CompTIA CySA+ (CS0-004) — the full course

Every lesson and every lab is free to read, mapped one-to-one to CompTIA’s published exam objectives. The paid tier adds the 500-question exam simulator; nothing is taken away from the free course to make room for it.

40written lessons

56hands-on labs

67hours of lab work

500practice questions

Start with lesson 1 — What a security operations centre actually does Exam simulator

Jump to a domain: 1. Security Operations · 2. Vulnerability Management · 3. Incident Response and Management · 4. Reporting and Communication

What the exam weighs

Domain	Share of the exam	Lessons here
1. Security Operations	34%	15
2. Vulnerability Management	26%	10
3. Incident Response and Management	24%	9
4. Reporting and Communication	16%	5

The curriculum

1. Security Operations 34% of the exam

01 What a security operations centre actually does objective 1.1 part single
- Triage five alerts you generated yourself short · 45 min
02 Network architecture, read the way an analyst reads it objective 1.1 part single
- See the same traffic from three vantage points short · 45 min
03 Identity as the new perimeter objective 1.1 part single
- Make a service account look like an intrusion short · 45 min
04 Logging: what to collect, and what you will regret not collecting objective 1.1 part single
- Build the telemetry inventory your incident will need applied · 90 min
- Prove your retention is what you think it is short · 45 min
05 Reading malicious activity on the network objective 1.2 part single
- Build a beacon and find it by shape short · 50 min
06 Reading malicious activity on a host objective 1.2 part single
- Read a process tree you built on purpose short · 50 min
07 Malicious activity in applications and cloud services objective 1.2 part single
- Find the web shell in your own access log short · 45 min
08 Account compromise and identity-based attacks objective 1.2 part single
- Find the intrusion you staged a week ago applied · 90 min
- Spray, stuff and travel impossibly short · 50 min
09 SIEM: searching, correlating and not drowning objective 1.3 part single
- Write a detection, then try to slip past it short · 50 min
10 EDR and what it can and cannot see objective 1.3 part single
- Watch EDR see, and not see short · 50 min
11 Packet analysis when the logs are not enough objective 1.3 part single
- Answer six questions from one capture applied · 90 min
- Get the answer without decrypting anything short · 50 min
12 Threat intelligence that changes what you do objective 1.4 part single
- Match a feed against your logs and count what it was worth short · 45 min
13 Threat hunting: looking without an alert objective 1.4 part single
- Turn intelligence into three hunts and one detection applied · 90 min
- Run a hunt that could have failed short · 50 min
14 Automation, orchestration and getting time back objective 1.5 part single
- Automate a playbook and measure what broke applied · 90 min
- Automate the enrichment, keep the decision short · 50 min
15 AI in security operations: uses, risks and governance objective 1.6 part single
- Put a model in the loop and keep it honest applied · 90 min
- Capstone -- be the SOC for a week of your own lab capstone · 180 min
- Check a model's summary against the raw log short · 45 min

2. Vulnerability Management 26% of the exam

01 Choosing the right scan for the question objective 2.1 part single
- Scan the same host four ways and compare the counts short · 60 min
02 Knowing what you have before you scan it objective 2.1 part single
- Find the host that is not on your list short · 50 min
03 Scanning web applications and APIs objective 2.1 part single
- Run a scanning programme against your whole lab applied · 90 min
- Watch a scanner miss most of the application short · 60 min
04 Reading scanner output without believing all of it objective 2.2 part single
- Prove one finding false and one finding real short · 50 min
05 Vulnerabilities in cloud and containers objective 2.2 part single
- Analyse output until you can defend every number applied · 90 min
- Fix the image, not the container short · 50 min
06 CVSS, and what a score does not tell you objective 2.3 part single
- Score by hand, then watch the score mislead you short · 45 min
07 Prioritising with business context objective 2.3 part single
- Re-rank the backlog with context you had all along short · 50 min
08 Fixing, mitigating and accepting objective 2.3 part single
- Take a backlog from ranked to closed, with evidence applied · 90 min
- Patch it, and find out you did not short · 50 min
09 Supply chain and dependency risk objective 2.4 part single
- Respond to a disclosure against your own estate applied · 90 min
- Generate an SBOM and answer the question it exists for short · 50 min
10 Controls, frameworks and where findings hang objective 2.4 part single
- Capstone -- run vulnerability management for a quarter capstone · 180 min
- Show a control exists, then show it operates short · 50 min

3. Incident Response and Management 24% of the exam

01 MITRE ATT&CK, the kill chain and the diamond model objective 3.1 part single
- Build a coverage map you would defend in a review applied · 90 min
- Map your own logs to techniques, then colour the gaps short · 50 min
02 The incident response lifecycle objective 3.2 part single
03 Preparation: the phase that decides the other four objective 3.2 part single
- Write the plan, then run a tabletop that breaks it applied · 90 min
- Measure your readiness instead of asserting it short · 50 min
04 Triage: deciding what this actually is objective 3.3 part single
- Scope it properly, then find out how wrong you were short · 50 min
05 Evidence that survives scrutiny objective 3.3 part single
- Acquire in order, hash it, and prove nothing changed short · 60 min
06 Containing without destroying what you need objective 3.3 part single
- Plant five persistence mechanisms and find all five short · 60 min
07 Enough malware analysis to make a decision objective 3.3 part single
- Triage a binary you wrote, and stop when it stops mattering short · 50 min
08 Responding to ransomware and extortion objective 3.3 part single
- Detect the precursors, and test the restore short · 60 min
09 Root cause, and making the lesson stick objective 3.3 part single
- Respond to an intrusion end to end applied · 120 min
- Capstone -- a ransomware incident from precursor to review capstone · 240 min
- Find nine root causes where you expected one short · 50 min

4. Reporting and Communication 16% of the exam

01 Vulnerability reporting people will act on objective 4.1 part single
- Report a quarter, and get a finding acted on applied · 90 min
- Write the same findings four times short · 50 min
02 Communicating with the people who own the fix objective 4.1 part single
03 Incident documentation as you go, not after objective 4.2 part single
- Write the report from notes you took at the time short · 50 min
04 Communicating while the incident is still running objective 4.2 part single
05 Metrics that change behaviour objective 4.2 part single
- Run the communications half of an incident applied · 90 min
- Capstone -- the analyst's year, reported honestly capstone · 180 min
- Compute your metrics, then game them on purpose short · 50 min

Supplementary not examined — background reading

01 Building a detection lab you can break part single
- Build the lab and prove it cannot reach anything short · 60 min

The exam simulator

500 questions, every one mapped to an objective and to the lesson that teaches it. Timed full-length papers drawn to the real domain split, retakes weighted to your weak areas, and a readiness report from your own results.

Open the simulator See the paid tier

This is an independent study companion for CompTIA CySA+ CS0-004 and is not produced by or endorsed by CompTIA.