CompTIA CySA+: Detecting, Preventing and Responding to Incidents

1. Security operations

• Understand system and network architecture concepts in security operations.
• Analyse indicators of potentially malicious activity in a scenario involving networks, hosts, applications, social engineering attacks and concealed URLs.
• Use appropriate tools or techniques to identify malicious activity in a defined scenario.
• Compare and contrast threat intelligence and threat hunting concepts.
• Understand the importance of process improvement in security operations.

2. Vulnerability management

• Apply vulnerability assessment methods and concepts to a scenario.
• Analyse vulnerability assessment tool results in a scenario.
• Analyse data to prioritise vulnerabilities in a scenario.
• Recommend control procedures to mitigate software attacks and vulnerabilities in a scenario.
• Understand vulnerability response, tracking and management concepts.

3. Incident response and management

• Understand cybersecurity framework concepts:
  • the kill chain principle;
  • the Diamond Model of Intrusion Analysis;
  • the MITRE ATT&CK® framework;
  • the Open Source Security Testing Methodology Manual (OSSTMM);
  • the Open Web Application Security Project (OWASP) Testing Guide.
• Execute incident response activities in a scenario:
  • detection and analysis;
  • containment, eradication and recovery.
• Understand preparation and post-incident activity phases of the incident management life cycle.

4. Reporting and communication

• Understand the importance of reports and communication processes:
  • vulnerability management reports;
  • compliance reports;
  • action plans;
  • remediation barriers;
  • metrics and key performance indicators (KPIs);
  • identifying stakeholders and their communication methods;
  • incident reporting and escalation;
  • incident response reports;
  • communication methods;
  • root cause analysis;
  • lessons learned.