CompTIA Cybersecurity
Analyst (CySA+)
Certification Exam
Objectives
EXAM NUMBER: CS0-003

About the Exam
The CompTIA Cybersecurity Analyst (CySA+) certification exam will certify the successful candidate
has the knowledge and skills required to:• Detect and analyze indicators of malicious activity• Understand threat hunting and threat intelligence concepts• Use appropriate tools and methods to manage, prioritize, and respond to attacks and vulnerabilities• Perform incident response processes• Understand reporting and communication concepts related to vulnerability management and incident
response activities

EXAM DEVELOPMENT
CompTIA exams result from subject matter expert workshops and industry-wide survey results
regarding the skills and knowledge required of an advanced IT professional.
CompTIA AUTHORIZED MATERIALS USE POLICY
CompTIA Certifications, LLC is not affiliated with and does not authorize, endorse, or condone utilizing
any content provided by unauthorized third-party training sites (aka “brain dumps”). Individuals who
utilize such materials in preparation for any CompTIA examination will have their certifications revoked
and be suspended from future testing in accordance with the CompTIA Candidate Agreement. In aneffort to more clearly communicate CompTIA’s exam policies on use of unauthorized study materials,
CompTIA directs all certification candidates to the CompTIA Certification Exam Policies. Please review
all CompTIA policies before beginning the study process for any CompTIA exam. Candidates will be
required to abide by the CompTIA Candidate Agreement. If a candidate has a question as to whether
study materials are considered unauthorized (aka “brain dumps”), he/she should contact CompTIA atexamsecurity@comptia.org to confirm.
PLEASE NOTE
The lists of examples provided in bulleted format are not exhaustive lists. Other examples oftechnologies, processes, or tasks pertaining to each objective may also be included on the exam,
although not listed or covered in this objectives document. CompTIA is constantly reviewing thecontent of our exams and updating test questions to be sure our exams are current, and the securityof the questions is protected. When necessary, we will publish updated exams based on existing
exam objectives. Please know that all related exam preparation materials will still be valid.

CompTIA Cybersecurity Analyst (CySA+) CS0-003 Certification Exam: Exam Objectives Version 3.0
Copyright © 2022 CompTIA, Inc. All rights reserved.

TEST DETAILS
Required exam

CS0-003

Number of questions

Maximum of 85

Types of questions

Multiple-choice and performance-based

Length of test

165 minutes

Recommended experience

4 years of hands-on experience as anincident response analyst or security
operations center (SOC) analyst

EXAM OBJECTIVES (DOMAINS)
The table below lists the domains measured by this examinationand the extent to which they are represented.
DOMAIN
1.0
2.0
3.0
4.0
Total

PERCENTAGE OF EXAMINATION

Security Operations			
Vulnerability Management		Incident Response and Management
Reporting and Communication		

33%
30%
20%
17%
100%

CompTIA Cybersecurity Analyst (CySA+) CS0-003 Certification Exam: Exam Objectives Version 3.0
Copyright © 2022 CompTIA, Inc. All rights reserved.

1.0 Security Operations
1.1

Explain the importance of system and network architecture
concepts in security operations.
• Log ingestion- Time synchronization- Logging levels• Operating system (OS) concepts- Windows Registry- System hardening- File structureoConfiguration file locations- System processes- Hardware architecture• Infrastructure concepts- Serverless- Virtualization- Containerization

1.2• Network architecture- On-premises- Cloud- Hybrid- Network segmentation- Zero trust- Secure access secure edge
(SASE)- Software-defined networking(SDN)• Identity and access management- Multifactor authentication (MFA)- Single sign-on (SSO)- Federation- Privileged access management(PAM)- Passwordless- Cloud access security broker(CASB)• Encryption- Public key infrastructure (PKI)- Secure sockets layer (SSL)
inspection• Sensitive data protection- Data loss prevention (DLP)- Personally identifiable
information (PII)- Cardholder data (CHD)

Given a scenario, analyze indicators of potentially malicious activity.
• Network-related- Bandwidth consumption- Beaconing- Irregular peer-to-peer
communication- Rogue devices on the network- Scans/sweeps- Unusual traffic spikes- Activity on unexpected ports• Host-related- Processor consumption- Memory consumption- Drive capacity consumption- Unauthorized software- Malicious processes- Unauthorized changes- Unauthorized privileges- Data exfiltration- Abnormal OS process behavior- File system changes oranomalies- Registry changes or anomalies- Unauthorized scheduled tasks• Application-related- Anomalous activity- Introduction of new accounts

CompTIA Cybersecurity Analyst (CySA+) CS0-003 Certification Exam: Exam Objectives Version 3.0
Copyright © 2022 CompTIA, Inc. All rights reserved.

- Unexpected output- Unexpected outboundcommunication- Service interruption- Application logs
• Other- Social engineering attacks- Obfuscated links

1.0 | Security Operations

1.3

Given a scenario, use appropriate tools or techniques todetermine malicious activity.
• Tools- Packet captureoWiresharkotcpdump- Log analysis/correlationoSecurity information andevent management (SIEM)o
Security orchestration,
automation, and response(SOAR)- Endpoint securityoEndpoint detection and 		
response (EDR)- Domain name service (DNS) andInternet Protocol (IP) reputation
o
WHOIS
o
AbuseIPDB- File analysis

1.4

StringsoVirusTotal- Sandboxingo
Joe SandboxoCuckoo Sandbox• Common techniques- Pattern recognitionoCommand and control- Interpreting suspicious
commands- Email analysisoHeaderoImpersonationoDomainKeys Identified Mail
(DKIM)o
Domain-based Message 		
Authentication, Reporting,and Conformance (DMARC)o

Sender Policy Framework(SPF)
oEmbedded links- File analysisoHashing- User behavior analysisoAbnormal account activityoImpossible travel• Programming languages/scripting- JavaScript Object Notation(JSON)- Extensible Markup Language(XML)- Python- PowerShell- Shell script- Regular expressionsoCompare and contrast threat-intelligence and threat-hunting
concepts.
• Threat actors- Advanced persistent threat(APT)- Hacktivists- Organized crime- Nation-state- Script kiddie- Insider threatoIntentionalo
Unintentional- Supply chain• Tactics, techniques, andprocedures (TTP)• Confidence levels- Timeliness- Relevancy- Accuracy• Collection methods and sources- Open sourceoSocial mediaoBlogs/forumsoGovernment bulletinsoComputer emergency 		
response team (CERT)oCybersecurity incident 		
response team (CSIRT)o
Deep/dark web- Closed sourceoPaid feedsoInformation sharing 		organizationsoInternal sources• Threat intelligence sharing- Incident response

CompTIA Cybersecurity Analyst (CySA+) CS0-003 Certification Exam: Exam Objectives Version 3.0
Copyright © 2022 CompTIA, Inc. All rights reserved.

- Vulnerability management- Risk management- Security engineering- Detection and monitoring• Threat hunting- Indicators of compromise (IoC)oCollectionoAnalysisoApplication- Focus areasoConfigurations/			
misconfigurationsoIsolated networksoBusiness-critical assets
and processes- Active defense- Honeypot

1.0 | Security Operations

1.5

Explain the importance of efficiency and process improvement
in security operations.
• Standardize processes- Identification of tasks suitable for automationo
Repeatable/do not require human interaction- Team coordination to manage and facilitate automation• Streamline operations- Automation and orchestrationoSecurity orchestration, automation, and response (SOAR)- Orchestrating threat intelligence dataoData enrichmentoThreat feed combination- Minimize human engagement• Technology and tool integration- Application programming interface (API)- Webhooks- Plugins• Single pane of glass

CompTIA Cybersecurity Analyst (CySA+) CS0-003 Certification Exam: Exam Objectives Version 3.0
Copyright © 2022 CompTIA, Inc. All rights reserved.

2.0 Vulnerability Management
2.1

Given a scenario, implement vulnerability scanning methods
and concepts.
• Asset discovery- Map scans- Device fingerprinting• Special considerations- Scheduling- Operations- Performance- Sensitivity levels- Segmentation- Regulatory requirements• Internal vs. external scanning• Agent vs. agentless

2.2• Credentialed vs. non-credentialed• Passive vs. active• Static vs. dynamic- Reverse engineering- Fuzzing• Critical infrastructure- Operational technology (OT)
- Industrial control systems (ICS)- Supervisory control and dataacquisition (SCADA)• Security baseline scanning• Industry frameworks- Payment Card Industry Data
Security Standard (PCI DSS)
- Center for Internet Security(CIS) benchmarks- Open Web Application Security
Project (OWASP)- International Organization forStandardization (ISO) 27000
seriesGiven a scenario, analyze output from vulnerability assessment tools.
• Tools- Network scanning and mappingoAngry IP ScanneroMaltego- Web application scannersoBurp Suiteo
Zed Attack Proxy (ZAP)oArachnio
Nikto- Vulnerability scannersoNessuso
OpenVAS- DebuggersoImmunity debuggeroGNU debugger (GDB)- MultipurposeoNmapoMetasploit framework (MSF)o
Recon-ng- Cloud infrastructure assessment
toolsoScout Suiteo
Prowlero
Pacu

CompTIA Cybersecurity Analyst (CySA+) CS0-003 Certification Exam: Exam Objectives Version 3.0
Copyright © 2022 CompTIA, Inc. All rights reserved.

2.0 | Vulnerability Management

2.3

Given a scenario, analyze data to prioritize vulnerabilities.
• Common Vulnerability Scoring
System (CVSS) interpretation- Attack vectors- Attack complexity- Privileges required- User interaction- Scope2.4• Context awareness- Internal- External- Isolated• Exploitability/weaponization• Asset value• Zero-day

Given a scenario, recommend controls to mitigate attacks andsoftware vulnerabilities.
• Cross-site scripting- Reflected- Persistent• Overflow vulnerabilities- Buffer- Integer- Heap- Stack• Data poisoning

2.5- ImpactoConfidentialityoIntegrityoAvailability• Validation- True/false positives- True/false negatives• Broken access control• Cryptographic failures• Injection flaws• Cross-site request forgery• Directory traversal• Insecure design• Security misconfiguration• End-of-life or outdated
components• Identification and authentication
failures• Server-side request forgery• Remote code execution• Privilege escalation• Local file inclusion (LFI)/remote
file inclusion (RFI)

Explain concepts related to vulnerability response, handling,
and management.
• Compensating control• Control types- Managerial- Operational- Technical- Preventative- Detective- Responsive- Corrective• Patching and configuration
management- Testing- Implementation- Rollback- Validation• Maintenance windows• Exceptions• Risk management principles- Accept- Transfer- Avoid- Mitigate• Policies, governance, and servicelevel objectives (SLOs)• Prioritization and escalation• Attack surface management- Edge discovery- Passive discovery- Security controls testing- Penetration testing andadversary emulation- Bug bounty

CompTIA Cybersecurity Analyst (CySA+) CS0-003 Certification Exam: Exam Objectives Version 3.0
Copyright © 2022 CompTIA, Inc. All rights reserved.

- Attack surface reduction• Secure coding best practices- Input validation- Output encoding- Session management- Authentication- Data protection- Parameterized queries• Secure software development
life cycle (SDLC)• Threat modeling3.0 Incident Response andManagement
3.1

Explain concepts related to attack methodology frameworks.
• Cyber kill chains• Diamond Model of Intrusion
Analysis• MITRE ATT&CK• Open Source Security Testing
Methodology Manual (OSS TMM)

3.2

Given a scenario, perform incident response activities.
• Detection and analysis- IoC- Evidence acquisitionsoChain of custodyoValidating data integrityoPreservationoLegal hold
- Data and log analysis

3.3• OWASP Testing Guide• Containment, eradication,and recovery- Scope- Impact- Isolation- Remediation- Re-imaging- Compensating controls

Explain the preparation and post-incident activity phases of
the incident management life cycle.
• Preparation- Incident response plan
- Tools- Playbooks- Tabletop- Training- Business continuity (BC)/disaster recovery (DR)

CompTIA Cybersecurity Analyst (CySA+) CS0-003 Certification Exam: Exam Objectives Version 3.0
Copyright © 2022 CompTIA, Inc. All rights reserved.

• Post-incident activity- Forensic analysis- Root cause analysis- Lessons learned

4.0 Reporting and Communication
4.1

Explain the importance of vulnerability management reportingand communication.
• Vulnerability management
reporting- Vulnerabilities- Affected hosts- Risk score- Mitigation- Recurrence- Prioritization• Compliance reports• Action plans- Configuration management- Patching

4.2- Compensating controls- Awareness, education, andtraining- Changing business requirements• Inhibitors to remediation- Memorandum of understanding(MOU)- Service-level agreement (SLA)- Organizational governance- Business process interruption- Degrading functionality- Legacy systems- Proprietary systems• Metrics and key performanceindicators (KPIs)- Trends- Top 10
- Critical vulnerabilities andzero-days- SLOs• Stakeholder identificationand communication

Explain the importance of incident response reporting andcommunication.
• Stakeholder identificationand communication• Incident declaration andescalation• Incident response reporting- Executive summary- Who, what, when, where,
and why- Recommendations- Timeline- Impact- Scope- Evidence• Communications- Legal- Public relationsoCustomer communicationoMedia- Regulatory reporting- Law enforcement

CompTIA Cybersecurity Analyst (CySA+) CS0-003 Certification Exam: Exam Objectives Version 3.0
Copyright © 2022 CompTIA, Inc. All rights reserved.

• Root cause analysis• Lessons learned• Metrics and KPIs
- Mean time to detect- Mean time to respond- Mean time to remediate- Alert volume

CompTIA CySA+ CS0-003 Acronym List
The following is a list of acronyms that appears on the CompTIA CySA+
CS0-003 exam. Candidates are encouraged to review the complete
list and attain a working knowledge of all listed acronyms as part of acomprehensive exam preparation program.
Acronym
ACL
API
APT
ARP
AV
BC
BCP
BGP
BIA
C2
CA
CASB
CDN
CERT
CHD
CI/CD
CIS
COBIT
CSIRT
CSRF
CVE
CVSS
DDoS
DKIM
DLP
DMARC
DNS
DoS
DR
EDR
FIM
FTP
GDB
GPO

Spelled Out
Access Control List
Application Programming Interface
Advanced Persistent Threat
Address Resolution Protocol
Antivirus
Business Continuity
Business Continuity Plan
Border Gateway Protocol
Business Impact Analysis
Command and Control
Certificate Authority
Cloud Access Security Broker
Content Delivery Network
Computer Emergency Response Team
Cardholder Data
Continuous Integration and Continuous
DeliveryCenter for Internet Security
Control Objectives for Information and
Related Technologies
Cybersecurity Incident Response Team
Cross-site Request Forgery
Common Vulnerabilities and Exposures
Common Vulnerability Scoring System
Distributed Denial of Service
Domain Keys Identified Mail
Data Loss Prevention
Domain-based Message Authentication,
Reporting, and Conformance
Domain Name Service
Denial of Service
Disaster Recovery
Endpoint Detection and Response
File Integrity Monitoring
File Transfer Protocol
GNU Debugger
Group Policy Objects

Acronym
HIDS
HIPS
HTTP
HTTPS
IaaS
ICMP
ICS
IDS
IoC
IP
IPS
IR
ISO
IT
ITIL
JSON
KPI
LAN
LDAPS
LFI
LOI
MAC
MFA
MOU
MSF
MSP
MSSP
MTTD
MTTR
NAC
NDA
NGFW
NIDS
NTP
OpenVAS

Spelled Out
Host-based Intrusion Detection System
Host-based Intrusion Prevention System
Hypertext Transfer Protocol
Hypertext Transfer Protocol Secure
Infrastructure as a Service
Internet Control Message Protocol
Industrial Control Systems
Intrusion Detection System
Indicators of CompromiseInternet Protocol
Intrusion Prevention System
Incident Response
International Organization forStandardization
Information Technology
Information Technology Infrastructure
Library
JavaScript Object Notation
Key Performance Indicator
Local Area Network
Lightweight Directory Access Protocol
Local File Inclusion
Letter of Intent
Media Access Control
Multifactor Authentication
Memorandum of Understanding
Metasploit Framework
Managed Service Provider
Managed Security Service Provider
Mean Time to Detect
Mean Time to Repair
Network Access Control
Non-disclosure Agreement
Next-generation Firewall
Network-based Intrusion Detection System
Network Time Protocol
Open Vulnerability Assessment Scanner

CompTIA Cybersecurity Analyst (CySA+) CS0-003 Certification Exam: Exam Objectives Version 3.0
Copyright © 2022 CompTIA, Inc. All rights reserved.

AcronymOS
OSSTMMOTOWASP
PAM
PCI DSS
PHP
PID
PII
PKI
PLC
POC
RCE
RDP
REST
RFI
RXSS
SaaS
SAML
SASE
SCADA
SDLC
SDN
SFTP
SIEM
SLA
SLO
SMB
SMTP

Spelled Out
Operating System
Open Source Security Testing
Methodology Manual
Operational Technology
Open Web Application Security Project
Privileged Access Management
Payment Card Industry Data Security
Standard
Hypertext Preprocessor
Process Identifier
Personally Identifiable Information
Public Key Infrastructure
Programmable Logic Controller
Proof of Concept
Remote Code Execution
Remote Desktop Protocol
Representational State Transfer
Remote File Inclusion
Reflected Cross-site Scripting
Software as a Service
Security Assertion Markup Language
Secure Access Secure Edge
Supervisory Control and Data Acquisition
Software Development Life Cycle
Software-defined Networking
Secure File Transfer Protocol
Security Information and Event Management
Service-level Agreement
Service-level Objective
Server Message Block
Simple Mail Transfer Protocol

Acronym
SNMP
SOAR
SOC
SPF
SQL
SSL
SSO
SSRF
STIX
SWG
TCP
TFTP
TLS
TRACE
TTP
UEBA
URI
URL
USB
VLAN
VM
VPN
WAF
WAN
XDR
XML
XSS
XXE
ZAP
ZTNA

Spelled Out
Simple Network Management Protocol
Security Orchestration, Automation, andResponse
Security Operations Center
Sender Policy Framework
Structured Query Languge
Secure Sockets Layer
Single Sign-onServer-side Request Forgery
Structured Threat Information Expression
Secure Web Gateway
Transmission Control Protocol
Trivial File Transfer Protocol
Transport Layer Security
Trade Reporting and Compliance Engine
Tactics, Techniques, and Procedures
User and Entity Behavior Analytics
Uniform Resource Identifier
Uniform Resource Locator
Universal Serial Bus
Virtual LAN
Virtual Machine
Virtual Private Network
Web Application Firewall
Wide Area Network
Extended Detection Response
Extensible Markup Language
Cross-site Scripting
XML External Entity
Zed Attack Proxy
Zero Trust Network Access

CompTIA Cybersecurity Analyst (CySA+) CS0-003 Certification Exam: Exam Objectives Version 3.0
Copyright © 2022 CompTIA, Inc. All rights reserved.

CompTIA CySA+ CS0-003 Hardware andSoftware List
CompTIA has included this sample list of hardware and software to assist
candidates as they prepare for the CySA+ CS0-003 certification exam.
This list may also be helpful for training companies that wish to create alab component for their training offering. The bulleted lists below each
topic are sample lists and are not exhaustive.
Equipment• Workstations (or laptop) with ability to run VM• Firewall• IDS/IPS• Servers
Software• Windows operating systems- Commando VM• Linux operating systems- Kali• Open-source UTM appliance• Metasploitable• SIEM- Greylog- ELK- Splunk• TCPDump• Wireshark• Vulnerability scanner (i.e., OpenVAS)• Nessus• Access to cloud instances- Azure
- AWS
- GCP

© 2022 CompTIA, Inc., used under license by CompTIA, Inc. All rights reserved. All certification programs and education related to suchprograms are operated exclusively by CompTIA, Inc. CompTIA is a registered trademark of CompTIA, Inc. in the U.S. and internationally.
Other brands and company names mentioned herein may be trademarks or service marks of CompTIA, Inc. or of their respective owners.
Reproduction or dissemination prohibited without the written consent of CompTIA, Inc. Printed in the U.S. 09804-Jul2022