Study guide · Core notes
Reference notes for indicators, hunting, vulnerability decisions, incident handling, and the reports CySA+ keeps asking you to separate.
How to read these notes: Items tagged Extra sit outside the CS0-003 objective bullets, such as AI in the SOC, which CS0-004 adds. Learn the unmarked items first. New to the exam? Start with the overview for the format, the 750 passing score, and the December 22, 2026 English retirement. Control definitions that this exam assumes are on the Security+ notes.
Domain 1 is 33 percent. Name the control plane before you name the product.
| Term | What to remember |
|---|---|
| Log ingestion | Events from many systems, with a logging level you chose on purpose. Time synchronization makes the order trustworthy. |
| Zero trust | Being on the office LAN is not permission. Identity is checked for the request in front of you. |
| SASE | Network access and security policy delivered together at the edge, rather than only at a central firewall. |
| SDN | The decision about forwarding is separated from the devices that move the packets. |
| Segmentation | A blast radius. Unexpected SMB across many subnets means the segment failed. |
| PAM | Powerful accounts are checked out, limited, and recorded. They are not shared passwords in a ticket. |
| CASB | Visibility and policy for cloud applications, including the ones the company did not buy. |
| DLP | Detects or blocks sensitive data, including PII and cardholder data, leaving by an unapproved path. |
Multifactor authentication uses more than one factor. Single sign-on is one authentication reused across applications. Federation lets another organization assert identity. Passwordless removes the memorized secret. None of these erase an impossible-travel alert. A phished second factor still produces a successful logon.
PKI issues and checks certificates. SSL inspection decrypts traffic so a control can see it, then re-encrypts. Inspection that you forgot to exclude will break certificate-pinned applications. It is not a reason to disable TLS.
A virtual machine is a guest on a hypervisor. A container shares the host kernel. Serverless runs a function without a server you patch. The indicator may look the same. The log source does not.
Automate tasks that are repeatable and do not need a person: enrichment, hash lookups, ticket routing. SOAR runs those playbooks. APIs and webhooks connect the tools. A single pane of glass is one view, not one vendor. Combining threat feeds and adding context is enrichment. Deciding to pay a ransom, brief the press, or fire someone is not an automation candidate.
AI use cases, risks, and governance in the SOC are an objective on CS0-004. Extra for CS0-003.
Say which layer you are looking at before you name the malware family.
| Layer | What you might see |
|---|---|
| Network | Bandwidth consumption, beaconing, irregular peer-to-peer traffic, a rogue device, scans and sweeps, traffic spikes, activity on an unexpected port. |
| Host | Processor, memory, or drive consumption. Unauthorized software, privileges, or scheduled tasks. Malicious processes, registry or file-system changes, data leaving the host. |
| Application | New accounts, unexpected output, unexpected outbound calls, a service interruption, and the application log that explains them. |
| Other | Social engineering, and links whose real target is hidden or encoded. |
A regular outbound interval to an unfamiliar host is command and control until you prove it is a management agent. A nightly backup to a known store is not beaconing. Confirm the process, then contain the live channel.
Two authentications that cannot both be physically real in the time between them. A successful MFA prompt does not clear it. Relay and phishing still produce a second factor.
SPF lists which hosts may send for the domain. DKIM signs the message with a domain key. DMARC tells receivers what to do when SPF or DKIM fails, and it can send you a report. Check the header and the real href before anyone clicks.
Match the tool to the question you are asking. A scanner does not replace a packet capture.
| Job | Examples |
|---|---|
| Packet capture | Wireshark for interactive analysis. tcpdump on the command line. |
| Log correlation | A SIEM. SOAR when the next steps are a playbook. |
| Endpoint | EDR for process, file, and user context a span port cannot see. |
| Reputation | WHOIS for a domain's registration. AbuseIPDB for an IP's reputation. |
| File analysis | Strings for readable text without execution. A hash lookup such as VirusTotal. A sandbox such as Cuckoo or Joe Sandbox when you must run it. |
| User behavior | Abnormal account activity and impossible travel. UEBA is the acronym for the analytics that flag them. |
Scripting shows up as JSON and XML logs, Python, PowerShell, shell, and regular expressions. An encoded PowerShell command launched by Word is a suspicious command, not a normal update. Detonate samples in a sandbox, not on a domain controller.
A feed is not a detection until you judge it and apply it.
| Actor | Usual clue |
|---|---|
| Advanced persistent threat | Skill and patience. The intrusion stays quiet and returns. |
| Nation-state | Funding and a strategic goal, often espionage or disruption. |
| Organized crime | Money. Ransomware and fraud are typical. |
| Hacktivist | A political or social cause. |
| Script kiddie | Low skill, ready-made tools. |
| Insider | Someone who already has access. The harm may be deliberate or a mistake. |
| Supply chain | The backdoor arrives inside a vendor update or a trusted package. |
Score a report on timeliness, relevancy, and accuracy. A six-month-old domain indicator is weak if the name was re-registered. A paid feed that matches an internal incident outranks a long blog post.
Open source includes social media, blogs, government bulletins, CERT and CSIRT publications, and the deep or dark web. Closed source includes paid feeds, information-sharing organizations, and your own incidents. Share outward only when the agreement and counsel allow it.
An indicator of compromise is collected, analyzed, then applied in a detection. Start with misconfigurations, isolated networks, and business-critical assets. A honeypot is a decoy for active defense. It is not the payroll database.
Domain 2 is 30 percent. A clean banner grab is not a clean host.
| Choice | What changes |
|---|---|
| Credentialed | Logs in and sees patches, software, and local settings. Non-credentialed sees mostly banners and open ports. |
| Agent | Software on the host reports in. Agentless reaches in from the scanner, which a firewall may block. |
| Passive | Watches traffic or telemetry and does not probe. Active sends packets. Fuzzing is active and dynamic. |
| Static and dynamic | Static reviews code or binaries without running them. Dynamic runs them. Reverse engineering and fuzzing sit on the dynamic side. |
| Internal and external | External is what the internet sees. Internal is what an attacker who is already inside sees. |
| OT, ICS, SCADA | Fragile. Prefer passive discovery and a vendor-approved window. An IT-style scan can stop a process. |
Also schedule for performance, sensitivity, segmentation, and regulatory needs. PCI DSS, CIS benchmarks, OWASP, and the ISO 27000 series are the frameworks the objectives name. Tools in the assessment list include Nessus and OpenVAS, Burp Suite, ZAP, Nikto, and Arachni, Nmap, Metasploit, and Recon-ng, Angry IP Scanner and Maltego, and the cloud tools Scout Suite, Prowler, and Pacu. Debuggers named there are Immunity and GDB.
A score is not a work order.
| Input | Question it answers |
|---|---|
| Attack vector and complexity | How the attacker reaches the flaw, and how hard the conditions are. |
| Privileges and user interaction | Whether an account is required, and whether a person must click or open something. |
| Scope and impact | Whether the impact crosses a security boundary, and what happens to confidentiality, integrity, and availability. |
| Validation | True or false positive, true or false negative. A miss is worse than noise. |
| Context | Internal, external, or isolated. Exploit code. Asset value. A zero-day has no vendor patch yet. |
Patch by testing, implementing, rolling back if the service fails, and validating the flaw is gone. Use a maintenance window. An exception needs an owner, a compensating control, and an end date. Risk treatments are accept, transfer, avoid, and mitigate. Deleting the ticket is none of those.
Managerial, operational, and technical describe where the control lives. Preventative, detective, responsive, and corrective describe what it does in time. A compensating control stands in when the preferred fix cannot be applied. The objectives spell preventative with that extra syllable. Use their word on the exam.
Edge discovery, passive discovery, control testing, penetration testing, adversary emulation, and bug bounty are ways you learn the surface. Reduction means removing the unused page, not putting a second copy of it on another port.
Name the bug by what the input does, then name the secure-coding fix.
| Flaw | Pattern |
|---|---|
| Reflected XSS | The script returns in the response to the request that sent it. |
| Persistent XSS | The script is stored and runs for a later visitor. Encode output. |
| SQL injection | Input changes the query. Parameterized queries keep data out of the statement. |
| CSRF | The victim's browser submits a request using a session they already have. |
| SSRF | The server fetches a URL the attacker chose, sometimes the cloud metadata address. |
| Directory traversal | ../ leaves the intended folder. LFI reads a local file. RFI pulls a remote one. |
| Overflows | Buffer, integer, heap, and stack. The write or the number goes past the type. |
| Access and auth | Broken access control, authentication failures, privilege escalation, remote code execution. |
| Design and age | Insecure design, security misconfiguration, cryptographic failure, end-of-life components, data poisoning. |
Threat modeling and a secure SDLC are how those bugs are supposed to be found before the scanner does. A crash in a dynamic test beats a static review that said the function was safe.
Domain 3 is 20 percent. Use the model that matches the question.
| Framework | Shape |
|---|---|
| Cyber kill chain | Stages in order. A common chain runs from reconnaissance through weaponization, delivery, exploitation, installation, command and control, and actions on objectives. |
| Diamond Model | Four vertices: adversary, capability, infrastructure, and victim. |
| MITRE ATT&CK | A matrix of tactics and techniques. Not a single straight line. |
| OSSTMM | A security testing methodology. |
| OWASP Testing Guide | A way to test web applications, paired here with incident and attack methods rather than with the scanner list. |
An attack that is still encrypting files gets contained before it gets a long forensic write-up on the production VLAN.
| Phase | What you actually do |
|---|---|
| Preparation | The plan, tools, playbooks, tabletops, training, and business continuity or disaster recovery. |
| Detection and analysis | Indicators, log review, and evidence: chain of custody, integrity hashes, preservation, and legal hold. |
| Containment | Scope, impact, and isolation. Cut off the active channel without destroying the only copy of memory. |
| Eradication and recovery | Remove the access and the malware. Re-image from a known-good build. Restore backups you have tested. Add a compensating control if the patch must wait. |
| Post-incident | Forensic analysis, root-cause analysis, and lessons learned that change the playbook. |
Volatile evidence, especially memory, is captured before power is lost. Fileless malware may exist only in RAM. If the same hash appears on a domain controller, the scope is wrong and you redo it. Declaration and escalation follow the plan. Paying a ransom is not a required step.
Domain 4 is 17 percent. Change the depth for the audience. Do not change the facts.
| Product | It must include |
|---|---|
| Vulnerability report | The flaws, affected hosts, a risk score, the mitigation, recurrence, and the priority. |
| Action plan | Configuration changes, patches, compensating controls, training, and business requirements that moved. |
| Inhibitors | An MOU, an SLA, governance, a process that would stop, a feature that would break, a legacy system, or a proprietary system. |
| Vulnerability KPIs | Trends, a top 10, critical items and zero-days, and service-level objectives. |
| Incident report | An executive summary, who, what, when, where, and why, recommendations, a timeline, impact, scope, and evidence. |
| Incident KPIs | Mean time to detect, mean time to respond, mean time to remediate, and alert volume. Do not collapse the first three into one undefined MTTR. |
Identify stakeholders before you send the note. Legal reviews customer and media language. Regulatory clocks, such as a 72-hour notice, are their own path. Law enforcement is called when the plan and counsel say the case meets the threshold. A reassuring sentence you have not verified is worse than silence.
Mean time to detect ends when someone notices. Mean time to respond ends when the response starts. Mean time to remediate ends when the fix is done. Opening a ticket in five seconds is not a 30-day rebuild.
A compliance report shows the scans, the exceptions, and the approvals. It is not a slogan. Recurrence belongs on the page even when it makes the chart worse.
No. They are an original summary of the public CS0-003 objectives, version 4.0. Confirm the current PDF with CompTIA before you book.
Extra marks a useful idea the CS0-003 objective bullets do not name, such as using AI in the SOC. That topic is on CS0-004. Learn the unmarked items first.
Containment before eradication and recovery. Preparation comes before the incident. Lessons learned, root-cause analysis, and forensic analysis are post-incident work.
Turn the tables into recall, then test them.
Exam format, the 750 passing score, four domain weights, and the CS0-004 retirement dates.
Reference notes for indicators, scanning, incident handling, and the reports leaders expect.
40 recall cards in four decks, plus memory notes for mail checks, CVSS, and the response clocks.
200 original questions with custom exams, explanations, and an unofficial score on the 100-900 scale.
Useful companions while you study.
Generate strong random passwords with custom length, characters, symbols, and security options.
Encode text and files to Base64 or decode Base64 data with UTF-8 support.
Convert structured data between JSON and YAML with formatting and validation.
Calculate elapsed time, add or subtract hours and minutes, and convert time to decimal hours.
Certicab provides general informational, educational, and convenience resources. Calculations, conversions, estimates, and learning materials may contain errors or become outdated. Financial, tax, medical, legal, and travel information is not professional advice. Verify important results and current requirements with qualified professionals or authoritative sources. Protect sensitive files and personal information, review each tool’s privacy limitations, and use only content you are authorized to process. You are responsible for how you use and share results. Study resources are independent and do not guarantee exam success or imply certification-provider endorsement. CompTIA and CySA+ are trademarks of CompTIA, Inc. Certicab is not affiliated with, endorsed by, or sponsored by CompTIA.
Certi