CompTIA CySA+ CS0-003 Study Guide: Security Operations

Coverage: CySA+ domain 1.0 Security Operations

Reviewed: 2026-09-08. Exam scope: CS0-003.

This guide follows the supplied CS0-003 objectives and courseware, with original worked examples and linked primary technical references.

Analyst Method

1. Establish what the artifact proves and what remains unknown.
2. Correlate host, network, identity, application, and time context.
3. Choose the action that best reduces risk while preserving evidence and process.
4. Prefer durable controls and measurable validation over point fixes.
5. Communicate confirmed facts, impact, ownership, and next decisions for the audience.

Objective Coverage

• 1.1: 22 questions
• 1.2: 23 questions
• 1.3: 23 questions
• 1.4: 19 questions
• 1.5: 14 questions

Domain Workflow Playbook

Security Operations questions reward evidence discipline. Begin with architecture and source health, move through indicator and tool analysis, then convert repeatable findings into intelligence, hunts, detections, and measured process improvements. The supplied courseware repeatedly connects those stages: architecture determines available telemetry; telemetry supports a behavioral conclusion; the conclusion drives a bounded action; and the action becomes reusable only after validation and documentation. Keep an evidence table with source, original and normalized time, entity, observation, interpretation, confidence, and next pivot. That simple structure prevents a reputation label or anomaly score from silently becoming a confirmed finding.

1.1 Explain the importance of system and network architecture concepts in security operations.

Courseware objective context. The courseware treats architecture as an evidence map: analysts must know where identity, network, workload, and data controls execute before deciding what a missing or present event means. Start with trust boundaries and telemetry ownership, then verify time, retention, and enforcement state. A log source can be healthy yet incomplete for the question being asked, and a control-plane event can be more authoritative than a workload log for cloud changes.

Log ingestion and time synchronization

Definition and purpose. Useful correlation depends on complete sources, suitable logging levels, normalized fields, and synchronized clocks. Validate pipeline health before treating missing events or timestamp order as attacker behavior.

Analyst workflow. Inventory the source clock, time zone, event timestamp, collector receipt time, and known offset. Normalize a comparison field while retaining the original value and provenance.

Worked artifact or example. An endpoint event at 10:01:50 with a verified stable 143-second slow offset at event time normalizes to 10:04:13. Retain both times, offset evidence, and uncertainty; a later clock measurement alone need not establish historical drift.

Commands, filters, or calculations. Check Windows with w32tm /query /status, Linux with timedatectl, and ingestion delay with a SIEM query comparing source and receipt timestamps.

Common traps. Do not mix source time for one system with receipt time for another. Correcting a live clock does not retroactively repair historical records.

Question-bank coverage: 3 items.

Operating system telemetry

Definition and purpose. Use registry, process, service, file-system, and configuration evidence to distinguish normal administration from persistence, execution, or unauthorized change.

Analyst workflow. Pivot from the alert to parent-child process lineage, command line, signer, user, file writes, services, tasks, registry changes, and outbound connections.

Worked artifact or example. A per-user Run value launching encoded PowerShell supports sign-in persistence; it does not by itself prove a service or recurring scheduled task.

Commands, filters, or calculations. Use Get-CimInstance Win32_Process, Get-ScheduledTask, sc.exe query, reg query, ps, systemctl, and EDR process trees on preserved telemetry.

Common traps. Signed binaries and familiar names are not authorization. Compare hashes, paths, lineage, and baseline before classifying dual-use administration as benign or malicious.

Question-bank coverage: 4 items.

Infrastructure and network architecture

Definition and purpose. Serverless, virtualized, containerized, cloud, hybrid, segmented, zero-trust, SASE, and SDN designs change where telemetry and enforcement live.

Analyst workflow. Draw trust boundaries, control planes, east-west paths, public ingress, management access, and telemetry points before selecting a pivot or containment control.

Worked artifact or example. Compromise of an SDN controller can alter forwarding across many devices, whereas loss of one workload normally has a narrower blast radius.

Commands, filters, or calculations. Review cloud flow logs, route tables, security groups, Kubernetes audit logs, hypervisor events, SASE policy, and SDN controller change records.

Common traps. Do not assume a cloud service exposes host logs or that segmentation blocks traffic in both directions. Verify effective policy and enforcement location.

Question-bank coverage: 8 items.

Identity and access management

Definition and purpose. Evaluate MFA, SSO, federation, PAM, passwordless access, and CASB evidence in the context of identity, device, privilege, and session risk.

Analyst workflow. Correlate issuer, subject, audience, device, MFA result, token and session IDs, privilege, application action, and revocation state across identity and service logs.

Worked artifact or example. A SAML assertion with the wrong audience must be rejected. A signature validated with the trusted issuer key supports signed-content integrity, not authorization for a different service provider; decoding claims alone is not validation.

Commands, filters, or calculations. Query IdP sign-ins and audit events, inspect JWT claims with an offline decoder, and use provider commands that enumerate and revoke active sessions and refresh tokens.

Common traps. Password reset may leave access tokens or application-issued sessions active. Verify provider and relying-application revocation behavior. Browser versions, IP ranges, and successful MFA are context, not proof of a trustworthy session.

Question-bank coverage: 4 items.

Encryption and sensitive data protection

Definition and purpose. PKI and inspection affect visibility and trust. DLP controls should identify and protect data such as PII and cardholder data without confusing encryption with authorization.

Analyst workflow. Identify data type, policy match, enforcement action, destination, user authorization, certificate trust, and whether transfer or decryption actually occurred.

Worked artifact or example. A DLP record with action=blocked and card-pattern matches proves enforcement, not successful disclosure. Preserve the event, validate content, then escalate by procedure.

Commands, filters, or calculations. Inspect certificate chains with openssl s_client -connect host:443 -showcerts; review DLP match samples, gateway action, classification labels, and approved exception records.

Common traps. Encryption does not grant access, and TLS inspection does not make every application compatible. Avoid declaring exfiltration from a regex count alone.

Question-bank coverage: 3 items.

1.2 Given a scenario, analyze indicators of potentially malicious activity.

Courseware objective context. Indicator analysis is contextual rather than signature matching. Build a sequence from network, host, application, and identity observations; compare it with the asset and user baseline; and state both the supported conclusion and the remaining uncertainty. Strong conclusions combine independent features such as process lineage, destination history, protocol behavior, privilege change, and timing. One unusual value should normally become a pivot, not an attribution claim.

Network indicators

Definition and purpose. Correlate volume, timing, protocol, source, destination, and baseline. Beaconing, scanning, tunneling, rogue devices, and denial-of-service patterns require context.

Analyst workflow. Measure frequency, byte direction, duration, protocol, destination age, reputation, and endpoint process, then compare the pattern with approved agents and peer baselines.

Worked artifact or example. Periodic small HTTPS sessions become stronger C2 evidence with unapproved document lineage, a novel TLS fingerprint, and no matching management baseline. A signed Windows executable can still be abused.

Commands, filters, or calculations. Use Zeek conn.log, dns.log, and ssl.log; flow queries grouped by source and destination; and packet filters such as tcp.port == 443 for detailed validation.

Common traps. Periodicity alone also appears in monitoring and push services. A high-volume source list alone does not distinguish scanning, load testing, scraping, or denial of service.

Question-bank coverage: 9 items.

Host indicators

Definition and purpose. CPU, memory, disk, processes, services, software, registry, and file changes become meaningful when compared with a known-good baseline and related identity or network activity.

Analyst workflow. Correlate utilization with process identity, signer, execution path, parent, persistence, file changes, user context, and network behavior against a known-good baseline.

Worked artifact or example. High CPU plus an unsigned all-core process and mining-pool traffic supports cryptomining; high CPU by itself may be a build, analytics job, or operational fault.

Commands, filters, or calculations. Use EDR telemetry, Get-Process, tasklist /v, ps aux, lsof, file-integrity records, and package or software inventory with stable host identity.

Common traps. Do not treat a clean antivirus result as authorization. Terminating one process is incomplete when services, tasks, credentials, or network shares preserve the foothold.

Question-bank coverage: 6 items.

Application and identity indicators

Definition and purpose. Application errors, input patterns, account changes, impossible travel, and authentication failures should be evaluated as sequences rather than isolated events.

Analyst workflow. Read the full request or event sequence, identify the parser or control being targeted, and correlate response, error, session, account, and downstream action evidence.

Worked artifact or example. A sanitized trace linking SQL query-structure tokens to a database parser error supports an injection attempt, not successful disclosure. LDAP, shell, and template interpretation require their own parser evidence.

Commands, filters, or calculations. Filter retained web logs by request ID, user, session, parameter class, and response status; correlate IdP audit events and precollected authorized assessment evidence without reconstructing attack payloads.

Common traps. One failed login or malformed request is rarely decisive. Do not infer compromise from impossible travel until VPN exits, tokens, device evidence, and application actions are checked.

Question-bank coverage: 8 items.

1.3 Given a scenario, use appropriate tools or techniques to determine malicious activity.

Courseware objective context. Tool choice follows the question. Packet data explains protocol content, flow records show communication patterns, EDR supplies process causality, SIEM correlates sources, and email or file tooling preserves artifact-specific evidence. The analyst should form a narrow question, select the least lossy source that can answer it, validate parser assumptions, and record query scope so another analyst can reproduce the result.

Packet, endpoint, and SIEM tools

Definition and purpose. Choose packet data for protocol detail, flow data for communication patterns, EDR for endpoint causality, and SIEM for cross-source correlation.

Analyst workflow. State the analytic question first, then select packet capture for content, flow for relationships, EDR for process causality, or SIEM for cross-source sequence and scale.

Worked artifact or example. For both directions between two hosts on HTTPS, ip.addr == 10.4.8.21 && ip.addr == 198.51.100.27 && tcp.port == 443 is narrower than an OR expression.

Commands, filters, or calculations. Use ss -lntup for Linux listener ownership, netstat -ano on Windows, Wireshark display filters for packets, and SIEM fields for identity, endpoint, and request pivots.

Common traps. Nmap filtered means state could not be determined, not closed. Packet data may lack process attribution, while SIEM display order may reflect ingestion delay.

Question-bank coverage: 9 items.

Email and file analysis

Definition and purpose. Header authentication, routing, links, hashes, strings, metadata, static review, and controlled dynamic analysis answer different questions. Preserve the original artifact.

Analyst workflow. Preserve the original, trace from the earliest trustworthy boundary header, check SPF/DKIM/DMARC alignment, expand links safely, hash attachments, then choose static or sandbox analysis.

Worked artifact or example. SPF and DKIM can pass for vendor-mail.net while DMARC fails when the visible From domain is payroll.example; authentication and alignment answer different questions.

Commands, filters, or calculations. Use sha256sum or Get-FileHash, file, strings, exiftool, archive listing tools, header parsers, and an isolated sandbox with network capture for dynamic behavior.

Common traps. Return-Path is not the origin host, and lower Received headers may be forged. Opening a live link or attachment on an analyst workstation changes risk and evidence.

Question-bank coverage: 6 items.

User behavior and anomalous activity

Definition and purpose. Behavior analytics identify deviations, but analysts must account for role, automation, travel, maintenance, and peer-group context before escalation.

Analyst workflow. Compare the event with the user's role, peers, device history, travel, VPN egress, maintenance, automation, and consequential actions before assigning confidence.

Worked artifact or example. A first login from a new country is weak alone; the same session creating an inbox rule, consenting an OAuth app, and downloading files is a stronger takeover sequence.

Commands, filters, or calculations. Build SIEM or UEBA pivots by user, device, session, geolocation, application, and action; preserve the raw events behind any model-generated risk score.

Common traps. A behavioral score is not a verdict. Shared service accounts and automation can distort peer baselines, while attackers can operate inside expected locations.

Question-bank coverage: 1 item.

Scripting and structured data

Definition and purpose. JSON, XML, Python, PowerShell, shell tools, and regular expressions can normalize and filter evidence. Keep source logs immutable and validate parsing assumptions.

Analyst workflow. Parse with a format-aware library, validate required fields and types, normalize values, handle missing data explicitly, and operate on a read-only copy with logged output.

Worked artifact or example. For JSON, access named fields rather than splitting punctuation. For CSV, parse quoted fields before aggregating source addresses or severities.

Commands, filters, or calculations. Use jq '.events[] | select(.severity == "high")', PowerShell ConvertFrom-Json and Import-Csv, Python json or csv, and tested regular expressions for bounded extraction.

Common traps. Field order is not a schema. Greedy regex can cross records, CSV values can contain commas, and silent parser failures can turn missing evidence into false negatives.

Question-bank coverage: 7 items.

1.4 Compare and contrast threat-intelligence and threat-hunting concepts.

Courseware objective context. Threat intelligence supports decisions through relevance, freshness, source reliability, and corroboration. The courseware distinguishes actors and motives from TTPs and indicators: techniques tend to outlive infrastructure, while addresses and hashes decay quickly. Hunts should turn intelligence into falsifiable behaviors and search available telemetry. Sharing must respect classification, handling markings, legal limits, and the recipient's operational need.

Threat actors and TTPs

Definition and purpose. Actor motive and capability inform likely objectives, while TTPs describe behavior that often survives changes to domains, addresses, hashes, and tools.

Analyst workflow. Separate motive and capability from observed behavior, then map stable techniques and specific procedures while retaining the raw event and confidence for each mapping.

Worked artifact or example. A signed vendor update that carries a backdoor is a supply-chain compromise; a stolen signing certificate used outside the update channel is a related but different path.

Commands, filters, or calculations. Use ATT&CK technique pages and Navigator for behavior coverage, plus case fields for actor hypothesis, motive, infrastructure, capability, victim, and confidence.

Common traps. Commodity tools and common techniques are reused. Do not name an actor from one certificate, domain, malware family, or ATT&CK overlap.

Question-bank coverage: 5 items.

Intelligence confidence and sources

Definition and purpose. Assess timeliness, relevance, accuracy, source reliability, and corroboration. Intelligence is decision support, not an automatic verdict.

Analyst workflow. Record collection date, source reliability, claim credibility, relevance, timeliness, and corroboration; increase or decrease weight as local evidence and infrastructure ownership change.

Worked artifact or example. Two independent reports plus a local certificate match raise confidence in the malware association, but certificate reuse still limits actor attribution.

Commands, filters, or calculations. Check passive DNS, certificate transparency, WHOIS history, malware repositories, vendor reporting, and internal observations; timestamp every enrichment result in the case.

Common traps. Provider confidence is not timeless. Proprietary collection can be useful, but missing date and confidence prevent reliable weighting even when details sound specific.

Question-bank coverage: 6 items.

Intelligence sharing

Definition and purpose. ISACs, ISAOs, STIX, TAXII, and handling markings support structured exchange. Share only what policy and classification permit.

Analyst workflow. Choose the community and format, apply classification and handling markings, remove restricted or personal data, and confirm the recipient's operational purpose before exchange.

Worked artifact or example. STIX structures indicators, sightings, relationships, and markings; TAXII transports collections. A sector ISAC adds peer context that a broad public feed may lack.

Commands, filters, or calculations. Validate STIX object IDs, timestamps, confidence, and marking definitions; test TAXII collection access and retain records of what was shared, with whom, and under which policy.

Common traps. STIX does not calculate vulnerability priority, and TAXII is not the content schema. Sharing an accurate indicator can still violate handling restrictions.

Question-bank coverage: 3 items.

Threat hunting and deception

Definition and purpose. Start with a falsifiable hypothesis and available telemetry. Honeytokens and decoys are high-signal because normal users should not touch them.

Analyst workflow. Write a falsifiable behavior hypothesis, identify required telemetry, execute broad-to-narrow queries, document negative and positive results, scope matches, and operationalize repeatable detections.

Worked artifact or example. A decoy access key used in an API log is high signal because production has no legitimate path to it; the next pivot identifies caller, actions, and related credentials.

Commands, filters, or calculations. Use ATT&CK-informed process, authentication, DNS, and network queries; maintain honeytoken ownership and alert routes; version tested hunts and resulting detection logic.

Common traps. A no-match may reflect missing telemetry. Preserve feasible evidence because blocking changes observables, but do not delay authorized containment of active harm for a hunt. Document authorized decoy-test exceptions narrowly.

Question-bank coverage: 5 items.

1.5 Explain the importance of efficiency and process improvement in security operations.

Courseware objective context. Efficiency means repeatable quality, not maximum automation. Standardize case fields and decision criteria first, measure false positives and handling time, then automate bounded steps with approvals, rollback, and error handling. Integrations should preserve source, timestamp, and confidence. A single dashboard can reduce analyst effort, but it cannot repair missing telemetry, excessive permissions, or an unreliable upstream API.

Standardization and orchestration

Definition and purpose. Documented playbooks, reusable case fields, safe automation, and feedback loops reduce inconsistency and make analyst work measurable.

Analyst workflow. Define evidence fields, decision criteria, approvals, failure states, rollback, and ownership in a reviewed playbook before automating bounded, reversible steps.

Worked artifact or example. For 4,000 alerts, 12 true positives, and 3 incidents, precision and analyst handling time reveal tuning value better than raw alert count alone.

Commands, filters, or calculations. Version playbooks and record actions. For adjudicated alerts, precision=TP/(TP+FP); on a ground-truth population, recall=TP/(TP+FN) and false-positive rate=FP/(FP+TN). Report unresolved labels separately; investigated alerts alone do not establish recall or accuracy.

Common traps. Automating inconsistent analyst choices scales inconsistency. A higher threshold may reduce volume while still allowing one unreliable signal to cause business-impacting containment.

Question-bank coverage: 8 items.

Tool integration and visibility

Definition and purpose. APIs, webhooks, plugins, enrichment, and a single pane of glass can reduce swivel-chair work, but source health and authorization boundaries still matter.

Analyst workflow. Verify API scope, authentication, rate limits, source health, field mapping, timestamp, confidence, retries, and ownership before treating integrated enrichment as evidence.

Worked artifact or example. Attach each reputation result with provider, query time, indicator, verdict, and confidence; never overwrite the original indicator or silently collapse conflicting providers.

Commands, filters, or calculations. Use read-only API tokens for enrichment, webhooks for event delivery, health dashboards for lag and errors, and a dead-letter queue for failed automations.

Common traps. A single pane of glass can hide source outages. Integration convenience does not justify broad write permissions or automatic blocking from one external label.

Question-bank coverage: 6 items.

Applied Evidence Lab: Process to Packet

CS0-003 focus: objectives 1.1-1.5. All hosts, events, addresses, and counts below are synthetic. Work from these supplied artifacts; no connection to the example addresses is required.

Worked Exercise: What Actually Happened?

An alert associates workstation WK-17 with an unfamiliar destination. Endpoint timestamps below are UTC from a clock measured 40 seconds slow throughout this interval. The network sensor is synchronized. Process GUIDs are abbreviated teaching labels, not literal Sysmon GUID syntax.

Endpoint original time  Source/event   Selected fields
09:14:20               Sysmon/1       host=WK-17 ProcessGuid=P41 ProcessId=4820
                                     Image=inventory-helper.exe User=LAB/alex
                                     ParentImage=explorer.exe
09:14:24               Sysmon/3       host=WK-17 ProcessGuid=P41 ProcessId=4820
                                     SourceIp=10.20.4.17 SourcePort=51520
                                     DestinationIp=198.51.100.24 DestinationPort=443
09:15:10               Sysmon/5       host=WK-17 ProcessGuid=P41 ProcessId=4820
09:17:00               Sysmon/1       host=WK-17 ProcessGuid=P99 ProcessId=4820
                                     Image=approved-updater.exe
Network sensor UTC     Sensor         Selected fields
09:15:04               PCAP           TCP stream=7 first SYN
09:15:04               DNS archive    query=updates.example answer=198.51.100.24

Tasks. Normalize the process creation and connection times. Which process owns the connection? Does the destination establish malicious activity? What evidence would most change your conclusion?

Worked answer. Creation becomes 09:15:00; the connection becomes 09:15:04. Join Sysmon events using host and ProcessGuid P41, then match the network five-tuple and time interval. The later PID 4820 belongs to P99: operating systems reuse process IDs. The DNS archive supports a name-to-address association, but same-second timestamps alone do not establish precise DNS/TCP ordering or prove that P41 made the DNS request. A friendly executable name does not establish approval. Retrieve full image path, hash, signer, deployment record, parent lineage, and the user's explanation through trusted channels. Compare peer machines running the approved inventory job. The present evidence supports investigation of P41, not a confirmed command-and-control finding or actor attribution.

Sysmon event 1 records process creation; event 3 records network connections and is disabled by default. Consequently, a missing event 3 requires a configuration and collection-health check before a no-network-activity conclusion. These field meanings come from Microsoft's Sysmon documentation.

Diagnostic Comparison: Ask the Source It Can Answer

Packet Exercise: Unique Bytes, Not Repeated Bytes

The following is a separate simplified excerpt from stream 7. Sequence and acknowledgment values are relative; payload counts describe TCP payload, not plaintext application content.

Question. How much unique client TCP payload is shown, and what does the acknowledgment establish?

Worked answer. Both payload segments cover sequence positions 1-600, so the observed unique payload is 600 bytes, not 1,200. ACK 601 acknowledges receipt through byte 600 by the TCP peer; it does not prove a file was saved or that data was sensitive. The SYN-to-SYN/ACK interval is 0.040 seconds, or 40 milliseconds at this capture point. Repeated sequence ranges justify examining retransmission or duplicate-capture explanations, not declaring an attack. Wireshark TCP analysis describes the dissector's state-dependent analysis.

On an already collected capture, use tcp.stream == 7 to retain both directions. A display filter such as ip.addr == 10.20.4.17 and tcp.port == 443 hides unrelated packets without deleting them. Capture-filter syntax instead uses expressions such as host 10.20.4.17 and tcp port 443; excluded traffic is never acquired. Neither filter proves that port 443 contains TLS. Preserve the full capture and document any exported subset. See the Wireshark filtering chapters.

Turning an Observation Into a Bounded Hunt

Hypothesis: an unapproved helper process communicates with unfamiliar external services on several managed workstations. Search preserved endpoint history for matching artifact identity and lineage, then corroborate connections. Of 50 in-scope workstations, only 42 supplied the required process-and-network telemetry: observable coverage is 42 / 50 x 100 = 84%. A no-match result clears neither the eight unobservable machines nor the unsearched retention period. Record coverage gaps as investigation tasks. ATT&CK can organize supported behavior, but a technique label is not evidence that every implementation is detected. MITRE's usage guidance explains these limits.

Primary References Reviewed 2026-09-08

• CompTIA CySA+ v3 / CS0-003: exam target and domain scope.
• Microsoft Sysmon: event fields and collection defaults.
• Wireshark User's Guide and TCP analysis: filter semantics and packet interpretation.
• MITRE ATT&CK getting started: evidence-based defensive use.