Start your lesson
Study the required lesson for each block, then take its short check. Guided exercises are optional. Required case practice within the blocks counts toward the readiness checklist, not lesson completion.
Your notesPrivate to you
Block 1 of 6Incident situation report · Known unknown · Audience-tailored communication · Update commitment
Practice savedNext · 15 min
Incident situation report · Known unknown · Audience-tailored communication · Update commitment
Practice savedNo provider lesson is assigned to this block. Study the ITForMe lesson below, then take the required check.
Required ITForMe lesson
Concept notes
Incident situation report
Provides a timestamped view of confirmed status, scope, impact, unknowns, actions, owners, decisions, and the next update.
Known unknown
Names a material unanswered question and its collection owner instead of presenting missing evidence as a fact.
Audience-tailored communication
Preserves one factual core while selecting the technical, business, and decision detail each authorized audience needs.
Update commitment
Specifies when recipients will receive the next situation report even if some investigation questions remain unresolved.
Required block check · Block 1
Required for course progress · Pass with 3 of 4 correct
Block 2 of 6Post-incident review · Improvement action owner · Measurable improvement outcome · Cause and contributing-condition separation
Practice saved15 min
Post-incident review · Improvement action owner · Measurable improvement outcome · Cause and contributing-condition separation
Practice savedNo provider lesson is assigned to this block. Study the ITForMe lesson below, then take the required check.
Required ITForMe lesson
Concept notes
Post-incident review
Reconstructs the event and response from records to identify causes, contributing conditions, strengths, and improvements.
Improvement action owner
Names the role accountable for completing a defined post-incident control or process change.
Measurable improvement outcome
Defines an observable target, deadline, dependency, and verification method rather than a vague instruction to improve security.
Cause and contributing-condition separation
Distinguishes the triggering technical failure from control or process conditions that increased duration, scope, or impact.
Required block check · Block 2
Required for course progress · Pass with 3 of 4 correct
Block 3 of 6Communicate an incident situation report
Practice saved8 min
Communicate an incident situation report
Practice savedNo provider lesson is assigned to this block. Study the ITForMe lesson below, then take the required check.
Required ITForMe lesson
Communicate an incident situation report
By the end, you can
- Analyze supplied evidence for situation-report uncertainty.
- Analyze supplied evidence for decision-oriented update cadence.
A situation report supports current decisions. State the reporting time, incident status, confirmed scope and impact, material unknowns, actions completed, actions underway, decisions needed, owner, and next update. Label preliminary facts so recipients do not repeat hypotheses as conclusions.
Use a consistent factual core across audiences while limiting sensitive detail to those who need it. Executives need business effect and decisions; responders need indicators, systems, and task ownership. Update prior statements explicitly when evidence changes rather than silently rewriting the record.
Worked example
A ransomware alert isolated six laptops; one file share is unavailable, but encryption on the share has not been confirmed and restoration timing is unknown.
- 15:20 EDR: six laptops isolated after matching encryption behavior
- 15:28 storage: share FIN-Reports unavailable; cause under investigation
- 15:32 tasks: endpoint lead collecting samples; storage lead checking snapshots; next coordination 16:00
Laptop behavior is confirmed, while the file-share cause and recovery estimate remain unknown. Reporting them as confirmed encryption would overstate impact.
Issue a timestamped update with confirmed isolation, unavailable service, named unknowns and owners, current tasks, and a 16:00 update commitment.
Reasoning self-check
A ransomware alert isolated six laptops; one file share is unavailable, but encryption on the share has not been confirmed and restoration timing is unknown.
- 15:20 EDR: six laptops isolated after matching encryption behavior
- 15:28 storage: share FIN-Reports unavailable; cause under investigation
- 15:32 tasks: endpoint lead collecting samples; storage lead checking snapshots; next coordination 16:00
- Record a timestamped fact table from the supplied evidence.
- Test the two most plausible explanations against every observation.
- Choose a bounded defensive action and state the result that would confirm it worked.
Compare your reasoning
Expected answers
- Issue a timestamped update with confirmed isolation, unavailable service, named unknowns and owners, current tasks, and a 16:00 update commitment.
- The conclusion cites at least two supplied observations and names one remaining uncertainty.
If you got stuck
- If the evidence conflicts, preserve both records and check clock, scope, and collection gaps before deciding.
- If no conclusion is supportable, request one specific log, capture, inventory fact, or controlled retest.
Compare your reasoning with the revealed answers if helpful. The block check below is required for course progress.
Required block check · Block 3
Required for course progress · Pass with 2 of 2 correct
Block 4 of 6Turn incident findings into owned improvements
Practice saved18 min
Turn incident findings into owned improvements
Practice savedNo provider lesson is assigned to this block. Study the ITForMe lesson below, then take the required check.
Required ITForMe lesson
Turn incident findings into owned improvements
By the end, you can
- Analyze supplied evidence for measurable lesson action.
- Analyze supplied evidence for cause and contributing-condition separation.
A post-incident review reconstructs what happened, what detected it, what limited or increased impact, and how the response performed. It should use records and participant evidence to improve systems and process, not assign blame. Distinguish root causes, contributing conditions, and symptoms.
An improvement item needs an owner, measurable outcome, due date, priority, dependency, and verification method. 'Improve logging' is not executable. 'Send identity audit events to the SIEM within five minutes and alert on disabled-source heartbeat for 24 hours' can be assigned and tested. Track completion through verification rather than ticket closure alone.
Worked example
An incident lasted four hours longer because identity audit logs stopped arriving and the SOC had no collection-health alert.
- Timeline: identity collector stopped 01:10
- SOC first noticed missing identity evidence at 05:20 during investigation
- Collector dashboard existed but had no routed alert; platform team owns the pipeline
The failed collector is the immediate condition; absent monitored health and ownership escalation allowed the gap to persist and delayed scoping.
Assign the platform owner a dated action to alert the SOC within five minutes of a missing heartbeat, then simulate a collector stop and preserve notification evidence.
Reasoning self-check
An incident lasted four hours longer because identity audit logs stopped arriving and the SOC had no collection-health alert.
- Timeline: identity collector stopped 01:10
- SOC first noticed missing identity evidence at 05:20 during investigation
- Collector dashboard existed but had no routed alert; platform team owns the pipeline
- Record a timestamped fact table from the supplied evidence.
- Test the two most plausible explanations against every observation.
- Choose a bounded defensive action and state the result that would confirm it worked.
Compare your reasoning
Expected answers
- Assign the platform owner a dated action to alert the SOC within five minutes of a missing heartbeat, then simulate a collector stop and preserve notification evidence.
- The conclusion cites at least two supplied observations and names one remaining uncertainty.
If you got stuck
- If the evidence conflicts, preserve both records and check clock, scope, and collection gaps before deciding.
- If no conclusion is supportable, request one specific log, capture, inventory fact, or controlled retest.
Compare your reasoning with the revealed answers if helpful. The block check below is required for course progress.
Work through the scenario
Use the case evidence to complete the tasks, then check objectives.
Guided: Report incident impact without overclaiming
Executives need an update after unauthorized access to a research repository.
- Incident leadactor
- Executive incident reportcontrol
- Research repositoryresource
- analystinterpretsevidence
- evidencedescribesasset
Objectives
- Interpret the supplied evidence without overclaimingpending
- Choose the bounded evidence-supported actionpending
- Select evidence that verifies security and operational outcomepending
Evidence 1
Audit: 412 restricted objects were read by a compromised identity.
Evidence 2
No complete outbound network capture exists for the source device.
Evidence 3
Access is contained; repository integrity checks show no modification.
Fictional, disposable SOC evidence. No production system or external service is contacted.
Report an issue with this exercise
Required case practice
Required for the readiness checklist · Pass at 100%
Explain a detection metric change
A monthly SOC report shows mean time to detect improving while alert volume falls sharply.
- SOC manageractor
- Operations metricscontrol
- Detection programresource
- analystinterpretsevidence
- evidencedescribesasset
Objectives
- Interpret the supplied evidence without overclaimingpending
- Choose the bounded evidence-supported actionpending
- Select evidence that verifies security and operational outcomepending
Evidence 1
MTTD: 46 to 31 minutes.
Evidence 2
Alert volume: 8,100 to 4,900 after a rule migration.
Evidence 3
Coverage test: two expected test alerts did not fire on one data source.
Fictional, disposable SOC evidence. No production system or external service is contacted.
Report an issue with this exercise
Required block check · Block 4
Required for course progress · Pass with 2 of 2 correct
Block 5 of 6Declare and communicate incidents through authorized channels
Practice saved9 min
Declare and communicate incidents through authorized channels
Practice savedNo provider lesson is assigned to this block. Study the ITForMe lesson below, then take the required check.
Required ITForMe lesson
Declare and communicate incidents through authorized channels
By the end, you can
- Explain and apply declaration and executive decision.
- Explain and apply authorized stakeholder communication.
- Explain and apply operationally secure channel.
Declaration activates ownership and communication; it should use defined criteria and can change with evidence. Executives need business impact, confidence, options, decision authority, and time constraints rather than raw logs. Unknown scope must remain visible.
Legal and privacy teams interpret obligations; PR coordinates public wording; regulators and law enforcement receive authorized reports; customers need accurate relevant facts. Use a communication matrix and approved channels. If chat or email may be compromised, move to a verified out-of-band path and preserve a secure decision record.
Worked example
A stolen administrator token may expose customer records while corporate chat is suspected and the affected population is unknown.
- Token use and two accessed stores confirmed
- No evidence yet identifies which records were read
- Incident chat shows an attacker-created forwarding integration
An incident and communication-channel compromise are supported; customer impact scope remains unknown and requires authorized legal/privacy coordination.
Declare the incident, move verified responders out of band, engage legal/privacy, state known and unknown scope, and commit to the next update.
Reasoning self-check
A stolen token may expose records while the normal incident chat has an attacker-created forwarding rule.
- Two repositories accessed; affected records unknown
- Legal notification clock may apply
- Corporate chat integrity cannot be trusted
- Build a short evidence table that separates observations, supported conclusions, and remaining unknowns.
- Choose the authorized action that tests the leading conclusion with the least operational impact.
- Compare your decision and reopen condition with the expected results before continuing.
Compare your reasoning
Expected answers
- Declare and escalate with known/unknown scope, brief executives on impact and decisions, move verified responders out of band, and coordinate legal, PR, regulators, law enforcement, and customers through authorized roles.
- Reopen communication content as scope changes; reopen the channel immediately if participant identity or message integrity cannot be verified.
If you got stuck
- If the answer depends on a product name alone, return to the actual evidence it produced.
- If no option can be falsified, name the missing record before choosing.
Compare your reasoning with the revealed answers if helpful. The block check below is required for course progress.
Required block check · Block 5
Required for course progress · Pass with 3 of 3 correct
Block 6 of 6Hand over evidence and report meaningful operations metrics
Practice saved9 min
Hand over evidence and report meaningful operations metrics
Practice savedNo provider lesson is assigned to this block. Study the ITForMe lesson below, then take the required check.
Required ITForMe lesson
Hand over evidence and report meaningful operations metrics
By the end, you can
- Explain and apply evidence-based post-incident report.
- Explain and apply operational handover and internal intelligence.
- Explain and apply metric definition and bias.
An after-action report reconstructs evidence and decisions, identifies root and contributing causes, and assigns improvements that can be tested. A shift handover is operational: it records what changed, rule IDs, evidence pointers, unresolved hypotheses, owners, and next decision. Internal threat intelligence should translate external observations into local assets, data sources, detections, and confidence.
Alert volume is the count in a stated scope and interval. Among adjudicated positive alerts, precision is TP/(TP+FP) and false-discovery share is FP/(TP+FP). True-positive rate (recall) is TP/(TP+FN), over actual positives; false-positive rate is FP/(FP+TN), over actual negatives. Alert dispositions alone cannot supply FN or TN; report unlabeled alerts separately. Mean time to detect averages detection time minus the supported malicious-event start. Mean time to respond, remediate, and close each need named start/end milestones. Phishing click rate uses unique clickers divided by successfully delivered valid tests; disclose duplicate clicks, exclusions and missing timestamps.
Worked example
A shift calculates operational metrics and transfers two temporary containment rules to the next analyst.
- Alerts: 20 TP, 60 FP, 20 still unlabeled; detection delays for three included incidents are 5, 10, and 15 minutes
- Phishing test: 950 successfully delivered recipients, 38 unique clickers, 42 total click events
- Two temporary rules expire next shift; their rule IDs and evidence pointers are absent
For the stated populations, precision is 25%, false-discovery share is 75%, mean detection time is 10 minutes, and unique-recipient click rate is 4%. TPR and FPR cannot be calculated without FN and TN; the 20 unlabeled alerts remain disclosed.
Publish the formulas and included/missing counts, then reconstruct rule IDs, purpose, evidence, expiry, current result, owner, and next action before transfer.
Reasoning self-check
A shift closes an incident and reports detection and phishing metrics while temporary rules and local intelligence remain active.
- Alerts: 30 TP, 70 FP, 10 unlabeled; detection intervals 6, 12, 18
- Phishing: 25 unique clickers among 1,000 delivered recipients
- Two rules lack owners; external behavior report not mapped to local assets
- Build a short evidence table that separates observations, supported conclusions, and remaining unknowns.
- Choose the authorized action that tests the leading conclusion with the least operational impact.
- Compare your decision and reopen condition with the expected results before continuing.
Compare your reasoning
Expected answers
- Report precision 30%, false-discovery share 70%, MTTD 12 minutes and click rate 2.5%. TPR/FPR and other means remain unavailable. Hand over rule state, map intelligence to local evidence, and assign post-incident causes and retests.
- Reopen any metric when its population or milestones change, and reopen closure if handover state, root cause, corrective owner, or local detection mapping is missing.
If you got stuck
- If the answer depends on a product name alone, return to the actual evidence it produced.
- If no option can be falsified, name the missing record before choosing.
Compare your reasoning with the revealed answers if helpful. The block check below is required for course progress.
Technical references
- CompTIA CySA+ CS0-004 V4 exam objectives, version 2.0 · CompTIA ↗
- NIST SP 800-61 Rev. 3, Incident Response Recommendations · NIST ↗
- NIST SP 800-92, log management · NIST ↗
- NIST SP 1500-28 Part 2B, Statistical Interpretation of Results · NIST ↗
- scikit-learn precision and recall definitions · scikit-learn ↗
Required block check · Block 6
Required for course progress · Pass with 3 of 3 correct
Review this lesson
Use only this lesson's worked example and key concepts for a quick self-check.
- Restate the worked example in your own words.
- Name the lesson concepts that explain the result.
- Explain why the closest alternative does not fit.
Check the whole objective
This unlocks objective 4.2 for recall. The latest checkpoint needs 70% or higher; a lower result puts the lesson back near the front of your timeline.