Scroll to top button

CompTIA Cybersecurity Analyst (CySA+)

ISBN : 9781616919696

Prepare for the CompTIA CySA+ CS0-001 certification exam with the Cybersecurity Analyst (CySA+) course and lab. The lab simulates real-world, hardware, software, and command-line interface environments and can be mapped to any text-book, course or training. The CompTIA Cybersecurity Analyst (CySA+) cert guide focuses on all the objectives of the CS0-001 exam and is designed for IT security analysts, vulnerability analysts, or threat intelligence analysts to configure and use threat detection tools, and perform data analysis.

The CompTIA Cybersecurity Analyst (CySA+) certification is an international, vendor-neutral credential that covers applying behavioral analytics to improve the overall state of IT security. The CompTIA CySA+ certification validates the critical knowledge and skills that are required to prevent, detect, and combat cybersecurity threats. It also teaches you how to interpret the reports to protect an organization by identifying vulnerabilities, threats, and risks.

Glossary of terms
Pre Assessment Questions
Full Length Tests
Post Assessment Questions
Performance lab
Learn the real world skills using LiveLab.
Exam related FAQs
What are the prerequisites for this exam? There is no required prerequisite for CompTIA CS0-001 certification exam, but the candidate should hold CompTIA Network+, Security+ or equivalent knowledge. He or she should have a minimum of 3-4 years of hands-on information security or related experience.
What is the exam registration fee? USD 346
Where do I take the exam? Pearson VUE
What is the format of the exam? Multiple-choice and performance-based
How many questions are asked in the exam? The exam contains 85 questions.
What is the duration of the exam? 165 minutes
What is the passing score? 750

(on a scale of 0-900)

What is the exam's retake policy?

In the event that you fail your first attempt at passing the CySA+ examination, CompTIA's retake policies are:

  1. CompTIA does not require a waiting period between the first and second attempt to pass such examination. However, if you need a third or subsequent attempt to pass the examination, you shall be required to wait for a period of at least 14 calendar days from the date of your last attempt before you can retake the exam.
  2. If a candidate has passed an exam, he/she cannot take it again without prior consent from CompTIA.
  3. A test result found to be in violation of the retake policy will not be processed, which will result in no credit awarded for the test taken. Repeat violators will be banned from participation in the CompTIA Certification Program.
  4. Candidates must pay the exam price each time they attempt the exam. CompTIA does not offer free re-tests or discounts on retakes.
What is the validity of the certification? CompTIA CySA+ certification expires after three years from the date of issue, after which the certification holder will need to renew their certification via CompTIA's Continuing Education Program.
Where can I find more information about this exam? To know more about the CS0-001-complete, click here.
Which certification covers this exam?
What are the career opportunities after passing this exam?
  • Security Analyst
  • Vulnerability Analyst
  • Cybersecurity Specialist
  • Threat Intelligence Analyst
  • Security Operations Center (SOC) Analyst
  • TOPIC A: Identify the Importance of Risk Management
  • TOPIC B: Assess Risk
  • TOPIC C: Mitigate Risk
  • TOPIC D: Integrate Documentation into Risk Management
  • Summary
  • TOPIC A: Classify Threats and Threat Profiles
  • TOPIC B: Perform Ongoing Threat Research
  • Summary
  • TOPIC A: Implement Threat Modeling
  • TOPIC B: Assess the Impact of Reconnaissance Incidents
  • TOPIC C: Assess the Impact of Social Engineering
  • Summary
  • TOPIC A: Assess the Impact of System Hacking Attacks
  • TOPIC B: Assess the Impact of Web-Based Attacks
  • TOPIC C: Assess the Impact of Malware
  • TOPIC D: Assess the Impact of Hijacking and Impersonation Attacks
  • TOPIC E: Assess the Impact of DoS Incidents
  • TOPIC F: Assess the Impact of Threats to Mobile Security
  • TOPIC G: Assess the Impact of Threats to Cloud Security
  • Summary
  • TOPIC A: Assess Command and Control Techniques
  • TOPIC B: Assess Persistence Techniques
  • TOPIC C: Assess Lateral Movement and Pivoting Techniques
  • TOPIC D: Assess Data Exfiltration Techniques
  • TOPIC E: Assess Anti-Forensics Techniques
  • Summary
  • TOPIC A: Implement a Vulnerability Management Plan
  • TOPIC B: Assess Common Vulnerabilities
  • TOPIC C: Conduct Vulnerability Scans
  • Summary
  • TOPIC A: Conduct Penetration Tests on Network Assets
  • TOPIC B: Follow Up on Penetration Testing
  • Summary
  • TOPIC A: Deploy a Security Intelligence Collection and Analysis Platform
  • TOPIC B: Collect Data from Network-Based Intelligence Sources
  • TOPIC C: Collect Data from Host-Based Intelligence Sources
  • Summary
  • TOPIC A: Use Common Tools to Analyze Logs
  • TOPIC B: Use SIEM Tools for Analysis
  • TOPIC C: Parse Log Files with Regular Expressions
  • Summary
  • TOPIC A: Analyze Incidents with Windows-Based Tools
  • TOPIC B: Analyze Incidents with Linux-Based Tools
  • TOPIC C: Analyze Malware
  • TOPIC D: Analyze Indicators of Compromise
  • Summary
  • TOPIC A: Deploy an Incident Handling and Response Architecture
  • TOPIC B: Mitigate Incidents
  • TOPIC C: Prepare for Forensic Investigation as a CSIRT
  • Summary
  • TOPIC A: Apply a Forensic Investigation Plan
  • TOPIC B: Securely Collect and Analyze Electronic Evidence
  • TOPIC C: Follow Up on the Results of an Investigation
  • Summary
  • TOPIC A: Remediate Identity and Access Management Issues
  • TOPIC B: Implement Security During the SDLC
  • Summary
  • TOPIC A: List of Security Resources
  • TOPIC A: Summary of U.S. Department of Defense Operational Security Practices

Hands on Activities (Labs)

  • Adding revision to the revision history
  • Viewing and downloading the policy templates
  • Opening the policy template and setting the company name
  • Reviewing and modifying the policy items
  • Identifying the most significant emerging technologies of 2016
  • Consulting a vulnerability database
  • Finding information security blogs
  • Performing reconnaissance on a network
  • Installing Wireshark and WinPcap
  • Acquainting yourself with Wireshark's interface
  • Analyzing the capture file to find the attack(s)
  • Generating network traffic and using filter
  • Examining the traffic between client and server
  • Assessing the impact of malware
  • Confirming the spoofing attack in Wireshark
  • Identifying security apps available for Android
  • Examining the DDOS_Attack.pcap file
  • Downloading and running scanning tools
  • Conducting vulnerability scans
  • Identifying search options in Metasploit
  • Performing initial scan
  • Collecting network-based security intelligence
  • Exporting your Windows logs
  • Making syslog entries readable
  • Installing Splunk on the server
  • Manipulating Kali Linux VM's network interfaces
  • Retrieving a real-time list of running processes
  • Starting a live packet capture
  • Examining the ipconfig options and creating the activity log
  • Initiating an SSH session from your Windows 10 client to your Windows Server
  • Using Process Explorer to view specific details about running processes on the system
  • Acquiring the Trojan horse simulator
  • Accessing remotely the DT_Watch folder to generate audit logs
  • Uploading the Trojan horse simulator to VirusTotal
  • Uploading the Trojan horse simulator to Malwr
  • Identifying a suspicious account on the System User Groups
  • Enabling auditing of the DT_Watch folder
  • Examining the audited events
  • Enabling logging for audited objects
  • Implementing security during the SDLC