CySA+ (CS0-003) Exam Mindset Rules
Target audience: SOC analysts, incident responders, threat hunters, and vulnerability management engineers.
- Correlate multiple log sources before declaring root cause: A single alert is a hypothesis. Combine IdP sign-in logs, endpoint process trees, DNS/proxy flows, and application authorization logs.
- Distinguish CVSS severity from real-world exploitability: Prioritize internet-exposed assets with CISA KEV or high EPSS over isolated internal systems with a 9.8 CVSS score.
- Verify postconditions after containment: An HTTP 200 or SOAR playbook checkmark does not mean an attacker session is dead. Verify token revocation and persistence removal.
DOMAIN 1 · 33% OF EXAM
Domain 1: Security Operations
Log ingestion, SIEM/EDR/NDR telemetry analysis, network and host forensics, email header analysis, and automation.
Drill Domain 1 practice questions ↗
Objectives & Mapped Field Lessons
Objective 1.1: Analyze network, identity, endpoint, and email telemetry to detect malicious activity
- Logs, alerts, and evidence: why an alert title is a hypothesis, not proof (F7 · 8 min)
- Identity alert triage: reconstructing who, what, and how across logs (S1 · 11 min)
- Networks in one request: DNS, TCP, TLS, and HTTP (F3 · 10 min)
- Email authentication: what SPF, DKIM, and DMARC prove (and what they do not) (E1a · 8 min)
- OSI and TCP/IP layers, encapsulation, and protocol attacks (N1 · 11 min)
- Agentic SOC architecture: autonomous triage vs human-gated containment (S4 · 10 min)
Domain 1 Rapid-Review Cheat Sheet
DOMAIN 2 · 30% OF EXAM
Domain 2: Vulnerability Management
Asset discovery, vulnerability scanning, SAST/DAST/SCA, SBOM analysis, CVSS v3/v4 vector interpretation, KEV/EPSS prioritization, and compensating controls.
Drill Domain 2 practice questions ↗
Objectives & Mapped Field Lessons
Objective 2.1: Prioritize vulnerabilities using CVSS, EPSS, KEV, asset exposure, and software supply-chain evidence
- Threat, vulnerability, and risk: the core equation (F2 · 9 min)
- Vulnerability prioritization: combining CVSS, KEV, EPSS, and asset exposure (S2 · 9 min)
- SBOM evidence and priority: binding inventory to the running build (A4 · 7 min)
- Software testing: SAST, DAST, IAST, SCA, fuzzing, and coverage math (AT3 · 10 min)
- Penetration testing, Rules of Engagement, and vulnerability validation (AT2 · 10 min)
Domain 2 Rapid-Review Cheat Sheet
DOMAIN 3 · 20% OF EXAM
Domain 3: Incident Response and Management
Triage, containment, eradication, recovery verification, digital forensics, Order of Volatility, and root-cause analysis.
Drill Domain 3 practice questions ↗
Objectives & Mapped Field Lessons
Objective 3.1: Execute containment, forensic evidence preservation, eradication, and verified recovery
- Investigate, respond, and verify: why HTTP 200 or 504 is not containment proof (S3 · 10 min)
- Digital forensics: order of volatility, chain of custody, and legal evidence (S5 · 10 min)
- Continuity operations: recovery sites, backup strategies, RAID, and DR testing (S6 · 14 min)
- Excessive agency: why a model sentence is never an authorization decision (G2 · 10 min)
- Human oversight gates and the NIST AI Risk Management Framework (G3 · 12 min)
Domain 3 Rapid-Review Cheat Sheet
DOMAIN 4 · 17% OF EXAM
Domain 4: Reporting and Communication
Incident reporting, executive risk sentences, compliance evidence, metrics, and stakeholder communication.
Drill Domain 4 practice questions ↗
Objectives & Mapped Field Lessons
Objective 4.1: Communicate incident findings, uncertainty, risk sentences, and control evidence clearly
- Write the risk sentence: cause, asset, and business impact (R1 · 9 min)
- Choose the control and its evidence: policies do not execute themselves (R2 · 10 min)
- Governance as an operating cadence: NIST CSF 2.0 Govern in practice (R3 · 11 min)
- Security audits, SOC 1 / 2 / 3 reports, and Type 1 vs Type 2 evidence (AT1 · 10 min)