ExamFinch.com My Study

Cheat sheet

CompTIA CySA+ Cheat Sheet

Practice this exam

Security Operations

  • 33% of exam
  • SOC Flow Telemetry Threat Intel Hunting Malware Cues

Vulnerability Management

  • 30% of exam
  • Scan Types Risk Factors CVSS Mitigation Cloud Findings

Incident Response Management

  • 20% of exam
  • IR Flow Frameworks Forensics Containment Evidence

Reporting and Communication

  • 17% of exam
  • Audience Metrics Compliance Reports Escalation

Quick Facts

  • Exam CS0-003
  • Version CySA+ V3
  • Questions Max 85
  • Time 165 min
  • Pass 750/900
  • Format MCQ + PBQ
  • Level Intermediate
  • Launch Jun 6 2023

SOC Loop OP

  • Collect, correlate, triage, enrich, escalate, tune.
  • Collect Correlate Triage Enrich Escalate Tune

IOC vs TTP OP

IOC

  • Hash
  • IP/domain
  • Artifact

TTP

  • Behavior
  • Technique
  • Reusable pattern
  • Clue vs method

Alert Picker OP

  • Many failed logons → Password attack ( Check 4625 )
  • Single odd success → Account takeover ( Check 4624 )
  • Random DNS names → DGA hunt ( Entropy )
  • Regular callbacks → Beaconing hunt ( C2 )
  • LSASS touched → Credential theft ( EDR )
  • Recent domain → Intel enrichment ( Reputation )
  • Same alert floods → Rule tuning ( Noise )
  • Multiple tools agree → Escalate incident ( Correlated )

SOC Flow OP

  • Ingest Collect telemetry
  • Normalize Common fields
  • Correlate Link events
  • Triage Rank alerts
  • Enrich Add context
  • Escalate Hand off incident
  • Tune Reduce noise
  • Automate Repeat playbooks

SIEM vs SOAR OP

SIEM

  • Collect logs
  • Correlate alerts
  • Search events

SOAR

  • Run playbooks
  • Automate tasks
  • Orchestrate tools
  • See vs act

Telemetry OP

  • Syslog Network device logs
  • Windows 4624 Successful logon
  • Windows 4625 Failed logon
  • DNS logs Domain lookups
  • Proxy logs Web requests
  • NetFlow Traffic metadata
  • EDR Endpoint behavior
  • Cloud audit API activity

Threat Intel OP

  • Strategic Executive trends
  • Operational Campaign details
  • Tactical TTP mapping
  • Technical IOCs
  • STIX Intel format
  • TAXII Intel transport
  • Confidence Source reliability
  • Relevance Environment fit

Malware Cues OP

  • DGA Random domains
  • Beaconing Regular callbacks
  • PowerShell Script abuse
  • LSASS access Credential theft
  • Masquerade Fake legitimate name
  • Injection Code in process
  • Persistence Survive reboot
  • Exfil Data leaves

Risk Stack VU

  • Severity plus exposure plus exploitability plus value.
  • CVSS Exposure Exploit Asset

Credentialed vs Uncredentialed VU

Credentialed

  • Authenticated
  • Patch detail
  • Config depth

Uncredentialed

  • Attacker view
  • Surface only
  • Fewer details
  • Inside vs outside

Vuln Picker VU

  • Internet-facing critical → Patch first ( High exposure )
  • Known exploited → Emergency change ( KEV )
  • Patch blocked → Compensating control ( Document )
  • Scanner doubtful → Validate finding ( False positive )
  • Legacy system → Segment monitor ( Plan replace )
  • Web exploit risk → WAF rule ( Virtual patch )
  • Cloud exposure → Fix IAM ( Least privilege )
  • Production risk → Maintenance window ( Change control )

Scan Types VU

  • Credentialed Authenticated depth
  • Uncredentialed External view
  • Agent Host resident
  • Agentless Network reach
  • Active Probe targets
  • Passive Observe traffic
  • Static Code review
  • Dynamic Runtime testing

Risk Factors VU

  • CVSS Base severity
  • EPSS Exploit likelihood
  • KEV Known exploited
  • Exposure Reachable target
  • Criticality Business value
  • Exploit code Attack available
  • Compensating Alternate control
  • Exception Approved delay

Mitigation VU

  • Patch Fix software
  • Harden Secure config
  • Segment Limit reach
  • WAF Virtual patch
  • IPS rule Block exploit
  • MFA Reduce account risk
  • Allowlist Constrain execution
  • Replace Retire legacy

Cloud Findings VU

  • Public bucket Data exposure
  • Open SG Wide ingress
  • No MFA Weak admin
  • Excess IAM Overprivilege
  • No logging Blind activity
  • Stale keys Credential risk
  • CSPM Posture checks
  • Kubernetes Cluster surface

IR Order IN

  • Prepare, detect, contain, eradicate, recover, learn.
  • Prepare Detect Contain Eradicate Recover Learn

Contain vs Eradicate IN

Contain

  • Stop spread
  • Isolate host
  • Preserve evidence

Eradicate

  • Remove malware
  • Close vector
  • Fix root cause
  • Limit vs remove

Incident Picker IN

  • Incident unclear → Analyze scope ( Identify )
  • Host active → Capture RAM ( Volatile )
  • Spread ongoing → Contain first ( Isolate )
  • Root cause known → Eradicate ( Remove )
  • Clean rebuild ready → Recover ( Restore )
  • Evidence needed → Forensic image ( Hash )
  • Process gap found → Lessons learned ( Improve )
  • Legal trigger → Escalate counsel ( Notice )

IR Flow IN

  • Prepare Plans ready
  • Detect Find incident
  • Analyze Scope impact
  • Contain Limit spread
  • Eradicate Remove cause
  • Recover Restore service
  • Lessons Improve process
  • RCA Root cause

Frameworks IN

  • ATT&CK Tactics techniques
  • Kill Chain Attack stages
  • Diamond Actor relation
  • D3FEND Defensive techniques
  • OSSTMM Testing methodology
  • OWASP Web testing
  • Playbook Repeat procedure
  • Tabletop Exercise response

Forensics IN

  • Volatile Capture first
  • RAM Live evidence
  • Hash Integrity proof
  • Image Bit copy
  • Chain Custody trail
  • Static No execution
  • Dynamic Sandbox behavior
  • Timeline Event sequence

Report Fit RE

  • Audience decides detail, tone, metrics, timing.
  • Audience Detail Tone Metric Timing

MTTD vs MTTR RE

MTTD

  • Detection lag
  • Monitoring quality
  • Before triage

MTTR

  • Response duration
  • Recovery quality
  • After detection
  • Find vs fix

Audience RE

  • Executive Risk impact
  • Technical IOCs steps
  • Legal Obligations
  • PR Public message
  • Regulator Required notice
  • Customer Impact guidance
  • Owner Remediation action
  • Board Strategic risk

Executive vs Technical RE

Executive

  • Risk impact
  • Cost priority
  • Business action

Technical

  • IOCs
  • Commands
  • Remediation steps
  • Why vs how

Metrics RE

  • MTTD Detect speed
  • MTTR Respond speed
  • MTTC Contain speed
  • SLA Service promise
  • SLO Target objective
  • False positive Benign alert
  • Backlog Open work
  • Trend Direction change

Compliance RE

  • PCI DSS Cardholder data
  • HIPAA Health data
  • GDPR EU privacy
  • SOX Financial controls
  • NIST CSF Risk framework
  • NICE Work roles
  • Audit log Accountability record
  • Data class Handling level

Common Traps

CVSS Is Not Priority

  • Score only ≠ Risk context

IOC Is Not Attribution

  • Artifact clue ≠ Actor proof

Contain Is Not Clean

  • Spread limited ≠ Cause remains

Logs Are Not Evidence

  • Operational record ≠ Preserved artifact

SOAR Is Not SIEM

  • Automation workflow ≠ Event correlation

Executive Needs Impact

  • Business risk ≠ Packet detail

Last Minute

  • 1. Security Operations is 33%
  • 2. Vulnerability Management is 30%
  • 3. Incident Response is 20%
  • 4. Reporting Communication is 17%
  • 5. SIEM correlates; SOAR automates
  • 6. IOC clue; TTP behavior
  • 7. Risk equals severity plus context
  • 8. Contain before eradication
  • 9. Capture volatile evidence first
  • 10. Reports match stakeholder audience

CompTIA CySA+

  • Practice Questions 400 questions Study Guide 29 topics Cheat Sheet 112 facts Flashcards 50 cards Shorts 1 short Blogs 1 blog Free CE Podcast