CompTIA Cybersecurity Analyst (CySA+)

CompTIA Cybersecurity Analyst (CySA+)

Lesson 1: Explaining the Importance of Security Controls and Security Intelligence

• Topic 1A: Identify Security Control Types
• Topic 1B: Explain the Importance of Threat Data and Intelligence

Lesson 2: Utilising Threat Data and Intelligence

• Topic 2A: Classify Threats and Threat Actor Types
• Topic 2B: Utilise Attack Frameworks and Indicator Management
• Topic 2C: Utilise Threat Modelling and Hunting Methodologies

Lesson 3: Analysing Security Monitoring Data

• Topic 3A: Analyse Network Monitoring Output
• Topic 3B: Analyse Appliance Monitoring Output
• Topic 3C: Analyse Endpoint Monitoring Output
• Topic 3D: Analyse Email Monitoring Output

Lesson 4: Collecting and Querying Security Monitoring Data

• Topic 4A: Configure Log Review and SIEM Tools
• Topic 4B: Analyse and Query Logs and SIEM Data

Lesson 5: Utilising Digital Forensics and Indicator Analysis Techniques

• Topic 5A: Identify Digital Forensics Techniques
• Topic 5B: Analyse Network-related IoCs
• Topic 5C: Analyse Host-related IoCs
• Topic 5D: Analyse Application-Related IoCs
• Topic 5E: Analyse Lateral Movement and Pivot IoCs

Lesson 6: Applying Incident Response Procedures

• Topic 6A: Explain Incident Response Processes
• Topic 6B: Apply Detection and Containment Processes
• Topic 6C: Apply Eradication, Recovery, and Post‑Incident Processes

Lesson 7: Applying Risk Mitigation and Security Frameworks

• Topic 7A: Apply Risk Identification, Calculation, and Prioritisation Processes
• Topic 7B: Explain Frameworks, Policies, and Procedures

Lesson 8: Performing Vulnerability Management

• Topic 8A: Analyse Output from Enumeration Tools
• Topic 8B: Configure Infrastructure Vulnerability Scanning Parameters
• Topic 8C: Analyse Output from Infrastructure Vulnerability Scanners
• Topic 8D: Mitigate Vulnerability Issues

Lesson 9: Applying Security Solutions for Infrastructure Management

• Topic 9A: Apply Identity and Access Management Security Solutions
• Topic 9B: Apply Network Architecture and Segmentation Security Solutions
• Topic 9C: Explain Hardware Assurance Best Practices
• Topic 9D: Explain Vulnerabilities Associated with Specialised Technology

Lesson 10: Understanding Data Privacy and Protection

• Topic 10A: Identify Non-Technical Data and Privacy Controls
• Topic 10B: Identify Technical Data and Privacy Controls

Lesson 11: Applying Security Solutions for Software Assurance

• Topic 11A: Mitigate Software Vulnerabilities and Attacks
• Topic 11B: Mitigate Web Application Vulnerabilities and Attacks
• Topic 11C: Analyse Output from Application Assessments

Lesson 12: Applying Security Solutions for Cloud and Automation

• Topic 12A: Identify Cloud Service and Deployment Model Vulnerabilities
• Topic 12B: Explain Service-Oriented Architecture
• Topic 12C: Analyse Output from Cloud Infrastructure Assessment Tools
• Topic 12D: Compare Automation Concepts and Technologies

CompTIA Cybersecurity Analyst (CySA+)

Lesson 1: Explaining the Importance of Security Controls and Security Intelligence

• Topic 1A: Identify Security Control Types
• Topic 1B: Explain the Importance of Threat Data and Intelligence

Lesson 2: Utilising Threat Data and Intelligence

• Topic 2A: Classify Threats and Threat Actor Types
• Topic 2B: Utilise Attack Frameworks and Indicator Management
• Topic 2C: Utilise Threat Modelling and Hunting Methodologies

Lesson 3: Analysing Security Monitoring Data

• Topic 3A: Analyse Network Monitoring Output
• Topic 3B: Analyse Appliance Monitoring Output
• Topic 3C: Analyse Endpoint Monitoring Output
• Topic 3D: Analyse Email Monitoring Output

Lesson 4: Collecting and Querying Security Monitoring Data

• Topic 4A: Configure Log Review and SIEM Tools
• Topic 4B: Analyse and Query Logs and SIEM Data

Lesson 5: Utilising Digital Forensics and Indicator Analysis Techniques

• Topic 5A: Identify Digital Forensics Techniques
• Topic 5B: Analyse Network-related IoCs
• Topic 5C: Analyse Host-related IoCs
• Topic 5D: Analyse Application-Related IoCs
• Topic 5E: Analyse Lateral Movement and Pivot IoCs

Lesson 6: Applying Incident Response Procedures

• Topic 6A: Explain Incident Response Processes
• Topic 6B: Apply Detection and Containment Processes
• Topic 6C: Apply Eradication, Recovery, and Post‑Incident Processes

Lesson 7: Applying Risk Mitigation and Security Frameworks

• Topic 7A: Apply Risk Identification, Calculation, and Prioritisation Processes
• Topic 7B: Explain Frameworks, Policies, and Procedures

Lesson 8: Performing Vulnerability Management

• Topic 8A: Analyse Output from Enumeration Tools
• Topic 8B: Configure Infrastructure Vulnerability Scanning Parameters
• Topic 8C: Analyse Output from Infrastructure Vulnerability Scanners
• Topic 8D: Mitigate Vulnerability Issues

Lesson 9: Applying Security Solutions for Infrastructure Management

• Topic 9A: Apply Identity and Access Management Security Solutions
• Topic 9B: Apply Network Architecture and Segmentation Security Solutions
• Topic 9C: Explain Hardware Assurance Best Practices
• Topic 9D: Explain Vulnerabilities Associated with Specialised Technology

Lesson 10: Understanding Data Privacy and Protection

• Topic 10A: Identify Non-Technical Data and Privacy Controls
• Topic 10B: Identify Technical Data and Privacy Controls

Lesson 11: Applying Security Solutions for Software Assurance

• Topic 11A: Mitigate Software Vulnerabilities and Attacks
• Topic 11B: Mitigate Web Application Vulnerabilities and Attacks
• Topic 11C: Analyse Output from Application Assessments

Lesson 12: Applying Security Solutions for Cloud and Automation

• Topic 12A: Identify Cloud Service and Deployment Model Vulnerabilities
• Topic 12B: Explain Service-Oriented Architecture
• Topic 12C: Analyse Output from Cloud Infrastructure Assessment Tools
• Topic 12D: Compare Automation Concepts and Technologies

• Examination: CompTIA Cybersecurity Analyst (CySA+)
• Version: V4
• Examination code: CS0-004
• Duration: 165 minutes
• Number of questions: Maximum of 85
• Question format: Multiple-choice and performance-based questions
• Passing score: 750 on a scale of 100–900
• Open book: No
• Delivery: Online proctored examination or at a Pearson VUE test centre

• Examination: CompTIA Cybersecurity Analyst (CySA+)
• Version: V4
• Examination code: CS0-004
• Duration: 165 minutes
• Number of questions: Maximum of 85
• Question format: Multiple-choice and performance-based questions
• Passing score: 750 on a scale of 100–900
• Open book: No
• Delivery: Online proctored examination or at a Pearson VUE test centre

• Five days of instructor-led training and exam preparation delivered by an accredited CompTIA trainer.
• Official CompTIA courseware and learning materials.
• CompTIA CySA+ certification examination voucher included. Examination vouchers are usually valid for up to 12 months from the date of issue; however, CompTIA requirements or funding rules for schemes such as PLA, ReAct or other government-funded programmes may require learners to sit their examination within a shorter timeframe. Learners must meet the examination deadline confirmed by NILC.
• Exam Pass Guarantee – if you do not pass the examination after attending the course, you can retake the same training with NILC at no additional cost. You will only need to pay the examination fee charged by the exam provider. Applies to instructor-led courses only.

• Five days of instructor-led training and exam preparation delivered by an accredited CompTIA trainer.
• Official CompTIA courseware and learning materials.
• CompTIA CySA+ certification examination voucher included. Examination vouchers are usually valid for up to 12 months from the date of issue; however, CompTIA requirements or funding rules for schemes such as PLA, ReAct or other government-funded programmes may require learners to sit their examination within a shorter timeframe. Learners must meet the examination deadline confirmed by NILC.
• Exam Pass Guarantee – if you do not pass the examination after attending the course, you can retake the same training with NILC at no additional cost. You will only need to pay the examination fee charged by the exam provider. Applies to instructor-led courses only.

Delegates should hold CompTIA Network+ and Security+ certifications or have equivalent knowledge.

CompTIA recommends about four years of experience as a security operations centre (SOC) analyst or vulnerability analyst. This is recommended experience, not a requirement to hold another certification.

Delegates should hold CompTIA Network+ and Security+ certifications or have equivalent knowledge.

CompTIA recommends about four years of experience as a security operations centre (SOC) analyst or vulnerability analyst. This is recommended experience, not a requirement to hold another certification.