CompTIA Cybersecurity Analyst (CySA+)

This course prepares learners for the CompTIA CySA+ CS0-004 (V4) exam. The V4 update applies behavioral analytics to combat modern threats through continuous monitoring, incident response, and vulnerability management. It introduces dedicated coverage of artificial intelligence (AI) use cases and risks, modern security architectures used in today’s Security Operations Centers (SOCs), and advanced vulnerability management practices such as SBOM and EPSS-based prioritization.

The CySA+ certification is also DoD 8570/8140 approved, making this course an excellent choice for military, civilian, and contractor personnel who require compliance with Department of Defense cybersecurity workforce standards.

System and Network Architecture Concepts for Secure Operations

Secure operations depend on a foundation of architectural controls that provide visibility, enforce trust, and protect data. Key concepts include:

• Logging and monitoring: Centralized collection of system, application, and network logs to support detection, investigation, and audit requirements.
• Identity and access management: Authentication, authorization, and accounting (AAA) mechanisms, including multifactor authentication (MFA), single sign-on (SSO), and least-privilege access.
• Encryption: Protection of data in transit and at rest using strong cryptographic standards and sound key management practices.
• Modern frameworks:
  • Zero Trust Network Access (ZTNA): Continuously verifies identity and context before granting access, replacing implicit network trust.
  • Secure Access Service Edge (SASE): Converges networking and security services in the cloud to protect distributed users and resources.
  • Cloud-native architecture: Leverages containers, microservices, and orchestration with security integrated into deployment pipelines.

Detecting and Analyzing Indicators of Malicious Activity

Analysts must identify signs of compromise across multiple domains:

• Network: Anomalous traffic patterns, unexpected outbound connections, and command-and-control indicators.
• Endpoints: Suspicious processes, unauthorized software, and abnormal file or registry changes.
• Cloud: Misconfigurations, unusual API calls, and unauthorized resource provisioning.
• Identity systems: Impossible travel, privilege escalation, and abnormal authentication behavior.

Tools and Methods for Determining Malicious Activity

Industry-standard tools support detection and investigation:

• SIEM: Aggregates and correlates log data to surface security events and alerts.
• EDR/XDR: Provides endpoint and extended detection and response across multiple telemetry sources.
• Packet analyzers: Enable deep inspection of network traffic for forensic and detection purposes.
• Threat intelligence platforms: Deliver context on adversary tactics, techniques, and indicators of compromise.

Applying Threat Intelligence and Threat Hunting

Proactive defense combines intelligence and investigation:

• Consume strategic, operational, and tactical threat intelligence to inform defenses.
• Develop and test hypotheses about adversary behavior using frameworks such as MITRE ATT&CK.
• Hunt for threats that evade automated detection by analyzing patterns and anomalies.

Running a Vulnerability Management Program

An effective program follows a repeatable, risk-based cycle:

• Scanning: Regular discovery of assets and identification of vulnerabilities.
• Analysis: Validation of findings to eliminate false positives.
• Prioritization: Ranking vulnerabilities using CVSS for severity and EPSS for exploitation likelihood.
• Risk-based remediation: Addressing vulnerabilities according to business impact and threat context.

Executing the Incident Response Lifecycle

Structured incident response reduces impact and supports recovery:

• Detection: Identifying and validating security incidents.
• Containment: Limiting the spread and impact of the incident.
• Eradication: Removing the threat and its artifacts from the environment.
• Recovery: Restoring systems and services to normal operation.
• Post-incident activities: Conducting lessons-learned reviews and improving controls.

AI in Security Operations

Artificial intelligence introduces both opportunities and risks:

• Use cases: Alert triage, anomaly detection, automation of repetitive tasks, and analyst assistance.
• Security risks: Adversarial attacks, data poisoning, model bias, and misuse of generative tools by attackers.
• Governance considerations: Oversight, transparency, data protection, and accountability for AI-driven decisions.

Vulnerability and Incident Response Reporting

Clear reporting enables informed stakeholder decisions:

• Communicate findings in business-relevant terms with clear risk context.
• Provide actionable recommendations and prioritized remediation guidance.
• Tailor detail and language to technical and executive audiences.
• Support decision-making with metrics, timelines, and impact assessments.