Risk Register and Vulnerability Register

Objective 4.1

Security Architecture Review for Analysts

Objective 4.1