CompTIA CySA+ (Cybersecurity Analyst) Certification Training (Exam CS0-002)

Lesson 1: Explaining the Importance of Security Controls and Security Intelligence

• Topic 1A: Identify Security Control Types
• Topic 1B: Explain the Importance of Threat Data and Intelligence

Lesson 2: Utilizing Threat Data and Intelligence

• Topic 2A: Classify Threats and Threat Actor Types
• Topic 2B: Utilize Attack Frameworks and Indicator Management
• Topic 2C: Utilize Threat Modeling and Hunting Methodologies

Lesson 3: Analyzing Security Monitoring Data

• Topic 3A: Analyze Network Monitoring Output
• Topic 3B: Analyze Appliance Monitoring Output
• Topic 3C: Analyze Endpoint Monitoring Output
• Topic 3D: Analyze Email Monitoring Output

Lesson 4: Collecting and Querying Security Monitoring Data

• Topic 4A: Configure Log Review and SIEM Tools
• Topic 4B: Analyze and Query Logs and SIEM Data

Lesson 5: Utilizing Digital Forensics and Indicator Analysis Techniques

• Topic 5A: Identify Digital Forensics Techniques
• Topic 5B: Analyze Network-related IOCs
• Topic 5C: Analyze Host-related IOCs
• Topic 5D: Analyze Application-related IOCs
• Topic 5E: Analyze Lateral Movement and Pivot IOCs

Lesson 6: Applying Incident Response Procedures

• Topic 6A: Explain Incident Response Processes
• Topic 6B: Apply Detection and Containment Processes
• Topic 6C: Apply Eradication, Recovery, and Post-incident Processes

Lesson 7: Applying Risk Mitigation and Security Frameworks

• Topic 7A: Apply Risk Identification, Calculation,and Prioritization Processes
• Topic 7B: Explain Frameworks, Policies, and Procedures

Lesson 8: Performing Vulnerability Management

• Topic 8A: Analyze Output from Enumeration Tools
• Topic 8B: Configure Infrastructure Vulnerability Scanning Parameters
• Topic 8C: Analyze Output from Infrastructure Vulnerability Scanners
• Topic 8D: Mitigate Vulnerability Issues

Lesson 9: Applying Security Solutions for Infrastructure Management

• Topic 9A: Apply Identity and Access Management Security Solutions
• Topic 9B: Apply Network Architecture and Segmentation Security Solutions
• Topic 9C: Explain Hardware Assurance Best Practices
• Topic 9D: Explain Vulnerabilities Associated with Specialized Technology

Lesson 10: Understanding Data Privacy and Protection

• Topic 10A: Identify Non-technical Data and Privacy Controls
• Topic 10B: Identify Technical Data and Privacy Controls

Lesson 11: Applying Security Solutions for Software Assurance

• Topic 11A: Mitigate Software Vulnerabilities and Attacks
• Topic 11B: Mitigate Web Application Vulnerabilities and Attacks
• Topic 11C: Analyze Output from Application Assessments

Lesson 12: Applying Security Solutions for Cloud and Automation

• Topic 12A: Identify Cloud Service and Deployment Model Vulnerabilities
• Topic 12B: Explain Service-oriented Architecture
• Topic 12C: Analyze Output from Cloud Infrastructure Assessment Tools
• Topic 12D: Compare Automation Concepts and Technologies

Assess and respond to security threats and operate a systems and network security analysis platform.

• Assess information security risk in computing and network environments.
• Analyze reconnaissance threats to computing and network environments.
• Analyze attacks on computing and network environments.
• Analyze post-attack techniques on computing and network environments.
• Implement a vulnerability management program.
• Collect cybersecurity intelligence.
• Analyze data collected from security and event logs.
• Perform active analysis on assets and networks.
• Respond to cybersecurity incidents.
• Investigate cybersecurity incidents.
• Address security issues with the organization's technology architecture.

Lab 1: Accessing Information Security Risk
Lab 2: Analyzing Reconnaissance Threats to Computing
Lab 3: Analyzing Attacks on Computing and Network Environments
Lab 4: Analyzing Post Attack Techniques
Lab 5: Managing Vulnerabilities in the Organization
Lab 6: Collecting Cybersecurity Intelligence
Lab 7: Analyzing Log Data
Lab 8: Performing Active Asset and Network Analysis
Lab 9: Responding to Cybersecurity Incidents
Lab 10: Investigating Cybersecurity Incidents
Lab 11: Addressing Security Architecture

To ensure your success in this course, you should meet the following requirements:

• At least two years (recommended) of experience in computer network security technology or a related field.
• The ability to recognize information security vulnerabilities and threats in the context of risk management.
• Foundation-level operational skills with some of the common operating systems for computing environments.
• Foundational knowledge of the concepts and operational framework of common assurance safeguards in computing environments. Safeguards include, but are not limited to, basic authentication and authorization, resource permissions, and anti-malware mechanisms.
• Foundation-level understanding of some of the common concepts for network environments, such as routing and switching.
• Foundational knowledge of major TCP/IP networking protocols including, but not limited to, TCP, IP, UDP, DNS, HTTP, ARP, ICMP, and DHCP.
• Foundational knowledge of the concepts and operational framework of common assurance safeguards in network environments. Safeguards include, but are not limited to, firewalls, intrusion prevention systems, and VPNs.

• IT Security Analyst
• Security Operations Center (SOC) Analyst
• Vulnerability Analyst
• Cybersecurity Specialist
• Threat Intelligence Analyst
• Security Engineer