CompTIA · certification · Guided course

CompTIA CySA+

Defensive analysis, detection, vulnerability management, and incident response.

CS0-004associateOfficial provider page ↗

Daily study planConsideringInclude new CySA+ sections and checks in your daily goal.

Catalog noteThe native beta path targets CS0-004 and assumes networking and Security+-level foundations. It covers the 15 published parent objectives; detailed final-PDF coverage and independent review remain unverified. CS0-003 materials belong to the earlier release; CompTIA retires the English CS0-003 exam on December 22, 2026.Provider catalog checked 2026-10-06.

Your course path

Start with the suggested objective

Open a section when you are ready to begin.

Course pace and remaining work

ApproachBuild in orderLearning; no professional IT experience yet

Core work left2423mRemaining short lesson blocks and checks · outside courses vary in length

Target paceNo deadlineSet a target below to calculate required weekly time

Security OperationsNot started

1.1 · Connect architecture, identity, and logging to security operations.

6 short lesson blocks · next block about 15m

Block 1 · Trust boundary · Endpoint telemetry · Network flow record · Segmentation verification

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Control-plane log · Data plane · Workload identity · Request correlation identifier

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Place telemetry at trust boundaries

○Study lessonRequired ITForMe lesson ○Block check

Block 4 · Analyze identity-aware cloud paths

○Study lessonRequired ITForMe lesson ○Block check

Block 5 · Operate trustworthy host and log evidence

○Study lessonRequired ITForMe lesson ○Block check

Block 6 · Connect access architecture, protected data, and critical systems

○Study lessonRequired ITForMe lesson ○Block check

○Checkpoint · 70%+ ○Spaced review 0/3

Suggested byNov 6Start section →

Full course map14 other objectivesOpen when you want to review progress or look ahead

Security OperationsNot started

1.2 · Investigate indicators of malicious activity across an environment.

6 short lesson blocks · next block about 15m

Block 1 · Password spraying · Credential stuffing · Brute-force authentication attack · Impossible-travel indicator

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Suspicious process chain · Persistence indicator · Network beaconing · DNS tunneling indicator

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Separate authentication attacks from user mistakes

○Study lessonRequired provider lesson ○Block check

Block 4 · Interpret endpoint and network indicators together

○Study lessonRequired ITForMe lesson ○Block check

Block 5 · Correlate network and host indicators

○Study lessonRequired ITForMe lesson ○Block check

Block 6 · Distinguish service, cloud, identity, and message abuse

○Study lessonRequired ITForMe lesson ○Block check

○Checkpoint · 70%+ ○Spaced review 0/3

Suggested byNov 12Start section →

Security OperationsNot started

1.3 · Use analysis tools to evaluate suspicious evidence.

18 short lesson blocks · next block about 15m

Block 1 · SIEM correlation · Clock skew · Event normalization · Correlation key

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Packet capture · Flow metadata · Process telemetry · Network five-tuple

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Correlate logs without losing event identity

○Study lessonRequired provider lesson ○Block check

Block 4 · Choose packet and host evidence for the question

○Study lessonRequired ITForMe lesson ○Block check

Block 5 · Parse evidence before automating conclusions

○Study lessonRequired ITForMe lesson ○Block check

Block 6 · Choose packet, detection, and log tools by evidence need

○Study lessonRequired ITForMe lesson ○Block check

Block 7 · Use intelligence and reputation services without outsourcing judgment

○Study lessonRequired ITForMe lesson ○Block check

Block 8 · Combine endpoint, file, and sandbox evidence

○Study lessonRequired ITForMe lesson ○Block check

Block 9 · Validate email paths and behavior baselines

○Study lessonRequired ITForMe lesson ○Block check

Block 10 · Interpret CyberChef, Wireshark, tcpdump, Snort output

○Study lessonRequired ITForMe lesson ○Block check

Block 11 · Interpret Suricata, Zeek, SIEM, OTX output

○Study lessonRequired ITForMe lesson ○Block check

Block 12 · Interpret MISP, OpenCTI, EDR, XDR output

○Study lessonRequired ITForMe lesson ○Block check

Block 13 · Interpret MDM, WHOIS, AbuseIPDB, Geo-IP output

○Study lessonRequired ITForMe lesson ○Block check

Block 14 · Interpret strings, VirusTotal, YARA, Joe Sandbox output

○Study lessonRequired ITForMe lesson ○Block check

Block 15 · Interpret Cuckoo Sandbox, Regular expressions, Suspicious commands, MXToolbox output

○Study lessonRequired ITForMe lesson ○Block check

Block 16 · Interpret UEBA, OpenUBA, JSON, XML output

○Study lessonRequired ITForMe lesson ○Block check

Block 17 · Interpret YAML, EVTX, Python, PowerShell output

○Study lessonRequired ITForMe lesson ○Block check

Block 18 · Interpret Shell script output

○Study lessonRequired ITForMe lesson ○Block check

○Checkpoint · 70%+ ○Spaced review 0/3

Suggested byNov 27Start section →

Security OperationsNot started

1.4 · Develop evidence-based threat intelligence and hunting hypotheses.

6 short lesson blocks · next block about 15m

Block 1 · Threat indicator · Intelligence confidence · STIX · Indicator expiration

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Threat-hunt hypothesis · ATT&CK data component · Hunt coverage · Hunt reproducibility

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Evaluate threat intelligence before operational use

○Study lessonRequired ITForMe lesson ○Block check

Block 4 · Run a falsifiable threat hunt

○Study lessonRequired ITForMe lesson ○Block check

Block 5 · Assess actors, TTPs, confidence, and sources

○Study lessonRequired ITForMe lesson ○Block check

Block 6 · Operationalize indicators, threat models, and deception

○Study lessonRequired ITForMe lesson ○Block check

○Checkpoint · 70%+ ○Spaced review 0/3

Suggested byDec 2Start section →

Security OperationsNot started

1.5 · Improve operational workflows and bounded automation.

6 short lesson blocks · next block about 15m

Block 1 · Detection tuning · False positive · False negative · Behavioral baseline

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Response playbook · Escalation path · Time to contain · Automation guardrail

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Tune detections with labeled outcomes

○Study lessonRequired ITForMe lesson ○Block check

Block 4 · Improve playbooks using measurable handoffs

○Study lessonRequired ITForMe lesson ○Block check

Block 5 · Standardize and automate without losing control

○Study lessonRequired ITForMe lesson ○Block check

Block 6 · Enrich detections and integrate tools safely

○Study lessonRequired ITForMe lesson ○Block check

○Checkpoint · 70%+ ○Spaced review 0/3

Suggested byDec 8Start section →

Security OperationsNot started

1.6 · Evaluate AI use, risks, and governance in security operations.

5 short lesson blocks · next block about 15m

Block 1 · AI grounding · AI hallucination · AI evaluation set · Human review of AI output

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · AI data minimization · Prompt injection · AI workflow least privilege · AI output validation

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Validate AI-assisted triage

○Study lessonRequired ITForMe lesson ○Block check

Block 4 · Protect AI workflows from untrusted input

○Study lessonRequired ITForMe lesson ○Block check

Block 5 · Govern AI-assisted security work

○Study lessonRequired ITForMe lesson ○Block check

○Checkpoint · 70%+ ○Spaced review 0/3

Suggested byDec 13Start section →

Vulnerability ManagementNot started

2.1 · Select and scope an appropriate vulnerability scan.

6 short lesson blocks · next block about 15m

Block 1 · Credentialed vulnerability scan · Uncredentialed vulnerability scan · Scan scope · Scan rate limit

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Passive asset discovery · Active vulnerability scanning · Web application assessment · Scan stop condition

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Define safe scan scope and credentials

○Study lessonRequired ITForMe lesson ○Block check

Block 4 · Control active, passive, and application testing

○Study lessonRequired ITForMe lesson ○Block check

Block 5 · Plan scanning from an accountable inventory

○Study lessonRequired ITForMe lesson ○Block check

Block 6 · Use discovery and baselines for different questions

○Study lessonRequired ITForMe lesson ○Block check

○Checkpoint · 70%+ ○Spaced review 0/3

Suggested byDec 18Start section →

Vulnerability ManagementNot started

2.2 · Interpret and validate vulnerability assessment results.

11 short lesson blocks · next block about 15m

Block 1 · Service banner · Security backport · Scan authentication failure · Scanner false positive

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · CVSS base score · Finding confidence · Finding reachability · Configuration finding

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Validate scanner findings against asset facts

○Study lessonRequired ITForMe lesson ○Block check

Block 4 · Read scan confidence, reachability, and evidence

○Study lessonRequired ITForMe lesson ○Block check

Block 5 · Interpret network, multipurpose, and web-tool output

○Study lessonRequired ITForMe lesson ○Block check

Block 6 · Separate vulnerability, cloud, and simulation evidence

○Study lessonRequired ITForMe lesson ○Block check

Block 7 · Interpret Angry IP Scanner, Masscan, Nmap, MSF output

○Study lessonRequired ITForMe lesson ○Block check

Block 8 · Interpret Maltego, Recon-ng, Burp Suite, ZAP output

○Study lessonRequired ITForMe lesson ○Block check

Block 9 · Interpret Nikto, Nessus, Nuclei, OpenVAS output

○Study lessonRequired ITForMe lesson ○Block check

Block 10 · Interpret ScoutSuite, Prowler, Trivy, Checkov output

○Study lessonRequired ITForMe lesson ○Block check

Block 11 · Interpret Atomic Red Team, Caldera output

○Study lessonRequired ITForMe lesson ○Block check

○Checkpoint · 70%+ ○Spaced review 0/3

Suggested byDec 28Start section →

Vulnerability ManagementNot started

2.3 · Prioritize, mitigate, and verify vulnerability remediation.

6 short lesson blocks · next block about 15m

Block 1 · Known Exploited Vulnerabilities catalog · Asset criticality · Exposure context · Compensating control

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Vulnerability remediation · Vulnerability mitigation · Virtual patching · Remediation verification

○Study lessonRequired provider lesson ○Block check

Block 3 · Prioritize vulnerabilities with threat and asset context

○Study lessonRequired ITForMe lesson ○Block check

Block 4 · Select and verify a mitigation path

○Study lessonRequired provider lesson ○Block check

Block 5 · Prioritize vulnerability findings with local evidence

○Study lessonRequired ITForMe lesson ○Block check

Block 6 · Choose treatment and prove the deployed result

○Study lessonRequired ITForMe lesson ○Block check

○Checkpoint · 70%+ ○Spaced review 0/3

Suggested byJan 2Start section →

Vulnerability ManagementNot started

2.4 · Relate controls and risk decisions to vulnerability management.

6 short lesson blocks · next block about 15m

Block 1 · Vulnerability-management cycle · Assessment coverage denominator · Remediation service-level target · Vulnerability exception

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Risk acceptance · Preventive control · Detective control · Corrective control

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Build a vulnerability-management control cycle

○Study lessonRequired ITForMe lesson ○Block check

Block 4 · Use controls and risk acceptance honestly

○Study lessonRequired ITForMe lesson ○Block check

Block 5 · Classify controls and risk decisions

○Study lessonRequired ITForMe lesson ○Block check

Block 6 · Use application and supply-chain evidence

○Study lessonRequired ITForMe lesson ○Block check

○Checkpoint · 70%+ ○Spaced review 0/3

Suggested byJan 8Start section →

Incident Response and ManagementNot started

3.1 · Apply attack frameworks to observed adversary behavior.

5 short lesson blocks · next block about 15m

Block 1 · ATT&CK tactic · ATT&CK technique · Adversary procedure · ATT&CK detection strategy

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Attack lifecycle model · Observation and inference separation · Framework-mapping confidence · Attribution limit

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Map observed behavior to an attack framework

○Study lessonRequired ITForMe lesson ○Block check

Block 4 · Use frameworks without forcing attribution

○Study lessonRequired ITForMe lesson ○Block check

Block 5 · Choose an attack framework for the question

○Study lessonRequired ITForMe lesson ○Block check

○Checkpoint · 70%+ ○Spaced review 0/3

Suggested byJan 13Start section →

Incident Response and ManagementNot started

3.2 · Plan and coordinate the incident response process.

5 short lesson blocks · next block about 15m

Block 1 · Incident triage · Incident declaration · Incident severity · Incident communication plan

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Containment · Eradication · Recovery · Lessons-learned review

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Triage and declare incidents with explicit criteria

○Study lessonRequired ITForMe lesson ○Block check

Block 4 · Sequence containment, eradication, and recovery

○Study lessonRequired provider lesson ○Block check

Block 5 · Use incident phases as decision states

○Study lessonRequired provider lesson ○Block check

○Checkpoint · 70%+ ○Spaced review 0/3

Suggested byJan 18Start section →

Incident Response and ManagementNot started

3.3 · Apply triage, evidence handling, containment, and recovery techniques.

6 short lesson blocks · next block about 15m

Block 1 · Order of volatility · Chain of custody · Evidence integrity hash · Evidence provenance

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Event time versus ingestion time · Timeline normalization · Root-cause analysis · Alternate hypothesis

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Collect volatile evidence with provenance

○Study lessonRequired ITForMe lesson ○Block check

Block 4 · Build and test an incident timeline

○Study lessonRequired ITForMe lesson ○Block check

Block 5 · Prepare people, plans, and telemetry for incidents

○Study lessonRequired ITForMe lesson ○Block check

Block 6 · Preserve evidence and prove containment through restoration

○Study lessonRequired ITForMe lesson ○Block check

○Checkpoint · 70%+ ○Spaced review 0/3

Suggested byJan 23Start section →

Reporting and CommunicationNot started

4.1 · Communicate vulnerability findings and remediation decisions.

5 short lesson blocks · next block about 15m

Block 1 · Validated vulnerability finding · Affected asset owner · Finding reproduction step · Vulnerability priority rationale

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Residual risk · Remediation owner · Finding age · Scan coverage metric

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Write actionable vulnerability findings

○Study lessonRequired ITForMe lesson ○Block check

Block 4 · Report remediation status and residual risk

○Study lessonRequired ITForMe lesson ○Block check

Block 5 · Turn vulnerability evidence into decisions

○Study lessonRequired ITForMe lesson ○Block check

○Checkpoint · 70%+ ○Spaced review 0/3

Suggested byJan 28Start section →

Reporting and CommunicationNot started

4.2 · Report security operations and incident response outcomes.

6 short lesson blocks · next block about 15m

Block 1 · Incident situation report · Known unknown · Audience-tailored communication · Update commitment

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Post-incident review · Improvement action owner · Measurable improvement outcome · Cause and contributing-condition separation

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Communicate an incident situation report

○Study lessonRequired ITForMe lesson ○Block check

Block 4 · Turn incident findings into owned improvements

○Study lessonRequired ITForMe lesson ○Block check

Block 5 · Declare and communicate incidents through authorized channels

○Study lessonRequired ITForMe lesson ○Block check

Block 6 · Hand over evidence and report meaningful operations metrics

○Study lessonRequired ITForMe lesson ○Block check

○Checkpoint · 70%+ ○Spaced review 0/3

Suggested byFeb 3Start section →

★

Course progression checks

Complete these quizzes and labs to finish the guided course. The readiness checklist below has additional requirements. Course completion does not predict your exam result.

○Pass both current-profile 85-question final forms at 85%+ within 180 days○Pass 4 distinct current in-browser scenarios whose mapped content spans 4 exam domains at 70%+ within 180 days

Open practice →

Optional learning resources1 choiceOpen for another teacher, format, or question review

Optional

Another explanation or review

Useful defensive-operations teaching, but not a complete CS0-004 course. A current exact primary source remains unverified. These resources do not change course progress or readiness.

TCM SecurityDefensive-Operations Foundation · Free

Security Operations (SOC) 101

The free video teaches practical SOC concepts but is not a complete CS0-004 course.

Video course · Free on YouTube

Open video on YouTube ↗

Checked 2026-08-18 · review due 2027-02-14