Threat Management

• Explain the importance of threat data and intelligence
• Given a scenario, utilize threat intelligence to support organizational security
• Given a scenario, perform vulnerability management activities
• Given a scenario, analyze the output from common vulnerability assessment tools
• Explain the threats and vulnerabilities associated with specialized technology
• Explain the threats and vulnerabilities associated with operating in the cloud
• Given a scenario, implement controls to mitigate attacks and software vulnerabilities

Software and Systems Security

• Given a scenario, apply security solutions for infrastructure management.
• Explain software assurance best practices
• Explain hardware assurance best practices

Security Operations and Monitoring

• Given a scenario, analyze data as part of security monitoring activities
• Given a scenario, implement configuration changes to existing controls to improve security
• Explain the importance of proactive threat hunting
• Compare and contrast automation concepts and technologies

Incident Response

• Explain the importance of the incident response process
• Given a scenario, apply the appropriate incident response procedure
• Given an incident, analyze potential indicators of compromise
• Given a scenario, utilize basic digital forensics techniques

Compliance and Assessment

• Understand the importance of data privacy and protection
• Given a scenario, apply security concepts in support of organizational risk mitigation.
• Explain the importance of frameworks, policies, procedures, and controls

CS0-002: Cybersecurity Analyst CySA+ Exam

• CySA+ Certification Overview
• CySA+ Exam Structure
• Exam Registration Process
• Time Management
• Topics and Concepts
• CySA+ Certification Question Structure
• Vendor Interpretation Techniques

What tools should candidates be familiar with in order to take the exam?

Candidates should know Wireshark, Bro and/or Snort at the very least.

Do I need to know a programming language for this exam, and if so, which one(s)?

It depends on your situation. XML is used to create the drivers in the AlienVault security information and event management (SIEM) platform, for example, and can be customized. However, your primary job is to identify vulnerabilities introduced on the network as a result of poor programming in languages like C and C++, which are harder to secure.

I have CompTIA A+ and CompTIA Network+. Can I go straight to CySA+ instead of getting CompTIA Security+?

You can, but it’s not recommended. Each CompTIA certification builds on the previous one, and skipping Security+ could leave a gap in your baseline cybersecurity skills. We recommend having a minimum of three to four years of hands-on information security or related experience before taking the CySA+ exam.

Why is CySA+ a separate certification rather than an enhancement of Security+?

CySA+ includes more analytics with a different focus to address the growing specialization in cybersecurity. Security+ is a baseline of general cybersecurity knowledge and skills.

How much does CySA+ overlap with CASP?

About 25 to 30 percent of the content overlaps, mainly under the topics of intrusion detection and vulnerability management.

How does CySA+ compare to other popular cybersecurity certifications?

CySA+ differs from others on the market because it’s a mid-level certification that focuses on security analytics for the security analyst job role. Many other certifications out there don't go into as much detail with analytics. CySA+ also focuses on defense, or “blue team,” cybersecurity skills rather than offense, or “red team,” skills.

I need to renew my Security+ certification. If I pass CySA+ or CompTIA Advanced Security Practitioner (CASP), will that renew it?

Yes, CySA+ and CASP both renew Security+, since they are considered higher-level certifications.

CompTIA Cybersecurity Analyst (CySA+) is for cyber security professionals that perform data analysis and interpret the results to identify vulnerabilities, threats and risks to an organization.

This vendor-neutral certification is considered intermediate to mid-career and will prove to organizations that you have the knowledge and skills needed to spearhead cybersecurity operations, either as a standalone information security professional or as part of a security team.

Job roles such as Security analyst, Security operations center (SOC) analyst, Vulnerability analyst, Cybersecurity specialist, Threat intelligence analyst, Security engineer, Cybersecurity analyst and so on.

Exam:

CS0-002 CySA+ - Released 04/20/2020

Duration:

165 minutes

Questions:

Maximum of 85 performance-based and multiple-choice questions

Skills measured:

• Threat and Vulnerability Management 22%
• Software and Systems Security 18%
• Security Operations and Monitoring 25%
•  Incident Response 22%
• Compliance and Assessment 13%

While our Training Camp boot camps were developed with the expectation that students do not have enough time to complete a rigorous self-study syllabus prior to attending class, we offer students that feel that extra preparation would be helpful a targeted list of self-study objectives that can be completed.

Candidates for this certification should have Network+, Security+ or equivalent knowledge. Minimum of 3-4 years of hands-on information security or related experience. While there is no required prerequisite, CySA+ is intended to follow CompTIA Security+ or equivalent experience and has a technical, hands-on focus.