CySA+ questline

Log ingestion and time synchronization; Operating system telemetry; Infrastructure and network architecture; Identity and access management; Encryption and sensitive data protection

Network indicators; Host indicators; Application and identity indicators

Packet, endpoint, and SIEM tools; Email and file analysis; User behavior and anomalous activity; Scripting and structured data

Threat actors and TTPs; Intelligence confidence and sources; Intelligence sharing; Threat hunting and deception

Standardization and orchestration; Tool integration and visibility

Scanning methods and safety; Scan scope, vantage, and authentication; Application and baseline scanning; Frameworks and scanner content

Web assessment output; Network and host assessment output; Cloud and human assessment output

CVSS interpretation; Validation and result quality; Contextual prioritization

Access and injection controls; Request, file, and execution controls; Overflow and platform controls; Design, component, and data controls

Risk treatment and control selection; Patch, configuration, and exceptions; Secure development and attack surface

Attack methodology frameworks

Detection and analysis; Containment, eradication, and recovery; Forensics and evidence handling

Preparation and post-incident improvement

Vulnerability reports and action plans; Vulnerability metrics and stakeholders

Incident metrics and lessons learned; Incident reports and communication