CS0-004 — CompTIA CySA+ V4 Cheat Sheet

Last revised: September 16, 2026

Cheat sheet: compact, exam-focused reference for CompTIA CySA+ V4 (CS0-004) incident analysis, threat detection, vulnerability management, and security operations.

Use the tables for a quick pre-exam check. Expand a topic’s notes for explanations, examples, and additional distinctions.

Scope and study context

High-Yield Analyst Mindset

Exam situation	Best analyst instinct
Alert with incomplete evidence	Validate first; do not assume compromise from one indicator.
Active compromise suspected	Scope impact, preserve evidence, then contain based on business risk.
Vulnerability backlog	Prioritize by exploitability, exposure, asset criticality, and compensating controls.
Noisy SIEM rule	Tune with context, thresholds, allowlists, and better fields; do not disable blindly.
User reports phishing	Preserve headers, URLs, attachment hashes, sender details, and affected recipients.
Possible data breach	Escalate through incident process; involve legal/privacy/compliance as required by policy.
Malware on endpoint	Isolate or contain, collect volatile/evidence data if required, then eradicate.
Cloud alert	Check identity activity, resource changes, network exposure, keys/secrets, and audit logs.
Executive report	Summarize impact, risk, business actions, and timeline; avoid tool-only details.
Technical report	Include evidence, queries, hashes, IOCs, affected assets, timeline, and remediation.

This is IT Mastery review support and is not affiliated with CompTIA.

Item	Detail
Vendor/provider	CompTIA
Official exam title	CompTIA CySA+ V4 (CS0-004)
Official exam code	CS0-004
Candidate focus	Cybersecurity analysis, detection, vulnerability management, incident response, communication, and operational security
Best use of this page	Quick concept refresh before IT Mastery practice and original practice questions

SOC Triage Workflow

    flowchart TD
	    A[Alert or report] --> B[Validate signal]
	    B --> C{True positive?}
	    C -- No --> D[Close as false positive or benign true positive]
	    C -- Yes --> E[Classify severity]
	    E --> F[Scope users, hosts, data, and time window]
	    F --> G{Active threat?}
	    G -- Yes --> H[Contain according to playbook]
	    G -- No --> I[Preserve evidence and continue analysis]
	    H --> J[Eradicate root cause]
	    I --> J
	    J --> K[Recover and monitor]
	    K --> L[Lessons learned, tuning, report]

Notes and examples

Triage Questions

Question	Why it matters	Evidence sources
What triggered the alert?	Identifies detection logic and possible blind spots.	SIEM rule, EDR alert, IDS signature, user report
Is the activity expected?	Separates malicious behavior from admin or business activity.	Change tickets, asset owner, maintenance windows
Who is involved?	Determines account risk and possible identity compromise.	IAM logs, VPN logs, SSO logs, directory logs
Which assets are involved?	Drives severity and containment priority.	CMDB, EDR inventory, vulnerability scanner
What is the earliest known activity?	Establishes timeline and dwell time.	SIEM searches, endpoint telemetry, logs
Is the threat still active?	Determines urgency of containment.	EDR process tree, network sessions, active logins
What data or systems are at risk?	Supports impact assessment and escalation.	DLP, database logs, file access, cloud storage logs
What changed recently?	Helps identify root cause.	Patch logs, deployment logs, IAM changes, firewall changes

Severity and Priority Decision Points

Factor	Raises severity	Lowers severity
Asset criticality	Domain controller, production database, identity provider, payment system	Test host, isolated lab, non-sensitive asset
Exposure	Internet-facing, remote access, public cloud resource	Internal-only with strong segmentation
Exploitability	Known exploited vulnerability, working exploit, active exploitation	Theoretical issue, strong compensating control
Privilege	Admin/root/service account involved	Low-privilege account with limited access
Scope	Multiple users, hosts, sites, tenants, or business units	Single contained endpoint
Data impact	Regulated, confidential, financial, customer, or credentials	Public data only
Persistence	New service, scheduled task, startup item, cloud access key	One failed attempt, blocked by control
Business impact	Outage, fraud, ransomware, data loss	Blocked scan or benign policy violation

Notes and examples

Common Severity Trap

Trap	Better exam answer
Treating every malware alert as critical	Determine asset value, spread, privilege, and active behavior.
Prioritizing only by CVSS	Combine CVSS with exploitability, exposure, asset criticality, and threat intelligence.
Closing alert because user is an admin	Validate whether admin behavior matches expected source, time, and change record.
Ignoring failed logins	Look for patterns: password spraying, impossible travel, disabled accounts, distributed sources.
Assuming blocked equals harmless	Blocked attempts can indicate targeting and may require threat hunting or tuning.

Incident Response Phases

Phase	Analyst tasks	Outputs
Preparation	Playbooks, logging, baselines, contacts, access, lab tools	Runbooks, escalation matrix, collection procedures
Detection and analysis	Validate, classify, correlate, scope, preserve evidence	Timeline, indicators, impacted assets
Containment	Short-term and long-term containment based on risk	Isolated hosts, blocked IOCs, disabled accounts
Eradication	Remove malware, close vulnerability, rotate secrets, remove persistence	Clean systems, patched weakness, reset credentials
Recovery	Restore services, monitor for recurrence, validate integrity	Recovered systems, heightened monitoring
Post-incident activity	Lessons learned, metrics, control improvements, reporting	Final report, rule tuning, backlog actions

Notes and examples

Containment Choices

Scenario	Likely containment	Watch for
Single infected workstation	Network isolate via EDR or VLAN quarantine	Do not destroy evidence before collection if forensics is required.
Compromised account	Disable account, revoke sessions/tokens, reset credentials	Check for MFA changes, forwarding rules, OAuth grants.
Web shell on server	Remove from load balancer or restrict access	Preserve web logs, file timestamps, process data.
Active ransomware spread	Isolate segments, disable lateral movement paths, block C2	Coordinate with business continuity and backups.
Leaked API key	Revoke/rotate key, review usage, search repositories	Rotation alone is not enough; determine abuse.
Malicious domain/IP	Block at DNS, proxy, firewall, EDR	Validate collateral impact and use time-bound blocks if needed.
Public cloud storage exposure	Remove public access, review object access logs	Identify downloaded data and misconfiguration source.

Response phase decision path

    flowchart TD
	    A[Alert or report received] --> B{Is activity validated?}
	    B -- No --> C[Collect more evidence]
	    C --> B
	    B -- Yes --> D{Is harm ongoing?}
	    D -- Yes --> E[Contain spread or access]
	    D -- No --> F[Scope affected systems and data]
	    E --> F
	    F --> G[Eradicate root cause]
	    G --> H[Recover and monitor]
	    H --> I[Lessons learned and reporting]

Incident response phase reminders

Phase	Analyst focus	Common mistake
Preparation	Playbooks, contacts, tools, training, logging	Waiting until incident to define roles
Detection and analysis	Validate, scope, classify, prioritize	Declaring breach from one weak signal
Containment	Limit damage and spread	Taking systems offline without considering business impact
Eradication	Remove malware, persistence, compromised accounts	Missing root cause
Recovery	Restore services and monitor	Reconnecting before validating clean state
Lessons learned	Improve controls and process	Skipping documentation after recovery

Containment choices

Situation	Likely containment
Malware on one workstation	Isolate host via EDR or network control
Compromised user account	Disable account, revoke sessions/tokens, reset credentials
Leaked API key	Revoke key, rotate secrets, review access logs
Ransomware spreading	Segment network, isolate affected hosts, disable propagation paths
Malicious email campaign	Quarantine messages, block sender/domain/URL, search mailboxes
Web app attack	WAF rule, disable vulnerable function, patch app
Cloud storage exposure	Remove public access, review object access logs
Insider data theft	Preserve evidence, restrict access, involve appropriate stakeholders

Incident classification clues

Incident type	Evidence to look for
Phishing	Email headers, links, attachments, sender domain, user clicks
Malware	Hashes, process tree, persistence, network beacons
Ransomware	File extension changes, ransom note, encryption activity
Credential compromise	Impossible travel, MFA fatigue, new devices, token abuse
Data exfiltration	Large outbound transfer, unusual destination, sensitive file access
Web application attack	Injection strings, abnormal parameters, WAF alerts, error spikes
DDoS	Traffic volume, many sources, service degradation
Insider threat	Unusual access, bulk downloads, policy violations, timing
Cloud compromise	New keys, role changes, unusual API calls, public resources

Incident response traps

Trap: “Delete malware first.” Better answer: isolate, collect evidence if needed, then eradicate.
Trap: “Power off every system.” Better answer: consider volatile evidence, business impact, and containment goals.
Trap: “Notify everyone immediately with unverified claims.” Better answer: communicate confirmed facts, impact, actions, and uncertainty.
Trap: “Restore from backup before root cause analysis.” Better answer: ensure the restored environment will not be reinfected.
Trap: “Close after service restoration.” Better answer: monitor, document, and hold lessons learned.

Evidence Preservation and Chain of Custody

Concept	Exam relevance
Integrity	Hash evidence and avoid modifying originals.
Chain of custody	Document who collected, handled, transferred, and stored evidence.
Volatile data	Memory, network connections, logged-in users, running processes; collect early if required.
Order of volatility	Prioritize data most likely to disappear first.
Time synchronization	Use consistent timestamps and time zones; NTP issues can distort timelines.
Forensic image	Bit-level copy for deeper analysis or legal preservation.
Write blocker	Prevents modification of source media during acquisition.
Evidence log	Records date/time, collector, system, method, hash, storage location, purpose.

Log and Telemetry Source Matrix

Source	Best for detecting	Key fields to inspect
SIEM	Cross-source correlation, timelines, rule alerts	Time, host, user, event type, source, destination
EDR/XDR	Malware, process chains, lateral movement, persistence	Process, parent process, command line, hash, user
Windows Security logs	Logons, privilege use, account changes	Event ID, logon type, SID, username, workstation
Sysmon	Process creation, network connections, file changes	Event ID, image, command line, hash, parent image
Linux auth logs	SSH access, sudo usage, authentication failures	User, source IP, TTY, command
Web server logs	Web attacks, scanning, exploitation attempts	URI, method, status, user agent, source IP
DNS logs	C2, tunneling, malware callbacks, DGA	Query, response, record type, entropy, NXDOMAIN rate
Proxy/SWG logs	Web access, downloads, blocked URLs	URL, category, action, user, bytes
Firewall logs	Network flows, denied traffic, policy hits	Source/destination, port, protocol, action
IDS/IPS	Exploit signatures, suspicious traffic	Signature, severity, packet metadata
NetFlow	Beaconing, exfiltration volume, lateral movement	5-tuple, bytes, packets, duration
VPN logs	Remote access, impossible travel, suspicious geolocation	User, IP, device, MFA result, duration
IAM/SSO logs	Account takeover, risky sign-ins, MFA events	User, app, result, IP, device, token events
Email gateway	Phishing, malware attachments, spoofing	Sender, SPF/DKIM/DMARC, URLs, attachment hash
DLP	Data movement and policy violations	User, file, data type, destination, action
Cloud audit logs	API actions, resource changes, identity misuse	Principal, action, resource, source IP, result
Container logs	Runtime behavior, image pulls, orchestration events	Image, namespace, pod/container, command
WAF logs	Web app attacks and blocked requests	Rule, URI, payload, source, action

Windows Event IDs Commonly Seen in Analysis

Event ID	Meaning	Analyst use
4624	Successful logon	Identify access time, account, logon type, source.
4625	Failed logon	Detect brute force, spraying, invalid account attempts.
4634	Logoff	Session timeline support.
4648	Explicit credentials used	Lateral movement or run-as behavior.
4672	Special privileges assigned	Admin-level logon clue.
4688	Process creation	Command execution and process lineage.
4697	Service installed	Persistence or admin software deployment.
4720	User account created	Unauthorized account creation.
4726	User account deleted	Anti-forensics or admin change.
4728 / 4732	User added to privileged group	Privilege escalation.
4740	Account locked out	Brute force or user issue.
4768 / 4769	Kerberos ticket activity	Kerberos authentication and service ticket analysis.
4776	NTLM authentication	Legacy auth and lateral movement clues.
1102	Audit log cleared	Strong anti-forensics indicator.

Sysmon Event IDs Commonly Seen in Analysis

Event ID	Meaning	Analyst use
1	Process creation	Command line, parent process, executable path.
3	Network connection	Process-to-network mapping.
7	Image loaded	DLL loading and suspicious libraries.
8	Create remote thread	Injection and lateral movement clue.
10	Process access	Credential dumping or process tampering.
11	File created	Dropped payloads or staged tools.
12-14	Registry object/value changes	Persistence and configuration changes.
15	File stream created	Alternate data streams.
22	DNS query	Process-level DNS investigation.

Linux and macOS Artifact Reference

Artifact	Platform	What it can show
`/var/log/auth.log` or `/var/log/secure`	Linux	SSH, sudo, authentication events
`~/.bash_history`	Linux	User command history, if not cleared
`/etc/passwd`, `/etc/shadow`, `/etc/sudoers`	Linux	Account and privilege changes
`crontab`, `/etc/cron*`	Linux	Scheduled persistence
`systemctl` service files	Linux	Service-based persistence
`journalctl`	Linux	Systemd logs and service events
`last`, `lastlog`, `who`	Linux	Login history and active users
LaunchAgents / LaunchDaemons	macOS	Persistence
Unified logs	macOS	System and application events
Keychain access events	macOS	Credential access clues

Network Analysis Cheat Sheet

Common Ports and Protocols

Port	Protocol	Analyst significance
20/21	FTP	Cleartext file transfer, credential exposure
22	SSH/SFTP	Remote administration, tunneling, brute force
23	Telnet	Insecure remote access
25	SMTP	Mail transfer, spam, phishing infrastructure
53	DNS	Resolution, tunneling, C2, exfiltration
67/68	DHCP	Address assignment, rogue DHCP clues
80	HTTP	Web traffic, exploit delivery
88	Kerberos	AD authentication
110/143	POP3/IMAP	Email retrieval
123	NTP	Time synchronization, amplification abuse
135/139/445	RPC/NetBIOS/SMB	Windows lateral movement, file sharing
389/636	LDAP/LDAPS	Directory queries and authentication
443	HTTPS	Encrypted web, C2, API traffic
514	Syslog	Centralized logging
587	SMTP submission	User mail submission
993/995	IMAPS/POP3S	Secure email retrieval
1433	MS SQL Server	Database access
1521	Oracle DB	Database access
3306	MySQL/MariaDB	Database access
3389	RDP	Remote desktop, brute force, lateral movement
5432	PostgreSQL	Database access
5900	VNC	Remote control
5985/5986	WinRM	Windows remote management
6379	Redis	Exposed cache/data store risk
8080/8443	Alternate HTTP/HTTPS	Proxies, admin panels, web apps

Notes and examples

TCP Flags

Flag	Meaning	Analyst clue
SYN	Start connection	SYN flood or scanning if high volume.
SYN-ACK	Server response	Confirms open service.
ACK	Acknowledgment	Seen in established sessions.
FIN	Graceful close	FIN scans may evade simple detection.
RST	Reset	Closed port, refused connection, or interrupted session.
PSH	Push data	Data transfer clue.
URG	Urgent	Rare; suspicious in scans or evasive traffic.

Suspicious Network Patterns

Pattern	Possible meaning
Many ports on one host	Port scan
One port across many hosts	Service sweep
Regular outbound connections	Beaconing
High DNS query entropy	DGA or tunneling
Many NXDOMAIN responses	DGA, typo-squatting checks, misconfig
Large outbound upload to unusual location	Exfiltration
SMB/RDP from workstation to many peers	Lateral movement
New outbound traffic from server segment	Compromise or misconfiguration
TLS to rare domain with self-signed cert	Malware C2 or test system
HTTP POST bursts after archive creation	Possible staged exfiltration

Packet and flow interpretation

Observation	Possible interpretation
SYN packets to many ports	Port scan
SYN packets to many hosts on same port	Service sweep
Large outbound HTTPS to unknown host	Possible exfiltration or normal cloud use
Repeated DNS TXT queries	Possible DNS tunneling
ICMP traffic with abnormal payload size	Possible tunneling or testing
SMB connections between workstations	Possible lateral movement
Beaconing at fixed intervals	Possible command-and-control
TLS to rare domain shortly after malware execution	Suspicious outbound callback

Common ports and services

Port/protocol	Service	Analyst note
22/TCP	SSH	Admin access; watch brute force and exposed keys
25/TCP	SMTP	Mail transfer; abuse and spoofing concerns
53/UDP/TCP	DNS	Tunneling, DGA, suspicious lookups
80/TCP	HTTP	Web traffic; inspect where unencrypted
443/TCP	HTTPS	Encrypted web traffic; use metadata and endpoint logs
445/TCP	SMB	Windows file sharing; lateral movement risk
3389/TCP	RDP	Remote access; high-value target
389/636	LDAP/LDAPS	Directory services
1433/TCP	MS SQL	Database exposure risk
3306/TCP	MySQL	Database exposure risk
5432/TCP	PostgreSQL	Database exposure risk

Network control selection

Need	Control
Block known bad traffic	Firewall, proxy, DNS filtering
Detect suspicious network activity	IDS, NDR, SIEM correlation
Stop malicious traffic inline	IPS, WAF, secure web gateway
Separate sensitive systems	Segmentation, VLANs, ACLs, microsegmentation
Secure remote access	VPN, ZTNA, MFA, conditional access
Protect web applications	WAF, secure coding, patching
Limit outbound exfiltration	Egress filtering, DLP, proxy controls

Threat Intelligence Reference

Term	Meaning	Exam use
IOC	Observable indicator such as IP, domain, URL, hash	Fast blocking and matching; often short-lived.
IOA	Indicator of attack behavior	More durable than atomic IOCs.
TTP	Tactics, techniques, and procedures	Maps adversary behavior to detection and controls.
Campaign	Coordinated activity over time	Helps cluster related incidents.
Actor	Individual or group behind activity	Attribution is usually low confidence unless supported.
Enrichment	Adding context to raw indicator	Reputation, WHOIS, geolocation, passive DNS, sandbox.
Confidence	Degree of trust in intelligence	Prevents overreaction to weak indicators.
Relevance	Fit to your environment	High-confidence intel may still be irrelevant.
Timeliness	Freshness of intel	Old IP/domain IOCs may be stale.
STIX	Structured format for threat intelligence	Sharing and machine-readable context.
TAXII	Transport mechanism for threat intel sharing	Automated exchange of STIX data.

Notes and examples

Intelligence Source Types

Source	Strength	Limitation
Internal telemetry	Highly relevant to environment	May lack external context.
ISAC/ISAO sharing	Sector-specific	Varies by sector and participation.
Vendor feeds	Operationally useful	Can be noisy or overlapping.
Open-source intelligence	Accessible and broad	Requires validation.
Government advisories	Authoritative for campaigns and critical issues	May be high level or delayed.
Dark web monitoring	Can reveal credential/data exposure	Requires careful validation and legal handling.
Honeypots	Useful attacker behavior data	May not represent production targeting.

Intelligence types

Type	Focus	Example use
Strategic	Business-level threat trends	Executive risk planning
Operational	Campaigns, adversary objectives, target sectors	Prepare defenses for likely attacks
Tactical	TTPs and behaviors	Improve detections and playbooks
Technical	IOCs such as IPs, hashes, domains	Block, search, enrich alerts

IOC versus TTP

Item	Meaning	Durability
IP address	Infrastructure indicator	Often short-lived
Domain	C2, phishing, or staging indicator	Can change quickly
File hash	Exact file match	Breaks if file changes
URL	Specific web resource	Useful but often temporary
Registry key	Host persistence clue	More durable than hash
Process behavior	Execution pattern	More durable
Attack technique	Adversary method	Most useful for detection engineering

Threat intel quality checks

Before acting on threat intelligence, ask:

Is it relevant to your industry, geography, technology stack, or users?
Is it timely, or is it stale?
Is the source reliable?
Is the confidence level clear?
Can the indicator cause collateral damage if blocked?
Does it support detection, prevention, hunting, or executive reporting?
Has it been correlated with internal telemetry?

Common formats and tools

Item	Purpose
STIX	Structured threat intelligence representation
TAXII	Sharing transport for threat intelligence
YARA	File/content pattern matching, often malware-focused
Sigma	Generic SIEM detection rule format
Snort/Suricata rules	Network detection signatures
ATT&CK-style mapping	Organizing adversary tactics and techniques
Threat feeds	External indicators for enrichment and blocking

Frameworks and Models

Framework/model	Use it for	Key exam distinction
MITRE ATT&CK	Mapping tactics and techniques	Behavior-oriented; useful for detection gaps.
Cyber Kill Chain	Attack lifecycle from recon to actions	Linear model; good for explaining progression.
Diamond Model	Adversary, capability, infrastructure, victim	Good for pivoting relationships.
Pyramid of Pain	Value of disrupting different indicators	Hashes are easy to change; TTPs are harder.
CVE	Unique vulnerability identifier	Names the weakness, not the risk by itself.
CVSS	Severity scoring framework	Useful input, not the only prioritization factor.
EPSS	Exploit likelihood estimate	Helps prioritize based on probability of exploitation.
KEV catalog concept	Known exploited vulnerabilities	Prioritize when relevant to your assets.
NIST CSF concept	Identify, Protect, Detect, Respond, Recover	High-level program framework.
CIS Controls concept	Prioritized safeguards	Control selection and maturity improvement.

Indicator Durability

Indicator type	Example	Durability	Best use
Hash	SHA-256 of malware	Low	Exact file detection
IP address	C2 IP	Low	Short-term blocking and scoping
Domain	Malicious domain	Low/medium	DNS/proxy detection
URL path	Exploit or payload URL	Medium	Web/proxy detection
File path	Suspicious executable path	Medium	Host hunting
Registry key	Run key persistence	Medium	Endpoint detection
Mutex	Malware family artifact	Medium	Malware clustering
Command line	LOLBin misuse pattern	High	Behavioral detection
Technique	Credential dumping via LSASS access	High	Durable detection engineering

Attack Pattern Reference

Attack	Common clues	Primary evidence	Defensive response
Phishing	Spoofed sender, urgent language, malicious URL/attachment	Email headers, gateway logs, URL sandbox, attachment hash	Quarantine, block indicators, user notification, credential reset if clicked
Business email compromise	Mailbox rules, unusual payment request, changed banking details	Mailbox audit, login history, forwarding rules	Disable forwarding, reset credentials, review financial process
Password spraying	Many usernames, few attempts each, common passwords	IAM, VPN, AD logs	Block source, enforce MFA, lockout tuning, user awareness
Credential stuffing	Known leaked credentials, many services attempted	WAF, IAM, proxy logs	MFA, bot controls, credential reset
Brute force	Repeated attempts against one/few accounts	Auth logs	Rate limiting, lockout, IP blocks
Pass-the-hash	NTLM use, lateral movement without plaintext password	Windows logs, EDR, network logs	Disable compromised accounts, segment, reduce admin reuse
Kerberoasting	Service ticket requests for SPNs, offline cracking	Kerberos logs, AD audit	Rotate service account passwords, use managed service accounts
Web shell	Unexpected script file, odd process spawned by web server	Web logs, file integrity, EDR	Isolate server, remove shell, patch app
SQL injection	Suspicious query strings, database errors	WAF, web logs, DB logs	Parameterized queries, WAF tuning, patch code
XSS	Script payload in input/output	Web logs, app logs, reports	Output encoding, input validation, CSP
SSRF	Server requests internal metadata or internal URLs	App logs, cloud logs, proxy logs	Egress controls, metadata protections, input validation
Ransomware	File renames, ransom note, mass encryption, shadow copy deletion	EDR, file server logs, process tree	Isolate, preserve evidence, restore from clean backups
Cryptojacking	High CPU, mining pool connections	EDR, DNS/proxy, cloud billing anomaly	Kill workload, remove miner, fix exposed service
Data exfiltration	Large outbound transfer, compression, unusual destination	DLP, proxy, NetFlow, cloud logs	Contain, determine data set, notify stakeholders
Insider misuse	Access outside role, unusual downloads, policy violation	DLP, IAM, file access logs	Investigate with HR/legal per policy
Supply chain compromise	Trusted update or dependency behaves maliciously	EDR, package logs, CI/CD logs	Pin/verify packages, rotate secrets, rebuild from trusted source

Malware and Endpoint Clues

Behavior	Possible technique
Office app spawns PowerShell	Malicious macro or phishing payload
PowerShell with encoded command	Obfuscation or fileless execution
`rundll32`, `regsvr32`, `mshta`, `wmic` unusual usage	Living-off-the-land execution
New scheduled task	Persistence
New service with random name	Persistence or remote execution
LSASS memory access	Credential dumping
Security tool disabled	Defense evasion
Log cleared after admin logon	Anti-forensics
Archive created before outbound upload	Exfiltration staging
Process injects into browser/system process	Defense evasion or credential theft
Unexpected outbound TLS from server	C2 or unauthorized integration

Notes and examples

Living-off-the-Land Binaries to Recognize

Tool	Normal use	Suspicious use
PowerShell	Administration and automation	Encoded commands, download cradle, hidden window
WMI/WMIC	Remote management	Remote process execution across many hosts
PsExec	Admin remote execution	Lateral movement with reused admin credentials
Certutil	Certificate utility	Downloading/encoding payloads
Regsvr32	Register DLLs	Scriptlet execution from remote URL
Rundll32	Execute DLL functions	Unknown DLL from temp/user path
Mshta	Run HTML applications	Remote script execution
Bitsadmin/BITS	Background transfer	Stealthy payload download
Schtasks	Scheduled tasks	Persistence at logon/startup
Net.exe	Windows network/admin tool	User/group changes, share discovery

Vulnerability Management Workflow

    flowchart TD
	    A[Asset inventory] --> B[Scan or assess]
	    B --> C[Validate findings]
	    C --> D[Prioritize risk]
	    D --> E[Assign remediation owner]
	    E --> F[Patch, configure, isolate, or accept]
	    F --> G[Rescan and verify]
	    G --> H[Report metrics and exceptions]
	    H --> A

Notes and examples

Vulnerability Terms

Term	Meaning	Exam distinction
Vulnerability	Weakness that could be exploited	Not the same as an exploit or threat.
Threat	Potential cause of harm	Actor, event, or condition.
Risk	Likelihood and impact of a threat exploiting a vulnerability	Drives prioritization.
Exposure	Reachability or accessibility of weakness	Internet-facing exposure raises urgency.
Exploit	Code or method to take advantage of a vulnerability	Public exploit changes priority.
Patch	Vendor update correcting weakness	Preferred when feasible and tested.
Mitigation	Reduces risk without fully removing weakness	Useful when patching is delayed.
Compensating control	Alternate control that reduces risk	Must be documented and monitored.
Exception	Approved deviation from policy	Requires owner, justification, expiration.
False positive	Finding is not actually present	Validate before closing.
False negative	Scanner missed a real issue	Dangerous; improve coverage and credentials.
Credentialed scan	Authenticated assessment	More accurate, deeper configuration visibility.
Uncredentialed scan	External view without credentials	Shows attacker-visible exposure but less detail.
Agent-based scan	Local agent reports posture	Useful for roaming endpoints.
Passive scan	Observes traffic/assets without probing	Lower disruption, less complete.

Prioritization Inputs

Input	Why it matters
Asset criticality	Critical assets have higher business impact.
Data classification	Sensitive data increases impact.
Internet exposure	Easier attacker access.
Exploit availability	Raises likelihood.
Active exploitation	Strong urgency signal.
Authentication required	May lower likelihood but not eliminate risk.
Privileges required	Affects attack feasibility.
Attack complexity	Lower complexity usually higher priority.
Compensating controls	Segmentation, WAF, EDR, hardening may reduce risk.
Business constraints	Maintenance windows and uptime affect remediation plan.
Age of finding	Long-open issues indicate process weakness.
Vulnerability chaining	Medium issues can combine into high risk.

Risk Formula Concepts

\[ \text{Risk} = \text{Likelihood} \times \text{Impact} \]\[ \text{Residual Risk} = \text{Inherent Risk} - \text{Control Effectiveness} \]

Use formulas conceptually. For the exam, the key is usually which factor changes risk and which remediation is most appropriate, not advanced calculation.

Remediation Decision Matrix

Finding type	Preferred action	If immediate fix is not possible
Missing security patch	Test and deploy patch	Isolate, restrict access, apply virtual patch/WAF rule
Default credentials	Change/remove defaults	Disable service until remediated
Weak cipher/protocol	Disable weak option, enforce secure configuration	Restrict access and document exception
Public storage bucket	Remove public access, apply least privilege	Monitor access and notify data owner
Exposed admin interface	Restrict by VPN/jump host/allowlist	Disable interface or add strong MFA
Unsupported software	Upgrade or replace	Segment, monitor, document migration plan
SQL injection	Fix code with parameterized queries	WAF rule as temporary mitigation
Misconfigured IAM	Remove excessive privileges	Apply permission boundary/approval workflow
Container image CVE	Rebuild from patched base image	Block deployment or isolate workload
Insecure secrets storage	Move to secrets manager/vault	Rotate exposed secrets and remove from repo

Vulnerability lifecycle

    flowchart LR
	    A[Asset inventory] --> B[Discover vulnerabilities]
	    B --> C[Validate findings]
	    C --> D[Prioritize risk]
	    D --> E[Remediate or mitigate]
	    E --> F[Verify fix]
	    F --> G[Report status]
	    G --> A

Prioritization factors

Do not prioritize remediation by scanner severity alone. Combine technical severity with business context.

Factor	Why it matters
Asset criticality	A medium issue on a crown-jewel system may outrank a high issue on a low-value lab host
Internet exposure	Externally reachable systems are easier to attack
Exploit availability	Known working exploit increases urgency
Active exploitation	Evidence of attacks raises priority
Data sensitivity	Systems with regulated or confidential data carry higher impact
Privilege required	No-auth remote issues are generally more urgent
Compensating controls	WAF, segmentation, EDR, or hardening may reduce immediate risk
Patch complexity	Downtime, dependencies, and testing affect remediation planning
Business deadline	Critical operations may require mitigation before patching
Vulnerability age	Long-open findings can indicate process failure

Scanner result interpretation

Finding type	Analyst caution
Unauthenticated scan	Faster and safer but may miss local/package/configuration issues
Authenticated scan	More complete but depends on credential scope and health
Agent-based scan	Good for roaming endpoints but requires deployment and maintenance
Network scan	Finds exposed services but may not see internal host state
Web app scan	Useful for application flaws but can create noise or affect fragile apps
Container image scan	Finds package/library issues before deployment
Cloud configuration scan	Detects risky permissions, public storage, insecure networking
False positive	Validate before escalating as confirmed risk
False negative	May occur if scanner lacks access, signatures, or context

Remediation versus mitigation

Action	Use when	Example
Remediation	You can remove the vulnerability	Apply vendor patch
Mitigation	You reduce likelihood or impact temporarily	Add WAF rule, disable service, restrict access
Compensating control	Alternative control provides comparable risk reduction	Network segmentation around unsupported system
Risk acceptance	Business formally accepts residual risk	Exception with owner and review date
Risk transfer	Shift financial/operational impact	Cyber insurance or outsourced responsibility
Avoidance	Stop the risky activity	Decommission exposed legacy app

Vulnerability management traps

Trap: “Highest CVSS always first.” Better answer: prioritize by exploitability, exposure, asset value, and business impact.
Trap: “Patch immediately in production.” Better answer: follow change control, test when appropriate, and use mitigation if urgent.
Trap: “Scanner output equals truth.” Better answer: validate critical findings and investigate anomalies.
Trap: “Risk accepted forever.” Better answer: exceptions should be documented, owned, justified, and reviewed.
Trap: “Remediation complete when ticket closes.” Better answer: verify with rescanning or control validation.

Configuration and Compliance Assessment

Control area	What to check
Baseline hardening	Secure build standards, disabled unnecessary services
Patch state	OS, applications, firmware, dependencies
Identity	MFA, privileged accounts, stale accounts, group membership
Logging	Required audit logs enabled and forwarded
Encryption	Data at rest and in transit based on classification
Network	Segmentation, exposed ports, firewall rules
Endpoint	EDR status, disk encryption, local admin rights
Cloud	Public exposure, IAM policies, audit logs, key rotation
Containers	Image provenance, vulnerabilities, runtime privileges
Secrets	No hardcoded secrets, rotation, vault usage
Backups	Backup success, isolation, restore testing
Exceptions	Approved, time-bound, risk accepted by owner

Detection Engineering Reference

Detection Rule Quality

Rule attribute	Good sign	Bad sign
Data source	Reliable logs with needed fields	Missing or inconsistent telemetry
Logic	Maps to adversary behavior	Overly broad keyword matching
Context	Uses asset/user criticality	Same severity for all assets
Threshold	Based on baseline and behavior	Arbitrary count without tuning
Suppression	Reduces known benign noise	Hides true positives
Testability	Can be validated with sample events	No test data or expected output
Response	Links to playbook	No owner or next action
Maintenance	Reviewed after incidents and environment changes	Stale rule no one owns

Notes and examples

Detection Logic Patterns

Pattern	Example use
Threshold	More than normal failed logins in a time window
Sequence	Phishing click followed by new mailbox rule
Rare event	First-time admin login from a country
Frequency	Beacon every fixed interval
Correlation	EDR malware hash plus proxy download
Statistical anomaly	User downloads far more data than baseline
Watchlist match	Known malicious domain queried
Behavior chain	Recon, credential access, lateral movement

False Positive Reduction

Technique	Use when
Add asset context	Admin servers or scanners trigger known events.
Add user context	Service accounts behave differently than humans.
Tune thresholds	Rule fires for normal bursty behavior.
Add maintenance-window suppression	Alerts occur during approved changes.
Allowlist carefully	Known-good signed tool or scanner is noisy.
Use parent/child process logic	Single process name is too broad.
Require multiple signals	Single weak IOC creates noise.
Review field normalization	Rule misses or misfires due to inconsistent fields.

SIEM and Query Concepts

Concept	Meaning
Normalization	Mapping vendor-specific fields to common names.
Parsing	Extracting fields from raw log text.
Correlation	Connecting events across sources.
Aggregation	Counting/grouping events over time.
Baseline	Expected activity for comparison.
Enrichment	Adding context such as asset owner or threat reputation.
Suppression	Temporarily hiding known benign matches.
Deduplication	Removing repeated identical events.
Time window	Period used for correlation or thresholding.
Ingestion gap	Missing logs that create detection blind spots.

Notes and examples

Vendor-Neutral Query Examples

Failed logins by user and source:

event.category = authentication
AND event.outcome = failure
GROUP BY user.name, source.ip
COUNT >= threshold
WITHIN time_window

Suspicious PowerShell:

process.name = "powershell.exe"
AND (
  process.command_line CONTAINS "-enc"
  OR process.command_line CONTAINS "IEX"
  OR process.command_line CONTAINS "DownloadString"
)

Possible beaconing:

network.direction = outbound
GROUP BY source.host, destination.domain
CALCULATE regular_interval_score, connection_count
FILTER connection_count >= threshold

Mailbox forwarding rule creation:

event.action IN ("New-InboxRule", "Set-InboxRule", "Create forwarding rule")
AND user.type = "human"

Sigma and YARA Recognition

Sigma-Style Detection Skeleton

title: Suspicious Encoded PowerShell
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith: '\powershell.exe'
    CommandLine|contains:
      - '-enc'
      - '-encodedcommand'
  condition: selection
level: high

YARA-Style Malware Matching Skeleton

rule Suspicious_Macro_Dropper_Example
{
    strings:
        $a = "AutoOpen" nocase
        $b = "CreateObject" nocase
        $c = "powershell" nocase
    condition:
        2 of ($a,$b,$c)
}

Tool/language	Best for	Not best for
Sigma	SIEM-portable log detections	Deep file content matching
YARA	File and malware pattern matching	Network flow correlation
Snort/Suricata rule	Network packet/payload detection	Host-only behavior
Regex	Field extraction and pattern matching	Complex risk context by itself

Email and Phishing Analysis

Artifact	What to inspect
From header	Display-name spoofing and sender mismatch
Return-Path	Bounce address and infrastructure
Received headers	Mail path and originating server clues
Reply-To	Business email compromise clue
SPF	Whether sending IP is authorized for domain
DKIM	Whether message signature validates
DMARC	Domain policy alignment for SPF/DKIM
URLs	Redirectors, punycode, lookalike domains, tracking
Attachments	File type mismatch, macros, archive nesting, hashes
Message-ID	Odd format or infrastructure clue
Language/intent	Urgency, payment change, credential request

SPF, DKIM, DMARC Distinction

Control	Validates	Analyst use
SPF	Sending server is authorized for domain	Helps detect spoofed sending infrastructure.
DKIM	Message has valid cryptographic signature	Detects modification and validates signing domain.
DMARC	Alignment and policy using SPF/DKIM	Indicates how receivers should handle failures.

Notes and examples

Phishing investigation checklist

Evidence	What to inspect
Headers	Sender path, return-path, received chain
SPF/DKIM/DMARC	Authentication and domain alignment
URLs	Redirects, lookalike domains, reputation
Attachments	Hashes, macros, sandbox results
User reports	Who received, clicked, submitted credentials
Mail gateway logs	Delivery, quarantine, similar messages
Authentication logs	Login attempts after click
Endpoint telemetry	Downloaded payload or script execution

Phishing response actions

Preserve a copy of the message and headers.
Identify all recipients.
Quarantine or remove similar messages.
Block malicious domains, URLs, hashes, or senders where appropriate.
Determine who clicked or submitted credentials.
Reset credentials and revoke sessions for affected users.
Search for payload execution or persistence.
Communicate user guidance without blame.
Update detections and awareness material.

Web Application Attack Clues

Attack	Example clue	Better control
SQL injection	`' OR 1=1--`, `UNION SELECT`	Parameterized queries, input validation
Reflected XSS	`<script>alert(1)</script>` in request	Output encoding, CSP
Stored XSS	Malicious script persists in comments/profile	Output encoding, sanitization
Command injection	`; cat /etc/passwd`, `&& whoami`	Avoid shell calls, input allowlisting
Directory traversal	`../../etc/passwd`	Normalize paths, restrict file access
SSRF	Request to metadata/internal IP	Egress filtering, metadata protections
Insecure deserialization	Serialized payload causing code execution	Safe serialization, signing, validation
File inclusion	Remote/local file path in parameter	Restrict includes, validate paths
IDOR	Changing object ID accesses another user data	Object-level authorization checks
CSRF	State change from forged request	CSRF tokens, SameSite cookies

IAM and Access Control

Concept	Meaning	Exam decision point
Least privilege	Minimum permissions required	Preferred over broad admin rights.
Need to know	Access only to required information	Important for sensitive data.
RBAC	Permissions based on role	Good for stable job functions.
ABAC	Permissions based on attributes	Good for dynamic context such as location/device/data label.
DAC	Owner controls access	Flexible but less centrally controlled.
MAC	System-enforced labels	High-control environments.
PAM	Controls privileged access	Use for admin credentials, session recording, JIT access.
JIT access	Temporary elevated permissions	Reduces standing privilege.
JEA	Admin can perform only specific tasks	Limits blast radius.
MFA	Additional authentication factor	Strong control against password compromise.
SSO	One login across apps	Improves management; increases IdP criticality.
Federation	Trust between identity providers and services	Common for cloud/SaaS access.
Conditional access	Policy based on risk/context	Device, location, MFA, user risk.
Service account	Non-human account for services	Monitor, least privilege, rotate secrets.

Notes and examples

Authentication and Authorization Protocols

Protocol	Primary use	High-yield distinction
SAML	Federated enterprise SSO	XML-based assertions, common with SaaS.
OAuth 2.0	Delegated authorization	Grants app access; not primarily authentication.
OpenID Connect	Authentication layer on OAuth 2.0	Provides identity tokens.
Kerberos	Domain authentication	Ticket-based; common in Active Directory.
LDAP/LDAPS	Directory queries/authentication	LDAPS encrypts LDAP traffic.
RADIUS	Network access authentication	Common for VPN/Wi-Fi AAA.
TACACS+	Device administration AAA	Separates authentication, authorization, accounting.

Identity attack patterns

Pattern	Clue	Response
Password spraying	Few attempts across many accounts	Block source, enforce MFA, detect low-rate failures
Brute force	Many attempts against one account	Lockout policy, source blocking, reset if compromised
MFA fatigue	Many push prompts	Revoke sessions, educate user, require phishing-resistant MFA where available
Impossible travel	Logins from distant locations in short time	Validate user, check VPN/proxy, revoke if suspicious
Privilege escalation	New admin rights or role changes	Review change authorization and actor
Token theft	Valid session from unusual context	Revoke tokens/sessions and investigate endpoint
Service account abuse	Interactive login or unusual access	Restrict use, rotate secret, monitor activity

Authentication and federation concepts

Concept	Review point
MFA	Adds factor; not all MFA is equally phishing-resistant
SSO	Centralizes authentication; compromise can have broad impact
SAML	Common enterprise federation protocol
OAuth 2.0	Authorization framework for delegated access
OpenID Connect	Authentication layer built on OAuth 2.0
Kerberos	Ticket-based authentication common in Windows domains
Conditional access	Policy based on user, device, location, risk, app
Least privilege	Users and services get only necessary access
Privileged access management	Controls and monitors high-risk admin access

Identity traps

OAuth is not the same as authentication by itself. OpenID Connect provides authentication on top of OAuth.
MFA does not eliminate credential risk. Tokens, consent grants, fatigue attacks, and session theft still matter.
Service accounts are high risk. They often have broad permissions and weak rotation practices.
Disabling an account may not end active sessions. Revoke tokens/sessions when needed.
Least privilege must include cloud roles and API permissions, not only local accounts.

Cloud Security Operations

Shared Responsibility

Layer	Customer usually responsible for	Provider usually responsible for
IaaS	OS, applications, IAM, data, network rules, logging configuration	Physical data center, hardware, virtualization platform
PaaS	Application code, data, IAM, configuration	Managed runtime, platform maintenance
SaaS	Users, data, access policies, tenant configuration	Application infrastructure and service operation

Notes and examples

Cloud Security Tool Selection

Need	Choose
Detect risky cloud configuration	CSPM
Protect cloud workloads/VMs/containers	CWPP
Manage excessive cloud identity permissions	CIEM
Secure SaaS usage and policy enforcement	CASB/SSE
Centralize cloud audit events	Cloud-native audit logs into SIEM
Protect secrets	Secrets manager/vault
Prevent public storage exposure	Storage policy, public access controls, IAM review
Detect anomalous API usage	Cloud audit log analytics and UEBA
Govern infrastructure changes	IaC scanning, policy as code, change control
Protect container images	Image scanning and trusted registry

Cloud Alert Investigation Checklist

Identify the principal: user, role, service account, workload identity.
Review action: API call, resource change, policy change, data access, key creation.
Check source: IP, geolocation, device, user agent, impossible travel.
Determine resource criticality and data classification.
Look for privilege escalation: new role, policy attachment, key generation.
Search for persistence: access keys, OAuth grants, backdoor roles, new users.
Scope lateral activity across accounts, projects, tenants, or subscriptions.
Contain by revoking sessions/keys, disabling principal, or restricting resource access.
Preserve cloud audit logs before retention or lifecycle rules remove them.

Alert triage decision rule

When a question asks what to do first, decide whether the scenario needs validation, containment, escalation, or preservation.

Scenario clue	Best first move
Single alert, no confirmed impact	Validate with additional telemetry
Active exfiltration or malware spread	Contain affected systems or accounts
Possible legal/regulatory issue	Follow incident plan and preserve evidence
Executive asks for status	Provide concise impact, scope, actions, and next update
Known false positive pattern	Tune rule after documenting evidence
Critical system involved	Coordinate with business owner before disruptive action, unless immediate harm requires containment

Telemetry sources to recognize

Source	What it helps detect	Useful clues
Firewall logs	Blocked/allowed connections, scanning, policy violations	Source/destination IP, port, action, rule name
IDS/IPS	Known attack patterns and suspicious traffic	Signature ID, severity, packet details
SIEM	Correlated events across tools	Timeline, rule logic, related entities
EDR	Process, file, registry, memory, host behavior	Parent-child process chains, hashes, command line
DNS logs	C2, tunneling, domain generation, phishing	Unusual domains, high entropy, NXDOMAIN spikes
Proxy logs	Web access, downloads, user browsing	URL, category, user, user agent
Email gateway	Phishing, malware attachments, spoofing	SPF/DKIM/DMARC results, headers, attachment hash
Authentication logs	Brute force, impossible travel, privilege abuse	Failed logins, MFA prompts, source location
Cloud logs	API activity, identity use, storage exposure	Access keys, role assumption, object access
NetFlow	Traffic patterns without payload	Volume, direction, duration, endpoints
Vulnerability scanner	Known weaknesses and misconfigurations	Plugin ID, severity, proof, affected asset
DLP	Sensitive data movement	Data type, user, destination, channel

Log analysis patterns

Pattern	Likely meaning	Analyst response
Many failed logins followed by success	Brute force or password spraying	Check source, MFA, user behavior, privilege
Login from unusual country plus new device	Possible account compromise	Validate with user, revoke sessions, reset credentials if confirmed
PowerShell with encoded command	Suspicious execution	Decode, inspect parent process, isolate if malicious
DNS queries to random-looking domains	Possible DGA or tunneling	Compare threat intel, check endpoint process
Large outbound transfer after privilege escalation	Potential exfiltration	Contain, preserve logs, identify data scope
New admin account created outside change window	Unauthorized persistence	Disable account, review creator, audit related changes
Web server 500 errors with SQL keywords	Possible SQL injection testing	Review WAF/app logs, patch or tune controls
Endpoint beaconing at regular intervals	Possible command-and-control	Correlate with EDR and network data

Detection quality concepts

Concept	Meaning	Exam reminder
True positive	Alert correctly identifies malicious or policy-violating activity	Investigate and respond
False positive	Alert fires on benign activity	Tune carefully, do not ignore blindly
True negative	Benign activity correctly ignored	Desired normal state
False negative	Malicious activity missed	Most dangerous detection gap
Baseline	Known normal behavior	Needed for anomaly detection
Correlation	Linking multiple weak signals into stronger evidence	SIEM use case core concept
Enrichment	Adding context such as asset owner, threat intel, geolocation	Helps prioritization
Suppression	Reducing repetitive alerts	Use only when risk is understood
Thresholding	Alerting after a count, rate, or condition is met	Avoid thresholds that are too low or too high

SIEM and query thinking

You do not need to memorize every vendor syntax, but you should understand query logic.

Task	Query idea
Find brute force	Count failed logins by user/source over time
Find successful login after failures	Correlate failed events followed by success
Find rare process	Compare process name/hash against baseline
Find lateral movement	Look for remote logons, admin shares, remote execution
Find exfiltration	Large outbound transfers to unusual destination
Find privilege escalation	New role/group membership or policy change
Find suspicious PowerShell	Encoded commands, download cradle, bypass flags
Find cloud compromise	New access key, unusual API calls, role assumption, public exposure

Container and Kubernetes Security

Area	What to inspect
Image provenance	Trusted registry, signed images, approved base images
Image vulnerabilities	Outdated packages, vulnerable dependencies
Secrets	No secrets in image layers, environment variables, or repos
Runtime privilege	Avoid privileged containers and host mounts unless required
Network policy	Restrict pod-to-pod and egress traffic
Admission control	Enforce policy before deployment
RBAC	Least privilege for service accounts
Namespace separation	Limit blast radius
Logging	API server, audit logs, container stdout/stderr
Persistence	Unexpected deployments, daemonsets, cronjobs
Supply chain	CI/CD integrity, dependency pinning, artifact scanning

Security Tool Selection Matrix

Tool/control	Best use	Common trap
SIEM	Central correlation and alerting	SIEM is only as good as ingested logs and tuning.
SOAR	Automated enrichment and response	Automating bad logic can amplify mistakes.
EDR	Endpoint process, malware, response	Does not replace patching or least privilege.
XDR	Cross-domain detection and response	Still needs analyst validation.
NDR	Network behavior detection	Encrypted traffic may limit payload visibility.
IDS	Detect suspicious traffic	Detection only unless paired with response.
IPS	Block suspicious traffic inline	Can disrupt business if poorly tuned.
WAF	Web attack protection	Temporary mitigation; code flaws still need fixing.
DLP	Detect/control sensitive data movement	Requires good data classification.
NAC	Control network admission	Asset identity and exceptions must be maintained.
UEBA	Detect abnormal user/entity behavior	Needs baseline and context.
Vulnerability scanner	Find known weaknesses	Findings require validation and prioritization.
BAS	Test controls with simulated attacks	Not a substitute for remediation.
Deception tech	Lure and detect attackers	Must avoid confusing production operations.
MDM/UEM	Manage endpoints/mobile devices	Coverage gaps weaken enforcement.
PAM	Protect privileged accounts	Does not fix excessive privileges by itself.
Backup platform	Recovery from deletion/ransomware	Must be isolated and restore-tested.

Cryptography and Data Protection

Need	Use	Watch for
Data confidentiality in transit	TLS	Expired certs, weak protocols, bad hostname validation
Data confidentiality at rest	Disk/database/object encryption	Key management and access control matter
Integrity	Hashing, digital signatures	Hash alone does not prove authenticity unless trusted
Authentication/nonrepudiation	Digital signatures, certificates	Private key protection is critical
Password storage	Salted adaptive hashing	Do not encrypt passwords for reversible storage
Key storage	KMS/HSM/secrets vault	Avoid hardcoded keys and unmanaged copies
Data minimization	Collect/store only needed data	Reduces breach impact
Tokenization	Replace sensitive value with token	Useful for payment or sensitive identifiers
Masking	Hide part of data in display/logs	Does not always protect underlying storage
DLP/classification	Control sensitive movement	Needs labels and accurate rules

Risk, Governance, and Reporting

Risk Response Options

Response	Meaning	Example
Avoid	Stop the risky activity	Decommission exposed legacy service
Mitigate	Reduce likelihood or impact	Patch, segment, add MFA
Transfer	Shift financial/operational impact	Cyber insurance, outsourced service
Accept	Acknowledge risk with approval	Document exception with owner and expiration

Notes and examples

Metrics to Recognize

Metric	Meaning
MTTD	Mean time to detect
MTTA	Mean time to acknowledge
MTTR	Mean time to respond/restore/remediate, depending on context
Dwell time	Time attacker remains undetected
False positive rate	Portion of alerts that are not actionable malicious events
Vulnerability age	How long a finding has remained open
Patch compliance	Percentage of assets meeting patch standard
SLA adherence	Whether response/remediation met defined targets
Control coverage	Assets/users/log sources covered by control
Recurrence rate	Whether incidents/findings repeat after remediation

Report Audience Matrix

Audience	Include	Avoid
Executives	Business impact, risk, decisions needed, trend	Excessive raw logs and tool syntax
Technical teams	Root cause, affected systems, IOCs, remediation steps	Vague business-only summaries
Legal/compliance	Timeline, data types, preservation status, policy triggers	Speculation beyond evidence
HR	User-related facts when insider or policy issue exists	Technical overload or unapproved disclosure
Customers/partners	Approved impact and action guidance	Unverified details or blame
SOC leadership	Metrics, gaps, tuning, staffing/process needs	Unsupported claims

Audience-based reporting

Audience	Wants	Avoid
Executive leadership	Business impact, risk, timeline, decision needed	Raw logs and tool jargon
Technical team	Affected systems, evidence, root cause, fix steps	Vague “secure it” statements
Legal/compliance	Facts, scope, timeline, evidence handling	Speculation
Asset owner	Operational impact and remediation plan	Security-only language
Customer/user communication	Clear impact and required action	Over-disclosure before facts are confirmed
Incident commander	Status, blockers, next actions	Unprioritized detail dump

Good security report structure

Executive summary
Scope and methodology
Key findings
Risk rating and business impact
Evidence
Affected assets
Recommended remediation
Compensating controls or exceptions
Validation plan
Appendices for technical detail

Metrics to understand

Metric	Use
MTTD	Mean time to detect
MTTR	Mean time to respond or recover, depending on context
Dwell time	Time attacker remains undetected
False positive rate	Detection quality and analyst workload
Patch compliance	Remediation program health
Vulnerability age	Backlog and process risk
Incident count by type	Trend analysis
Phishing click rate	Awareness and control effectiveness
Control coverage	Visibility and protection gaps

Common Commands and Analyst Utilities

Network and Host Triage

## Active connections and listening services
ss -tulpen
netstat -ano

## DNS investigation
dig example.com
nslookup example.com

## HTTP header and redirect review
curl -I -L https://example.com

## Packet capture
tcpdump -i eth0 host 203.0.113.10 -w capture.pcap

## Hash a file
sha256sum suspicious.bin

## Search logs
grep -i "failed password" /var/log/auth.log

Notes and examples

Windows Triage Examples

## Recent processes
Get-Process | Sort-Object StartTime -Descending

## Local users
Get-LocalUser

## Local administrators
Get-LocalGroupMember Administrators

## Network connections with owning process
Get-NetTCPConnection | Select-Object LocalAddress,LocalPort,RemoteAddress,RemotePort,State,OwningProcess

## Scheduled tasks
Get-ScheduledTask | Where-Object {$_.State -ne "Disabled"}

Nmap Use Cases

## Basic service discovery
nmap -sV 192.0.2.10

## Scan top ports on a subnet
nmap --top-ports 100 192.0.2.0/24

## No ping discovery if hosts block ICMP
nmap -Pn 192.0.2.10

Nmap option	Meaning
`-sV`	Service/version detection
`-sS`	SYN scan
`-O`	OS detection
`-Pn`	Treat host as up; skip host discovery
`-p`	Specify ports
`--top-ports`	Scan most common ports
`-oA`	Output in multiple formats

Alert-to-Action Playbook Patterns

Alert	First checks	Likely next action
Malware detected	Host, file hash, process tree, user, network activity	Isolate if active; collect evidence; remove malware
Multiple failed VPN logins	User/source pattern, success after failures, MFA status	Block source, reset account if success, tune detection
Impossible travel	Geo/IP, VPN/proxy, device, recent password change	Revoke session and require MFA/reset if suspicious
New admin account	Change ticket, creator, source host, group membership	Disable if unauthorized; investigate creator
EDR disabled	User/process causing change, policy status	Re-enable, isolate if malicious, investigate tampering
DNS tunneling	Query length, entropy, volume, domain age	Block domain, inspect host, hunt similar queries
Web attack blocked by WAF	Payload, target URI, source frequency	Tune/monitor if blocked; escalate if exploitation succeeded
Public cloud storage	Resource owner, access logs, data type	Remove public access; assess exposure
DLP exfil alert	User, data type, destination, business justification	Contain transfer, notify data owner
Vulnerability scanner critical finding	Asset exposure, exploitability, owner	Validate and assign urgent remediation

High-Yield Exam Traps

If the question says…	Do not jump to…	Prefer…
“The alert fired”	Assume incident confirmed	Validate with correlated evidence.
“A patch is available”	Patch production immediately	Follow change control unless active critical risk requires emergency process.
“User clicked link”	Reimage immediately	Check credential submission, payload execution, and mailbox/account activity.
“Firewall blocked traffic”	Close ticket	Determine whether it indicates targeting or compromised internal host.
“CVSS is high”	Always top priority	Consider exposure, exploit activity, asset value, and compensating controls.
“Hash is malicious”	Hunt only by hash	Add behavior, filenames, domains, command lines, and parent process.
“Admin account used”	Treat as authorized	Validate source, timing, MFA, ticket, and expected admin path.
“Cloud key created”	Ignore if by admin	Check whether expected, then inspect usage and permissions.
“Need legal evidence”	Collect casually	Preserve chain of custody and minimize evidence modification.
“Need to reduce alert noise”	Disable the rule	Tune, enrich, suppress narrowly, or improve parsing.

Rapid Review Checklist

Before Exam Day

Know the difference between alert, event, incident, vulnerability, threat, and risk.
Practice choosing between containment, eradication, and recovery actions.
Review common Windows, Linux, DNS, web, firewall, IAM, and cloud log clues.
Memorize high-value Windows Event IDs for authentication, process creation, account changes, and log clearing.
Be able to explain IOC vs TTP, SIEM vs SOAR, EDR vs IDS, CSPM vs CWPP vs CIEM.
Review phishing header fields and SPF/DKIM/DMARC distinctions.
Practice vulnerability prioritization using exploitability, exposure, criticality, and business impact.
Understand when to escalate to legal, privacy, HR, management, or system owners.
Read questions for words such as first, best, most likely, next, and primary.

Practical Next Step

Use this Cheat Sheet to identify weak areas, then move into timed CS0-004-style practice questions and scenario-based labs that require you to triage alerts, prioritize vulnerabilities, interpret logs, and choose the best next analyst action.

Notes and examples

Final quick checklist

Before you start a CS0-004 practice set, make sure you can answer these quickly:

What evidence confirms an alert is a real incident?
What should be contained first: host, account, network path, email, or cloud key?
What evidence is volatile and should be preserved early?
Which findings deserve priority when scanner severity and business risk differ?
Which log source best supports the investigation?
What is the difference between remediation, mitigation, and risk acceptance?
What should an executive report include?
What root cause must be fixed before recovery?
What detection should be improved after lessons learned?
What answer choice is safest, least disruptive, and aligned with the incident phase?

Next step: start a timed CompTIA CySA+ V4 (CS0-004) topic drill, review every detailed explanation, and turn each missed question into a short decision rule for your final question bank pass.

Last-pass study strategy

For a final review, do not try to reread everything. Focus on decisions.

Read the scenario carefully. Identify the asset, threat, business impact, evidence, and current phase of response.
Separate alert from incident. An alert is a signal; an incident requires validation and impact assessment.
Prioritize by risk, not noise. Severity, exploitability, asset criticality, exposure, and compensating controls matter.
Preserve evidence before destructive actions. Especially in forensic or legal-sensitive scenarios.
Match the tool to the question. Scanner, SIEM, EDR, packet capture, SOAR, DLP, WAF, CASB, IAM logs, cloud-native logs, and forensics tools solve different problems.
Choose the least disruptive effective action. Contain the threat while minimizing business impact.
Answer as an analyst. Communicate clearly, document findings, escalate appropriately, and verify remediation.

High-yield topic map

Area	Know cold	Common exam trap
Security monitoring	Logs, alerts, SIEM correlation, EDR telemetry, network traffic, authentication events	Treating one alert as proof without corroboration
Detection engineering	Signatures, behavior analytics, baselines, rules, false positives, tuning	Over-tuning until true positives disappear
Vulnerability management	Scanning, prioritization, remediation, exceptions, validation	Ranking by CVSS alone without asset context
Threat intelligence	IOCs, TTPs, confidence, relevance, source quality, sharing formats	Assuming every IOC is current or useful
Incident response	Preparation, detection, analysis, containment, eradication, recovery, lessons learned	Eradicating before containment or evidence capture
Digital forensics	Volatile data, disk images, hashing, chain of custody, timeline analysis	Changing evidence while collecting it
Cloud and hybrid security	IAM, logging, storage exposure, network controls, shared responsibility	Assuming cloud provider secures customer configuration
Application security	Injection, XSS, auth flaws, API abuse, insecure deserialization, SSRF	Confusing vulnerability type with remediation
Identity security	MFA, SSO, federation, privilege, conditional access, anomalous login behavior	Ignoring identity as the control plane
Reporting	Executive summary, technical findings, remediation plan, metrics, risk acceptance	Giving executives raw logs instead of business impact

Digital forensics review

Evidence handling basics

Concept	Meaning	Why it matters
Chain of custody	Documented control of evidence	Supports integrity and admissibility
Hashing	Integrity verification	Shows evidence was not altered
Forensic image	Bit-level copy where appropriate	Preserves original media
Write blocker	Prevents modification of source media	Protects evidence
Volatile data	Data lost on shutdown	Memory, network connections, running processes
Timeline analysis	Event reconstruction	Helps determine attack sequence
Scope	Systems, accounts, data, and time period affected	Drives response and reporting

Notes and examples

Order of volatility

Collect the most volatile evidence first when it is safe and appropriate.

More volatile	Less volatile
CPU/register/cache state	Disk images
Memory contents	Archived logs
Network connections	Backups
Running processes	Printed documentation
Logged-in users	Long-term records
Temporary files	Historical reports

Host artifacts to recognize

Artifact	What it can show
Process list	Suspicious running programs
Parent-child process tree	Execution chain
Command history	User or attacker actions
Scheduled tasks/cron jobs	Persistence
Registry run keys	Windows persistence
Services/daemons	Auto-start mechanisms
Prefetch/shimcache/amcache-style artifacts	Program execution evidence
Browser history/downloads	Phishing or drive-by activity
Event logs	Authentication, process, service, policy events
File metadata	Creation, modification, access clues
Memory dump	Malware, credentials, network connections

Application and API security review

Common web vulnerabilities

Vulnerability	What it means	Better remediation direction
SQL injection	User input alters database query	Parameterized queries, input validation
Command injection	User input executes OS commands	Avoid shell execution, sanitize input, least privilege
Cross-site scripting	Attacker script runs in user browser	Output encoding, CSP, input handling
CSRF	User is tricked into submitting authenticated action	Anti-CSRF tokens, SameSite cookies
SSRF	Server is tricked into making requests	Egress controls, allowlists, metadata protection
Path traversal	Access files outside intended directory	Canonicalize paths, restrict file access
Insecure deserialization	Untrusted object data causes code or logic abuse	Avoid unsafe deserialization, integrity checks
Broken access control	User accesses unauthorized function/data	Server-side authorization checks
Security misconfiguration	Unsafe defaults or exposed admin features	Hardening, configuration review
Vulnerable dependency	Flawed third-party component	SCA, patching, dependency management

Notes and examples

API security review

Risk	Clue	Control
Broken object-level authorization	User can access another user’s object ID	Enforce authorization per object
Excessive data exposure	API returns more fields than needed	Minimize response data
Lack of rate limiting	Automated abuse succeeds	Throttling and abuse detection
Weak token handling	Long-lived or exposed tokens	Short lifetimes, rotation, secure storage
Poor input validation	Malformed requests trigger errors	Schema validation and sanitization
Shadow APIs	Unknown or undocumented endpoints	API inventory and gateway controls

Secure SDLC and testing

Method	Purpose
SAST	Static source/code analysis before runtime
DAST	Dynamic testing of running application
SCA	Third-party dependency and license/vulnerability analysis
IAST	Instrumented testing during application execution
Fuzzing	Sending malformed inputs to find crashes or flaws
Threat modeling	Identifying design-level risks early
Code review	Human review for logic and security flaws
Secrets scanning	Detecting hardcoded keys and credentials
CI/CD controls	Automated security checks in pipelines

Cloud, container, and hybrid security review

Cloud security decision points

Scenario	Think about
Public storage bucket	Data exposure, access policy, object logs
Overprivileged role	Least privilege, role assumption, permissions boundary
Leaked access key	Revoke, rotate, find use, check persistence
Public management port	Security group/network ACL, bastion, ZTNA
Unencrypted data store	Encryption at rest, key management, data sensitivity
Missing logs	Enable cloud audit logs before incident
Suspicious API call	Identity, source IP, user agent, role, time
Container escape concern	Host hardening, runtime security, patching
Image vulnerability	Rebuild from patched base image
Kubernetes secret exposure	Rotate secrets, RBAC review, audit logs

Notes and examples

Shared responsibility reminder

In cloud scenarios, the provider and customer share responsibilities, but the customer is commonly responsible for identity configuration, data classification, access policies, workload configuration, and application security. Do not assume the provider fixes insecure customer settings.

Container and Kubernetes clues

Item	Security relevance
Image	May contain vulnerable packages or secrets
Registry	Needs access control and signing/scanning
Runtime	Detect suspicious container behavior
Namespace	Logical isolation boundary
RBAC	Controls Kubernetes permissions
Secrets	Must be protected and rotated
Admission control	Enforces deployment policy
Network policy	Limits pod-to-pod communication
Privileged container	High risk; may access host resources
Immutable infrastructure	Rebuild rather than manually patch running instances

Endpoint security review

Malware behavior indicators

Behavior	Possible purpose
Creates scheduled task	Persistence
Modifies registry run key	Persistence
Injects into another process	Evasion or privilege abuse
Disables security tools	Defense evasion
Dumps credentials	Credential theft
Scans local network	Discovery/lateral movement
Connects to rare external domain	Command-and-control
Encrypts many files rapidly	Ransomware
Compresses staged files	Exfiltration preparation
Deletes shadow copies/backups	Ransomware impact maximization

Notes and examples

Endpoint response choices

Situation	Best action
Confirmed malware with active C2	Isolate endpoint and preserve evidence
Suspicious process but uncertain	Collect process, hash, command line, network evidence
Credential theft suspected	Reset credentials and revoke sessions after containment planning
Widespread endpoint indicator	Hunt across fleet using EDR query
False positive from known admin tool	Document and tune detection carefully
Ransomware indicator	Isolate immediately and protect backups

Data protection and privacy-aware analysis

Data security controls

Need	Control
Protect data at rest	Encryption, access control, key management
Protect data in transit	TLS, VPN, secure protocols
Prevent unauthorized sharing	DLP, classification, access reviews
Limit blast radius	Least privilege, segmentation, token scoping
Detect exfiltration	DLP, proxy logs, cloud access logs, UEBA
Recover from loss	Backups, replication, tested restore
Reduce retained risk	Data minimization and retention controls

Backup and recovery reminders

Concept	Review point
Offline/immutable backup	Helps resist ransomware
Restore testing	Backup is not useful unless recoverable
Recovery point objective	Acceptable data loss target
Recovery time objective	Acceptable downtime target
Golden image	Trusted rebuild source
Clean restore	Restore only after root cause and reinfection risk are addressed

Tool and command quick review

Common analyst tools

Tool/category	Use
SIEM	Correlation, search, alerting, dashboards
SOAR	Automated enrichment and response workflows
EDR/XDR	Endpoint detection, containment, investigation
NDR	Network detection and response
Vulnerability scanner	Find known vulnerabilities and misconfigurations
Packet analyzer	Inspect network traffic
Sandbox	Detonate suspicious files/URLs safely
Forensic suite	Image, preserve, and analyze evidence
Ticketing system	Track remediation and accountability
GRC platform	Risk, compliance, exceptions, reporting

Notes and examples

Command-line recognition

Command/tool	Typical use
ping	Basic reachability
traceroute/tracert	Network path
nslookup/dig	DNS lookup
whois	Domain/IP registration context
netstat/ss	Network connections and listening ports
ipconfig/ifconfig/ip	Interface configuration
route	Routing table
arp	Local neighbor mapping
nmap	Port/service discovery
curl/wget	HTTP requests and downloads
tcpdump	Packet capture
Wireshark/tshark	Packet analysis
grep/findstr	Search text/logs
awk/sed	Text processing
strings	Extract readable strings from binary
sha256sum/Get-FileHash	File integrity/hash
ps/tasklist	Running processes
lsof	Open files and sockets
journalctl	Linux system logs
sc/systemctl	Service management
reg	Windows registry inspection/modification

“Best tool” examples

Question asks for	Strong answer direction
Identify open ports	Nmap or scanner
Inspect payload details	Packet capture/Wireshark
Correlate many logs	SIEM
Isolate compromised host	EDR or network control
Automate enrichment	SOAR
Identify vulnerable packages	SCA or vulnerability scanner
Detect data leaving	DLP, proxy, NetFlow, cloud logs
Verify file integrity	Hash comparison
Preserve disk evidence	Forensic imaging
Analyze suspicious attachment safely	Sandbox

Scenario decision rules

“First,” “best,” and “next” wording

Wording	How to answer
FIRST	Choose the earliest correct step in the process
BEST	Choose the most complete and risk-appropriate action
NEXT	Continue from the current phase described
MOST likely	Infer from evidence, not from fear
LEAST likely	Eliminate supported options first
MOST secure	Strongest control, if operationally reasonable
MOST cost-effective	Adequate risk reduction with lower complexity
BEST long-term	Root cause fix, not temporary workaround

Notes and examples

High-frequency decision rules

If the scenario says…	Prefer…
“Unconfirmed alert”	Validate and collect more evidence
“Active compromise”	Containment
“Forensic investigation”	Preserve evidence and chain of custody
“Critical production service”	Coordinate containment with business impact in mind
“Known exploited vulnerability on internet-facing asset”	Urgent remediation or mitigation
“Legacy system cannot be patched”	Compensating controls and risk documentation
“Many noisy alerts”	Tuning, correlation, and prioritization
“Credential compromise”	Revoke sessions/tokens, reset credentials, review activity
“Cloud public exposure”	Remove public access and review access logs
“Repeat incident”	Root cause analysis and control improvement

Common candidate mistakes

Technical mistakes

Confusing hashing with encryption. Hashing verifies integrity; encryption protects confidentiality.
Confusing encoding with encryption. Encoding is reversible formatting, not security.
Treating base64 as a secure protection method.
Assuming HTTPS traffic is safe just because it is encrypted.
Forgetting that valid credentials can be maliciously used.
Assuming MFA stops all account compromise.
Choosing eradication before containment during active compromise.
Ignoring egress traffic in exfiltration scenarios.
Overlooking cloud IAM as the highest-impact control plane.
Treating scanner severity as identical to business risk.

Process mistakes

Skipping documentation during incidents.
Failing to verify remediation.
Reporting technical detail without business impact.
Closing incidents without lessons learned.
Blocking indicators without considering collateral impact.
Not involving asset owners for production changes.
Failing to preserve chain of custody when evidence may matter.
Accepting risk without an owner, justification, or review.

Compact comparison tables

Preventive, detective, corrective

Control type	Purpose	Examples
Preventive	Stop event from happening	MFA, firewall, hardening, secure coding
Detective	Identify event	SIEM alert, IDS, audit logs
Corrective	Restore or fix	Patch, restore backup, remove malware
Deterrent	Discourage behavior	Warning banners, policies
Compensating	Alternative protection	Segmentation around unpatchable system
Recovery	Return to operation	Backups, disaster recovery plan

Notes and examples

Signature, anomaly, behavior

Detection type	Strength	Weakness
Signature	Good for known threats	Misses new/modified threats
Anomaly	Finds unusual activity	Can produce false positives
Behavior	Detects suspicious actions/TTPs	Requires context and tuning
Heuristic	Flexible pattern-based detection	May be noisy
Threat intel match	Fast enrichment	Indicators may be stale

IDS, IPS, WAF, EDR

Control	Primary location	Main purpose
IDS	Network or host	Detect and alert
IPS	Inline network path	Detect and block
WAF	In front of web app	Filter malicious web requests
EDR	Endpoint	Detect, investigate, contain host threats
NDR	Network	Identify suspicious traffic behavior
DLP	Endpoint, network, cloud	Prevent or detect sensitive data leakage

Mini playbooks

Suspected ransomware

Isolate affected systems.
Protect backups and prevent further spread.
Preserve evidence where possible.
Identify initial access and scope.
Disable compromised accounts.
Remove persistence and malware.
Restore from known-good backups.
Monitor for reinfection.
Document timeline, impact, and lessons learned.

Suspected cloud key compromise

Disable or revoke the exposed key.
Rotate related secrets.
Review API activity for that identity.
Identify created users, roles, policies, compute, storage, or network changes.
Remove unauthorized resources and persistence.
Check data access and exfiltration.
Tighten permissions and add detection.
Document impact and remediation.

Suspected data exfiltration

Confirm unusual transfer or access.
Identify user, system, data type, destination, and time window.
Contain access path without destroying evidence.
Preserve logs and relevant artifacts.
Determine data sensitivity and scope.
Escalate according to incident plan.
Implement corrective controls.
Prepare audience-appropriate reporting.

Suspected phishing credential theft

Analyze email and identify recipients.
Remove message from mailboxes.
Determine who clicked or submitted credentials.
Revoke sessions and reset affected credentials.
Review authentication and mailbox rules.
Search for lateral movement or data access.
Block infrastructure and update detections.
Communicate user guidance.

Put the review into practice

Study Plan