CompTIA Cybersecurity

Analyst (CySA+)
Certification Exam
Objectives
EXAM NUMBER: CS0-001
 About the Exam
The CompTIA Cybersecurity Analyst (CySA+) certification is a vendor-neutral credential. The CompTIA
CySA+ exam is an internationally targeted validation of intermediate-level security skills and knowledge.
While there is no required prerequisite, the CompTIA CySA+ certification is intended to follow CompTIA
Security+ or equivalent experience and has a technical, “hands-on” focus on IT security analytics.
The CompTIA CySA+ examination is designed for IT security analysts, vulnerability analysts,
or threat intelligence analysts. The exam will certify that the successful candidate has the
knowledge and skills required to configure and use threat detection tools, perform data analysis
and interpret the results to identify vulnerabilities, threats, and risks to an organization with the
end goal of securing and protecting applications and systems within an organization.
It is recommended for CompTIA CySA+ certification candidates to have the following:
• 3-4 years of hands-on information security or related experience
• Network+, Security+, or equivalent knowledge

CompTIA AUTHORIZED MATERIALS USE POLICY

CompTIA Certifications, LLC is not affiliated with and does not authorize, endorse or condone utilizing any
content provided by unauthorized third-party training sites (aka “brain dumps”). Individuals who utilize
such materials in preparation for any CompTIA examination will have their certifications revoked and be
suspended from future testing in accordance with the CompTIA Candidate Agreement. In an effort to more
clearly communicate CompTIA’s exam policies on use of unauthorized study materials, CompTIA directs
all certification candidates to the CompTIA Certification Exam Policies. Please review all CompTIA policies
before beginning the study process for any CompTIA exam. Candidates will be required to abide by the
CompTIA Candidate Agreement. If a candidate has a question as to whether study materials are considered
unauthorized (aka “brain dumps”), he/she should contact CompTIA at examsecurity@comptia.org to confirm.

PLEASE NOTE
The lists of examples provided in bulleted format are not exhaustive lists. Other examples of
technologies, processes or tasks pertaining to each objective may also be included on the exam
although not listed or covered in this objectives document. CompTIA is constantly reviewing the
content of our exams and updating test questions to be sure our exams are current and the security
of the questions is protected. When necessary, we will publish updated exams based on existing
exam objectives. Please know that all related exam preparation materials will still be valid. y

CompTIA Cybersecurity Analyst (CySA+) Certification Exam Objectives Version 3.0

 TEST DETAILS
Required exam CS0-001
Number of questions Maximum of 85
Types of questions Multiple choice and performance-based
Length of test 165 Minutes
Recommended experience Network+, Security+, or equivalent knowledge.
Minimum of 3-4 years of hands-on information security or
related experience. While there is no required prerequisite,
CySA+ is intended to follow CompTIA Security+ or equivalent
experience and has a technical, “hands-on” focus.
Passing score 750 (on a scale of 100–900)

EXAM OBJECTIVES (DOMAINS)

The table below lists the domains measured by this examination and the extent to
which they are represented. The CompTIA CySA+ exam is based on these objectives.

DOMAIN PERCENTAGE OF EXAMINATION

1.0 Threat Management 27%

2.0 Vulnerability Management 26%
3.0 Cyber Incident Response 23%
4.0 Security Architecture and Tool Sets 24%
Total 100%

CompTIA Cybersecurity Analyst (CySA+) Certification Exam Objectives Version 3.0

 1.0 Threat Management
1.1 Given a scenario, apply environmental reconnaissance
techniques using appropriate tools and processes.
• Procedures/common tasks - DNS harvesting - Network mapping
- Topology discovery - Phishing - NETSTAT
- OS fingerprinting • Variables - Packet analyzer
- Service discovery - Wireless vs. wired - IDS/IPS
- Packet capture - Virtual vs. physical - HIDS/NIDS
- Log review - Internal vs. external - Firewall rule-based and logs
- Router/firewall ACLs review - On-premises vs. cloud - Syslog
- Email harvesting • Tools - Vulnerability scanner
- Social media profiling - NMAP
- Social engineering - Host scanning

1.2 Given a scenario, analyze the results of a network reconnaissance.

• Point-in-time data analysis - Heuristic analysis • Tools
- Packet analysis - Behavioral analysis - SIEM
- Protocol analysis • Data output - Packet analyzer
- Traffic analysis - Firewall logs - IDS
- Netflow analysis - Packet captures - Resource monitoring tool
- Wireless analysis - NMAP scan results - Netflow analyzer
• Data correlation and analytics - Event logs
- Anomaly analysis - Syslogs
- Trend analysis - IDS report
- Availability analysis

CompTIA Cybersecurity Analyst (CySA+) Certification Exam Objectives Version 3.0

 1.0 Threat Management

1.3 Given a network-based threat, implement or recommend

the appropriate response and countermeasure.
• Network segmentation • Hardening
- System isolation - Mandatory Access Control (MAC)
- Jump box - Compensating controls
• Honeypot - Blocking unused ports/services
• Endpoint security - Patching
• Group policies • Network Access Control (NAC)
• ACLs - Time-based
- Sinkhole - Rule-based
- Role-based
- Location-based

1.4 Explain the purpose of practices used to secure a corporate environment.

• Penetration testing • Training and exercises
- Rules of engagement - Red team
- Timing - Blue team
- Scope - White team
- Authorization • Risk evaluation
- Exploitation - Technical control review
- Communication - Operational control review
- Reporting - Technical impact and likelihood
• Reverse engineering - High
- Isolation/sandboxing - Medium
- Hardware - Low
- Source authenticity of hardware
- Trusted foundry
- OEM documentation
- Software/malware
- Fingerprinting/hashing
- Decomposition

CompTIA Cybersecurity Analyst (CySA+) Certification Exam Objectives Version 3.0

 2.0 Vulnerability Management
2.1 Given a scenario, implement an information security
vulnerability management process.
• Identification of requirements • Configure tools to perform scans • Remediation
- Regulatory environments according to specification - Prioritizing
- Corporate policy - Determine scanning criteria - Criticality
- Data classification - Sensitivity levels - Difficulty of implementation
- Asset inventory - Vulnerability feed - Communication/change control
- Critical - Scope - Sandboxing/testing
- Non-critical - Credentialed vs. non-credentialed - Inhibitors to remediation
• Establish scanning frequency - Types of data - MOUs
- Risk appetite - Server-based vs. agent-based - SLAs
- Regulatory requirements - Tool updates/plug-ins - Organizational governance
- Technical constraints - SCAP - Business process interruption
- Workflow - Permissions and access - Degrading functionality
• Execute scanning • Ongoing scanning and
• Generate reports continuous monitoring
- Automated vs. manual distribution

2.2 Given a scenario, analyze the output resulting

from a vulnerability scan.
• Analyze reports from a vulnerability scan • Validate results and correlate
- Review and interpret scan results other data points
- Identify false positives - Compare to best
- Identify exceptions practices or compliance
- Prioritize response actions - Reconcile results
- Review related logs and/
or other data sources
- Determine trends

2.3 Compare and contrast common vulnerabilities found

in the following targets within an organization.
• Servers - Virtual hosts • Virtual Private Networks (VPNs)
• Endpoints - Virtual networks • Industrial Control Systems (ICSs)
• Network infrastructure - Management interface • SCADA devices
• Network appliances • Mobile devices
• Virtual infrastructure • Interconnected networks

CompTIA Cybersecurity Analyst (CySA+) Certification Exam Objectives Version 3.0

 3.0 Cyber Incident Response
3.1 Given a scenario, distinguish threat data or behavior
to determine the impact of an incident.
• Threat classification - Recovery time - Payment card information
- Known threats vs. unknown threats - Data integrity - Intellectual property
- Zero day - Economic - Corporate confidential
- Advanced persistent threat - System process criticality - Accounting data
• Factors contributing to incident - Types of data - Mergers and acquisitions
severity and prioritization - Personally Identifiable
- Scope of impact Information (PII)
- Downtime - Personal Health Information (PHI)

3.2 Given a scenario, prepare a toolkit and use appropriate

forensics tools during an investigation.
• Forensics kit - Tamper-proof seals - Analysis utilities
- Digital forensics workstation - Documentation/forms - Chain of custody
- Write blockers - Chain of custody form - Hashing utilities
- Cables - Incident response plan - OS and process analysis
- Drive adapters - Incident form - Mobile device forensics
- Wiped removable media - Call list/escalation list - Password crackers
- Cameras • Forensic investigation suite - Cryptography tools
- Crime tape - Imaging utilities - Log viewers

3.3 Explain the importance of communication

during the incident response process.
• Stakeholders • Purpose of communication processes • Role-based responsibilities
- HR - Limit communication - Technical
- Legal to trusted parties - Management
- Marketing - Disclosure based on regulatory/ - Law enforcement
- Management legislative requirements - Retain incident response provider
- Prevent inadvertent
release of information
- Secure method of communication

CompTIA Cybersecurity Analyst (CySA+) Certification Exam Objectives Version 3.0

 3.0 Cyber Incident Response

3.4 Given a scenario, analyze common symptoms to select the

best course of action to support incident response.
• Common network-related symptoms • Common host-related symptoms
- Bandwidth consumption - Processor consumption
- Beaconing - Memory consumption
- Irregular peer-to-peer communication - Drive capacity consumption
- Rogue devices on the network - Unauthorized software
- Scan sweeps - Malicious processes
- Unusual traffic spikes - Unauthorized changes
- Unauthorized privileges
- Data exfiltration
• Common application-related symptoms
- Anomalous activity
- Introduction of new accounts
- Unexpected output
- Unexpected outbound
communication
- Service interruption
- Memory overflows

3.5 Summarize the incident recovery and post-incident response process.

• Containment techniques • Validation • Corrective actions
- Segmentation - Patching - Lessons learned report
- Isolation - Permissions - Change control process
- Removal - Scanning - Update incident response plan
- Reverse engineering - Verify logging/communication • Incident summary report
• Eradication techniques to security monitoring
- Sanitization
- Reconstruction/reimage
- Secure disposal

CompTIA Cybersecurity Analyst (CySA+) Certification Exam Objectives Version 3.0

 4.0 Security Architecture and Tool Sets
4.1 Explain the relationship between frameworks,
common policies, controls, and procedures.
• Regulatory compliance - Data retention policy - Patching
• Frameworks - Account management policy - Compensating control development
- NIST - Data classification policy - Control testing procedures
- ISO • Controls - Manage exceptions
- COBIT - Control selection based on criteria - Remediation plans
- SABSA - Organizationally defined parameters • Verifications and quality control
- TOGAF - Physical controls - Audits
- ITIL - Logical controls - Evaluations
• Policies - Administrative controls - Assessments
- Password policy • Procedures - Maturity model
- Acceptable use policy - Continuous monitoring - Certification
- Data ownership policy - Evidence production

4.2 Given a scenario, use data to recommend remediation of

security issues related to identity and access management.
• Security issues associated with • Security issues associated • Exploits
context-based authentication with identity repositories - Impersonation
- Time - Directory services - Man-in-the-middle
- Location - TACACS+ - Session hijack
- Frequency - RADIUS - Cross-site scripting
- Behavioral • Security issues associated with - Privilege escalation
• Security issues associated with identities federation and single sign-on - Rootkit
- Personnel - Manual vs. automatic
- Endpoints provisioning/deprovisioning
- Servers - Self-service password reset
- Services
- Roles
- Applications

CompTIA Cybersecurity Analyst (CySA+) Certification Exam Objectives Version 3.0

 4.0 Security Architecture and Tool Sets

4.3 Given a scenario, review security architecture and make

recommendations to implement compensating controls.
• Security data analytics • Defense in depth - Technologies
- Data aggregation and correlation - Personnel - Automated reporting
- Trend analysis - Training - Security appliances
- Historical analysis - Dual control - Security suites
• Manual review - Separation of duties - Outsourcing
- Firewall log - Third party/consultants - Security as a Service
- Syslogs - Cross training - Cryptography
- Authentication logs - Mandatory vacation - Other security concepts
- Event logs - Succession planning - Network design
- Processes - Network segmentation
- Continual improvement
- Scheduled reviews
- Retirement of processes

4.4 Given a scenario, use application security best practices while

participating in the Software Development Life Cycle (SDLC).

• Best practices during • Secure coding best practices

software development - OWASP
- Security requirements definition - SANS
- Security testing phases - Center for Internet Security
- Static code analysis - System design recommendations
- Web app vulnerability scanning - Benchmarks
- Fuzzing
- Use interception proxy
to crawl application
- Manual peer reviews
- User acceptance testing
- Stress test application
- Security regression testing
- Input validation

CompTIA Cybersecurity Analyst (CySA+) Certification Exam Objectives Version 3.0

 4.0 Security Architecture and Tool Sets

4.5 Compare and contrast the general purpose and reasons

for using various cybersecurity tools and technologies.
(**The intent of this objective is NOT to test specific vendor feature sets.)

• Preventative - Packet capture • Exploit

- IPS - Wireshark - Interception proxy
- Sourcefire - tcpdump - Burp Suite
- Snort - Network General - Zap
- Bro - Aircrack-ng - Vega
- HIPS - Command line/IP utilities - Exploit framework
- Firewall - netstat - Metasploit
- Cisco - ping - Nexpose
- Palo Alto - tracert/traceroute - Fuzzers
- Check Point - ipconfig/ifconfig - Untidy
- Antivirus - nslookup/dig - Peach Fuzzer
- Anti-malware - Sysinternals - Microsoft SDL File/Regex Fuzzer
- EMET - OpenSSL • Forensics
- Web proxy - IDS/HIDS - Forensic suites
- Web Application Firewall (WAF) - Bro - EnCase
- ModSecurity • Analytical - FTK
- NAXSI - Vulnerability scanning - Helix
- Imperva - Qualys - Sysinternals
• Collective - Nessus - Cellebrite
- SIEM - OpenVAS - Hashing
- ArcSight - Nexpose - MD5sum
- QRadar - Nikto - SHAsum
- Splunk - Microsoft Baseline - Password cracking
- AlienVault Security Analyzer - John the Ripper
- OSSIM - Monitoring tools - Cain & Abel
- Kiwi Syslog - MRTG - Imaging
- Network scanning - Nagios - DD
- NMAP - SolarWinds
- Vulnerability scanning - Cacti
- Qualys - NetFlow Analyzer
- Nessus - Interception proxy
- OpenVAS - Burp Suite
- Nexpose - Zap
- Nikto - Vega
- Microsoft Baseline
Security Analyzer

CompTIA Cybersecurity Analyst (CySA+) Certification Exam Objectives Version 3.0

CompTIA Cybersecurity Analyst (CySA+)
Acronym List
The following is a list of acronyms that appear on the CompTIA
CySA+ exam. Candidates are encouraged to review the complete
list and attain a working knowledge of all listed acronyms as a
part of a comprehensive exam preparation program.
ACRONYM SPELLED OUT ACRONYM SPELLED OUT
ACL Access Control List PCA Prinicpal Component Analysis
ARP Address Resolution Protocol PCI Payment Card Industry
BYOD Bring Your Own Device PHI Protected Health Information
CIS Center for Internet Security PII Personally Identifiable Information
CoBiT Control Objectives for RACI Responsible, Accountable,
Information and Related Technology Consulted and Informed
CCTV Closed-Circuit Television RADIUS Remote Authentication Dial-In User Service
CRM Customer Relations Management SABSA Sherwood Applied Business Security Architecture
DDoS Distributed Denial of Service SANS System Administration,
DNS Domain Name Service Networking, and Security Institute
EMET Enhanced Mitigation Experience Toolkit SCADA Supervisory Control and Data Acquisition
FISMA Federal Information Security Management Act SCAP Security Content Automation Protocol
FTK Forensic Tool Kit SDLC Software Development Life Cycle
FTP File Transfer Protocol SEO Search Engine Optimization
HBSS Host Based Security System SHA Secure Hash Algorithm
HIDS Host Intrusion Detection System SIEM Security Incident and Event Manager
HIPS Host Intrusion Prevention System SLA Service Level Agreement
HR Human Resources SOC Security Operations Center
ICS Industrial Control Systems SPF Sender Policy Framework
IDS Intrusion Detection System SSH Secure Shell
IMAP Internet Message Access Protocol SSL Secure Sockets Layer
IOC Indicator of Compromise TACACS+ Terminal Access Controller
IPS Intrusion Prevention System Access Control System Plus
ISO International Organization for Standardization TFTP Trivial File Transfer Protocol
ITIL Information Technology Infrastructure Library TLS Transport Layer Security
LDAP Lightweight Directory Access Protocol TOGAF The Open Group Architecture Framework
MAC Mandatory Access Control USB Universal Serial Bus
MD5 Message Digest 5 VAS Vulnerability Assessment System
MOA Memorandum Of Agreement VDI Virtual Desktop Infrastructure
MOU Memorandum Of Understanding VLAN Virtual Local Area Network
MRTG Multi Router Traffic Grapher VPN Virtual Private Network
NAC Network Access Control WAF Web Application Firewall
NAXSI Nginx Anti XSS & SQL Injection
NIC Network Interface Card
NIDS Network Intrusion Detection System
NIST National Institute of Standards & Technology
OEM Original Equipment Manufacturer
OSSIM Open Source Security Information Management
OWASP Open Web Application Security Project
PAM Pluggable Authentication Module

CompTIA Cybersecurity Analyst (CySA+) Certification Exam Objectives Version 3.0

Suggested Classroom Equipment
for CySA+ Certification Training
CompTIA has included this sample list of hardware and software to assist
candidates as they prepare for the CySA+ exam. This list may also be helpful
for training companies who wish to create a lab component for their training
offering. The bulleted lists below each topic are a sample list and not exhaustive.
IT HARDWARE CONSUMABLES
• Router • Cat 5/6 cables
• Switch • Spare drives/flash drives
• Firewall
• Workstations/laptops SOFTWARE
• IDS/IPS • Virtualization platform
• Servers • Kali Linux/BackTrack
• Write blocker • Virtualized attack targets
• Pelican cases - Web servers
• Wireless access point - Database servers
• Drive adapters - Time servers
• VoIP phone - DNS servers
• Mobile phone - PC workstations

TOOLS
• Screw driver
• PC service toolkit

© 2017 CompTIA Properties, LLC, used under license by CompTIA Certifications, LLC. All rights reserved. All certification programs and education related to such
programs are operated exclusively by CompTIA Certifications, LLC. CompTIA is a registered trademark of CompTIA Properties, LLC in the U.S. and internationally.
Other brands and company names mentioned herein may be trademarks or service marks of CompTIA Properties, LLC or of their respective owners. Reproduction
or dissemination prohibited without written consent of CompTIA Properties, LLC. Printed in the U.S. 03263B-Jan2017