CS0-004 cheat sheet — every exam topic on one page

Security Operations

CySA+ System and Network Architecture: Logging, OS, Cloud, IAM, Encryption and OT

• A SIEM sees only what is configured at the source and parsed into normalized fields; events without a parser are stored but never match field-based rules.
• Protect logs by forwarding them off the host in near real time and keeping the central copy on immutable storage; local copies are controlled by whoever owns the host.
• Use one NTP hierarchy and log in UTC; Kerberos fails when clocks skew beyond the tolerance (event 4771, code 0x25).
• Regulation and contracts set the minimum retention; hot plus archive tiers meet it at the lowest cost.
• Harden from a consensus baseline such as a CIS Benchmark; know the hosts file, SAM, /etc/passwd (UID 0 means root) and /etc/shadow.
• wininit.exe starts services.exe and the one lsass.exe; services.exe starts svchost.exe; orphaned csrss.exe and wininit.exe are normal.
• Containers share the host kernel and are ephemeral: ship logs off them, add sandboxed runtimes for untrusted code, and pull a compromised pod out of service before capturing and deleting it.
• Serverless and cloud control-plane activity are visible only through the provider's logs and APIs.
• ZTNA grants per-application access after identity and posture checks; SASE converges SD-WAN with cloud-delivered SWG, CASB, ZTNA and FWaaS.
• PAM means just-in-time elevation, injected vaulted credentials and recorded sessions; OIDC proves identity on top of OAuth 2.0; dynamic secrets limit how long a leak is useful.

CySA+ CS0-004 Indicators of Malicious Activity: Network, Host, Application, Cloud and Identity

• Judge every indicator against a baseline and context: the host's role, the destination's reputation and whether an approved change explains it.
• A rogue DHCP server shows as a second DHCPOFFER; a cloned MAC flaps between ports while the real device keeps working and no loop evidence exists.
• Horizontal scans probe one port across many hosts; vertical scans probe many ports on one host; chained whoami/net group/nltest from an Office parent is domain enumeration.
• DNS tunneling is one domain, many high-entropy labels and successful answers; a DGA is many domains answered NXDOMAIN; fast flux is one name with rotating IPs.
• Judge processes and LOLBins by parent, path, user and arguments: svchost.exe always comes from services.exe, and certutil, mshta and regsvr32 pulling from internet IPs are download cradles.
• $STANDARD_INFORMATION timestamps can be faked easily; a mismatch with $FILE_NAME means timestomping.
• Event 4719 plus event 1102 by an account with no change request is anti-forensics; a full log produces 1104, not 1102.
• Stolen cloud keys show identity checks, unused regions and expensive instances; instance role credentials used from outside the provider point to SSRF against 169.254.169.254.
• Password failures mean spraying or brute force; unknown usernames with one-try successes mean stuffing; repeated MFA denials then an approval mean MFA fatigue; many RC4 service tickets mean Kerberoasting.
• SPF, DKIM and DMARC passing only proves the lookalike domain's owner sent the mail; hidden inbox rules and external forwarding mean the real mailbox is compromised.

CySA+ CS0-004 Tools to Determine Malicious Activity: CyberChef, Wireshark, Suricata, Zeek, YARA, Sandboxes and More

• CyberChef chains operations into a recipe; encoded PowerShell is Base64 of UTF-16LE, so decode Base64 and then UTF-16LE text.
• tcpdump -w writes a pcap and -r reads one; BPF capture filters (host, port) differ from Wireshark display filters (ip.dst, http.request.method).
• In Snort/Suricata rules, the header fixes protocol and direction and flow:to_server means client-to-server; drop blocks silently inline, reject answers with a reset or ICMP error.
• Zeek logs all traffic as per-protocol metadata (conn, dns, http, ssl, files), so encrypted beaconing still shows in conn.log intervals and ssl.log server names.
• SIEM correlation fails silently when sources use different time zones; normalize timestamps to UTC at ingestion. UEBA catches valid-credential misuse that breaks no rule.
• OTX is a hosted community service, MISP syncs events between self-hosted instances with per-event distribution levels, and OpenCTI models intelligence as a STIX 2.1 graph.
• EDR isolation contains a host while keeping remote investigation; MDM selective wipe removes only the corporate container on a personal device.
• WHOIS creation date, AbuseIPDB reports and GeoIP answer different questions; GeoIP locates the egress address, so VPNs mislead impossible-travel alerts.
• Search VirusTotal by hash for sensitive samples; use strings -e l for UTF-16LE text; YARA strings without wide match ASCII only; empty sandbox reports can mean evasion.
• uniq -c only counts adjacent duplicates, re.match only matches at the start, EVTX must be parsed before grep, and Security 4688 differs from PowerShell 4104.

CySA+ CS0-004 Threat Intelligence and Threat Hunting: ATT&CK, Pyramid of Pain, IoCs, STRIDE and Deception

• A hunt starts from a specific, testable hypothesis about behaviour, checked against telemetry you actually hold; its conclusion covers only the systems whose data was searched.
• APTs are marked by narrow, deliberate targeting and determination to keep or regain access; common tools, encryption and long dwell alone also fit financially motivated crime.
• Insider classification depends on who is acting: evidence that ties activity to the person points to an insider, while evidence that ties it only to their credentials points to an external actor.
• ATT&CK tactic = why, technique = how, procedure = this actor's exact implementation; a technique listed under several tactics is recorded under the goal that step achieved.
• Heat maps prioritise techniques that relevant groups use widely and you do not yet detect.
• Pyramid of Pain: hashes, IPs, domains, artifacts, tools, TTPs; behavioral detections at the top cost the adversary most to evade.
• Act on intelligence only when it is timely, relevant and accurate; corroboration counts only when it is independent.
• TLP:AMBER allows the organisation and its clients; AMBER+STRICT the organisation only. STIX is the format, TAXII the transport, and a Sighting reports that you saw an indicator.
• Deconflict, corroborate and expire IoCs before use; hunt backwards for past compromise, block forward where collateral risk is low.
• STRIDE pairs Spoofing-authentication, Tampering-integrity, Repudiation-non-repudiation, Information disclosure-confidentiality, DoS-availability, Elevation-authorization; decoys must be excluded from all legitimate traffic.

CySA+ CS0-004 SOC Efficiency: Playbooks, SOAR, IaC, Enrichment, Tuning and Integrations

• A playbook says whether, when and who for a type of incident; a runbook says exactly how to do one task. Disagreement on method calls for a runbook.
• Coordinate incidents in one case with owned tasks and a single action log; standardize triage across shifts and regions with one playbook library.
• SIEM collects, correlates and alerts; SOAR orchestrates response across tools and manages cases. Automation is one task; orchestration chains tasks into a workflow.
• Automate high-volume, read-only steps such as enrichment first; put an approval gate on actions that change accounts, mailboxes, mail flow or critical assets.
• With IaC, fix it in the code: console changes are drift and get reverted. Block insecure resources with a policy-as-code scan of the resolved plan, and keep waivers scoped to one resource in code.
• Enrich alerts with asset, identity and threat context at ingestion, and capture volatile IP-to-host mappings at the time of the event.
• Tune out the specific benign source, choose the grouping field the attack concentrates on, and prove coverage with attack simulation and exclusion review.
• Dashboards serve one audience and drive action; always show per-source data health so no data is not mistaken for no alerts.
• APIs pull on demand with dedicated least-privilege keys (429 means back off); webhooks push events and need HMAC signatures, replay checks, fast 2xx and idempotency.
• Prefer vendor-supported plug-ins, vet permissions and maintenance, and replace abandoned ones before a platform upgrade.

CySA+ CS0-004 AI in Security Operations: Risks, Governance and SOC Use Cases

• Hallucinations are fluent fabrications such as non-existent CVE or patch IDs; ground answers with retrieval, require citations to the evidence, and verify against authoritative sources.
• Hallucinations are reduced by supplying and checking facts, not by changing generation settings; retrieval suits private, fast-changing facts better than fine-tuning.
• Control data exposure before the prompt: approved enterprise AI under no-retention/no-training terms, masking of personal data and secrets, DLP on AI-bound traffic, and retrieval that enforces each user's permissions.
• Poisoning corrupts training data or labels (slow baseline drift, false feedback labels, backdoor triggers); evasion manipulates inputs at prediction time. High clean-test accuracy does not rule out a backdoor.
• Direct injection is typed by the user and is screened at an AI gateway; indirect injection hides in content the AI reads, so bound the damage with least-privilege agent credentials and human approval.
• PHI to an AI vendor needs a HIPAA BAA; EU personal data needs a GDPR DPA and, outside the EEA, a lawful transfer mechanism; pseudonymized data is still personal data; residency needs in-country hosting.
• An AI usage policy names approved tools, permitted data classifications and mandatory human review; it is the governance answer to shadow AI.
• When AI disagrees with a hash or diff, trust the deterministic evidence; a 'no differences' result only covers what fit in the context window.
• Validate AI-generated SIEM queries before trusting an empty result, and use ML to find outliers at scale with the LLM explaining them.
• AI conclusions are not evidence: preserve the underlying logs, verify extracted indicators before blocking, keep source alerts searchable when correlating, and automate only where mistakes are cheap.

Vulnerability Management

CySA+ Vulnerability Scanning Methods: Planning, Scan Types and Baselines

• The asset inventory comes first: it supplies scope, owners and criticality, and unknown assets found by discovery are reconciled back into it.
• In the cloud, key findings to identifiers the platform never reuses (resource IDs) plus owner tags, not to recyclable IP addresses or hostnames.
• Coverage and cadence are fixed; timing and load are what you adjust: maintenance windows, local off-hours, rotating groups, scans when assets are powered on.
• Protect fragile targets with safe checks and throttling, coordinate scan windows with the SOC, and scope intrusive checks to the targets that need them.
• Scanning across a firewall measures the firewall; distributed scan engines per zone keep coverage without wide rules, and a dual-homed scanner bridges zones.
• PCI DSS: internal and external scans at least quarterly and after significant change; quarterly external scans by an ASV, passing under the ASV Program Guide; internal scans authenticated.
• Credentialed scans find missing application patches and local policy; agents cover roaming hosts; agentless scans cover appliances and rogue devices; passive sensing suits OT but misses silent, locally switched and encrypted traffic.
• Baseline scans find insecure settings a CVE scan misses; CIS Benchmarks supply the testable settings that PCI DSS 2.2.1 and ISO/IEC 27001 control 8.9 ask for.

CySA+ Vulnerability Assessment Tools: Reading Nmap, Nessus, Burp, Prowler and BAS Output

• An empty report is a clean result only after you prove the checks ran: failed logins, missing API keys, missing read permissions and template filters all produce silence.
• Masscan and Angry IP Scanner find hosts and open ports; Nmap -sV identifies what listens. Too high a Masscan rate silently drops results.
• Nmap filtered means probes are dropped, closed means a reset came back; compare inside and outside scans to separate network filtering from host services.
• Metasploit check 'Detected' means the service is present but the flaw is unverified; imported scanner data in the MSF database is a lead, not a validation.
• Banner-based findings on backporting Linux distributions are prone to false positives; OpenVAS QoD rates the detection method, not severity.
• ZAP baseline is passive only; Burp 'Tentative' needs manual confirmation, and a Collaborator interaction from the server points to SSRF.
• Prowler MANUAL needs a person, and muted findings are suppressed, not fixed; ScoutSuite shows checked versus flagged items.
• Trivy --ignore-unfixed gates on fixability, and Checkov inline skips suppress one check for one resource with a recorded reason.
• Read BAS results as a chain: executed, logged, alerted. A failed step must be explained before it is credited to a control.

CySA+ Vulnerability Prioritization and Mitigation: CVSS, EPSS, Context and Remediation

• Priority combines likelihood (exploitability, KEV, EPSS, exposure) with business impact (asset value, which of C/I/A matters); a CVSS base score alone is not a priority.
• Confirmed exploitation beats prediction: a KEV-listed or vendor-confirmed exploited flaw normally comes first among reachable systems.
• Internet-facing first, internal next, verified-isolated last; isolation lowers priority but never turns a real flaw into a false positive.
• Tailor CVSS with environmental (CR/IR/AR) and threat/temporal metrics instead of editing base values; in v4.0 a race condition is AT:P and confirmed attacks set E to Attacked.
• EPSS is FIRST's daily probability of exploitation activity in the next 30 days, with a percentile; it measures likelihood, CVSS measures severity.
• Backported packages cause false positives; non-credentialed scans and missing plugins cause false negatives. Record evidence and suppress narrowly, never via an exception.
• Fix at the source: base images, GPO/config management, parameterized queries and context-aware output encoding; urgent patches use the emergency change process.
• Exceptions are risk-owner approved, time-bound and list compensating controls; compensating controls must block the real attack path.
• Validate with the same scan policy, a retest of the original payload and a check that the fixed version is actually running.

CySA+ Control Types, Risk Management and Application Security (SAST, DAST, SAMM, SBOM)

• Type is what a control is (administrative, technical, physical); function is what it does (preventative, detective, responsive, corrective). Answer the two separately.
• Classify a control by what it does today: monitor-only DLP and an IPS on a SPAN port are detective; prevention needs blocking mode and an inline position.
• Responsive controls contain an incident in progress; corrective controls restore and fix after containment.
• Inherent risk is before controls, residual risk is after; compare residual risk with appetite, and let the lower-appetite category win when two conflict.
• Avoid stops the risky activity; mitigate keeps it with controls that reduce likelihood or impact; transfer moves the financial impact but never accountability.
• A valid acceptance has an accountable business owner, a documented rationale and a review date, and is reopened early when its assumptions change.
• Policies, standards and procedures are mandatory; guidelines are optional. Findings without an owner are a governance gap, fixed by policy that assigns accountability.
• An SLO breach is a finding's age against its own severity's target; supplier SLAs must be aligned with the internal SLOs they support.
• SAST: source code, early, line-level, noisy, blind to runtime. DAST: running app, later, confirms exploitability, blind to code, and only as good as its (authenticated) crawl.
• SAMM is a prescriptive maturity model (Governance, Design, Implementation, Verification, Operations); BSIMM describes observed peer activity; SCA finds vulnerable components, SBOMs (SPDX, CycloneDX) list them, and VEX says whether a CVE affects the product.

Incident Response and Management

CySA+ CS0-004 Attack Methodology Frameworks: Cyber Kill Chain, Diamond Model and MITRE ATT&CK

• Kill chain phases in order: reconnaissance, weaponization, delivery, exploitation, installation, command and control, actions on objectives; the furthest phase reached is the last one the evidence proves.
• Weaponization happens on the attacker's side and is seen only through payload artifacts; builder artifacts are durable detection content.
• Courses of action: deny removes the possibility (patch), disrupt interrupts in flight (DEP, inline IPS), degrade slows (tarpit), deceive misleads (decoys, honeypots).
• Break the chain at the earliest phase you can, on behaviour the actor repeats; hashes and addresses get rotated.
• The kill chain fits external, malware-driven intrusions; insiders and long post-compromise activity fit poorly.
• Diamond core features are adversary, capability, infrastructure and victim, assigned by role in the event; meta-features are timestamp, phase, result, direction, methodology and resources, plus social-political and technology in the extended model.
• Type 1 infrastructure is adversary-controlled, Type 2 is controlled by an intermediary; decide by control in the event, not by how it was paid for.
• Pivoting names the starting feature (victim-, capability-, infrastructure- or adversary-centered); threads order one intrusion, activity-attack graphs add possible paths, activity groups cluster intrusions.
• ATT&CK: TA = tactic, T = technique, T.nnn = sub-technique, M = mitigation, G = group, S = software (tool or malware), C = campaign; PRE-ATT&CK became Reconnaissance and Resource Development.
• Record a multi-tactic technique under the goal it served; start remediation at the technique entry and compare controls through mitigation pages.

CySA+ Incident Response Process: Preparation to Post-Incident (CS0-004 3.2)

• The phases run preparation, detection, analysis, containment, eradication, recovery, post-incident, and loop back whenever new evidence appears.
• Preparation happens before any incident: contacts, a checked jump kit, out-of-band communications, baselines, central logging and synchronized clocks.
• An incident is an event that violates or imminently threatens security policy; an insider policy violation counts even without malware.
• A precursor says an incident may happen; an indicator says one may have happened or is happening.
• Scope before you contain, and find the initial access vector so eradication can close it.
• Contain proportionately: cut the source or the attacker's path, enforce isolation outside the compromised host, and isolate rather than power off.
• Watch an attacker only inside an isolated, monitored environment with nothing of value at risk.
• Containing a stolen credential means invalidating it: deactivate keys, revoke sessions and tokens, rotate service-account secrets and update their consumers.
• Eradication removes all persistence, including fileless WMI subscriptions and a stolen KRBTGT hash (reset twice with replication between).
• Recovery restores from a known-good state, patches before reconnecting, and monitors for the incident's own indicators for longer than the threat's check-in interval.

CySA+ Incident Response Techniques: Triage, Evidence and Recovery (CS0-004 3.3)

• Incident response plan = definitions, severity, authority; communication plan = who tells whom, when and how; playbook = ordered steps for one incident type.
• Assign decision authority before an incident, with trained deputies; tabletop practises decisions, simulation practises hands-on skills safely.
• Ship logs off hosts as they are written, sync clocks, normalize to UTC, and enrich volatile context at ingestion.
• Triage asks two questions, did it happen and did it work, before any containment.
• Severity rises with functional impact, information impact and poorer recoverability, not with facts about the attacker.
• Custody records who held the evidence; hashes prove it did not change; RAM goes first; legal hold stops deletion until counsel lifts it.
• Isolate everything except the access responders and the business genuinely need.
• Verify remediation on every host with your own tests; revoke tokens, reset krbtgt twice, and release only into a clean environment.
• Restore in dependency order from pre-compromise, immutable or offline backups.
• Root cause is the condition that let the trigger succeed; corrective actions fix it and carry an owner, a due date and a measurable check.

Reporting and Communication

CySA+ Vulnerability Management Reporting: Scan Reports, Scorecards, Action Plans and KPIs

• Technical teams get per-host findings, fixes and evidence; owners get their systems' due and overdue items; executives get ratings, trends, top risks and the decisions needed.
• Every scan report states scope, exclusions and how hosts were assessed: "no findings" must never be confused with "not scanned" or "partially assessed".
• Detailed scan results are need-to-know; share progress widely as metrics, and share detail with third parties by scope first. Encryption and NDAs protect a copy but do not shrink it.
• Compliant is not secure: report compliance findings (control failed, found vs required) separately from vulnerabilities, and remember a compliance finding needs no CVE.
• Risk scorecards weight findings by severity and asset criticality, show trend, and sit next to scan coverage so descoping cannot look like improvement.
• Action plans record owners, dependencies with dates, interim mitigations, verification and a defined escalation path; analysts document exceptions, accountable risk owners approve them.
• Inhibitors: contractual (outside terms), governance (internal approvals), business process interruption (applying the fix stops operations), degrading functionality (the fix breaks something), legacy (no support), proprietary (only the vendor can change it), patch availability (no fix yet).
• With an inhibitor in place, reduce risk now, document the SLA miss and track the fix; never descope, auto-accept or relabel a real finding.
• Owners approve, custodians implement, others are informed; tell executives the business impact, the cost and the decision you need.
• SLA compliance counts verified on-time fixes only; exceptions and late fixes are reported separately, and trends are annotated when scope or method changes.

CySA+ Incident Response Reporting and Communication (CS0-004 4.2)

• Analysts escalate confirmed evidence through the documented path; only the role the plan names declares an incident, and severity is raised again when the impact grows.
• An executive summary gives business impact, status, residual risk and decisions needed, and states what is confirmed, what is unknown and when you will know.
• Every stakeholder in the communication plan has one named message owner; legal decides what must be disclosed and reviews external statements, and PR is the single public voice.
• Regulatory clocks start at awareness or discovery: notify on time with what you know and update in phases rather than waiting for the root cause analysis.
• Involving law enforcement is a management decision on legal advice; it adds an investigator, not a responder, and it does not satisfy regulatory notice.
• When the attacker can see your normal channels, move coordination out of band and limit the case to people with a need to know.
• The after-action report records what happened, lessons learned turns findings into owned and tracked actions, and root cause analysis finds the fixable condition behind the trigger.
• A handover passes open cases, containment in place and next steps; serious incidents get a written handover plus a live briefing.
• Read each mean-time metric for its own interval, and compare teams only when they start and stop the clock at the same events.
• Judge detections by volume, false positives and true positives together, and treat a phishing click rate from one repeated lure with suspicion.