CertiMail checks
SPF lists the senders. DKIM signs the body. DMARC tells receivers what to do when those checks fail.
Study guide · Flashcards & memory notes
CySA+ Flashcards & Memory Notes
40 recall cards for the facts CySA+ (CS0-003) keeps asking you to separate: indicators and tools, vulnerability decisions, incident order, and the clocks in a report.
How to use these cards: Say the answer out loud before you flip the card, and mark it honestly. Revisit the cards you missed tomorrow rather than rereading them right away. Progress is kept only while this page is open. For the full explanations behind each card, see the core notes.
Study mode
Choose a deck, flip each card, and mark what you already know.
You marked every card in this deck as known. Shuffle and run through it again, or choose another deck.
All flashcards
Select a question to reveal its answer.
Deck 1 · Security operations
Indicators, mail checks, and the tools that see them.
1.1What does beaconing indicate?
A regular outbound callback, often command and control. A nightly backup to a known store is not beaconing.
1.2What does a SIEM do?
It collects logs from many systems and correlates them into alerts. SOAR runs the playbook after the alert.
1.3How does EDR differ from a span-port capture?
EDR sees the process, file, and user on the endpoint. A span port sees packets, not which local program sent them.
1.4What is impossible travel?
Two sign-ins too far apart for the time between them. A successful MFA prompt does not clear it.
1.5What do SPF, DKIM, and DMARC each do?
SPF lists senders, DKIM signs the message, and DMARC sets the failure policy.
1.6What is a honeypot?
A decoy used to watch attackers. It is not the payroll database.
1.7What does zero trust reject?
Implicit trust just because a device is on the internal network.
1.8What does a CASB watch?
How people use cloud applications, including ones the company did not approve.
1.9Who is an unintentional insider?
A trusted person who causes harm without meaning to. A supply-chain actor hides in a vendor update.
1.10Which SOC work should be automated?
Repeatable enrichment that does not need judgment. Paying a ransom or briefing the press stays with a person.
Deck 2 · Vulnerability management
Scans, scores, and the bug names.
2.1How does a credentialed scan differ from a non-credentialed scan?
It logs in and can see missing patches. A banner grab that looks clean can be a false negative.
2.2Which is worse, a false positive or a false negative?
A false negative misses a real flaw. A false positive is an alert on something that is not vulnerable.
2.3How do CVSS and priority differ?
CVSS is technical severity. Priority also uses exposure, exploit code, and asset value.
2.4How do reflected and persistent XSS differ?
Reflected XSS returns in the same response. Persistent XSS is stored for later visitors.
2.5What is server-side request forgery?
The server is tricked into fetching a URL the attacker chose. CSRF uses the victim's browser instead.
2.6What stops SQL injection?
Parameterized queries, so data cannot change the statement. Concatenating the username into SQL is the bug.
2.7How do avoid and transfer differ?
Avoid stops the activity. Transfer shifts the impact, often to insurance.
2.8What is a compensating control?
A substitute when the preferred control cannot be used. It still needs an owner and an end date.
2.9Why are SCADA scans treated differently?
Aggressive probes can disrupt fragile industrial processes. Prefer passive discovery and an approved window.
2.10What is a zero-day?
A flaw exploited before the vendor has a patch. An old bug on an unsupported product is end-of-life, not automatically a zero-day.
Deck 3 · Incident response
Models, evidence, and the order of the work.
3.1What are the four vertices of the Diamond Model?
Adversary, capability, infrastructure, and victim.
3.2How do a kill chain and MITRE ATT&CK differ?
A kill chain is a sequence of stages. ATT&CK is a matrix of tactics and techniques.
3.3What does chain of custody record?
Who handled the evidence, and when. A matching hash shows the copy was not altered.
3.4What is a legal hold?
An order to keep data that would otherwise be deleted. It outranks a faster rebuild.
3.5What comes first when ransomware is still encrypting files?
Containment. Eradication, recovery, and lessons learned follow. Do not leave the host on the production VLAN while you image it all day.
3.6What is a tabletop exercise?
A discussion rehearsal of the plan. It does not exploit production systems.
3.7What is re-imaging?
Rebuilding a host from a known-good image. Renaming the malware file is not recovery.
3.8Why capture memory before you power a host off?
Fileless malware may exist only in RAM. Volatile evidence is gone after shutdown.
3.9What do you redo when the same hash appears on a domain controller?
Scope and impact. The incident is larger than the first laptop.
3.10What must lessons learned change?
The playbook and the detections, with an owner. A meeting with no notes leaves the next incident unchanged.
Deck 4 · Reporting
Metrics, inhibitors, and the two audiences.
4.1What is mean time to detect?
How long the incident ran before anyone noticed.
4.2How do mean time to respond and mean time to remediate differ?
Respond is when the work starts. Remediate is when the fix is done. Opening a ticket is not a rebuild.
4.3What does recurrence mean on a vulnerability report?
The same finding is still open, or it came back. Hiding it to keep a chart green falsifies the report.
4.4Name two inhibitors to remediation.
An SLA or MOU, and a legacy or proprietary system that would break. An approved window is not an inhibitor.
4.5What belongs in an executive summary?
What happened, the impact, and the decision leaders need. The packet capture stays in the technical annex.
4.6Who reviews a customer breach notice before it is sent?
Legal, with public relations. An untrue reassurance is worse than a delay.
4.7What does alert volume explain next to a faster MTTD?
The cost of the new detection, especially when most new alerts are false.
4.8What does a vulnerability report list besides the CVE?
Affected hosts, a risk score, the mitigation, recurrence, and the priority.
4.9How do you brief the board and the SOC from one incident?
Same facts, different depth. The board gets impact and a decision. The SOC gets indicators.
4.10When do you escalate a zero-day outside the monthly report?
As soon as internet-facing hosts are exposed. Waiting for the calendar leaves the path open.
Memory notes
Groupings that make the highest-yield CySA+ facts easier to recall.
Scan vision
Credentialed and agent scans see local patches. Passive scans do not probe. A clean non-credentialed report can be a false negative.
Score versus order
CVSS is severity. Patch the exposed, weaponized, valuable host first, even when a lab printer has the bigger number.
Incident order
Prepare, detect, contain, eradicate, recover, learn. Isolate a spreading host before you restore files onto a live network.
Evidence
Memory first if the malware is fileless. Hash the copy. Write down every handoff. Legal hold means you do not wipe the disks to look tidy.
Three clocks
Detect is time to notice. Respond is time to start. Remediate is time to finish. Alert volume explains whether the faster detection buried the team.
Continue the CySA+ study path
Test what you have learned with a timed practice exam.
Overview
Exam format, the 750 passing score, four domain weights, and the CS0-004 retirement dates.
Core Notes
Reference notes for indicators, scanning, incident handling, and the reports leaders expect.
Flashcards & Memory Notes
40 recall cards in four decks, plus memory notes for mail checks, CVSS, and the response clocks.
Practice Exams
200 original questions with custom exams, explanations, and an unofficial score on the 100-900 scale.
Related Tools
Useful companions while you study.
Password Generator
Generate strong random passwords with custom length, characters, symbols, and security options.
Base64 Converter
Encode text and files to Base64 or decode Base64 data with UTF-8 support.
JSON/YAML Converter
Convert structured data between JSON and YAML with formatting and validation.
Time Calculator
Calculate elapsed time, add or subtract hours and minutes, and convert time to decimal hours.
Legal Disclaimer
Certicab provides general informational, educational, and convenience resources. Calculations, conversions, estimates, and learning materials may contain errors or become outdated. Financial, tax, medical, legal, and travel information is not professional advice. Verify important results and current requirements with qualified professionals or authoritative sources. Protect sensitive files and personal information, review each tool’s privacy limitations, and use only content you are authorized to process. You are responsible for how you use and share results. Study resources are independent and do not guarantee exam success or imply certification-provider endorsement. CompTIA and CySA+ are trademarks of CompTIA, Inc. Certicab is not affiliated with, endorsed by, or sponsored by CompTIA.