CompTIA CySA+ course
Defensive analysis, detection, vulnerability management, and incident response.
Current scope and updates: The native beta path targets CS0-004 and assumes networking and Security+-level foundations. It covers the 15 published parent objectives; detailed final-PDF coverage and independent review remain unverified. CS0-003 materials belong to the earlier release; CompTIA retires the English CS0-003 exam on December 22, 2026.
Open the course pathThese lessons and checks are currently available as preview study material. Each block names its required provider or ITForMe lesson; optional provider products may have their own costs.
How you will study
- Study one learning block. Use its assigned provider lesson when one has been verified. Where no suitable assignment has been verified, study the required ITForMe teaching. Other explanations and guided practice remain available for support.
- Confirm study and take its short check. Opening a page or provider link does not complete a block. A passing current check is required for course progress.
- Review and continue. Today suggests the next activity using your study and review history. Review helps you revisit earlier concepts while you learn new material.
Separate observed evidence, uncertainty, and business impact before choosing an analyst action.
Connect architecture, identity, and logging to security operations
This is a short excerpt of ITForMe concept notes. It shows the kind of explanation available here; it is not the complete lesson or a scored check.
- Trust boundary
- Marks where identities, data, or requests cross between zones with different trust assumptions and therefore need an explicit policy decision.
- Endpoint telemetry
- Records host activity such as processes, users, file changes, sockets, and persistence so analysts can connect behavior to a specific system.
- Network flow record
- Summarizes a network conversation with endpoints, ports, protocol, timing, and byte counts without necessarily retaining the packet payload.
- Segmentation verification
- Uses allowed-path and denied-path observations at an enforcement point to confirm that actual connectivity matches the intended zone policy.
Applied practice: Investigate the supplied fictional telemetry, make a scoped decision, and explain the evidence needed to verify it.
Course topics
These are the current objective lessons in this course. Their presence describes the shipped study scope; it does not establish exam equivalence or independent approval.
Browse 15 objective lessons
- Connect architecture, identity, and logging to security operations
- Investigate indicators of malicious activity across an environment
- Use analysis tools to evaluate suspicious evidence
- Develop evidence-based threat intelligence and hunting hypotheses
- Improve operational workflows and bounded automation
- Evaluate AI use, risks, and governance in security operations
- Select and scope an appropriate vulnerability scan
- Interpret and validate vulnerability assessment results
- Prioritize, mitigate, and verify vulnerability remediation
- Relate controls and risk decisions to vulnerability management
- Apply attack frameworks to observed adversary behavior
- Plan and coordinate the incident response process
- Apply triage, evidence handling, containment, and recovery techniques
- Communicate vulnerability findings and remediation decisions
- Report security operations and incident response outcomes
Review status and preparation limits
0 of 15 objective lessons currently have named independent subject-matter review. Internal and automated checks are separate from that review. Question and practice-scenario review status is shown on those activities.
ITForMe is not affiliated with or endorsed by CompTIA. These original lessons and checks are not official exam questions, a vendor exam replica, or a pass predictor. Use the vendor's published requirements and additional practice to judge your preparation.
You can explore before signing in. Anonymous progress depends on this browser's session; clearing its site data can make saved work inaccessible. Sign in to keep progress with your account.