CompTIA CySA+ (CS0-003) Study Guide

The largest domain is the day-to-day work of a SOC analyst: knowing how systems and networks are built (logging, operating-system internals, network architecture, identity and access management, encryption, and protecting sensitive data) so you recognize when something deviates from normal. You analyze indicators of potentially malicious activity across the network (beaconing, irregular peer-to-peer traffic, rogue devices), the host (unauthorized changes, processes, privilege escalation, memory artifacts), and the application (anomalous behavior, new accounts, unexpected output). You apply the right tools and techniques — packet and protocol analysis, log correlation in a SIEM, endpoint and email telemetry, DNS and IP reputation, file analysis and sandboxing — to confirm or dismiss a lead. Finally you fold in threat intelligence and threat hunting: the intelligence cycle, threat-actor TTPs and confidence levels, indicators of compromise, and forming a hypothesis to hunt proactively rather than waiting for an alert. Closing the loop, process improvement standardizes and streamlines operations through automation and orchestration (SOAR) and tool integration toward a single pane of glass.

The second-largest domain is the full lifecycle of finding and fixing weaknesses. You choose the right scanning method for the situation: asset discovery first, then internal vs external, credentialed vs non-credentialed, agent vs agentless, passive vs active, and static vs dynamic analysis (SAST, DAST, IAST), plus software composition analysis and an SBOM for third-party code. You analyze tool output from network mappers, web-application scanners (Burp Suite, OWASP ZAP), and vulnerability scanners (Nessus, OpenVAS), validating findings to separate true positives from false positives. The hardest skill is prioritization: a CVSS base score alone is not a priority — you weigh exploitability and weaponization, asset value and context, zero-day status, the EPSS probability of exploitation, and whether a CVE sits in the CISA Known Exploited Vulnerabilities (KEV) catalog. Then you recommend controls for classes like injection, cross-site scripting, broken access control, and cryptographic failures, and manage the response with patching, configuration and change management, compensating controls, maintenance windows, exceptions, and an explicit risk decision to mitigate, transfer, avoid, or accept.

This domain is how you act once activity is confirmed malicious. You use attack methodology frameworks to structure your thinking: the Cyber Kill Chain's staged progression, the Diamond Model of Intrusion Analysis (adversary, capability, infrastructure, victim), the MITRE ATT&CK matrix of real-world tactics and techniques, and the OWASP testing guidance for application attacks. You then carry out the incident-response activities that mirror the NIST SP 800-61 lifecycle — detection and analysis (correlating indicators, acquiring and preserving evidence, determining scope and impact), then containment, eradication, and recovery (isolating affected systems, removing the foothold, re-imaging, and restoring to known-good). Wrapping the lifecycle are preparation (an IR plan, playbooks, tooling, training, and business-continuity / disaster-recovery readiness) and post-incident activity (forensic and root-cause analysis plus a blameless lessons-learned review that feeds improvements back into preparation).

The smallest domain is also the one that makes the other three matter to the business: turning analysis into clear, actionable communication. For vulnerability management reporting you translate raw scores into context-aware risk, recommend action (patch, compensating control, or accept), and tailor the message to each stakeholder — while naming the real inhibitors to remediation such as SLAs and MOUs, organizational governance, legacy or proprietary systems, business-process interruption, and degrading functionality. For incident-response reporting you identify stakeholders, handle declaration and escalation, and write a report that covers the who / what / when / where / why, the timeline, scope, impact, evidence, and recommendations — coordinating with legal, public relations, and regulatory or law-enforcement bodies as required. Underpinning both are root-cause analysis, lessons learned, and metrics/KPIs like mean time to detect (MTTD) and mean time to respond (MTTR) that quantify program performance and prove improvement over time.