KEMBAR78
CompTIA CySA Study Notes | PDF | Crime Prevention | Security
Scribd
Upload
293 views3 pages

CompTIA CySA Study Notes

The document provides detailed study notes for the CompTIA CySA+ (CS0-003) exam, covering key topics such as threat and vulnerability management, security operations, incident response, tools and techniques, security architecture, governance, risk, compliance, and reporting metrics. It includes specific examples of vulnerabilities, incident response phases, and various security frameworks. Additionally, it highlights the importance of monitoring, detection, and effective reporting in cybersecurity practices.

Uploaded by

Sugam Sinha
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
293 views3 pages

CompTIA CySA Study Notes

The document provides detailed study notes for the CompTIA CySA+ (CS0-003) exam, covering key topics such as threat and vulnerability management, security operations, incident response, tools and techniques, security architecture, governance, risk, compliance, and reporting metrics. It includes specific examples of vulnerabilities, incident response phases, and various security frameworks. Additionally, it highlights the importance of monitoring, detection, and effective reporting in cybersecurity practices.

Uploaded by

Sugam Sinha
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 3

CompTIA CySA+ (CS0-003) Detailed Study Notes

1. Threat and Vulnerability Management

- SQL Injection: A technique that injects SQL commands via input fields. Mitigate using parameterized

queries or stored procedures.

- Cross-Site Scripting (XSS): Script injection into trusted websites. Prevent with input sanitization and output

encoding.

- Command Injection: Direct execution of system commands via input.

- Steganography: Hiding malicious data within benign files (e.g., images or videos).

- Polymorphic Virus: Alters its code pattern to avoid detection.

- Zero-Day Vulnerability: Newly discovered flaws without patches; often exploited before the vendor becomes

aware.

- BitLocker Key Recovery: Key remnants can be found in hibernation files, memory dumps, or MBR if not

properly cleared.

2. Security Operations and Monitoring

- SIEM & IDS/IPS Logs: Analyze logs for anomalies (e.g., odd port usage, unexpected services).

- MITRE ATT&CK: A structured matrix of TTPs (Tactics, Techniques, Procedures) used by adversaries.

- Cyber Kill Chain: Seven stages - Reconnaissance, Weaponization, Delivery, Exploitation, Installation, C2,

Actions on Objectives.

- Mean Time to Detect (MTTD): Time taken to detect an incident. Lower is better.

- False Positives: Alerts on benign activity.

- False Negatives: No alert on malicious activity.

3. Incident Response

- Phases:

1. Preparation: IR planning, tooling, and team formation.

2. Detection and Analysis: Identifying and understanding the scope.


CompTIA CySA+ (CS0-003) Detailed Study Notes

3. Containment, Eradication, Recovery: Isolating, removing, and restoring systems.

4. Post-Incident Activities: Conduct lessons learned, root cause analysis.

- IOCs: Indicators like abnormal logins, sudden traffic spikes.

- Containment Techniques: Network segmentation, service isolation, account lockouts.

4. Tools and Techniques

- Burp Suite: Web app testing tool; supports plugin integration.

- tcpdump -e: Captures and shows Ethernet frame headers.

- VirusTotal: Checks suspicious files against multiple AV engines.

- AbuseIPDB: Reports and checks malicious IP addresses.

- Regex in logs: Use patterns to find indicators like email addresses or command injections.

5. Security Architecture

- Access Control: Role-based access, MFA (e.g., password + OTP).

- LDAP Secure Ports: Use 636 (LDAPS) over 389 (insecure).

- Network Controls: ACLs, segmentation, firewalls, VPNs.

- SCADA/ICS: Always isolate from general network; monitor for C2 traffic.

6. Governance, Risk, and Compliance

- Frameworks:

- NIST CSF Tiers: Partial to Adaptive.

- OSSTMM: Security testing methodology across domains.

- OWASP: Web app security (Top 10 vulnerabilities).

- SLA & Patch Delays: SLAs may restrict downtime, delaying vulnerability remediation.

- Secure Supply Chain: Only source from verified vendors; check authenticity.
CompTIA CySA+ (CS0-003) Detailed Study Notes

7. Reporting and Metrics

- Annualized Loss Expectancy (ALE): ALE = SLE x ARO.

- Example: Asset value = $120,000, Risk = 30%, ARO = 0.25 ALE = $9,000.

- Intelligence Cycle: Collection Analysis Dissemination Feedback.

- Reports: Custom reports should be scheduled and auto-emailed (e.g., monthly vulnerability trends).

You might also like