CySA+ Exam Guide

CompTIA CySA+ (CS0-003) is an intermediate-level cybersecurity certification for analysts with 3–4 years of hands-on experience. It validates skills in threat detection, vulnerability management, incident response, and SOC reporting using behavioral analytics tools.

CySA+ includes performance-based questions that require hands-on tasks rather than selecting an answer. Common PBQ types:

• Log Analysis: Analyze SIEM alerts or log files to identify the attack type, affected systems, and timeline
• Vulnerability Assessment: Prioritize vulnerabilities from a scan report based on CVSS score, asset criticality, and exploitability
• Incident Response Ordering: Drag and drop IR steps into the correct NIST SP 800-61r2 sequence
• Network Diagram Analysis: Identify security gaps in a network topology and recommend controls
• Tool Configuration: Configure firewall rules, SIEM correlation rules, or vulnerability scan settings in a simulated interface

Strategy: PBQs appear at the beginning. Do not spend more than 15–20 minutes total on them. Flag and move on to multiple choice if stuck — come back with remaining time.

• MITRE ATT&CK: Know the 14 tactics by name and at least 3 common techniques per tactic
• CVSS scoring: Be able to calculate approximate scores given base metric values
• NIST SP 800-61r2: Memorize all 7 IR phases and what happens in each
• SIEM correlation rules: Understand what makes a good vs. noisy rule
• Order of volatility: CPU registers → RAM → swap space → HDD → remote logs → archives
• Chain of custody: Required for forensic evidence admissibility in legal proceedings
• EPSS vs. CVSS: EPSS predicts exploitation probability; CVSS measures severity — use both for prioritization
• CISA KEV Catalog: Known Exploited Vulnerabilities should be prioritized above all regardless of CVSS score

CompTIA recommends CySA+ candidates have:

• 3–4 years of hands-on information security or IT administration experience
• CompTIA Security+ or Network+ (or equivalent knowledge)
• Familiarity with SIEM tools, vulnerability scanners, and packet analysis

Career Path: CompTIA A+ → Network+ → Security+ → CySA+ → SecurityX (CAS-005)

Job Roles: SOC Analyst (T2/T3), Threat Intelligence Analyst, Vulnerability Management Analyst, Incident Responder, Security Engineer

Average Salary: ~$105,000 in the United States