CompTIA CySA+ CS0-003 — the complete study guide

If Security+ asks what is this control, CySA+ asks you are the analyst on shift, here is the output, what do you do. The jump in difficulty is real, and it is almost entirely a jump in analysis rather than in memorisation.

The people who struggle with CS0-003 are usually the ones who prepared for it the same way they prepared for Security+.

The exam at a glance#

165 minutes is generous unless you get stuck in the performance-based questions, which on CySA+ typically involve reading logs, correlating events across sources, or triaging a vulnerability report. Budget roughly 10 minutes each and move on.

Domain weightings#

Domains 1 and 2 are 63% of the exam between them. That is where the study time goes. But note Domain 4: nearly a fifth of the exam is about writing it up and telling people — which almost nobody practises.

Domain 1 — Security Operations (33%)#

System and network architecture concepts#

You cannot spot anomalous behaviour without knowing what normal looks like.

• Log ingestion, time synchronisation (why NTP drift ruins correlation), logging levels.
• Operating system concepts: Windows Registry, system hardening, file structure, configuration file locations, system processes, hardware architecture.
• Infrastructure concepts: serverless, virtualisation, containerisation.
• Network architecture: on-premises, cloud, hybrid, network segmentation, zero trust, SDN, secure access service edge (SASE).
• Identity and access management: MFA, SSO, federation, privileged access management, passwordless, cloud access security broker (CASB).
• Encryption: PKI, SSL inspection, public key infrastructure.
• Sensitive data protection: data loss prevention, personally identifiable information, cardholder data.

Analysing indicators of potentially malicious activity#

This is the core skill. For each category, know the observable:

• Network: bandwidth consumption, beaconing, irregular peer-to-peer communication, rogue devices on the network, scans and sweeps, unusual traffic spikes, activity on unexpected ports.
• Host: processor consumption, memory consumption, drive capacity consumption, unauthorised software, malicious processes, unauthorised changes, unauthorised privileges, data exfiltration, abnormal OS process behaviour, file system changes, registry changes, unauthorised scheduled tasks.
• Application: anomalous activity, introduction of new accounts, unexpected output, unexpected outbound communication, service interruption, application logs.
• Other: social engineering attacks, obfuscated links.

Beaconing looks like: regular interval + consistent packet size + same
destination + low volume. The regularity is the tell — humans are irregular,
implants are not (until they add jitter).

Tools and techniques#

Know what each tool is for, and be able to read its output:

• Packet capture: Wireshark, tcpdump.
• Log analysis and correlation: SIEM, SOAR.
• Endpoint: EDR, file analysis.
• Email analysis: header analysis, DKIM/DMARC/SPF, message digest, phishing triage, embedded links.
• Vulnerability scanning and network scanning/mapping: Nmap, Angry IP.
• File analysis: hashing, static and dynamic analysis, sandboxing.
• Programming: regular expressions (learn these properly), scripting in Python/PowerShell/Bash, JSON and XML.

Threat intelligence and threat hunting#

• Threat actors, tactics techniques and procedures, confidence levels, collection methods and sources (open source, closed source), the intelligence cycle (requirements, collection, analysis, dissemination, feedback).
• Frameworks: MITRE ATT&CK, the Diamond Model of Intrusion Analysis, Cyber Kill Chain, OSSTMM, OWASP Testing Guide. Know what each one is for — ATT&CK catalogues adversary behaviour; the Kill Chain describes attack phases; the Diamond Model relates adversary, capability, infrastructure and victim.
• Threat hunting: focusing on high-value assets, documenting and reporting, integrated intelligence, improving detection capabilities.

Efficiency and process improvement#

Automation, orchestration, SOAR playbooks, single pane of glass, API integration, and the business case for each. The exam likes questions where the right answer is "automate this repeatable step".

Domain 2 — Vulnerability Management (30%)#

Discovery and scanning#

• Asset discovery (mapping, fingerprinting), special considerations (scheduling, operations, performance, sensitivity levels, segmentation, regulatory requirements).
• Internal vs external, agent vs agentless, credentialed vs non-credentialed, passive vs active, static vs dynamic analysis.
• Industry frameworks: OWASP Top 10, PCI DSS, CIS Benchmarks.

Analysing output#

You must be able to read a scanner report and separate signal from noise:

• Cross-site scripting (reflected, persistent), overflow attacks (buffer, integer, heap, stack), data poisoning, broken access control, cryptographic failures, injection flaws, insecure design, security misconfiguration, end-of-life or outdated components, identification and authentication failures, server-side request forgery, remote code execution, privilege escalation, local file inclusion / remote file inclusion.

Prioritisation#

The heart of the domain, and the part CySA+ actually cares about:

• CVSS — be able to interpret a vector string, not just a score. Attack vector, attack complexity, privileges required, user interaction, scope, and the CIA impact metrics.
• Validation: true positive, false positive, true negative, false negative.
• Context awareness: internal, external, isolated. A critical CVE on an isolated lab box outranks nothing.
• Exploitability and weaponisation, asset value, zero-day.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
 
AV:N  network reachable      → widens exposure
AC:L  low complexity         → easy to exploit
PR:N  no privileges needed   → no foothold required
UI:N  no user interaction    → wormable
C/I/A:H total compromise
 
Read the vector before the number. Two 9.8s are not equally urgent if one
of them sits on a segment nobody can route to.

Controls and mitigation#

Cross-site scripting, overflow, data poisoning, broken access control, cryptographic failures, injection, insecure design, misconfiguration, authentication failures, SSRF, RCE, privilege escalation, LFI/RFI — and the control that addresses each. Plus the process side: patching, configuration management, compensating controls, awareness/training/education, changing business requirements, maintenance windows, exceptions, risk acceptance, and the perennial blockers (legacy systems, proprietary systems, degrading functionality, organisational governance, business process interruption).

Domain 3 — Incident Response and Management (20%)#

• Attack methodology frameworks: Cyber Kill Chain, Diamond Model, MITRE ATT&CK, OSSTMM, OWASP.
• Incident response process: preparation, detection and analysis, containment, eradication and recovery, post-incident activity — including forensic analysis, root cause analysis, lessons learned.
• Containment strategy: isolation vs segmentation, removal, and the trade-off between preserving evidence and stopping the bleeding.
• Evidence handling: legal hold, chain of custody, acquisition, validation (hashing), preservation, order of volatility.

Order of volatility — collect in this order:
  1. CPU registers, cache
  2. Routing table, ARP cache, process table, kernel statistics, RAM
  3. Temporary file systems
  4. Disk
  5. Remote logging and monitoring data
  6. Physical configuration, network topology
  7. Archival media

Order of volatility is near-guaranteed to appear. Memorise it.

Domain 4 — Reporting and Communication (17%)#

The domain that separates an analyst from a technician. Nearly one question in six.

• Vulnerability management reporting: vulnerability, affected hosts, risk score, mitigation, recommendation, prioritisation.
• Compliance reports, action plans, inhibitors to remediation, metrics and key performance indicators, stakeholder identification and communication.
• Incident reporting: stakeholder identification, incident declaration and escalation, communications (legal, public relations, regulatory reporting, law enforcement), root cause analysis, lessons learned, metrics and KPIs (mean time to detect, mean time to respond, mean time to remediate, alert volume).

An eight-week study plan#

Weeks 1–2 — Domain 1 foundations. Architecture, logging, IAM, encryption. Build a small lab with a SIEM (Security Onion, Wazuh, or Elastic) and ship real logs into it. Everything after this is easier once you have watched your own traffic.

Weeks 3–4 — Domain 1 analysis and tooling. Indicators, Wireshark, tcpdump, email header analysis, regex. Practise reading captures rather than reading about captures.

Weeks 5–6 — Domain 2. Run a real scanner against your own lab. Take one real CVSS vector a day and explain out loud why it scores what it scores. Then prioritise a deliberately messy report.

Week 7 — Domains 3 and 4. Incident response phases, order of volatility, forensics, and — genuinely — write two incident reports. One for engineers, one for an executive. Practising the audience shift is the whole domain.

Week 8 — Timed practice papers. Same rule as always: for every wrong answer, one sentence on why the correct answer is better.

Where people lose marks#

• Treating CVSS scores as priorities. The exam wants context: exposure, asset value, exploit availability.
• Skipping Domain 4. It is 17% and it is the easiest domain to prepare for.
• Not practising log reading under time pressure. The knowledge is not the bottleneck; the reading speed is.
• Confusing containment with eradication. Containment stops spread. Eradication removes the cause. Recovery restores service.

Resources#

• The official CS0-003 objectives PDF — again, use it as a checklist.
• A working home SIEM. This single step does more for CySA+ than any course.
• MITRE ATT&CK Navigator — spend an hour mapping a real breach report onto it.
• Practice exams for timing, not for content.

CySA+ rewards people who have actually looked at logs. If you do nothing else from this guide, build the lab.